Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_helper.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MI391D~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_proxy.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\cookie_exporter.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\cookie_exporter.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\identity_helper.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\notification_helper.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.37\MICROS~3.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\pwahelper.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_pwa_launcher.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedge_proxy.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5068 wrote to memory of 624	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 5068 wrote to memory of 624	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 5068 wrote to memory of 624	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 624 wrote to memory of 3292	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 624 wrote to memory of 3292	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 624 wrote to memory of 3292	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 3292 wrote to memory of 4724	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3292 wrote to memory of 4724	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3292 wrote to memory of 4724	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4724 wrote to memory of 432	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4724 wrote to memory of 432	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4724 wrote to memory of 432	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 432 wrote to memory of 4404	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 432 wrote to memory of 4404	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 432 wrote to memory of 4404	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4404 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4404 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4404 wrote to memory of 5012	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 5012 wrote to memory of 1500	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 5012 wrote to memory of 1500	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 5012 wrote to memory of 1500	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1500 wrote to memory of 4624	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1500 wrote to memory of 4624	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1500 wrote to memory of 4624	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4624 wrote to memory of 4172	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4624 wrote to memory of 4172	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4624 wrote to memory of 4172	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4172 wrote to memory of 3312	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4172 wrote to memory of 3312	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4172 wrote to memory of 3312	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 3312 wrote to memory of 3724	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3312 wrote to memory of 3724	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3312 wrote to memory of 3724	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3724 wrote to memory of 644	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3724 wrote to memory of 644	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3724 wrote to memory of 644	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 644 wrote to memory of 3380	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 644 wrote to memory of 3380	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 644 wrote to memory of 3380	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3380 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\System32\Conhost.exe
PID 3380 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\System32\Conhost.exe
PID 3380 wrote to memory of 2436	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\System32\Conhost.exe
PID 2436 wrote to memory of 4816	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2436 wrote to memory of 4816	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2436 wrote to memory of 4816	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 4816 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4816 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 4816 wrote to memory of 1360	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1360 wrote to memory of 840	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1360 wrote to memory of 840	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1360 wrote to memory of 840	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 840 wrote to memory of 1056	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 840 wrote to memory of 1056	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 840 wrote to memory of 1056	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1056 wrote to memory of 1248	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1056 wrote to memory of 1248	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1056 wrote to memory of 1248	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1248 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1248 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1248 wrote to memory of 808	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 808 wrote to memory of 2360	N/A	C:\Windows\svchost.com	C:\Windows\svchost.com
PID 808 wrote to memory of 2360	N/A	C:\Windows\svchost.com	C:\Windows\svchost.com
PID 808 wrote to memory of 2360	N/A	C:\Windows\svchost.com	C:\Windows\svchost.com
PID 2360 wrote to memory of 1512	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com

Processes

C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3236,i,16488180140590516186,11762960689811837350,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	76.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	77.190.18.2.in-addr.arpa	udp
US	8.8.8.8:53	79.190.18.2.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	204.79.197.200:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	214.143.182.52.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe

MD5	6b96ccfc2148a36288bad6d898db8a64
SHA1	d5f1c6cd9b80ab91f95ae45a0eedc719a475e11a
SHA256	7494bd2af8789ec2e27f443b6e931361765cbc1cd6e3ec094232a2ea36b89396
SHA512	268205e89b801c0d4e3d11a75779dca436fa265949876d4085c20207a1b43542d37dd87b1aa4afc34c682b80fe628e6d48be01b8826cccfc4469bbb9fc978d1d

C:\Windows\svchost.com

MD5	076d7aaf36ed85a21a5cd85d3cce6b4b
SHA1	50125a8d0e54aacc753b1eef5828ca640836a54e
SHA256	c6448bebf9ae4a5dd4656adea4d10c24748ba112002bddd8b62fe3d5b3041c0a
SHA512	b6fb4f997a0afa5510f283404cf6439a605379704e9290413fdc258a668d26ebf6ac61715a4e7c78103df729de51c670083826e3979e8696b2660dbeed333b2c

memory/3292-16-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5	63041b7c4840abc49f2e0e26957e3e1f
SHA1	039b8300d0ab092c7291a061a98acf9b7357b979
SHA256	a4f81d8cfc8bb12324a1b7e271b53b71bc58dda1df37551f7a16157ab572c0c4
SHA512	c0b7655b3833e16ec1c775ee01051d0049e84a6b826e6a48f380897a684e2ec64278e483c2ab9046f769d8131180ff9faa7c60baa0a08762e0d6306ff863cf72

memory/4724-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/432-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4404-32-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5012-40-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1500-44-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4624-52-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/4172-56-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3312-64-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3724-68-0x0000000000400000-0x000000000041B000-memory.dmp

memory/644-76-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3380-80-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2436-88-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4816-92-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5	a344438de9e499ca3d9038688440f406
SHA1	c961917349de7e9d269f6f4a5593b6b9d3fcd4d2
SHA256	715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557
SHA512	8bf3c621725fddafa6326b057fee9beee95966e43c5fbab40ebaa4a1a64d17acca97a19d0ece10c3574e13e194ff191316871d1d46d4d74ffc0ac3efb403bca9

