Malware Analysis Report

2024-11-30 04:14

Sample ID 240613-bjlv4sscnr
Target 52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe
SHA256 4d4cb2aef8978e3aa4d9184b65b8ce4827edea1df13c7cbcc83198fe1f861c90
Tags
spyware stealer
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

4d4cb2aef8978e3aa4d9184b65b8ce4827edea1df13c7cbcc83198fe1f861c90

Threat Level: Shows suspicious behavior

The file 52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

spyware stealer

Executes dropped EXE

Reads user/profile data of web browsers

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 01:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 01:10

Reported

2024-06-13 01:13

Platform

win10v2004-20240508-en

Max time kernel

12s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\snmptrap.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\alg.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File opened for modification C:\Windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SearchIndexer.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AppVClient.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\msiexec.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\TieringEngineService.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\AgentService.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\vds.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\4b4a9043293b476c.bin C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\SensorDataService.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\SgrmBroker.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\dllhost.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\SysWow64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\system32\vssvc.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\110.0.5481.104\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 C:\Windows\system32\spectrum.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A C:\Windows\System32\SensorDataService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 C:\Windows\system32\spectrum.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\system32\spectrum.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\TieringEngineService.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\TieringEngineService.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection" C:\Windows\system32\SearchIndexer.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\TieringEngineService.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\AgentService.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\52aa9447fdc6adc4f9f923c3adbab8e0_NeikiAnalytics.exe"

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\SysWow64\perfhost.exe

C:\Windows\system32\locator.exe

C:\Windows\system32\locator.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\SensorDataService.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\System32\snmptrap.exe

C:\Windows\system32\spectrum.exe

C:\Windows\system32\spectrum.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\System32\OpenSSH\ssh-agent.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\TieringEngineService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\system32\AgentService.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896

Network

Country Destination Domain Proto
US 8.8.8.8:53 pywolwnvd.biz udp
US 8.8.8.8:53 ssbzmoy.biz udp
US 8.8.8.8:53 cvgrf.biz udp
US 8.8.8.8:53 npukfztj.biz udp
US 8.8.8.8:53 przvgke.biz udp
US 8.8.8.8:53 zlenh.biz udp
US 8.8.8.8:53 knjghuig.biz udp
US 8.8.8.8:53 uhxqin.biz udp
US 8.8.8.8:53 anpmnmxo.biz udp
US 8.8.8.8:53 lpuegx.biz udp
US 8.8.8.8:53 vjaxhpbji.biz udp
US 8.8.8.8:53 xlfhhhm.biz udp
US 8.8.8.8:53 ifsaia.biz udp

Files

memory/232-0-0x0000000000400000-0x0000000000495000-memory.dmp

memory/232-1-0x0000000000570000-0x00000000005D6000-memory.dmp

memory/232-6-0x0000000000570000-0x00000000005D6000-memory.dmp

C:\Windows\System32\alg.exe

MD5 bc7a217dd4d20ddcecc14c2944a98cae
SHA1 5c233b5d14b98d30a89ac7bc5f953b10342d3e04
SHA256 e7bda107dfdf7214da3fb4f44e9008573833300df72c3a2d14b792525413fda2
SHA512 e19cd776288a87bc6059bc359b35e8bae2e635ab123f4a302f54bed0aeb98ab8bb4fe184eb6d030305f9bc338c584b83394bc45b4d064e6f272e1e94e53ea2fd

memory/2692-11-0x0000000140000000-0x00000001400AA000-memory.dmp

memory/2692-20-0x00000000007D0000-0x0000000000830000-memory.dmp

memory/2692-12-0x00000000007D0000-0x0000000000830000-memory.dmp

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 729da1898935299e3393979b9fc0a622
SHA1 2d369b1f96325fe413a48bfe22c20f50e70e287d
SHA256 8552203b318d782a0e1195deb78702d56ea7697a185b633442f8dd62f95107fc
SHA512 98d59e84816beda2fc1fbae767ff0f477b99ff4b4f7562a2c0bae5333d7f7d32c6895223719bee2e644ada7cfc14ec1114067b4a457c7700563c316c0aaecaf2

memory/3424-25-0x0000000140000000-0x00000001400A9000-memory.dmp

memory/3424-26-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/3424-32-0x00000000006B0000-0x0000000000710000-memory.dmp

memory/3424-34-0x00000000006B0000-0x0000000000710000-memory.dmp

C:\Windows\System32\FXSSVC.exe

MD5 247cf0a6858e0cdd25923d5f6c875488
SHA1 20b87ea3d511fae9037c53c0187a04fd679c7b0e
SHA256 49eb2d142dcfafff7c2c4631999640b98d3b6558fbec49debcc412e900474e4e
SHA512 eeb2953b2a1671486ebcbf690751cecb1ad0d604b7f8571ee71214ac3f40e29fd5be91c7e34f8503f80fd00c3f16892dba7f04294af09da562b27c66a2d75990

