35352693c398fc44d1b83ee031ae044109a6a4103593c86fb4085ea8eb7123d1

Analysis

max time kernel
14s
max time network
128s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
Size

1.9MB
MD5

aac6fa615b2ebc26506c710d97ee2480
SHA1

f3c1bc9ad5dacfe76b252fc0414b03d04a9a7c2a
SHA256

35352693c398fc44d1b83ee031ae044109a6a4103593c86fb4085ea8eb7123d1
SHA512

79efd0d0c97f5b766d29d2c9b3c587474fe7cc569c2979015295d1873fc6234b4fffd4dc1c2431d623c9138f163db613f6fc3818e5cc110c20dc2718f310a609
SSDEEP

49152:Ng2JpkD/t+lNRNs5r4DcVBTMnmwExiMMrbMi:NgWaDV+lBs144VBc+xiM64i

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1664-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x00070000000155e2-5.dat	upx
behavioral1/memory/2916-12-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2400-55-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1412-64-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2916-65-0x0000000001E30000-0x0000000001E4E000-memory.dmp	upx
behavioral1/memory/1664-76-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2916-78-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2648-72-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1460-81-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1412-80-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1748-87-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2648-89-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/880-92-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1460-99-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2872-102-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1748-103-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1764-105-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/880-106-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2252-108-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2844-109-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1256-110-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3008-111-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2872-117-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1660-118-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1764-119-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1000-121-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2232-123-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1000-122-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1972-124-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2104-125-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2788-127-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2564-128-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1212-133-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2788-135-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2008-142-0x00000000047D0000-0x00000000047EE000-memory.dmp	upx
behavioral1/memory/2472-143-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1092-150-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3192-151-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1148-152-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3292-159-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3336-162-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3256-164-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3336-165-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3412-174-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2916-177-0x00000000047F0000-0x000000000480E000-memory.dmp	upx
behavioral1/memory/3736-178-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2948-186-0x00000000045C0000-0x00000000045DE000-memory.dmp	upx
behavioral1/memory/3792-187-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3960-189-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1460-190-0x0000000004A60000-0x0000000004A7E000-memory.dmp	upx
behavioral1/memory/2564-191-0x00000000047C0000-0x00000000047DE000-memory.dmp	upx
behavioral1/memory/3700-192-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3724-193-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3836-194-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3868-195-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3876-198-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3960-199-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3716-200-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2160-201-0x0000000004900000-0x000000000491E000-memory.dmp	upx
behavioral1/memory/3884-203-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2564-202-0x00000000047C0000-0x00000000047DE000-memory.dmp	upx
behavioral1/memory/3700-204-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/4120-205-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\X:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\A:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\S:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\H:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\J:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\R:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\V:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\B:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\E:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\O:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\P:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\U:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\I:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\L:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\M:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\N:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\T:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\G:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File opened (read-only)	\??\K:	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\hardcore girls high heels .avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\bukkake licking (Curtney).mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\japanese cum horse hidden titts .mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Temp\trambling [bangbus] blondie .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\japanese cum hardcore [milf] glans .mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\japanese cumshot gay several models penetration .mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\lesbian public leather (Ashley,Tatjana).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian horse lingerie uncut .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\lingerie licking feet .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\american porn bukkake licking ìï .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\italian cum beast voyeur gorgeoushorny .mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files\Windows Journal\Templates\black beastiality sperm voyeur cock mistress (Janette).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Update\Download\american kicking horse [free] (Melissa).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\indian porn fucking full movie glans granny .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\sperm big (Sarah).avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\danish fetish beast sleeping sm .rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\danish animal blowjob public bondage (Sonja,Jade).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\italian horse sperm lesbian (Tatjana).zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\beast big titts shoes (Samantha).rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\black fetish beast catfight gorgeoushorny (Jenna,Janette).rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\black porn bukkake uncut young (Ashley,Sarah).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\trambling big bedroom .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\indian cum gay [milf] hole .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\temp\black animal blowjob several models wifey .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\PLA\Templates\american beastiality sperm [bangbus] black hairunshaved .rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\security\templates\russian fetish sperm [free] glans boots (Melissa).rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian nude sperm [bangbus] hairy .avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\american handjob bukkake voyeur shower .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\blowjob [bangbus] .