Malware Analysis Report

2024-09-11 00:09

Sample ID 240617-adlsgsygkm
Target 22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
SHA256 1e9ddaaae02815fbbc4f99de6f308df0c1a1036e0af5219b1797a939f6bf21a1
Tags
neshta persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e9ddaaae02815fbbc4f99de6f308df0c1a1036e0af5219b1797a939f6bf21a1

Threat Level: Known bad

The file 22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

neshta persistence spyware stealer

Detect Neshta payload

Neshta family

Neshta

Checks computer location settings

Modifies system executable filetype association

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-17 00:05

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 00:05

Reported

2024-06-17 00:08

Platform

win7-20240220-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Windows\svchost.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE C:\ProgramData\Synaptics\._cache_Synaptics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE C:\ProgramData\Synaptics\._cache__CACHE~4.EXE N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache_SYNAPT~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\._cache__CACHE~4.EXE N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\._cache_SYNAPT~1.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\ProgramData\Synaptics\Synaptics.exe N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2368 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2368 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2368 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2368 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3016 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3016 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3016 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3016 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2368 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2368 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2368 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2368 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 2560 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2560 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2560 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 2560 wrote to memory of 332 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 332 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Windows\svchost.com
PID 332 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Windows\svchost.com
PID 332 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Windows\svchost.com
PID 332 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Windows\svchost.com
PID 2416 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2416 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2416 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2416 wrote to memory of 2188 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2656 wrote to memory of 344 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
PID 2656 wrote to memory of 344 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
PID 2656 wrote to memory of 344 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
PID 2656 wrote to memory of 344 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE
PID 2560 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
PID 2560 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
PID 2560 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
PID 2560 wrote to memory of 1432 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE
PID 2188 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 2188 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 2188 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 2188 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 1556 wrote to memory of 1276 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
PID 1556 wrote to memory of 1276 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
PID 1556 wrote to memory of 1276 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
PID 1556 wrote to memory of 1276 N/A C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE
PID 344 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
PID 344 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
PID 344 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
PID 344 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE
PID 1432 wrote to memory of 1372 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1432 wrote to memory of 1372 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1432 wrote to memory of 1372 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 1432 wrote to memory of 1372 N/A C:\ProgramData\Synaptics\Synaptics.exe C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
PID 2000 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE C:\Windows\svchost.com
PID 2000 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE C:\Windows\svchost.com
PID 2000 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE C:\Windows\svchost.com
PID 2000 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE C:\Windows\svchost.com
PID 1372 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 1372 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 1372 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 1372 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe C:\Windows\svchost.com
PID 2860 wrote to memory of 2832 N/A C:\Windows\svchost.com C:\Windows\svchost.com
PID 2860 wrote to memory of 2832 N/A C:\Windows\svchost.com C:\Windows\svchost.com
PID 2860 wrote to memory of 2832 N/A C:\Windows\svchost.com C:\Windows\svchost.com
PID 2860 wrote to memory of 2832 N/A C:\Windows\svchost.com C:\Windows\svchost.com
PID 1276 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE C:\ProgramData\Synaptics\Synaptics.exe
PID 1276 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE C:\ProgramData\Synaptics\Synaptics.exe
PID 1276 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE C:\ProgramData\Synaptics\Synaptics.exe
PID 1276 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE C:\ProgramData\Synaptics\Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-2118340761345564306-810172868870374296-2109526173-5834461421838567520860541315"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE

"C:\ProgramData\Synaptics\._cache_SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\._cache__CACHE~4.EXE

"C:\ProgramData\Synaptics\._cache__CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\ProgramData\Synaptics\._cache_Synaptics.exe

"C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\ProgramData\Synaptics\._cache__CACHE~4.EXE

"C:\ProgramData\Synaptics\._cache__CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE" InjUpdate

C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE

C:\PROGRA~3\SYNAPT~1\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\._cache_Synaptics.exe

"C:\ProgramData\Synaptics\._cache_Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_SYNAPT~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache_SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\ProgramData\Synaptics\._cache__CACHE~4.EXE

"C:\ProgramData\Synaptics\._cache__CACHE~4.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\ProgramData\Synaptics\._cache__CACHE~2.EXE

"C:\ProgramData\Synaptics\._cache__CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~2.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\SYNAPT~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 8.8.8.8:53 docs.google.com udp
DE 142.250.185.206:443 docs.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
DE 172.217.18.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
DE 172.217.18.3:80 o.pki.goog tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
DE 142.250.186.97:443 drive.usercontent.google.com tcp

Files

memory/2368-0-0x0000000000220000-0x0000000000221000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 7fca799dcae0469e49076bf81a783748
SHA1 4d50c0dc248967b3e8c311e5a726810cf5ba198f
SHA256 7a242eaaf9dbc3bb01bd4247c3341feab6019241ce9194eec0383f2d67f12b7e
SHA512 91153bbca28542aa2451541e45349399680825c108a05ec7ceb2374535759aa3076a3aaed68779a3bcf03ac31576705cf56eae50a7c0b90ee646157922cb808d

C:\ProgramData\Synaptics\Synaptics.exe

MD5 22174995a9896b9c8c0c8b1c22036900
SHA1 6485935373246153f0bc485544e0f7356b355622
SHA256 1e9ddaaae02815fbbc4f99de6f308df0c1a1036e0af5219b1797a939f6bf21a1
SHA512 c1b9cf67aaa5eab474b3ef06329ca2a09ddffe2465a1c2b48f4f3c9e1b4282eb932e039a03e003ec2b42a6ece5ccdd4c11c7fd8396cf38104c27efdb8bce59f4