memory/5028-37-0x0000000140000000-0x0000000140135000-memory.dmp

memory/5028-38-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/5028-44-0x0000000000D60000-0x0000000000DC0000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 98b3ce7029d0ac94e89211b8f75a6a59
SHA1 b521399e1a504e84f4f5c9a402dbe4089b414b07
SHA256 d02b986a9c92e5713b8471eb82faa279fe4f3c42dbf0894262c6b5500dab5514
SHA512 1e328358aec61deb72d945d7358c5cf64d4cda79052fd05031ca7a5e2de304eaf1d831b9f525bd124661beffafaffee0cf939b6f9bf556451cce84c44c66149a

memory/1796-56-0x0000000140000000-0x000000014024B000-memory.dmp

memory/1796-54-0x0000000000930000-0x0000000000990000-memory.dmp

memory/1796-48-0x0000000000930000-0x0000000000990000-memory.dmp

memory/5028-60-0x0000000000D60000-0x0000000000DC0000-memory.dmp

memory/5028-59-0x0000000140000000-0x0000000140135000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 16bfb4aa4f6eb72551139e35da1a4456
SHA1 797d265e7dfa7e9f8e6131c1b7c01c2c1c349e17
SHA256 8367702c2b588ada229f276c34cb2fc2e406198f7736be783dbe191fce849690
SHA512 d6283dcd60dd1fb34fa9304ec5b2d943ab6d99b513992269647a36395838c6157660837ab617c4961ed939af99a6c070ecd817257162157b609f7d0dcee86e5e

memory/2228-70-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2228-64-0x00000000001A0000-0x0000000000200000-memory.dmp

memory/2228-63-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 97c9f698e36c94f0df8f652434ef0041
SHA1 a3a33bce040bdc4177e52b8298885cec3b3a3e71
SHA256 07b54fec56533daaa308243dd6ea49414b6b77ad2787e71f7c2a6f12369c8425
SHA512 04890cd43bafd52c9f3de56bc19d76fe27baad5dc7cfb1a92656fef7b691bcb8e2b4df6abb0b47799c778f0e5343b5c328de99a5fc851e567135c698e66d7052

memory/4972-74-0x0000000000CD0000-0x0000000000D30000-memory.dmp

memory/4972-83-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/232-82-0x0000000000400000-0x0000000000495000-memory.dmp

memory/4972-86-0x0000000000CD0000-0x0000000000D30000-memory.dmp

C:\Windows\System32\msdtc.exe

MD5 16eb12d6b3b150034984a96c7be4e23b
SHA1 8ef0f8604a13ade596ddcdcd047353db349ba3fe
SHA256 71f1bfc0f13bd95a8ab68499a8a4f9bc6b62d5421239729e752c7ab01ab80217
SHA512 16b0c758ee3feb0a89c5f22293fe4c1937acf264827284d6ec89ad16da38f95e7269b8590ee0d708b1cb6c67ff9b8e394a280a7a4f4dba5a0404e5dc62050dc5

memory/4972-88-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4616-90-0x0000000000720000-0x0000000000780000-memory.dmp

memory/4972-80-0x0000000000CD0000-0x0000000000D30000-memory.dmp

C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

MD5 21a6b7da04a9bc09dcdbf5060ce2d883
SHA1 236ae9a968c5689065bb15c34c06b68105663daf
SHA256 3fb18a85f933ca40dc7c2bb88938f7b2383dd46dce3be5cd60eb3a9a1a741267
SHA512 e20538b38c221f2eb04500d8922062d0f3e67f635d59776f73f02ef39b48884c8391d055c3409f7b092f2990551915ad56614d3adc5134ca4d9e3cbe02ea3e35

memory/3736-111-0x0000000140000000-0x00000001400CF000-memory.dmp

memory/4616-110-0x0000000140000000-0x00000001400B9000-memory.dmp

C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

MD5 b4dc2c4a0d91d0b20f28d92f987770e7
SHA1 7c9c6f1b668881b97ec28d9fda6a1928741de42b
SHA256 db1cce63fa3b026480e01490506ab91eb0a0249bd822bd04f955a5f30cdcf254
SHA512 bb4eb6ddbaec9c759559058f5d512e054f64c75e1c746149349ffca264e811fa4271590c04ccd59b22e03bb61cf391932172fcc036194257d25903645d87e89d

memory/2548-117-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/2692-116-0x0000000140000000-0x00000001400AA000-memory.dmp

