4fc23b31f5adb8c2bb6614b9a4095e56de9f0f1986f2ea300391409b96c3c8d4

Analysis

max time kernel
12s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
Size

899KB
MD5

475db7768b049db90bb95c6bd5647af0
SHA1

9a9a05ef6e1d0e7ccc1a268f627e4018fc0ca3cc
SHA256

4fc23b31f5adb8c2bb6614b9a4095e56de9f0f1986f2ea300391409b96c3c8d4
SHA512

71601b2ef2f19fd7ccb8dd9b1f0c803de579b04cf27ed7f068249fd9e25673a575f8f918ea6763b3bbd4084f492e26c09626af074f8254b302185358fb65ed2a
SSDEEP

24576:gp7CiEJEIv9Zy3X1FqFf0fUlnrMQFWfEnRaZRl:5h0X1of0fUlrMjsarl

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000139e8-5.dat	upx
behavioral1/memory/1524-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2636-51-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/324-63-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1524-65-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/564-66-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2548-69-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2636-71-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2636-76-0x0000000004910000-0x0000000004930000-memory.dmp	upx
behavioral1/memory/1936-75-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2860-77-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1376-79-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2476-78-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2872-74-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1204-93-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1640-92-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/324-94-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/564-100-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1524-99-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2312-102-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2872-101-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1376-106-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1720-105-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2924-104-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2100-113-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2012-116-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1988-117-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2984-115-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1980-114-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/516-112-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1876-110-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2044-119-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/856-122-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1324-125-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2472-124-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2312-126-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2748-123-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1116-121-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1184-120-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/932-131-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1720-132-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2336-136-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2100-138-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/516-137-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2156-135-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1608-134-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2012-140-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2984-139-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1184-141-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1116-142-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/856-143-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2748-144-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1324-147-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2808-151-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2792-152-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2148-154-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3016-159-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2560-160-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2524-161-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/320-164-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2724-166-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2824-167-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2812-168-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1948-169-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\R:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\S:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\B:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\E:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\G:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\H:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\J:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\U:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\W:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\A:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\I:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\O:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\X:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\L:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\M:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\T:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\V:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\K:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File opened (read-only)	\??\N:	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\black action lesbian hole castration .avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian bukkake animal hidden .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\Templates\asian fetish hot (!) young (Britney).zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Update\Download\beastiality hardcore lesbian bedroom .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\chinese trambling handjob girls granny (Karin).mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\norwegian horse xxx several models .avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\american fetish masturbation glans leather .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\kicking hidden lady (Tatjana,Anniston).zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Temp\malaysia bukkake big blondie .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian beast licking cock girly .zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\american lesbian bukkake lesbian nipples lady (Sandy,Jade).mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files\Common Files\Microsoft Shared\indian horse animal [milf] .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files\DVD Maker\Shared\french fetish lesbian black hairunshaved .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\german horse public ¤ã .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie uncut (Gina).avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\swedish beast action public (Kathrin).zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\italian cum full movie young .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish action fetish girls 40+ .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\british nude sperm public .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\horse lesbian sweet (Christine,Christine).rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\tmp\horse catfight cock .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\tyrkish beastiality licking .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\italian nude bukkake big lady .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\french beast sleeping legs young .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\nude big (Jenna,Samantha).mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\norwegian nude cum hidden (Sylvia,Britney).rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\lingerie full movie .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\horse catfight circumcision .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\mssrv.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\sperm fucking uncut Ôë .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\indian beast [milf] (Jenna).avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\security\templates\bukkake sperm public cock black hairunshaved .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\black gay masturbation black hairunshaved .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\chinese horse cum public swallow .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\asian fetish lesbian public .zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\french trambling handjob voyeur high heels .rar.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\british kicking [free] ¼ç (Tatjana,Christine).mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\russian beast cum masturbation mistress .zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\temp\beastiality sperm several models ash high heels .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\action sperm lesbian sm (Kathrin,Christine).mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\PLA\Templates\beast girls ash .avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\japanese sperm nude hidden shower .zip.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\xxx horse licking sweet .avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\beastiality blowjob [milf] hole gorgeoushorny .mpg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\SoftwareDistribution\Download\horse [free] ejaculation (Curtney,Curtney).avi.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\malaysia beast hardcore uncut swallow .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\trambling bukkake lesbian pregnant .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\norwegian fucking big .mpeg.exe	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1640	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
324	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
564	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2860	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2872	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1376	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1936	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1640	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
324	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2472	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1876	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1980	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1988	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2548	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	28
PID 1524 wrote to memory of 2548	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	28
PID 1524 wrote to memory of 2548	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	28
PID 1524 wrote to memory of 2548	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	28
PID 2548 wrote to memory of 2636	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	29
PID 2548 wrote to memory of 2636	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	29
PID 2548 wrote to memory of 2636	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	29
PID 2548 wrote to memory of 2636	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	29
PID 1524 wrote to memory of 2476	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	30
PID 1524 wrote to memory of 2476	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	30
PID 1524 wrote to memory of 2476	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	30
PID 1524 wrote to memory of 2476	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	30
PID 2548 wrote to memory of 1640	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	31
PID 2548 wrote to memory of 1640	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	31
PID 2548 wrote to memory of 1640	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	31
PID 2548 wrote to memory of 1640	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	31
PID 2636 wrote to memory of 1204	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	32
PID 2636 wrote to memory of 1204	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	32
PID 2636 wrote to memory of 1204	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	32
PID 2636 wrote to memory of 1204	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 324	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 324	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 324	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 324	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	33
PID 1524 wrote to memory of 564	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	34
PID 1524 wrote to memory of 564	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	34
PID 1524 wrote to memory of 564	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	34
PID 1524 wrote to memory of 564	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	34
PID 1204 wrote to memory of 2872	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	35
PID 1204 wrote to memory of 2872	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	35
PID 1204 wrote to memory of 2872	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	35
PID 1204 wrote to memory of 2872	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	35
PID 2548 wrote to memory of 2860	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	36
PID 2548 wrote to memory of 2860	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	36
PID 2548 wrote to memory of 2860	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	36
PID 2548 wrote to memory of 2860	2548	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	36
PID 1640 wrote to memory of 1936	1640	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	37
PID 1640 wrote to memory of 1936	1640	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	37
PID 1640 wrote to memory of 1936	1640	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	37
PID 1640 wrote to memory of 1936	1640	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	37
PID 2636 wrote to memory of 1376	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	38
PID 2636 wrote to memory of 1376	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	38
PID 2636 wrote to memory of 1376	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	38
PID 2636 wrote to memory of 1376	2636	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	38
PID 324 wrote to memory of 1876	324	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	39
PID 324 wrote to memory of 1876	324	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	39
PID 324 wrote to memory of 1876	324	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	39
PID 324 wrote to memory of 1876	324	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 1980	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 1980	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 1980	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 1980	2476	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	41
PID 564 wrote to memory of 1988	564	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	40
PID 564 wrote to memory of 1988	564	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	40
PID 564 wrote to memory of 1988	564	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	40
PID 564 wrote to memory of 1988	564	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	40
PID 1524 wrote to memory of 2472	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	42
PID 1524 wrote to memory of 2472	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	42
PID 1524 wrote to memory of 2472	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	42
PID 1524 wrote to memory of 2472	1524	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	42
PID 1204 wrote to memory of 2312	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	43
PID 1204 wrote to memory of 2312	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	43
PID 1204 wrote to memory of 2312	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	43
PID 1204 wrote to memory of 2312	1204	475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe	43

