Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 07:07
Behavioral task
behavioral1
Sample
3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe
-
Size
1.4MB
-
MD5
3bc09cb6c4620f2616841dde646226a0
-
SHA1
8041ca8cf7077f0410b428e2d677ac89111cfb66
-
SHA256
21d5836414432df0f8fc9ca584a0934cdc4cccf8b756ab1bfd90c6dc60534460
-
SHA512
476cdf863137942f60b4d0815f5e1775361b72e62ed2a8878656e4036c2427c03a7a478810935a180bb9e0e0a23ea7bccbc5f4ba03adbe9b058f6ecdf8889067
-
SSDEEP
24576:V/GlmpyOmahf+2FeNVTTC4Y/tOATJuyJWodxyEAUdnT0caFVhwkfZlwkYQtxup:ZmsCHnC4otd8jFUpT0bVKkf/3px6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/992-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000800000002295d-5.dat upx behavioral2/memory/2012-12-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3276-149-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2752-153-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1844-164-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4472-167-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1612-169-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2980-170-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5100-187-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4916-186-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3500-188-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/992-189-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4864-190-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2012-191-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/320-194-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3276-193-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3096-192-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2752-195-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/364-197-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4676-196-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2396-201-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4296-200-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1844-199-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4472-202-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3640-203-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1612-204-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4972-205-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4916-208-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4592-207-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2980-206-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2968-210-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1416-213-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4864-214-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1560-215-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4512-212-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3500-211-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5100-209-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3096-216-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4284-218-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2408-217-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/320-219-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/628-223-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2540-222-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/364-221-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4676-220-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2396-225-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4296-224-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5248-228-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3640-227-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4972-229-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5356-231-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5348-230-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4592-232-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2968-234-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5412-233-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5452-235-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5512-238-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1416-237-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4512-236-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1560-239-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5600-242-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4284-241-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2408-240-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\G: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\L: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\P: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\Q: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\S: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\A: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\B: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\I: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\T: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\Y: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\E: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\M: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\R: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\W: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\X: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\V: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\Z: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\H: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\J: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\K: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\N: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File opened (read-only) \??\O: 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\xxx licking bedroom .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\russian beastiality gay sleeping glans shower .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\config\systemprofile\black beastiality fucking lesbian .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\russian handjob fucking voyeur titts shoes .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\sperm big feet traffic .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\config\systemprofile\swedish nude xxx girls feet penetration (Tatjana).zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\FxsTmp\italian horse trambling public feet traffic .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\IME\SHARED\horse [bangbus] .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\gay public .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\horse catfight hole .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\System32\DriverStore\Temp\brasilian handjob horse licking hole .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\System32\LogFiles\Fax\Incoming\american beastiality trambling girls (Janette).rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files\Windows Sidebar\Shared Gadgets\indian kicking lingerie uncut titts shower .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\russian cumshot lingerie licking gorgeoushorny .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Common Files\microsoft shared\lingerie hot (!) cock .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\dotnet\shared\american beastiality xxx sleeping .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Temp\lesbian girls (Samantha).mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Google\Update\Download\black animal trambling full movie latex .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\tyrkish fetish beast voyeur glans .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\swedish handjob lesbian public hole .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\xxx girls hole .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\indian nude fucking [milf] sm .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\blowjob uncut feet pregnant .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\russian cum beast public latex .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\Updates\Download\black porn horse [milf] fishy .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\american kicking trambling hidden cock gorgeoushorny .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\kicking gay catfight feet .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files (x86)\Microsoft\Temp\tyrkish cum sperm lesbian feet bondage .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\Templates\beast hot (!) (Sarah).avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish nude trambling public titts (Kathrin,Curtney).zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Drops file in Windows directory 50 IoCs
description ioc Process File created C:\Windows\assembly\tmp\blowjob [bangbus] glans mistress (Karin).rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish cum trambling catfight feet sm .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\indian horse horse lesbian 40+ .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\xxx uncut glans .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\japanese kicking hardcore [milf] fishy .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\sperm [milf] castration .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\LocalService\Downloads\danish horse bukkake catfight feet .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\templates\japanese kicking fucking hidden (Curtney).mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_de-de_7860bee9439c3ae7\indian cumshot lesbian uncut girly .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\russian beastiality fucking hot (!) titts girly .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse hidden hole .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_en-us_310bfb76047869ad\norwegian fucking lesbian beautyfull (Gina,Liz).mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_bdb6c49fcea35732\malaysia lingerie masturbation leather .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.1202_none_621728fcd3c9d5f6\bukkake [milf] stockings .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost_31bf3856ad364e35_10.0.19041.264_none_cb389cf57d74d691\fucking girls titts .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_es-es_211cf1c632a13851\italian horse hardcore voyeur titts bondage .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.928_none_33e0d5558cdd7c61\chinese sperm [free] sweet .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c3d467c525734eb3\horse xxx uncut .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\french xxx [bangbus] titts mistress (Tatjana).mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\Downloaded Program Files\italian cumshot fucking catfight titts (Jenna,Sarah).zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\PLA\Templates\american beastiality fucking [milf] hole castration (Tatjana).mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\xxx uncut (Janette).zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\assembly\temp\beast voyeur bondage .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_10.0.19041.1_none_de1581e9a275faf8\malaysia fucking full movie bondage .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_30d7585a049f5b52\handjob horse hidden titts femdom (Melissa).rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\templates\swedish handjob horse masturbation titts girly .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_it-it_adfc5e0bfca53431\malaysia horse hot (!) glans (Gina,Sarah).mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..gement-uevtemplates_31bf3856ad364e35_10.0.19041.1_none_0d66b54875835a49\italian horse trambling girls (Curtney).zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\american fetish fucking voyeur hairy (Kathrin,Karin).rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5021dd18efc0460c\handjob lesbian several models cock .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\brasilian horse lesbian [free] titts gorgeoushorny .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SoftwareDistribution\Download\beast uncut leather .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\ServiceProfiles\NetworkService\Downloads\american nude lesbian sleeping glans .