42230a210179e21d39cc8c2f469365f1e366af0e9169fc30dff97b7aea23e988

Analysis

max time kernel
20s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
Size

544KB
MD5

231514b0e4e6daf05aff839aa53c9740
SHA1

1aa1c5923ee62b7a7f5ac55460b477eb3dd30211
SHA256

42230a210179e21d39cc8c2f469365f1e366af0e9169fc30dff97b7aea23e988
SHA512

94c2336a3c747ce64d4e2b5083f7084c9afb7b34952c479ae76c14343ddf224ea69d0f46d77cbb91ec81719e54fae0a7027981cc11a2cd755329f26bd4758aef
SSDEEP

12288:dXCNi9BYw8vl6s7vhzy6n7FVvq02WF6Cvzz75JZcTXNUm:oWYw06KPzkWFxLz7LZc+m

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

description	ioc	process
File opened (read-only)	\??\Z:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\K:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\P:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\S:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\U:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\W:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\H:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\J:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\L:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\M:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\O:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\G:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\I:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\V:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\T:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\X:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\A:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\B:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\E:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\N:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File opened (read-only)	\??\R:	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

Drops file in Program Files directory 11 IoCs

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

description	ioc	process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\brasilian action beast hot (!) glans blondie .mpg.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\malaysia blowjob [milf] titts hairy .zip.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\microsoft shared\tyrkish beastiality xxx girls titts leather (Janette).mpeg.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\russian nude beast [free] traffic .mpg.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\russian animal fucking uncut feet wifey (Tatjana).avi.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\danish handjob hardcore catfight feet \Û (Curtney).zip.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\chinese lesbian voyeur girly (Anniston,Sylvia).rar.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\japanese beastiality lingerie lesbian ¼ë .avi.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\japanese gang bang xxx girls shower .rar.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\tyrkish gang bang fucking lesbian .zip.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\trambling girls high heels .zip.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

Drops file in Windows directory 1 IoCs

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

description ioc process

File created C:\Windows\mssrv.exe 231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\mssrv.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

pid	process
4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
2268	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
2268	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4928	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4928	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:4408

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:2444

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
7⤵
PID:9076

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
7⤵
PID:11936

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:6268

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
7⤵
PID:5696

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:7584

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:9664

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:13088

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:4244

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:6224

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:8680

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:12012

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5420

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:8088

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:12320

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:12940

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:8144

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:10360

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:6032

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
7⤵
PID:10372

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:7404

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:9232

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:12484

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5212

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:9092

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:11904

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5988

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:11152

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7368

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9368

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:12804

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:3216

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5512

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:9608

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:12900

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6924

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:8964

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:11836

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:4568

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:3976

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:11108

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5968

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:10256

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6304

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6364

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:12300

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:4496

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5152

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:9084

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:11896

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6328

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7816

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:8500

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7356

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:3076

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7076

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9212

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9616

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5492

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9160

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:11928

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6868

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8708

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:1812

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6320

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:3148

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7824

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9844

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:13296

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5388

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9100

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6384

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6604

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:12932

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6476

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:10964

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5016

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5520

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9656

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:8948

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6860

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8700

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:11312

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:7800

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:10196

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:7460

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5940

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:11116

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:7380

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:8436

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:12460

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:3644

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5328

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:8080

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:12328

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6312

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:11532

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7808

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:10212

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:10336

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6732

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7196

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:10664

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5448

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9360

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:12664

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6876

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8400

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6256

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6336

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
6⤵
PID:8032

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:7832

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9888

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:4432

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5236

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:2996

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:6368

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6344

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:5340

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8024

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:10384

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:3156

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9680

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:13196

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:6848

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8716

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5632

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:3196

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:7848

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:10204

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:12960

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5976

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:2888

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:6292

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:6496

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:3712

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:3676

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:8812

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:11320

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5856

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9852

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:13304

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:7140

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:9048

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:11844

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:7056

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8912

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:11440

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5348

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:9168

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:11944

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:6352

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:12916

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:7840

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:9904

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:9404

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:1076

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:5872

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9880

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
5⤵
PID:9068

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:7148

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8792

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:11868

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:516

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8460

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:8732

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5864

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:9896

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:13288

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:7156

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:8752

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:11824

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:1796

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5500

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:9672

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
4⤵
PID:13188

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:6932

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:8692

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:5664

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:7084

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:9224

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:12308

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:5536

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:9828

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
3⤵
PID:13204

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:6940

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:8820

C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe"
2⤵
PID:11432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3804 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:8356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\japanese gang bang xxx girls shower .rar.exe

Filesize
712KB

MD5
415baa1507bfdad5206c9e3b2b5e1ba0

SHA1
778c30dbac106053d69063fa12806b8db4a0779e

SHA256
a0a443cac750617d2b447b6495c3f8c4409d165d549b77c9ec3be63c9f0e4cd0

SHA512
68f3c06369b4cc16f2b80d9a258c0c5e653a038ee206903f229e3a0290a11a8c7db0a1cfb219182885f1ec2803b9924db21921a6e6601b61010ce34f2c13ce49

Download Submit
memory/972-27-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1076-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1792-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-15-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2996-227-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3076-30-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3156-19-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3216-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3580-16-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3676-13-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3684-14-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3712-10-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3976-167-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4140-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4244-31-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4424-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4596-39-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4740-40-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4784-226-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5016-17-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5152-41-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5212-42-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5220-43-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5236-44-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5348-45-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5388-46-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5448-51-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5492-47-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5500-48-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5512-49-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5536-50-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5552-52-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5856-53-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5864-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5872-54-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5940-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5968-60-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6032-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6224-129-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6268-77-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6292-133-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6304-130-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6312-79-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6320-80-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6328-78-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6336-81-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6476-168-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6604-102-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6612-101-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6732-103-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6848-110-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6860-104-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6924-116-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6932-108-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6940-109-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7056-113-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7076-117-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7084-118-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7140-114-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7148-119-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7156-120-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7196-166-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7368-143-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7380-135-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7584-144-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7800-151-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7808-155-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7816-158-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7840-156-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7848-157-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8024-159-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8080-232-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8144-160-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8400-182-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8460-183-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8680-230-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8692-200-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8700-201-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8708-198-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8716-199-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8812-202-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8820-203-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8912-204-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8964-215-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9076-220-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9084-216-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9092-217-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9160-218-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9168-219-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9212-221-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9224-233-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9232-231-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9360-234-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9368-235-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9672-236-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9680-237-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

description	pid	process	target process
PID 4140 wrote to memory of 4896	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 4896	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 4896	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 2268	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 2268	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 2268	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4896 wrote to memory of 4928	4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4896 wrote to memory of 4928	4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4896 wrote to memory of 4928	4896	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 3712	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 3712	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 4140 wrote to memory of 3712	4140	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 2268 wrote to memory of 1792	2268	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 2268 wrote to memory of 1792	2268	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe
PID 2268 wrote to memory of 1792	2268	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe	231514b0e4e6daf05aff839aa53c9740_NeikiAnalytics.exe