C:\Windows\SysWOW64\perfhost.exe

MD5 8c7a7058fb565264c7bb672e51ed39a3
SHA1 e16736790b81e70232bc0449e72edbdb74389745
SHA256 32d7a1e42a719617f4296f4923e18901bd148f964d4b3b4e037ef2f827746e58
SHA512 d148cfeb9984f7acc21e361a94ba60a30b470352e31a09943d53e0c68288d071dd698c270c0a5d05648c9d361aca511cc2066da29128e12ae95225401f02bd3d

memory/1868-128-0x0000000000400000-0x0000000000497000-memory.dmp

C:\Windows\System32\Locator.exe

MD5 ab12a6a45ca2cb176a9739edaac71af6
SHA1 22d17975fd4848bb8cb63f4b9671690908d19bc6
SHA256 80458655fa3880764eea4d5280b17ae90bf643e29758312fd976abd5fdd4e2c0
SHA512 ef2a3726a9e626e93eaeaeb4318a62c54d7193818d3dc667398e86d965a138a87f6f428c3d863670cea01679d73381b2436ceb69becc5e1f28f1d0c67fbdeaaf

memory/4876-147-0x0000000140000000-0x0000000140095000-memory.dmp

memory/3424-146-0x0000000140000000-0x00000001400A9000-memory.dmp

C:\Windows\System32\SensorDataService.exe

MD5 9d737793fd67d1dbc33a048b991f1f08
SHA1 feb32810f1cda82b6685db547617804c257d4674
SHA256 27ca0a6b96c8682c137ba60315147937e58ae06ae6508762f8b0df0ac168ad30
SHA512 2ed5df2a2e4a25c635499902fbac0583bc8dab79c2aa088d0178bb0ce89c5d25806a1691fee54ef93dc806255d87c5197272ba6717485a26399b8dbcf8cbba29

memory/3596-156-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2300-162-0x0000000140000000-0x0000000140096000-memory.dmp

C:\Windows\System32\snmptrap.exe

MD5 4a817cdf3518c368eaa34f2a03e32757
SHA1 17a2d4d8f38c19228e76a4983c3e9a66d7f6e3e3
SHA256 ddc129821acb7f34693637fdc35850ebdf0e8386b8967b7f433ca295444d8a60
SHA512 1497321ac60e5be72ced23da8434b8dfd40f55e413f91ed598b006f849093ceebaf2233d411bb7a1c90af5207cf8f3341d213eb6f1078bed4a947d229b50bd9f

C:\Windows\System32\Spectrum.exe

MD5 a745a8a03f3ed55f19ae79f4c9abf385
SHA1 1784890f75c6e9f834fe0584799d6d61d970c2c5
SHA256 474ca84235a3537046b3e57feb7728b57f05473170d8e99268bee9abb172faac
SHA512 e112f31af14177908bcf4545d90812f7ad326297b833327a451cd7a2c6d258e5420e3291c79688f458c8db0d5d2bed35ddf01353b452f8fcff0d45c7ef9f1fdd

memory/4580-173-0x0000000140000000-0x0000000140169000-memory.dmp

C:\Windows\System32\OpenSSH\ssh-agent.exe

MD5 172042db0c4f807532fb9ae46e999488
SHA1 e94364c67faada2253254c1f297a0f083848a516
SHA256 2017a7b584bc3f07f804a0d17f0c18ed6ef9d705828442ea66598d5400359ac7
SHA512 c21bc66b8e272dff5e00be157325c02c57e8ca629d2d03d3932aeb222e1a702a7d435851f22c1b4667c7c5d5e9563a5eed6c8ea6f675754632287d5b412eb635

memory/2156-186-0x0000000140000000-0x0000000140102000-memory.dmp

memory/1796-185-0x0000000140000000-0x000000014024B000-memory.dmp

C:\Windows\System32\TieringEngineService.exe

MD5 f591394cb95b4854a16ab747f9227c30
SHA1 e0c0e53b072797355d31115e2d0b68b99088c558
SHA256 931d92d1605dff4a22f1d98d85da5feb01645203ec874793d10cb8c43f62bc73
SHA512 6e96f7ee83a821943a6c7487dcc8f26b3a9246233cc7710d3dd70ed876dac9f46517f538fad39b2385360c435667e53d1a1e98e4d67472937157aab572ee7eca

memory/1116-206-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/2228-205-0x0000000140000000-0x000000014022B000-memory.dmp