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5	3b73078a714bf61d1c19ebc3afc0e454
SHA1	9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256	ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512	75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5	8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1	919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA256	8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA512	0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

MD5	322302633e36360a24252f6291cdfc91
SHA1	238ed62353776c646957efefc0174c545c2afa3d
SHA256	31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
SHA512	5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

MD5	8c753d6448183dea5269445738486e01
SHA1	ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA256	473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
SHA512	4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

memory/1360-122-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe

MD5	e7a27a45efa530c657f58fda9f3b9f4a
SHA1	6c0d29a8b75574e904ab1c39fc76b39ca8f8e461
SHA256	d6f11401f57293922fb36cd7542ae811ab567a512449e566f83ce0dcef5ff8e5
SHA512	0c37b41f3c075cd89a764d81f751c3a704a19240ad8e4ebab591f399b9b168b920575749e9d24c2a8f0400b9f340ab9fea4db76ff7060d8af00e2b36ac0c4a54

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe

MD5	e316c67c785d3e39e90341b0bbaac705
SHA1	7ffd89492438a97ad848068cfdaab30c66afca35
SHA256	4fc8b9433b45c2607cbdf3d1c042c3918b854c9db3ade13b5bb2761d28f1c478
SHA512	25ec433c10adc69305de97107463be74d7b4768acca27886498485e8bc2c8b099994e6c1c6c09a7e603816203d6b18e509fb79f24992915eb802f59bcb790090

memory/840-137-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe

MD5	de69c005b0bbb513e946389227183eeb
SHA1	2a64efdcdc71654356f77a5b77da8b840dcc6674
SHA256	ad7b167ab599b6dad7e7f0ad47368643d91885253f95fadf0fadd1f8eb6ee9c7
SHA512	6ca8cec0cf20ee9b8dfe263e48f211b6f1e19e3b4fc0f6e89807f39d3f4e862f0139eb5b35e3133ef60555589ad54406fb11d95845568a5538602f287863b7d7

C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE

MD5	e5589ec1e4edb74cc7facdaac2acabfd
SHA1	9b12220318e848ed87bb7604d6f6f5df5dbc6b3f
SHA256	6ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67
SHA512	f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a

C:\PROGRA~2\Google\Update\DISABL~1.EXE

MD5	3b0e91f9bb6c1f38f7b058c91300e582
SHA1	6e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA256	57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512	a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\msedgewebview2.exe

MD5	8d02e12a6e12a15882584f2ce59c93cb
SHA1	d868bf3c491e5f8cd1c9dd0e11f962408053a655
SHA256	0eb172c21b63cce9fb42a2692a2b298c2e9800ff0d74994956d8bd82029ec897
SHA512	19155cdd269430f6f2c88a3e404f099548166a0f7c333148db38dbee964323b51e6b90715b2d2d16f786a1b59147f74160e308eb66bc737a9fd26a7b3485247a

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\INSTAL~1\setup.exe

MD5	3c6af29363b09b1fe010b098eb483da8
SHA1	a3eb972dad6881268d5aec7db7a5b3112d0d5f82
SHA256	82ff701fb161ceff3a018b7a744a71c9e88b7009e32792499b742c2b0a88ec01
SHA512	6fbff42fca39c93a972e55b227f05a507ea494a4cd22a0e09c578c144bb9bc3eea9ab8402ffa1f1c7e10bd53c4384e68049aeb51d729629cc9f0624d0fd747fa

C:\PROGRA~2\MICROS~1\EdgeCore\124024~1.80\PWAHEL~1.EXE

MD5	845705026ff8f5de0faf8dbe21af17bd
SHA1	f206a88626d19d7c403ef89df86562d5f4f24ed4
SHA256	9e502b3fffdeacabc600f39cc176c3d31e19dfbb9036d30177e164d96ba5278f
SHA512	79bc46c1d00d373e9b6f33385330b62a7f1447300721ed356c0fc235ec3e5c79a55fb740591d54259828f2b804898e4fb078ffc3bffbbe3980d6c1224aa4d3be

