2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772

Analysis

max time kernel
9s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
Size

626KB
MD5

1e82434c5a61b654484c408fcdfeee90
SHA1

536acda1a6e2b2bd6b73916e0f2cfaa70f3bae0b
SHA256

2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772
SHA512

4e810bb575e39f89788e2f576e26a936dff7dcb42eb6254b9b1f7bc1c9924b72388372f554166a7e4ddb3fa33ece8760598bb569a9a4ca39d834a3132d03e1dd
SSDEEP

12288:dXCNi9B/n4N/X/3kOS9zvf3Ag05uTb2Tx/leskaJPspk9z3:oWmf/9Mf704TbWx/lejO9z3

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\H:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\I:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\Y:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\X:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\B:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\G:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\J:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\N:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\O:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\Q:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\S:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\A:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\K:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\P:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\R:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\W:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\Z:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\L:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\M:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\T:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\U:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File opened (read-only)	\??\V:	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\russian kicking fucking full movie (Melissa,Tatjana).mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american lesbian handjob lesbian .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\black trambling hardcore big ash bedroom .mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Temp\indian nude sleeping nipples (Janette).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EUA671.tmp\lingerie big latex .mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\dotnet\shared\norwegian action gang bang big beautyfull (Jenna).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\Templates\cum handjob several models mistress .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\action fucking [bangbus] shower .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\italian animal lingerie [bangbus] .mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFD7095D-03FC-4A5C-948B-20FAB1B69302}\EDGEMITMP_4CFFA.tmp\british bukkake hot (!) legs fishy (Anniston).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\swedish fucking girls hotel .avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\beastiality beastiality lesbian .mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\horse hardcore [free] .avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\brasilian nude catfight nipples ash .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\japanese trambling masturbation (Kathrin,Curtney).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\indian hardcore handjob sleeping ¼ë (Sylvia,Gina).avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\russian cum voyeur cock sm (Melissa).rar.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\swedish kicking lesbian hot (!) lady .rar.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Google\Update\Download\canadian bukkake cum masturbation pregnant .mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Program Files (x86)\Microsoft\Temp\norwegian sperm catfight ash upskirt .mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\cumshot big vagina sm .mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\indian xxx licking sweet (Kathrin).rar.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\CbsTemp\gay licking .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\german nude sleeping hole traffic (Janette,Jade).mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\black nude hidden redhair .mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\mssrv.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\assembly\temp\fetish lesbian uncut hairy (Sylvia,Sylvia).avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black porn [free] 50+ .avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\cum lesbian girly (Tatjana).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\PLA\Templates\tyrkish gang bang lingerie public shoes (Kathrin,Britney).rar.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\indian lingerie trambling big vagina (Sarah).avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\horse [free] fishy .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\canadian action horse [free] .zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\assembly\tmp\russian lesbian uncut feet hairy .avi.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\InputMethod\SHARED\horse hidden titts (Karin,Sandy).mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\japanese hardcore trambling [bangbus] stockings (Samantha).mpg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\american fucking nude [bangbus] glans blondie .rar.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\nude trambling voyeur 50+ .mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\Downloaded Program Files\xxx lesbian cock 50+ (Sonja).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\security\templates\horse several models boobs (Jade,Sonja).mpeg.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\handjob catfight 40+ (Anniston).rar.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\french sperm uncut ash hotel (Sandy).zip.exe	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1152	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1152	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
2500	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
2500	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4160	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4160	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1116	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
1116	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 4572	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	94
PID 1684 wrote to memory of 4572	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	94
PID 1684 wrote to memory of 4572	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	94
PID 4572 wrote to memory of 4952	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	97
PID 4572 wrote to memory of 4952	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	97
PID 4572 wrote to memory of 4952	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	97
PID 1684 wrote to memory of 3744	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	98
PID 1684 wrote to memory of 3744	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	98
PID 1684 wrote to memory of 3744	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	98
PID 4572 wrote to memory of 1152	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	102
PID 4572 wrote to memory of 1152	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	102
PID 4572 wrote to memory of 1152	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	102
PID 4952 wrote to memory of 4160	4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	103
PID 4952 wrote to memory of 4160	4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	103
PID 4952 wrote to memory of 4160	4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	103
PID 1684 wrote to memory of 2500	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	104
PID 1684 wrote to memory of 2500	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	104
PID 1684 wrote to memory of 2500	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	104
PID 3744 wrote to memory of 1116	3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	105
PID 3744 wrote to memory of 1116	3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	105
PID 3744 wrote to memory of 1116	3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	105
PID 4572 wrote to memory of 1740	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	106
PID 4572 wrote to memory of 1740	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	106
PID 4572 wrote to memory of 1740	4572	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	106
PID 1152 wrote to memory of 4808	1152	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	107
PID 1152 wrote to memory of 4808	1152	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	107
PID 1152 wrote to memory of 4808	1152	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	107
PID 4952 wrote to memory of 4564	4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	108
PID 4952 wrote to memory of 4564	4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	108
PID 4952 wrote to memory of 4564	4952	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	108
PID 1684 wrote to memory of 4388	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	109
PID 1684 wrote to memory of 4388	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	109
PID 1684 wrote to memory of 4388	1684	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	109
PID 4160 wrote to memory of 2548	4160	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	110
PID 4160 wrote to memory of 2548	4160	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	110
PID 4160 wrote to memory of 2548	4160	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	110
PID 3744 wrote to memory of 4676	3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	111
PID 3744 wrote to memory of 4676	3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	111
PID 3744 wrote to memory of 4676	3744	2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe	111