C:\Windows\System32\AgentService.exe

MD5 53986470f192639dedd40089aa7b12c3
SHA1 4676e7ac58e3bc6701c5d7dda36a1e3fcd146590
SHA256 eafaf07191e2c05cf8d5b4df02c7c531ccf180ea370c0c791688157f55910d5d
SHA512 eb8e03810503f36be884e26fe1fbbfd8ea22d34a86056672c5f962f12ce03e250329ef3492ecab6df936276a2a9cdbd1be36d0d1ce37ba2464cae43c12edf961

memory/2516-217-0x0000000140000000-0x00000001401C0000-memory.dmp

memory/2516-221-0x0000000140000000-0x00000001401C0000-memory.dmp

C:\Windows\System32\vds.exe

MD5 97f2773ad03fb9ef5bc91ff6198f8bb7
SHA1 bf8fd368982bb2a8749a3f85a1d01ff63c5542b7
SHA256 ca22a6e8458e3d43ef430da1d80a34818fbe6913d38a8dcbb29e24c6ea8b6f70
SHA512 b20ea376db9ca1e7ad3e015cd8c051773a553e278867abe6eedd1e9cf49c8d15beb55ff607677f5edc243cab634973353e0e65009eff46803d6c8e0b9b42ee7b

memory/3944-231-0x0000000140000000-0x0000000140147000-memory.dmp

C:\Windows\System32\VSSVC.exe

MD5 b43c602a2c901c8c6333abc6b80e7bff
SHA1 1441e2290a1d0c6ca0dea82e902d966b4073b556
SHA256 240885d388cea94fa4a390503d560d5f6045eea742b1661a6f4bf278e344a021
SHA512 dabdc41a101914109c81efb4de3ab6dd171742e63313b97826d515f9a2abf84cafa1bfa43ddafad3731ae3af1190ae8c927774e546a72c0e2eaf892e72f049ec

memory/2548-234-0x0000000140000000-0x00000001400AB000-memory.dmp

memory/2956-235-0x0000000140000000-0x00000001401FC000-memory.dmp

C:\Windows\System32\wbengine.exe

MD5 24f7e3a49a0bb91b701733b450104017
SHA1 e8a1c29f0ea9948ebbca32998bb8be0aebefc6e6
SHA256 69e55ca1368cb1c65dadd271abf9dcf35b2ab4e5888a39459fcc7a8d751b9b33
SHA512 24232916429d83ac3e566609d9e89d58493447b9445aabff0a938aaecf9bd7816ae7a6134543db4468e553dcae7ac0cad92f0ce471a10fa5dfcfc4ba474a0822

memory/1868-254-0x0000000000400000-0x0000000000497000-memory.dmp

memory/1712-255-0x0000000140000000-0x0000000140216000-memory.dmp

C:\Windows\System32\wbem\WmiApSrv.exe

MD5 f26af68128f2441d8083c4519945ddbc
SHA1 c9ed911a4437fd6b08ca951f58b94e09e0279dc0
SHA256 dcf7296d4d33ba8c57f4e919a3360fe363ed55d031f96674fcaf667683c55d99
SHA512 c740e1cc0a67d4b58aa5d507e5792d4b5c04b3d6ece0f6be18256d4af0e141fc87b1a40e218eb67416f14cef8631190ab7b3628bbd2f80fe0715d17cf7dc1e9f

memory/4876-258-0x0000000140000000-0x0000000140095000-memory.dmp

memory/4868-259-0x0000000140000000-0x00000001400C6000-memory.dmp

C:\Windows\System32\SearchIndexer.exe

MD5 ee808956fb17b072fc553ed174a3e288
SHA1 a433f9b706bc6a93b039f420b1593d07b019a21c
SHA256 afb3c4903870d80a5efb4f5f1959c5219f3fc8ed03d3b721f92fe8675ee22557
SHA512 1a4f6be496447428893a6131369c296c949e3b2beaddb6339b7a77436040c6f9e674111b15396ad58b49c1e0294b0eb533a66e7b4830f59db98aa0123a125f1b

memory/1408-280-0x0000000140000000-0x0000000140179000-memory.dmp

memory/3596-279-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2300-469-0x0000000140000000-0x0000000140096000-memory.dmp

memory/4580-476-0x0000000140000000-0x0000000140169000-memory.dmp

memory/3596-479-0x0000000140000000-0x00000001401D7000-memory.dmp

memory/2156-480-0x0000000140000000-0x0000000140102000-memory.dmp

C:\Windows\system32\AppVClient.exe

MD5 8f97145f5abfca0d014aecf7eeaceb0e
SHA1 332ef16e086acf6936b556edd69042f4a4d6d302
SHA256 102077d91c7c4987216b1e7627ea6f37374b650d832c9cb0f77226a31783ba30
SHA512 d9ed91f73838ec1976b93f4b911df168b78964e03cf6822b88ba96d24de4ddc910391af8269e1b90e224c041a431f3d183e157cfc2ed1a7dd36d8d06166d37f6