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese cumshot horse big hole .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_5fdc43acc1be690d\gay [bangbus] titts pregnant .rar.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.19041.1_none_0bc0f3d4cd7dc8fd\french gay girls titts ash .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SystemResources\Windows.ShellCommon.SharedResources\japanese cumshot lingerie public cock .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\beastiality hardcore voyeur gorgeoushorny (Sonja,Karin).mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.789_en-us_58ebf9ecc407e3c0\african lesbian sleeping hairy .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\security\templates\swedish cum sperm big .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\mssrv.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d38ece58f77171b4\spanish horse catfight hole ash .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\swedish handjob lesbian catfight .mpg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SystemResources\Windows.UI.ShellCommon\SharePickerUI\black cum sperm sleeping titts lady .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_microsoft-composable-sharepicker_31bf3856ad364e35_10.0.19041.1_none_c87e96327faffd0e\horse full movie .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\CbsTemp\brasilian handjob beast girls sm (Jenna,Sylvia).zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.1_en-us_215194e2327a46ac\hardcore sleeping cock .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\InputMethod\SHARED\lesbian girls feet mistress .avi.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\SoftwareDistribution\Download\SharedFileCache\black beastiality hardcore [milf] mistress .mpeg.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..ce-shared.resources_31bf3856ad364e35_10.0.19041.867_en-us_49453482f1fb5356\japanese action bukkake licking .zip.exe 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4916 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4916 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 5100 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 5100 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3500 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3500 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4864 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4864 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3096 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 3096 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 320 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 320 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 364 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 364 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4676 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4676 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 992 wrote to memory of 2012 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 85 PID 992 wrote to memory of 2012 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 85 PID 992 wrote to memory of 2012 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 85 PID 992 wrote to memory of 3276 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 90 PID 992 wrote to memory of 3276 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 90 PID 992 wrote to memory of 3276 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 90 PID 2012 wrote to memory of 2752 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 92 PID 2012 wrote to memory of 2752 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 92 PID 2012 wrote to memory of 2752 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 92 PID 992 wrote to memory of 1844 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 95 PID 992 wrote to memory of 1844 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 95 PID 992 wrote to memory of 1844 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 95 PID 2012 wrote to memory of 4472 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 96 PID 2012 wrote to memory of 4472 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 96 PID 2012 wrote to memory of 4472 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 96 PID 3276 wrote to memory of 1612 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 97 PID 3276 wrote to memory of 1612 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 97 PID 3276 wrote to memory of 1612 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 97 PID 2752 wrote to memory of 2980 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 98 PID 2752 wrote to memory of 2980 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 98 PID 2752 wrote to memory of 2980 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 98 PID 2012 wrote to memory of 5100 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 100 PID 2012 wrote to memory of 5100 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 100 PID 2012 wrote to memory of 5100 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 100 PID 992 wrote to memory of 4916 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 101 PID 992 wrote to memory of 4916 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 101 PID 992 wrote to memory of 4916 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 101 PID 3276 wrote to memory of 3500 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 102 PID 3276 wrote to memory of 3500 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 102 PID 3276 wrote to memory of 3500 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 102 PID 1844 wrote to memory of 4864 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 103 PID 1844 wrote to memory of 4864 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 103 PID 1844 wrote to memory of 4864 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 103 PID 2752 wrote to memory of 3096 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 104 PID 2752 wrote to memory of 3096 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 104 PID 2752 wrote to memory of 3096 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 104 PID 1612 wrote to memory of 320 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 105 PID 1612 wrote to memory of 320 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 105 PID 1612 wrote to memory of 320 1612 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 105 PID 2980 wrote to memory of 4676 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 107 PID 2980 wrote to memory of 4676 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 107 PID 2980 wrote to memory of 4676 2980 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 107 PID 4472 wrote to memory of 364 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 106 PID 4472 wrote to memory of 364 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 106 PID 4472 wrote to memory of 364 4472 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 106 PID 992 wrote to memory of 4296 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 109 PID 992 wrote to memory of 4296 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 109 PID 992 wrote to memory of 4296 992 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 109 PID 2012 wrote to memory of 2396 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 110 PID 2012 wrote to memory of 2396 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 110 PID 2012 wrote to memory of 2396 2012 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 110 PID 4916 wrote to memory of 3640 4916 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 111 PID 4916 wrote to memory of 3640 4916 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 111 PID 4916 wrote to memory of 3640 4916 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 111 PID 5100 wrote to memory of 4972 5100 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 112 PID 5100 wrote to memory of 4972 5100 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 112 PID 5100 wrote to memory of 4972 5100 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 112 PID 3276 wrote to memory of 4592 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 115 PID 3276 wrote to memory of 4592 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 115 PID 3276 wrote to memory of 4592 3276 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 115 PID 1844 wrote to memory of 2968 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 114 PID 1844 wrote to memory of 2968 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 114 PID 1844 wrote to memory of 2968 1844 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 114 PID 2752 wrote to memory of 4512 2752 3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:6688
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"8⤵PID:12092
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"8⤵PID:17172
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:8840
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"8⤵PID:16592
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:11532
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:16164
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:6224
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:9924
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:13652
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:7764
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:15452
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:10428
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14268
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:6304
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:10516
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:13980
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:7936
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:15496
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:10636
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14768
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:8788
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:4724
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:11692
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:16428
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7136
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13004
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:9076
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12760
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17680
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:6584
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:10284
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:15744
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:8512
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:16732
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:11372
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:15932
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9356
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13128
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7396
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13756
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:9220
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13796
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6296
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:10476
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13932
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7788
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:15376
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10424
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13872
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8196
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:17072
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:11348
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:15760
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7032
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12984
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:8676
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:12880
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:17872
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:364 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:6512
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:10820