C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        8⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:3280
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:13064
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7740
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:13652
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4892
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3256
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7324
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:10780
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:11260
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:12512
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5880
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:5684
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:9024
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:13740
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:324
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        7⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3944
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:576
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:13676
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3780
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:13264
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:13660
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:10868
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:11380
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:4620
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:6932
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:11336
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:1324
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        6⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:8372
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:856
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:6728
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:14408
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:6920
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:11048
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
        5⤵
        
        PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:10892
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:320
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:13792
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:13760
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:10884
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  PID:2748
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
      4⤵
      PID:8608
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:6464
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:11388
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:10852
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  PID:3816
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:7164
- - C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
    3⤵
    PID:10900
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  PID:6520
- C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\475db7768b049db90bb95c6bd5647af0_NeikiAnalytics.exe"
  2⤵
  PID:12504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\lingerie uncut (Gina).avi.exe

Filesize
1.7MB

MD5
d3d2ffd4b7e12fcee062b7ba0ae734a9

SHA1
27af1e6bc94a3acdc05cc3d95dfb2b32863b8fda

SHA256
e7214c98da34c5c9d30bddb727d93be2370ed125aa2ba596400ae852b1575403

SHA512
9a2f8e92a50f4f76279677ad54c345a58920a274fafcf39a62c0d605ad43bb0c2b40aa2bcc86d9a78151236268a9da91dfad6f14b5badc9dd81507ee53b53a3f

Download Submit
C:\debug.txt

Filesize
183B

MD5
ca83717e9ed8120aade940e561da54db

SHA1
132c3d30748f28c8c19ddf751632e79ee63b0060

SHA256
60976c077c98ecc66830eadc1d62651aa2616510b109ab7c81ff77ec56cc93d0

SHA512
dd3568c95d78794e5f8ffcd73b6452485c981d2ee1c45f552f8f0b936d92ecf2bce8effd472685acc067dc0a8bad717f0b4d8f1c04d22c2539d7814be3e52d78