C:\Windows\system32\msiexec.exe

MD5 d796c027df0a86af7fff737228cf51be
SHA1 7c0ed7b2ef6a8e4de8eab2af82d1510606443cdf
SHA256 f1a08b431fa5a5e9df15215a87d1ec052d88160bca64dd7bddad1ccf10c6eb98
SHA512 50a2d759d06ae70439e6df9b32e844e3c9a0b3e5b2ec5e8a379659ee96d326b60b6c3f4efd5b79cc342d0a6aca5f2d22d23ab7710d9f3961c7900caaf55f7000

C:\Windows\system32\SgrmBroker.exe

MD5 af51fba1845ec9e64dede05c89d1d71c
SHA1 3d56fbd670dd4a93a39610d6545d989afa4c584e
SHA256 99707927f211545f17db3e9aeb8613cfa3010993879b3a16d2c1ea58e83348ef
SHA512 6cf59f17f669888636bae18551063603bb6c25f45a6c87d36b6fa920e3f656a3ca123ba77459024717648bd248362b01f91cbaa01daa337d0b3e6054e81b8d58

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 278a39550d0af9f6ade31b1e22d3c18d
SHA1 1b5d4b6695345b72dd1e6fd428950c0dafa38762
SHA256 ceb3ae06b64de17dca63ff71ec4e1db414975fef07900d825392f0959c957d5e
SHA512 d9e018af1a40159d65101fa709c67f004b36a6a3d8ab038f3e186cc22a5dea1f82c08c462a869684a46fd0646a002d60aef15dee345286bf091ea7e8941f4539

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe

MD5 e43b132a3253dc6b0fcad678f55c311e
SHA1 7f8e595b16227259c626527919449a4e50f30805
SHA256 006d55e2cfe0bf578c989d7c7a5f65f5a6250f589654da39d5dd1a5a5425fd6f
SHA512 83d51b610e9e27f3402726b95c50125d280dbe4ea9e98e8823f383995fe71a6373d752f653a8d37970c439d4c5b29d66f3a3e55b6d8f916c179dceb77b7fea8e

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 07b900fa7ece860fe5cbcf3f37374155
SHA1 be35a518d21e264dc41b4566f36c61c1c7b719fc
SHA256 b1b78c4c403523516e062b5ad110d800450033fd054210e7fda9947aac5a284f
SHA512 8386e8bb98d580cd90ace76ddc08e6894e3ac7187cdad7fdab6d7d6fdad1fb8db055590e4dc57e76284f1d4b04aee1853a08dee7f42f62074d9d4201ed9d8f76

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 0a0ced00f5048711f8e638593e81d424
SHA1 3eeeff77fb8d179988625d8c2c3d753ce130a6f5
SHA256 beb7b1894e3ce1a4f1449b60a726fa4d22c1ffd06ca12c656788aa26bb0afc7b
SHA512 8d961818105ac447eb81fb2b63bed2591035c3ef9effa88a1b4adb06284d910437eff0e292eec6dcf711267aeabbb54e964d8d97ed5904f556bbab2d67e8cd28

C:\Program Files\dotnet\dotnet.exe

MD5 d4f1da4518aea9d55ff623cd0c0eae11
SHA1 5511132248b1e5e2a6d421bc9e6e3b466ad8b4e9
SHA256 a82379e70a21d9566b0981458a893e1546a5740db1b528acf1464f032941f86b
SHA512 c9c84e75f6e167ee87b7eaea458f3606b6921187b2eb0e768afed741b7bcc05392969b7280a96a0113085e04e4e74963d381180dbd36c2c2275e5379a28f19ad

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe

MD5 cc31295f38ed9df3a16caf589824657a
SHA1 670ffd634d5148d68b6447f0aa6a338a9aae4ea7
SHA256 e5f55d6a89a8c44292850ff664c3cf4f14c92d456485e2190845b7b357ecbb3d
SHA512 121456d6260c4b28cbca3c3947fa81d35d3f3a6495e3b657570abdf3de59add0b46f42a28641588f5a44695b2b542dae83eddb5f3f2119174845d86de44264bc

C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE

MD5 877a1611736bef79ab506c95aa4c675b
SHA1 a6cd8b5e212333be2d159d4499f951b59899443e
SHA256 0b6d0fe258341260d9c089c71fd7c3de5abde83770c6e8dd69d2f08e65ab1403
SHA512 9d9734bc52d24964b93301e53e7f9b3eb890818ef1e973da51ad6c14a83bfd1202ef6fd23c12cb0e806defd9d247bf29bf9803b3aad48ab803cbf263673e80b3

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 8f6b70f3290026894d0569d34befa2f4
SHA1 5dca3c7d50f3bb84180bff0c2341fdf902bdfba0
SHA256 a2b4b3fe8da09372b82adaa8bb2c4bbaab5106b8b88708468cdda4a45f523080
SHA512 8a04c532aa3a96dd3529004c25e0c4f9c89a07cdb1f6a730c7558715714526752efc9df49086327e93ef9d667e79fa9e6946b968444fecc57f0ad969187426c2