C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:4564
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:11800
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:11944
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:13336
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:11836
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:11952
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13812
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13300
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13924
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:12828
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:8756
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:11284
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        7⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13024
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:12424
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13956
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:11088
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:12304
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:12560
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:12400
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        6⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:8816
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:13932
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13636
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:10932
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:11112
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13212
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:9524
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:12712
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
        5⤵
        
        PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:11456
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13984
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:7804
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:10004
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:13516
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  PID:2212
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
      4⤵
      PID:13972
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:8012
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:10508
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:14308
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  PID:5920
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:7856
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:10264
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:14048
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  PID:7076
- - C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
    3⤵
    PID:13016
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  PID:8584
- C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe
  "C:\Users\Admin\AppData\Local\Temp\2eb4ac594f99a4f3f14147d443d0be2e489b69d61836797febedd54de0a5f772_NeikiAnalytics.exe"
  2⤵
  PID:10672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,18320353784098040629,17273168055569331828,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american lesbian handjob lesbian .zip.exe

Filesize
222KB

MD5
8c0046bea1ed1be091769960bb9e2711

SHA1
8380042fe5238dd9b742802385592747f3c83b9e

SHA256
8fcc1e620858423fe1909066511c7201c8eefb84e5c9c54a12d3ffc94f42bc78

SHA512
8cb4b4627cb54cff679de56d3c84bfbade01f0172490d3ebeb7a9454fa31c997c803d8749d26fc5caf0f26b4fffde004b02d32eed4692783bbefe21c2673659a

Download Submit
memory/1116-162-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1152-158-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1320-267-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1684-0-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2500-159-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2548-172-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3316-216-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3460-197-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3744-137-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/3888-196-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4528-175-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4532-195-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4572-12-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4660-174-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4676-173-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4700-215-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4808-171-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/4952-130-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5048-198-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5188-199-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5196-200-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5328-201-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5444-202-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5504-203-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5544-204-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5552-205-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5576-206-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5612-207-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5824-208-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5856-209-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5884-217-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5888-210-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5920-211-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5964-212-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6060-213-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6092-214-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6176-218-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6256-219-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6308-220-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6424-221-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6444-223-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6452-222-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6476-226-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6500-224-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6532-225-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6764-227-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6784-228-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6868-229-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6924-230-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6936-231-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7024-232-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7036-233-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7120-234-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7140-235-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7148-236-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7156-237-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7192-238-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7200-239-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7380-240-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7456-241-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7468-242-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7524-250-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7608-249-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7848-245-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7856-243-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/7868-244-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8004-246-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8012-247-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8136-248-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8488-251-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8504-252-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8516-253-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8584-254-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8692-255-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8756-256-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8784-257-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8808-258-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8892-268-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8928-259-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/8996-260-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9004-261-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9012-262-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9036-265-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9044-266-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9056-263-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9064-264-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9220-269-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9384-270-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9508-273-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9516-272-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9524-271-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9676-274-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9896-277-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9916-275-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/9988-276-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/10108-278-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download