Download Submit
memory/320-164-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/324-94-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/324-108-0x0000000000860000-0x0000000000880000-memory.dmp

Filesize
128KB

Download
memory/324-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/324-89-0x0000000000860000-0x0000000000880000-memory.dmp

Filesize
128KB

Download
memory/324-118-0x0000000004530000-0x0000000004550000-memory.dmp

Filesize
128KB

Download
memory/516-112-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/516-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/516-172-0x00000000047B0000-0x00000000047D0000-memory.dmp

Filesize
128KB

Download
memory/516-165-0x00000000047B0000-0x00000000047D0000-memory.dmp

Filesize
128KB

Download
memory/564-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/564-109-0x00000000044A0000-0x00000000044C0000-memory.dmp

Filesize
128KB

Download
memory/564-100-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/564-201-0x0000000004A70000-0x0000000004A90000-memory.dmp

Filesize
128KB

Download
memory/564-90-0x00000000044A0000-0x00000000044C0000-memory.dmp

Filesize
128KB

Download
memory/856-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/856-122-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/932-133-0x00000000021C0000-0x00000000021E0000-memory.dmp

Filesize
128KB

Download
memory/932-173-0x0000000004A60000-0x0000000004A80000-memory.dmp

Filesize
128KB

Download
memory/932-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-121-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1184-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1184-120-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1204-176-0x0000000004A60000-0x0000000004A80000-memory.dmp

Filesize
128KB

Download
memory/1204-93-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1324-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1324-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1376-79-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1376-111-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/1376-106-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-8-0x0000000004B10000-0x0000000004B30000-memory.dmp

Filesize
128KB

Download
memory/1524-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-95-0x0000000004B10000-0x0000000004B30000-memory.dmp

Filesize
128KB

Download
memory/1524-188-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-273-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-99-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1524-64-0x0000000004B10000-0x0000000004B30000-memory.dmp

Filesize
128KB

Download
memory/1608-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1612-180-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-92-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1640-156-0x0000000004900000-0x0000000004920000-memory.dmp

Filesize
128KB

Download
memory/1720-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1720-105-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1876-110-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1936-158-0x0000000004900000-0x0000000004920000-memory.dmp

Filesize
128KB

Download
memory/1936-192-0x0000000004910000-0x0000000004930000-memory.dmp

Filesize
128KB

Download
memory/1936-75-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1936-189-0x0000000004910000-0x0000000004930000-memory.dmp

Filesize
128KB

Download
memory/1948-169-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1980-208-0x0000000004920000-0x0000000004940000-memory.dmp

Filesize
128KB

Download
memory/1980-114-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1988-163-0x0000000004A70000-0x0000000004A90000-memory.dmp

Filesize
128KB

Download
memory/1988-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2012-116-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2012-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2044-119-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2100-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2100-113-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2148-154-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2156-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2312-102-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2312-126-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2336-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2472-124-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2476-78-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2476-107-0x00000000045E0000-0x0000000004600000-memory.dmp

Filesize
128KB

Download
memory/2476-62-0x0000000004580000-0x00000000045A0000-memory.dmp

Filesize
128KB

Download
memory/2476-91-0x00000000045E0000-0x0000000004600000-memory.dmp

Filesize
128KB

Download
memory/2476-199-0x00000000045E0000-0x0000000004600000-memory.dmp

Filesize
128KB

Download
memory/2524-161-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-103-0x0000000004A60000-0x0000000004A80000-memory.dmp

Filesize
128KB

Download
memory/2548-70-0x0000000004580000-0x00000000045A0000-memory.dmp

Filesize
128KB

Download
memory/2560-160-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-51-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2636-76-0x0000000004910000-0x0000000004930000-memory.dmp

Filesize
128KB

Download
memory/2636-57-0x0000000004900000-0x0000000004920000-memory.dmp

Filesize
128KB

Download
memory/2636-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2724-166-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2748-123-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2792-152-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-151-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2808-187-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/2812-168-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2824-167-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2860-77-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2860-153-0x0000000004A50000-0x0000000004A70000-memory.dmp

Filesize
128KB

Download
memory/2872-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2872-155-0x0000000004920000-0x0000000004940000-memory.dmp

Filesize
128KB

Download
memory/2872-101-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2924-104-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2984-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2984-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3016-159-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3016-211-0x0000000004540000-0x0000000004560000-memory.dmp

Filesize
128KB

Download
memory/3116-186-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download