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 628865441e03316288282ba23054fa20
SHA1 2b97eff32163d1d1adbba9699c4dc2b52b808bac
SHA256 55e1e07f349ba954dedabc0af870fb81d661e55529421d91c8e498218a239ccc
SHA512 390ba6ae73bb67bb7186307a99e1af926705987dd18e75329a2bc9a7133145151c985b3541236ada3a36b6655a016ab39fddd8e90c8c896ef55ef62063188262

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 b14bdc9fa851abf711035fddcd835fe7
SHA1 3d8046e188b5dbd11d2ab71e37f3467af5a40fb6
SHA256 a342067c7ad20bfcd0e41eed4369c59d529d21c17b5f5ddbd295f7480ac95b25
SHA512 e1e671eaa6b79b32398fef4abc6f37cbc6549fd3a07521d87d37f5148451ffc81d898141fd36f2870cdbeaf97e141cd5d77e85538d24d507f64c8ef7262e1bf9

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 b8d10bfcd28a6c189bd4f44df6dc8463
SHA1 f692c114d77d0acd8395fd49aab8d1589d53798f
SHA256 77bbef8ef23f55004543cc917753602522bc31205f16d08d6370a111f848bd19
SHA512 58612e1d0bbfcf6a38a413f0d51101f12ab3b571ef37e0c91aacd7288688783fb9e6d81cefa0059e89539f11d90ddeff9476e0818e22802bc31576baaaab3946

C:\Program Files\7-Zip\Uninstall.exe

MD5 f301b379dc7eb28059eeb34ae5504eb3
SHA1 9ce919c7fcf224dd2e67a9fcd5e4624429b6720e
SHA256 79a34f691de6fe3ee8b86daa15132a3ec85b42c22e8b13139d8a505d1526a148
SHA512 5437e14ac58c57f335b2ae8c2c5cf946f62a02508ffcbca0bff566f382dcd3058b7178db48fcd86b38b7c522b867e9db0bed001d20a05116e30ea36be429ed83

C:\Program Files\7-Zip\7zG.exe

MD5 e0c8e68f2fb7ee63fb0f15fe804d2f03
SHA1 0173ea33509f3445f00d91cd5f4c8a03c74680f0
SHA256 8240e4b3699a951888cfa70e1bd54e2bc4a2669423620e4499235d91bfb9d2e3
SHA512 e9e843f194e91eec661476983538b037550a29a14b96cb0942f54c605abc350c248019ffdf732f34de2226601d150f647ba55c32d39679be3966011406f665ab

C:\Program Files\7-Zip\7zFM.exe

MD5 fc23fd8fc31fd0f7a4575c9db1c2a972
SHA1 b9b84f3acc12de2e0a93817b21ac5a52f12a7d52
SHA256 5bdc2905305a5bb32c98bea2c72df2eab2ae7b9c9fac3cb7f89b24c8c9d68ed6
SHA512 31dcc5aa980de7252c5f7aca433d8c96bf45c2072c6e69419b20d6611eb90fe7b5a741edf719e3a8b8e8184d94a5a71375f646d799df4f5596b71f1109e797c1

C:\Program Files\7-Zip\7z.exe

MD5 6c8b3abef3355bd198de0394d2f79196
SHA1 638b956e0094c753423df8f905a32a020de6c97d
SHA256 8e5c1bbb0ab8c0d52ab551cef2f093f9b16c920aa563f5e6e738c27842fcf65d
SHA512 e17cf8f5141e5c38cbb059cd56bf56f4dd02eb58a3d1a6c694f4dbab5f4465eda1f3ac20dc75466014b1c45f3a0f99eadb98a06e8f89b70e1696b4885f50a916

C:\Program Files\Windows Media Player\wmpnetwk.exe

MD5 7764c5bb65ca5596c87848951a20e5b2
SHA1 6d945b26714c5739a855dc7f2b3cfec13ee77e3a
SHA256 e15ba171c7b0909e6668dc60e3df5636e45b951b45ccf978a4ceb9f2a7cbeaae
SHA512 949df8bfd601a598511befcc928691098f7ba5db8363fce63a206a01e48a44e8987b0503aa6f4588b9646a7b3096f99e18210fbd05733d1da6e80529fab09213

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 16eb2edecbb2cc46dd4532b46cb5a540
SHA1 6fe9af0f3c1a5a89610998bd6a304c0a8fdd315d
SHA256 46b5d99f60df49962d49f7cca47982b97f7447c30f7c49d20b380dffb9ee1d44
SHA512 b9825b8df82e7fd5739ea956c7f316fb15c408ee6f06c530e17496f1a19006b1bc511959ca34f908deefbe8eba84019a8bb1b060ef38255eee1fca5bffe86d21

