Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    26s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 23:18

General

  • Target

    41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe

  • Size

    578KB

  • MD5

    41362fc117d8de01f56a86d060ac6bf0

  • SHA1

    5d0c0a74b613b60b409c5c3a89f3bcd3e01a0f91

  • SHA256

    49cb55b8a6bd8d4b214d45ea3923086c791450edfc78152835331120b89b5cd6

  • SHA512

    0b294cb0e7d0152164514bae98b73fc1788c41ac4e3a827e28c3599314b0d1ed564503f01c3994f1233fa805ec35667205542b053b910bdf6bb2176b9b6fdb5d

  • SSDEEP

    12288:0EQoSCGZ47EyEnLDntYP1NANwkOqrceXzY6E0riRs1STYeQZfO:0+7Eyupo1WCqrceXzYW2Vw2

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
          4⤵
            PID:4828
            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
              5⤵
                PID:2936
                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                  6⤵
                    PID:5384
                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                      7⤵
                        PID:9068
                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                        7⤵
                          PID:6012
                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                        6⤵
                          PID:6464
                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                            7⤵
                              PID:3652
                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                            6⤵
                              PID:7584
                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                              6⤵
                                PID:9700
                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                6⤵
                                  PID:7800
                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                5⤵
                                  PID:4220
                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                    6⤵
                                      PID:6160
                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                      6⤵
                                        PID:8952
                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                        6⤵
                                          PID:11272
                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                        5⤵
                                          PID:5412
                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                            6⤵
                                              PID:9028
                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                              6⤵
                                                PID:11620
                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                              5⤵
                                                PID:6316
                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                  6⤵
                                                    PID:10468
                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                  5⤵
                                                    PID:7552
                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                    5⤵
                                                      PID:9428
                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                      5⤵
                                                        PID:12904
                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                      4⤵
                                                        PID:3420
                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                          5⤵
                                                            PID:2244
                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                              6⤵
                                                                PID:6864
                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                6⤵
                                                                  PID:8000
                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                  6⤵
                                                                    PID:9388
                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                  5⤵
                                                                    PID:5368
                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                      6⤵
                                                                        PID:9020
                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                        6⤵
                                                                          PID:11628
                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                        5⤵
                                                                          PID:6204
                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                            6⤵
                                                                              PID:10324
                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                            5⤵
                                                                              PID:7544
                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                              5⤵
                                                                                PID:9468
                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                5⤵
                                                                                  PID:12928
                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                4⤵
                                                                                  PID:2896
                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                    5⤵
                                                                                      PID:6764
                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                      5⤵
                                                                                        PID:8016
                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                        5⤵
                                                                                          PID:10596
                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                        4⤵
                                                                                          PID:5240
                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                            5⤵
                                                                                              PID:9324
                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                              5⤵
                                                                                                PID:8556
                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                              4⤵
                                                                                                PID:6248
                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                  5⤵
                                                                                                    PID:4512
                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                  4⤵
                                                                                                    PID:7520
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                    4⤵
                                                                                                      PID:9756
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                      4⤵
                                                                                                        PID:896
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                      3⤵
                                                                                                        PID:4644
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                          4⤵
                                                                                                            PID:3860
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                              5⤵
                                                                                                                PID:5376
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                  6⤵
                                                                                                                    PID:8212
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                    6⤵
                                                                                                                      PID:11344
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                    5⤵
                                                                                                                      PID:6196
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                        6⤵
                                                                                                                          PID:1548
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                        5⤵
                                                                                                                          PID:7536
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                          5⤵
                                                                                                                            PID:9548
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                            5⤵
                                                                                                                              PID:12888
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                            4⤵
                                                                                                                              PID:4536
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                5⤵
                                                                                                                                  PID:7560
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                  5⤵
                                                                                                                                    PID:9540
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                    5⤵
                                                                                                                                      PID:12896
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:5652
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                        5⤵
                                                                                                                                          PID:5972
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:11324
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:6456
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                              5⤵
                                                                                                                                                PID:4420
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:7576
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:9444
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:12764
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4116
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:4804
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                          5⤵
                                                                                                                                                            PID:7104
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                            5⤵
                                                                                                                                                              PID:8908
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:9676
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5256
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:7616
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:9000
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:6256
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:10916
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:7600
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:9476
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:12920
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1808
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6448
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                    5⤵
                                                                                                                                                                                      PID:11036
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:7628
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:9748
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:12436
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:2756
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:8600
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:5520
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:8664
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:7512
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:9436
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:7916
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                      PID:3732
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:5000
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:3900
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:5344
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                      PID:9108
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                        PID:12060
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:6240
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                            PID:10808
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                            PID:7528
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:9484
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:12912
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:3656
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:9036
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:11696
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:5604
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                          PID:9092
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                            PID:11848
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:6576
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:7980
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:11096
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:4664
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:6920
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                          PID:7992
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                            PID:9504
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                PID:9060
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                  PID:11612
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:6376
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                      PID:11024
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:7568
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:9556
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:12772
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                  PID:8536
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:7096
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:8944
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:9840
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:9076
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:11856
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:3400
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:10256
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:8044
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:10604
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                PID:1680
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:4140
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                            PID:9052
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:11680
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:4892
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:10908
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:7608
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:9460
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:12756
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1216
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:5136
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:8928
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:8276
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:10184
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:6568
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:5192
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:8008
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:10612
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:2128
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:232
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5836
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                      PID:8228
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5816
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:6872
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7408
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:10588
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:436
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9044
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:11688
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5996
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:10264
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:7088
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:8936
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:10352
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2776
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:8240
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:7968
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6584
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7972
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:10576
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:1712
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:9084
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:11840
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5612
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:9208
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:12052
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7592
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:9452
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\41362fc117d8de01f56a86d060ac6bf0_NeikiAnalytics.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:12936
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7352