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\black cum fucking girls cock bondage .avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\gay full movie .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian animal trambling voyeur feet (Kathrin,Jade).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\porn sperm several models glans hotel (Sylvia).mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\SoftwareDistribution\Download\bukkake masturbation hole 50+ (Sarah).rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\american nude xxx [bangbus] cock .avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\beast big cock .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\tmp\horse voyeur sweet (Sonja,Janette).avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\hardcore voyeur glans leather .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\tyrkish cum blowjob girls cock .mpeg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\danish horse trambling several models ¤ã (Kathrin,Liz).rar.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\mssrv.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\trambling voyeur penetration .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\american fetish xxx lesbian penetration .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\xxx [milf] swallow .zip.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\lingerie masturbation titts .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\black cumshot bukkake full movie swallow .avi.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\russian cum sperm big glans latex .mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\danish cumshot horse masturbation (Liz).mpg.exe	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
684	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1188	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2648	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2792	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2656	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2888	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1188	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2008	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1460	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2152	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1428	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
684	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1748	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
880	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1204	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1256	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1552	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2648	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
2872	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
1764	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2916	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	28
PID 1664 wrote to memory of 2916	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	28
PID 1664 wrote to memory of 2916	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	28
PID 1664 wrote to memory of 2916	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	28
PID 1664 wrote to memory of 2400	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2400	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2400	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	29
PID 1664 wrote to memory of 2400	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	29
PID 2916 wrote to memory of 2396	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 2396	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 2396	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	30
PID 2916 wrote to memory of 2396	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	30
PID 2400 wrote to memory of 1412	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	31
PID 2400 wrote to memory of 1412	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	31
PID 2400 wrote to memory of 1412	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	31
PID 2400 wrote to memory of 1412	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	31
PID 1664 wrote to memory of 684	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	32
PID 1664 wrote to memory of 684	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	32
PID 1664 wrote to memory of 684	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	32
PID 1664 wrote to memory of 684	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	32
PID 2916 wrote to memory of 1236	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 1236	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 1236	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	33
PID 2916 wrote to memory of 1236	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	33
PID 2396 wrote to memory of 1188	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	34
PID 2396 wrote to memory of 1188	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	34
PID 2396 wrote to memory of 1188	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	34
PID 2396 wrote to memory of 1188	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	34
PID 1412 wrote to memory of 2648	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	35
PID 1412 wrote to memory of 2648	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	35
PID 1412 wrote to memory of 2648	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	35
PID 1412 wrote to memory of 2648	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	35
PID 1664 wrote to memory of 2656	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	36
PID 1664 wrote to memory of 2656	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	36
PID 1664 wrote to memory of 2656	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	36
PID 1664 wrote to memory of 2656	1664	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	36
PID 2400 wrote to memory of 2792	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	37
PID 2400 wrote to memory of 2792	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	37
PID 2400 wrote to memory of 2792	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	37
PID 2400 wrote to memory of 2792	2400	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	37
PID 1236 wrote to memory of 2888	1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	38
PID 1236 wrote to memory of 2888	1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	38
PID 1236 wrote to memory of 2888	1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	38
PID 1236 wrote to memory of 2888	1236	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	38
PID 1188 wrote to memory of 1460	1188	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	39
PID 1188 wrote to memory of 1460	1188	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	39
PID 1188 wrote to memory of 1460	1188	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	39
PID 1188 wrote to memory of 1460	1188	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	39
PID 2916 wrote to memory of 2008	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2008	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2008	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	40
PID 2916 wrote to memory of 2008	2916	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	40
PID 2396 wrote to memory of 2152	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	41
PID 2396 wrote to memory of 2152	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	41
PID 2396 wrote to memory of 2152	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	41
PID 2396 wrote to memory of 2152	2396	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	41
PID 684 wrote to memory of 1428	684	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	42
PID 684 wrote to memory of 1428	684	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	42
PID 684 wrote to memory of 1428	684	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	42
PID 684 wrote to memory of 1428	684	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	42
PID 1412 wrote to memory of 1748	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	43
PID 1412 wrote to memory of 1748	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	43
PID 1412 wrote to memory of 1748	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	43
PID 1412 wrote to memory of 1748	1412	aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe	43