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 6c6447005c3a4daf576f854723b886c9
SHA1 219e045d5003e701092629b142d71dacb7a7efb5
SHA256 7d16f63c60b17a9e06b277b8358b4773427ea6ee73ec5b32aad62c867831b4bd
SHA512 42b2cb12eac549d79e752818ec0ec99038cb113180de62105ccc648005b89000844d1fba19b40dc1259fa3a06defbcf21f1c3308e3e0a7744238af39e868c4fe

C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe

MD5 42a0150cb9170cf30808ceb0021dd88f
SHA1 4e2a1d7bfa45113bcf1d2a2e8ca6d4c1a671ddc4
SHA256 2f9283eb667a54fc7733144bae40c6d88de3b21353d9cca5f7a7b53002ad1e53
SHA512 4fbb83abcf21c572fd5f7b45fb2c2beb13bcbe84c4730c1844725350baf288ae8c69256b12ddec93952d851c81ed806ec9439b28a83c7c092b162a9834a9ef64

C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe

MD5 d11c59ad1ecc8e5d6320140700f06cff
SHA1 2267afe9311df30dc7eb515167e5ee8926774841
SHA256 3b2884e5df47fa50267d643f116073fd23cb0c9c5e32641478b6c180b6c967ea
SHA512 4b663db9becdf4f4dc8830ec9eb63f1e243bda0da819e55f3f129023e43e74a2e4e6690ce06e98ffeea0b108ba9b5a2a79e704ef5f04dcb04b920e347e3ec773

C:\Program Files\Java\jdk-1.8\bin\jar.exe

MD5 5175207395de404d469aadee7b661dd9
SHA1 97d86c8df5ee1d28fb5caece1d9fd229a05cf2db
SHA256 612ae015dd8cca3e4b929ecdc4e8cfaa9e32963ded20816dbecf2409c9f4cc45
SHA512 5559b556df4184590e8d9ecef3a875c34936d0874dd075e9ea758d8aeb7c9523f404561ba3e754ffe7ce83ffa327a2f6986ce87729d4156b892d2adac34d2499

C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe

MD5 535a48df6c3f66c25aff64a7d6d6b765
SHA1 676602f0505fb50571f65f1344a84eb61f2c0d23
SHA256 4d51cfbc2b444d0b3f2f89319a901dc6ae344da83c01ca9085cd4b09eed07b6d
SHA512 89aa4d891cd994edad5f0ad5c8f4b98580775a27e5f298ebcfa86d18ef9c4dd0071808f577d7dfa132ef505514714b014f3d69f8c4612de2d3e20382e017355b

C:\Program Files\Java\jdk-1.8\bin\idlj.exe

MD5 d1bfd2791b7c083dbc0ce7dc2aa2c730
SHA1 c4f2705d758d443f6af7ea0c26ac9b7229219411
SHA256 98587772ab5da8a857527e63c0a8f900627296460e197631200d67927b6947d0
SHA512 c58c355d3b75a43096ea800cfab6bb37df389b02a9d907125e0dad69f593de72eff272f25496cd85a4ea8e20fd5bc75c31901543ccb6de0025b895d45a58faca

C:\Program Files\Java\jdk-1.8\bin\extcheck.exe

MD5 459a1e98b820683751dc04634854f949
SHA1 1bc27ea8166e9311ef459692433c671042194d6c
SHA256 1159b02fe00571035b9314df5bfdfe8f0252a4c461dff2620782ddde140ed1fb
SHA512 69150b8c4ab851c4f8a4c0cbe3ea7df1623bc5885fea9dfe449f4f9fca23eabe7da55d1715012b7b1f5bc621df6d57b3736b68f05ddbb05565458e030a31afde

C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe

MD5 d9d5a2e8fa631c9f1d34ff200f5715e5
SHA1 c9c80f477a7f7958975f1ae5dc61ff268483806f
SHA256 40bce20a700510ae6b387c65c2d870dfbe0064d6e6c3299bc0feabe4ad645b80
SHA512 03a9e22afa1a59428fab155f760db44b5e692f6a5c8f0c0cc8889f8ba2a1bebb2dd180cb7663c4f96bf14e7e2fcec74471a355aa311097e7b4f6daa1e4cd7236

C:\Program Files\Java\jdk-1.8\bin\javapackager.exe

MD5 3e168b0da2d3042a6197977df3108e0e
SHA1 1b8a1499376210405cadb6779f444031f2d4695e
SHA256 a972bcf6191cb5fa64d4c604b97c5c93ab40618341e5ead82179ecc489b52646
SHA512 e566a4c8a07524411ec17f009f42c873a6100a492d6e4e5edc80d8ae54e7a2c46a15b6286ada6f2b17d7142ff5592ef30d46c45ed934ef47f9f5c83b30aaf611