C:\PROGRA~2\MICROS~1\EdgeCore\124024~1.80\NOTIFI~1.EXE

MD5	35a7ae8cc07eac7a49f03d45fd446620
SHA1	a13ea61f68a48b7797038c8a517d92e99fcc4866
SHA256	f5c9e992eb29062f27f8a1a569d8be337f38a2dc5935a5457133036c72e911d2
SHA512	8b980ff267d843b16f0c1b69d8cbfaff3eef3cd6b9917049acd78a6bcd4e56c6402a81b706543595618d034345bd4a250248411daff9863f250359f5a081cb15

C:\PROGRA~2\MICROS~1\EdgeCore\124024~1.80\MSEDGE~2.EXE

MD5	fc3622c190003839a2dc11c8ee0606b5
SHA1	bcabad43d44ca4ef5b5e1724c5cba2f538fcd9b0
SHA256	c2da0bd463ffbfaa67f49830740207468164afd5e56fd7c75109de0fd82d6313
SHA512	091aa3050a28e91d2017d3146dc7bbc0989b470ac015550d82d6592e32c1125b7f4dd1d712f7912e3aeb90aac1f065fbad632f8ab4fb1e4caa599fe4bcd0c9a1

C:\PROGRA~2\MICROS~1\EdgeCore\124024~1.80\msedge.exe

MD5	f72b423cf9cc798732925eed3cf2e60c
SHA1	79704a4604020a0f6e7ae63d1be486cdbe08e061
SHA256	a978d5aa986b25b229b3c45120b9cac1f223497cfb870c869b86aedcdc4602f1
SHA512	0d72aaf9fa6acc92da60c34f59c72fa07ec5d857dfeea114613bc94de44154fa2d6a94aa8dea47a8212e74776c76b8cc2049f787d726361400521f724458c55f

C:\PROGRA~2\MICROS~1\EdgeCore\124024~1.80\COOKIE~1.EXE

MD5	59dfac4d3296abec3d7cb4b6a18aec5a
SHA1	a643c1e4d4186a66832203eeaddd739b3eda3cec
SHA256	33cea01cec18ac92aa5fb139c6582b364e3433c66f1f2e990f62b428ee249f33
SHA512	8345092a50c4482f803e43aabd57171d52e587e3265b56b7b41a1c847b18090b74e741c66b05dc46a2c87bf8b2f338825bc45dda0d15e5bc842ab40d4a30e7f2

C:\PROGRA~2\MICROS~1\EdgeCore\124024~1.80\BHO\IE_TO_~1.EXE

MD5	ac0d708bbcd017ea66c1e5342769247f
SHA1	80ac2eba3acd2c5cd46b5dd0d7d4e50bc1dcd832
SHA256	9bad891baaba2084cb551b981b9eec735f3a9482b51b4b3abbabf76dbc217cd2
SHA512	4bc2f1d9d86407776a725a97f80f8ffd88c5139977ee84bbefd7e01b37a4665f1ccf23bde4ac3f9bcaf8bb4159868577153bf93bb07abc4e7924b12019cb18a2

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\identity_helper.exe

MD5	f4c739b8d39e94691f85aca0f3007eed
SHA1	8f0ba5301a025835a024dcf9312fdddf8d49cba2
SHA256	95cfee63090a0368c1d5e49a7e6d3b0f219a6ff1fb4e835bbab9e7689d273d47
SHA512	ef35fb3857a8a192223bf5f49cd9f7a4007fbb5c34171a3f42900dad1db7b4d1b20804b2c1c296ad4950942d0a92c4d5ab8e495aeed0e350bc4f216cdfff8b4b

memory/1056-226-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1248-237-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\124024~1.80\elevation_service.exe

MD5	f6d23b507a70dc334edc1f7a83f23f35
SHA1	faad9c7cc838feca898f79a59ee3fc172b4c793b
SHA256	66c7ddec71930588f69aa9b2ea682a4b5e166ff4d12e3a053b6bc73b44f24992
SHA512	cce30fb7085c6b833532b5d64c6d2c9af9a5dd9b1b74832a2c526ea1944c360bbdb7e0d65de6f9db068a650c0abcd65490e33240618e8e8fd0da0348dd00022d

C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE

MD5	f7c714dbf8e08ca2ed1a2bfb8ca97668
SHA1	cc78bf232157f98b68b8d81327f9f826dabb18ab
SHA256	fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899
SHA512	28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE