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:14752
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:8220
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:16628
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:11148
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14968
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9852
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13492
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7388
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14260
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10236
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13772
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6384
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9316
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14020
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8056
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:15672
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10988
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14776
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:9156
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:17724
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12184
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17376
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6440
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13132
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9448
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13080
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9164
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:17732
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:12308
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:4844
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7128
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13200
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6608
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13244
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7944
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:15996
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10720
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14760
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12372
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17384
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:8980
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17740
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:11772
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:16796
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8116
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:17716
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10964
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14932
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6532
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:11192
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:15140
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:8264
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:16608
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:10892
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:14976
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7120
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12976
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:18424
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9440
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13228
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:6524
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:10696
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:14628
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:8108
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:16904
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:11160
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:15400
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:320 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:6312
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:10628
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:14656
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:8048
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"7⤵PID:16436
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:11004
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:15124
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9432
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:1640
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7356
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13920
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:9336
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14208
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6340
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9236
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:13996
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8124
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:16776
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10812
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14676
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8828
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:17236
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:11700
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:16412
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6980
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12920
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17836
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9180
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:12660
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:17576
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6324
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:10604
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14636
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:7780
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:15776
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10532
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13828
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8280
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:17224
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:11684
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13668
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6672
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:536
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9256
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13264
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:9348
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12592
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7348
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:15464
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:10124
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13736
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:8376
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17108
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:11248
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:16156
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:6996
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13100
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:9544
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:13296
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:6332
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:9472
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:14108
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8064
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:16600
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10976
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14784
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:9916
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13572
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7364
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:13892
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9312
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:14028
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8576
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:17864
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12772
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17672
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7412
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:16004
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:10088
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13696
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:8040
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:15924
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:10728
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:14540
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:7072
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13208
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:7476
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:12996
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:8152
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"6⤵PID:16420
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:10996
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:14924
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:6988
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:12828
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17824
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9188
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:17880
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:12668
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:17056
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7480
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:15768
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:9480
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:14060
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:6752
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:11736
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:17300
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:8820
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:17076
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:11856
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:16096
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:7380
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"5⤵PID:15504
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:8352
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:14012
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:6712
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:11304
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:16264
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:8504
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:17748
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:11380
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:16052
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:7420
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"4⤵PID:13748
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:9228
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:14004
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵PID:6424
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:10392
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:14620
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵PID:8232
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"3⤵PID:17064
-
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵PID:11240
-
-
C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3bc09cb6c4620f2616841dde646226a0_NeikiAnalytics.exe"2⤵PID:15752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\tyrkish nude trambling public titts (Kathrin,Curtney).zip.exe
Filesize1.1MB
MD55c34797b1710e12a9ec448d50da601a4
SHA1ca423277f5a3db08b0a2a2b0a1af325e32c2366d
SHA2562a269e76091ab7fd9f72bfa923972719960cb78ccfab26bce35204030b1dcb20
SHA512f6f51c933602a1ff4e3815f3e65f30b82b7daeb31f8e6231c0b1a64d68848a3044b66107b0b2cd5710aaee22aa278cd2203583430a6f60276b5d91c5e2104ab6