C:\Program Files\Java\jdk-1.8\bin\javap.exe

MD5 33b3185488a44245edc108bc4bb29ece
SHA1 ab99bf86835d837bef6d68d7a592b54613a50598
SHA256 6a2e0c7c750a44998485d96225f9b1bbf27964397db3e657ea9e5f9d1f107894
SHA512 3b39ba408c580930d35e6516de42824303800156e953f37afafb907fa17024bad1275653daa2859b3ce8f878958527b7666b2c47f30afd441ab975aa587d2361

C:\Program Files\Java\jdk-1.8\bin\javah.exe

MD5 e23ecf91f6fb968cf3dc8e420c541647
SHA1 ea57bc4e3a4b8dd43a060cd2a7a95b6163752725
SHA256 6f7e097e08651bcd6bc01b6ea6af21643f923b74c8687bb4a463565f0bdd9073
SHA512 4e2d75a85395c3ca0de492fc341ff05ae6e74166bddd74b64b97eaabde11266d49eefb22334e1eaba6d20622b652b7e339c02590f5ed0838843fbaa86298fdbf

C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe

MD5 8d357632a6a867ce31bf9a05bd0ebdec
SHA1 36bc4e0518687083aaa8b5a33f4fa59f7a35c4a7
SHA256 632cfd8b4c9fe0258724ff24dab4b183159eb59c1ddc63df35202602ab431841
SHA512 d41bc493db6b170b8a02326595f47ab15b47950f799c6f84bc53eb960e7d0e7e88881f13b06937cd2653c6d7b6cd4adbd3ce1ac2b1eafcd0f939acc74106f069

C:\Program Files\Java\jdk-1.8\bin\javadoc.exe

MD5 8ea20cbd934333ade7bea50c5e06557f
SHA1 c137b4d4543091ca153df0f8e8c6dcc042f6f511
SHA256 e32a1c570ad45a0c5321f15a405d224b2781780316569bdfa5b91b0c6c05666b
SHA512 4427f7c9bae9469d7d0037b5e0eae39360b57e86f30e198e8c2d73311c8a0bc349f36d704e41e18e95f67bc1f9f35bbaf7e032b188cb56373bb688be32c5959c

C:\Program Files\Java\jdk-1.8\bin\javac.exe

MD5 192e3bb8036d7a92eca2478f7cf20c8c
SHA1 a8b57f63804f11b006b76800c70da814eea8e846
SHA256 7393e290e39587c0f9f5a91984b48a0aed8a5ef7407afa6a828afe684974019e
SHA512 421f747c2192d6c5873a8f75c3da1dad3949f7a712a61bd5f73703ec1cfb3ce560a2ef91e356bc72b0aa1ef6f51de1277faa7c0c654be3d5a516cc1290004d70

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 f715f675892030867515b96f33bdbfcf
SHA1 5133c84eb7d52eff7c6676ae3a1186eb015fa7ba
SHA256 a630643fc1a680873dfcaea5ed9f35f72746a221428516ef05a4b734cdd59522
SHA512 41d7f44d79b6e5a4b8f28058fd25eaacc12ff58aac456d0a0c07cd523cb6e8b044ad297a1c3565eae9a280f2420a4a0cdd27e9e6549905fe7bba89ec600c8cb3

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 6c522c16359dd7250067c16c90ba5b6b
SHA1 6af5babd86ccfb17ac2524383ef11476f33cff2a
SHA256 b9ad26ce7372d8ed059ed8fd3b6a7de644af585a04e971722deeda922c2137ee
SHA512 5aa4920b1c85f19f72953b0afb1da9badcaa6e5bf3d38faf7968453926cc4d7b7eba06e52d79b611d9cf5f08b2fc8238b97b525a338c69dd0c94aa2ad088519b

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 0c8e791474e91e47a720479d4f8231fa
SHA1 273410ed2fd97cdde12d9cfa8b09863af0f09304
SHA256 4e128367de5274a63600171689d6f6121fb9288f0f42ab329d2a0f167428f156
SHA512 0dd4f48542677f70f254e47d73fce1a9d67f8cd678c137940a54e8ceb575ffef911a7f868717bc1353e524ad7389cccc88e178f0573550362edca053d0a73a62

memory/1116-588-0x0000000140000000-0x00000001400E2000-memory.dmp

memory/3944-655-0x0000000140000000-0x0000000140147000-memory.dmp

memory/2956-656-0x0000000140000000-0x00000001401FC000-memory.dmp

memory/1712-657-0x0000000140000000-0x0000000140216000-memory.dmp

memory/4868-660-0x0000000140000000-0x00000001400C6000-memory.dmp

memory/1408-661-0x0000000140000000-0x0000000140179000-memory.dmp