                                                                                                                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\beast [milf] traffic (Anniston,Melissa).zip.exe

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            629KB

                                                                                                                                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                                                                                                                                            8626fb69a53f1ea2eb3509a7246887ac

                                                                                                                                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                                                                                                                                            252014f2a9a0b5b0f3404e6dcbb2dce466b3ca4a

                                                                                                                                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                                                                                                                                            eb8617a81d094259b32b177fd88d6fff6fef641f1359bab7d2f2e2099640708f

                                                                                                                                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                                                                                                                                            c6c3c5343de1a22f4ff70e02ee4b3610a973dd1b8f610140ddc29674a72ce592c064755f1368d1155e3ac9a2e74b9b231f896bec02aca0d7b6bf9eaec973961f

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/232-43-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/232-26-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/412-17-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/436-74-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/436-44-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1216-61-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1216-39-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1680-19-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1712-72-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1808-45-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1808-28-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/1856-14-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2104-0-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2104-1-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2104-12-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2104-133-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2104-54-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2128-27-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2244-56-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2300-30-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2300-47-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2492-31-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2656-49-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2656-95-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2756-88-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-42-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2776-24-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2896-32-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2896-48-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2936-37-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/2936-18-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3400-96-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3400-142-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3420-34-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3656-69-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3732-15-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3860-40-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3860-20-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3900-41-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/3900-22-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4116-29-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4140-91-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4220-38-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4220-60-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4536-66-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4644-21-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4664-35-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4664-51-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4804-55-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4828-25-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4892-145-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/4892-101-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5000-13-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5000-23-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5080-16-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5080-36-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5136-149-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5240-52-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5256-53-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5332-100-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5332-144-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5344-103-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5368-106-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5368-57-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5376-107-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5376-58-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5384-108-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5384-59-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5412-111-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5412-62-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5420-112-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5420-63-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5604-117-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5612-116-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5652-70-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5652-123-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5736-75-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5736-128-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5744-127-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5744-73-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5836-129-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5916-89-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/5996-90-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6196-113-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6196-193-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6204-120-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6240-118-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6248-119-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6316-124-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6376-125-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6764-134-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6872-138-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/6920-146-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7088-150-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7104-147-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7512-203-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7520-204-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7536-205-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7544-206-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                                                                                                                                                                                          • memory/7568-207-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                                                                                                                                            120KB