MD5	96a14f39834c93363eebf40ae941242c
SHA1	5a3a676403d4e6ad0a51d0f0e2bbdd636ae5d6fc
SHA256	8ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a
SHA512	fbf307a8053e9478a52cfdf8e8bad3d7c6664c893458786ae6ee4fffc6fe93006e99a2a60c97fb62dad1addd5247621517f4edee5d9545717c4587a272cef9a2

C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE

MD5	5da33a7b7941c4e76208ee7cddec8e0b
SHA1	cdd2e7b9b0e4be68417d4618e20a8283887c489c
SHA256	531e735e4e8940dfe21e30be0d4179ceaecb57ce431cf63c5044e07048ac1751
SHA512	977aeecfbc693c9d5746fedf08b99e0b0f6fd7b0c7b41ac2b34a832e68a2e6f3c68f38af2e65c87075fcf00c1c6103e34324df45d7da9412cbbeea7e410794b6

C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe

MD5	60d1d70ce0e486291840f495dd204822
SHA1	2fdc59a7c003483c84af1bfb4b40852487f96a46
SHA256	590afbe437514646a30918a6dddff718adcfcd92f709bfcd983d7226f9ef4665
SHA512	979cb9e361562a1fd7651c80ee3c4da4b9547c34ab2a06c4d517a90a1a901a994b2f19d1e1cbc0696e6bef774ab54a5a2ba2aa401db3df235d39ae9caaccd68b

memory/808-240-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

MD5	bcd0f32f28d3c2ba8f53d1052d05252d
SHA1	c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA256	bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
SHA512	79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

memory/2360-247-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1512-248-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1664-255-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3312-256-0x0000000000400000-0x000000000041B000-memory.dmp

memory/212-263-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1628-264-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1136-271-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3840-272-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4832-274-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2576-280-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4772-287-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3716-288-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1360-290-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1884-296-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1196-298-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4384-304-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3100-306-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2412-312-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4020-314-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3764-320-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1972-327-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4584-328-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3940-335-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3500-336-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1392-343-0x0000000000400000-0x000000000041B000-memory.dmp

memory/452-344-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4828-346-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3320-352-0x0000000000400000-0x000000000041B000-memory.dmp

memory/212-359-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1904-360-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3380-367-0x0000000000400000-0x000000000041B000-memory.dmp

memory/436-368-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2428-370-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4376-376-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1608-378-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2572-384-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2292-386-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4900-392-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4320-399-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2112-400-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3924-407-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1688-408-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4720-415-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2720-416-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5092-418-0x0000000000400000-0x000000000041B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 08:37

Reported

2024-05-18 08:39

Platform

win7-20240215-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe"

Signatures

Detect Neshta payload

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Neshta

persistence spyware neshta

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
N/A	N/A	C:\Windows\svchost.com	N/A
N/A	N/A	C:\Windows\svchost.com	N/A

Modifies system executable filetype association

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\directx.sys	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A
File opened for modification	C:\Windows\svchost.com	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\directx.sys	C:\Windows\svchost.com	N/A
File opened for modification	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	N/A

Enumerates physical storage devices

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2204 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 2204 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 2204 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 2204 wrote to memory of 1668	N/A	C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
PID 1668 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 1668 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 1668 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 1668 wrote to memory of 2628	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe	C:\Windows\svchost.com
PID 2628 wrote to memory of 2604	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2628 wrote to memory of 2604	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2628 wrote to memory of 2604	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2628 wrote to memory of 2604	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2604 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2604 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2604 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2604 wrote to memory of 2800	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2800 wrote to memory of 2760	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2800 wrote to memory of 2760	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2800 wrote to memory of 2760	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2800 wrote to memory of 2760	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2760 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2760 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2760 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2760 wrote to memory of 2588	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2588 wrote to memory of 2460	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2588 wrote to memory of 2460	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2588 wrote to memory of 2460	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2588 wrote to memory of 2460	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2460 wrote to memory of 2572	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2460 wrote to memory of 2572	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2460 wrote to memory of 2572	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2460 wrote to memory of 2572	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2572 wrote to memory of 3032	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2572 wrote to memory of 3032	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2572 wrote to memory of 3032	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2572 wrote to memory of 3032	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 3032 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 3032 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 3032 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 3032 wrote to memory of 2836	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2836 wrote to memory of 2960	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2836 wrote to memory of 2960	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2836 wrote to memory of 2960	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2836 wrote to memory of 2960	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2960 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2960 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2960 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2960 wrote to memory of 2948	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2948 wrote to memory of 1008	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2948 wrote to memory of 1008	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2948 wrote to memory of 1008	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2948 wrote to memory of 1008	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1008 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1008 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1008 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1008 wrote to memory of 2036	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 2036 wrote to memory of 1444	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2036 wrote to memory of 1444	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2036 wrote to memory of 1444	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 2036 wrote to memory of 1444	N/A	C:\Windows\svchost.com	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE
PID 1444 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1444 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1444 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com
PID 1444 wrote to memory of 2672	N/A	C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE	C:\Windows\svchost.com