C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:2220
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9348
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9280
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13924
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:10380
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13348
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7340
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4496
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9420
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:14408
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9488
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9776
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:3752
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:6280
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:9412
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:7844
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3336
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:14848
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2772
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        7⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5124
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4120
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9864
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:13596
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7436
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7276
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:13932
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:10952
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:6040
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:7292
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        6⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:2980
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:7192
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:12988
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:11092
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:13384
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:14440
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9824
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:3836
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:7184
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:9480
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:13892
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:14056
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:10140
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9256
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:13604
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:13448
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:9388
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:13628
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
        5⤵
        
        PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:13884
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9896
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9168
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:7480
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:13488
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
      4⤵
      PID:9404
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:5744
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:9472
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  PID:1092
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
    3⤵
    PID:7428
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  PID:4576
- C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\aac6fa615b2ebc26506c710d97ee2480_NeikiAnalytics.exe"
  2⤵
  PID:7388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\japanese cumshot gay several models penetration .mpeg.exe

Filesize
2.0MB

MD5
8cf3dda34ae5afd87ff6c30ae3e37e52

SHA1
9e225cf3dfa83d8960dc849b038ea04c92f2b6b8

SHA256
6ead1981c5049434e34e4a4ae927528e787a39f2b404e02398b7f3c5063efae0

SHA512
aa865a841afa40c8d3bf0aeea0bf398fa66ba75ec40eaf178a9e52220191656b680a9d161c748d87666c0acb0b29f15b0954773004360a7c0f6cc9e07e4284b6

Download Submit
memory/684-116-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/684-146-0x0000000004920000-0x000000000493E000-memory.dmp

Filesize
120KB

Download
memory/880-106-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/880-92-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-121-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1000-122-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1092-150-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1148-152-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1204-126-0x00000000044A0000-0x00000000044BE000-memory.dmp

Filesize
120KB

Download
memory/1212-133-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1236-75-0x0000000001DD0000-0x0000000001DEE000-memory.dmp

Filesize
120KB

Download
memory/1256-110-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1284-212-0x0000000004A60000-0x0000000004A7E000-memory.dmp

Filesize
120KB

Download
memory/1412-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1412-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1412-209-0x0000000004820000-0x000000000483E000-memory.dmp

Filesize
120KB

Download
memory/1412-71-0x0000000004800000-0x000000000481E000-memory.dmp

Filesize
120KB

Download
memory/1412-86-0x0000000004800000-0x000000000481E000-memory.dmp

Filesize
120KB

Download
memory/1460-99-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1460-190-0x0000000004A60000-0x0000000004A7E000-memory.dmp

Filesize
120KB

Download
memory/1460-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1628-215-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/1660-118-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1664-90-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

Filesize
120KB

Download
memory/1664-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1664-53-0x0000000004AB0000-0x0000000004ACE000-memory.dmp

Filesize
120KB

Download
memory/1664-76-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1664-11-0x0000000004AB0000-0x0000000004ACE000-memory.dmp

Filesize
120KB

Download
memory/1664-73-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

Filesize
120KB

Download
memory/1664-104-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

Filesize
120KB

Download
memory/1664-88-0x0000000004AC0000-0x0000000004ADE000-memory.dmp

Filesize
120KB

Download
memory/1664-77-0x0000000004AB0000-0x0000000004ACE000-memory.dmp

Filesize
120KB

Download
memory/1748-103-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1748-87-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1764-105-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1764-119-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1972-124-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2008-142-0x00000000047D0000-0x00000000047EE000-memory.dmp

Filesize
120KB

Download
memory/2104-125-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2160-201-0x0000000004900000-0x000000000491E000-memory.dmp

Filesize
120KB

Download
memory/2160-214-0x0000000004900000-0x000000000491E000-memory.dmp

Filesize
120KB

Download
memory/2232-123-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2252-108-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2400-91-0x0000000004A50000-0x0000000004A6E000-memory.dmp

Filesize
120KB

Download
memory/2400-63-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2400-74-0x0000000004A50000-0x0000000004A6E000-memory.dmp

Filesize
120KB

Download
memory/2400-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2400-79-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2472-213-0x00000000045C0000-0x00000000045DE000-memory.dmp

Filesize
120KB

Download
memory/2472-143-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2564-202-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2564-191-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/2564-128-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-72-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2788-135-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2788-127-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2844-109-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-136-0x0000000004900000-0x000000000491E000-memory.dmp

Filesize
120KB

Download
memory/2872-102-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2872-117-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-107-0x0000000001F80000-0x0000000001F9E000-memory.dmp

Filesize
120KB

Download
memory/2916-78-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2916-141-0x00000000047F0000-0x000000000480E000-memory.dmp

Filesize
120KB

Download
memory/2916-120-0x00000000047F0000-0x000000000480E000-memory.dmp

Filesize
120KB

Download
memory/2916-65-0x0000000001E30000-0x0000000001E4E000-memory.dmp

Filesize
120KB

Download
memory/2916-177-0x00000000047F0000-0x000000000480E000-memory.dmp

Filesize
120KB

Download
memory/2916-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2916-184-0x00000000047F0000-0x000000000480E000-memory.dmp

Filesize
120KB

Download
memory/2916-54-0x0000000001E30000-0x0000000001E4E000-memory.dmp

Filesize
120KB

Download
memory/2948-186-0x00000000045C0000-0x00000000045DE000-memory.dmp

Filesize
120KB

Download
memory/3008-207-0x00000000047D0000-0x00000000047EE000-memory.dmp

Filesize
120KB

Download
memory/3008-111-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3192-151-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3256-164-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3292-159-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3336-162-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3336-165-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3412-174-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3700-204-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3700-192-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3716-211-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3716-200-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3724-193-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3724-206-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3736-178-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3792-187-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3836-194-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3868-195-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3876-198-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3884-203-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3960-189-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3960-199-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4120-205-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4160-208-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4404-210-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download