Processes

C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE"

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\B7DE84~1.EXE

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "15353532421060212308-1303257922-123926766566137053-2023335200481010882635211086"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\3582-490\b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe

MD5	6b96ccfc2148a36288bad6d898db8a64
SHA1	d5f1c6cd9b80ab91f95ae45a0eedc719a475e11a
SHA256	7494bd2af8789ec2e27f443b6e931361765cbc1cd6e3ec094232a2ea36b89396
SHA512	268205e89b801c0d4e3d11a75779dca436fa265949876d4085c20207a1b43542d37dd87b1aa4afc34c682b80fe628e6d48be01b8826cccfc4469bbb9fc978d1d

C:\Windows\svchost.com

MD5	076d7aaf36ed85a21a5cd85d3cce6b4b
SHA1	50125a8d0e54aacc753b1eef5828ca640836a54e
SHA256	c6448bebf9ae4a5dd4656adea4d10c24748ba112002bddd8b62fe3d5b3041c0a
SHA512	b6fb4f997a0afa5510f283404cf6439a605379704e9290413fdc258a668d26ebf6ac61715a4e7c78103df729de51c670083826e3979e8696b2660dbeed333b2c

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5	cf6c595d3e5e9667667af096762fd9c4
SHA1	9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256	593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512	ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5	02ee6a3424782531461fb2f10713d3c1
SHA1	b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256	ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA512	6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

MD5	566ed4f62fdc96f175afedd811fa0370
SHA1	d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256	e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512	cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

MD5	58b58875a50a0d8b5e7be7d6ac685164
SHA1	1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA256	2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512	d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

memory/2604-31-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2628-32-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\directx.sys

MD5	63041b7c4840abc49f2e0e26957e3e1f
SHA1	039b8300d0ab092c7291a061a98acf9b7357b979
SHA256	a4f81d8cfc8bb12324a1b7e271b53b71bc58dda1df37551f7a16157ab572c0c4
SHA512	c0b7655b3833e16ec1c775ee01051d0049e84a6b826e6a48f380897a684e2ec64278e483c2ab9046f769d8131180ff9faa7c60baa0a08762e0d6306ff863cf72

memory/2800-47-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2760-46-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2460-61-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2588-62-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3032-76-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2572-77-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2836-92-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2960-91-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1008-106-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2948-107-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2036-122-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1444-121-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE

MD5	8c4f4eb73490ca2445d8577cf4bb3c81
SHA1	0f7d1914b7aeabdb1f1e4caedd344878f48be075
SHA256	85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5
SHA512	65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

memory/2816-144-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2672-145-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1648-159-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2068-158-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2920-177-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1724-176-0x0000000000400000-0x000000000041B000-memory.dmp

memory/676-189-0x0000000000400000-0x000000000041B000-memory.dmp

memory/592-188-0x0000000000400000-0x000000000041B000-memory.dmp

memory/688-204-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2396-203-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1040-220-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1396-219-0x0000000000400000-0x000000000041B000-memory.dmp

memory/968-232-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1516-233-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2316-245-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1284-246-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2876-268-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1348-269-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2124-284-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1748-285-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2604-292-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2632-293-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2752-301-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2568-300-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2800-311-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2448-310-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2620-325-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2276-324-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2736-334-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2684-333-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3000-341-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2964-342-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3004-349-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3008-350-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2688-358-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1684-357-0x0000000000400000-0x000000000041B000-memory.dmp

memory/816-366-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2704-365-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2156-373-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2436-374-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2840-381-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1704-382-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1660-389-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2696-390-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2068-397-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2056-398-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2912-405-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1544-406-0x0000000000400000-0x000000000041B000-memory.dmp

memory/776-414-0x0000000000400000-0x000000000041B000-memory.dmp

memory/820-413-0x0000000000400000-0x000000000041B000-memory.dmp

Sample ID	240518-kjbjtacb3x
Target	b7de84462688cd19db902ace0479afb0_NeikiAnalytics.exe
SHA256	a35068cb5ee30a810f9e3afe469321efa9742c1e1038980919246c8f7f75afaf
Tags	neshta persistence spyware stealer

Malware Analysis Report

2024-09-11 03:12

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files