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 6a86c81aa200c1ce3d4cdd9e9d232ef7
SHA1 b384eb51b9ae978d4db3307d55d8798af0212344
SHA256 7d97a2e9598da5350d3ad1f8bdce7d708f8852a3ab71da75783eca5d7eb32ac4
SHA512 d23d44ecb18807e7483b7010e2ca7a00fbdf613944587394782666e8f68be41ef8326aa65963e00d3b67a12900936a8b06bcdb3480010e8f6a10b72f5c241d4b

memory/2368-48-0x0000000000400000-0x000000000073A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 4b6c12ce2bb8cd0d3a24254850a13d4d
SHA1 11070e23fcdf3968d334d013eeb7f82257e8312b
SHA256 68fe3d7c846d040fbcb8be080845a9ec727ccd9f72cd5d748d617e3c43788c22
SHA512 5cd860c5b0bb52bb33b5e6fda5b49022763ab61df7d7abc6f3dde27cb19217b1b09ab2910de8808c39efb55ae2146a6087d3d4c4a32df0a7c19091fd76a0855f

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

MD5 cf6c595d3e5e9667667af096762fd9c4
SHA1 9bb44da8d7f6457099cb56e4f7d1026963dce7ce
SHA256 593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d
SHA512 ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

MD5 02ee6a3424782531461fb2f10713d3c1
SHA1 b581a2c365d93ebb629e8363fd9f69afc673123f
SHA256 ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc
SHA512 6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

MD5 dc3a4ffda9bc7970803a7b5a0fa6a78e
SHA1 09f9aef7fac8c17ab6762746fdaf31f566b57277
SHA256 d9039fb6656b6d2a625ec73dcc88cac9c6641529ff55bedaca994cf0e0520fba
SHA512 253dff69d0aee508239992b819798d2e282f5cabf9200f9275d49221e7b272513eb841c5176ae7c4df785f6323902024842442b9f7315cea37cbe576d86239ee

C:\Windows\svchost.com

MD5 223dd32576ace5da898257671c5cdf36
SHA1 87474af22e6a24ef24de43d2e798c87bd986514c
SHA256 8d4dbd3013a493f904e0863bb55d910bbb640ef3bdc6fcbaf3c78e95fbdd5254
SHA512 aaef06b777e4b015af8843b2955af6fbc4c6c7a0630729737a76464d9a443cf673b5b583ae7cf2ea2333f81bd083cf104bb4da9add41a5da48bc4eb1bf0dbdc7

C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

MD5 566ed4f62fdc96f175afedd811fa0370
SHA1 d4b47adc40e0d5a9391d3f6f2942d1889dd2a451
SHA256 e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460
SHA512 cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

MD5 58b58875a50a0d8b5e7be7d6ac685164
SHA1 1e0b89c1b2585c76e758e9141b846ed4477b0662
SHA256 2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae
SHA512 d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

memory/2560-89-0x0000000000400000-0x0000000000674000-memory.dmp

C:\Windows\directx.sys

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\directx.sys

MD5 b42f2603883dadf133cee3ae5d767bb2
SHA1 dc4161551044405353e870b029afff27c8030e22
SHA256 998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28
SHA512 a4c33c9b87f84b4aba84ecf8b0b2d8a90703ef8523f1d057824196e584451072ab5bbc96e0c95a319baaffd16ba7a26f940fec2e28e9228e1275c87fb061c02d

memory/2656-102-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2188-105-0x0000000000400000-0x000000000041B000-memory.dmp

\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE

MD5 748bbc1c938500f4b2d1390ebb8c5f7d
SHA1 40cb480c77be512da9399ff35b711a911735c94c
SHA256 4db2e2ce516c3a232f4a3d441b4785862e66ef0faaa2ae07c875abb3dc471945
SHA512 c02605af649054a160dab76bd7eeb058694944b65cab9122178fb7d37d008eb6a13a44a0c52d5729850c4d39e46c8c305ac3dfe66ecab05103dd37b42f248382

memory/1556-120-0x0000000000400000-0x000000000041B000-memory.dmp

memory/344-121-0x0000000000400000-0x00000000005AD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

MD5 fdd26a04bda85ce1418b6cfe529d03d3
SHA1 fd72ff6c98b92cde0e1db73b4fcdb32807368c6d
SHA256 750fc3a9547af96b2d722f3ab8ad964521fc820732dbf4c74882d4cb5ce61ed3
SHA512 6f63fe6bc893ca346bc68ffe32cf1aae92df2c618a88e7086cf9d145c3deb591fdc7567290d9ebfd587fdb2385e74b8828785b2a2b2d1d58f0cc9d1a1e888b89

memory/1372-147-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2860-151-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2000-131-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2416-163-0x0000000000400000-0x000000000073A000-memory.dmp

memory/2832-171-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/2352-179-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 6b3bfceb3942a9508a2148acbee89007
SHA1 3622ac7466cc40f50515eb6fcdc15d1f34ad3be3
SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
SHA512 fa222bfcade636824af32124b45450c92b1abec7a33e6e647a9248eef5371c127d22ccb7cc5a096b4d5d52e2457f3841293a1b34304e8e5523549856ac02f224

memory/2360-178-0x0000000000400000-0x000000000041B000-memory.dmp

memory/808-190-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1432-164-0x0000000000400000-0x000000000073A000-memory.dmp

memory/1756-175-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1276-193-0x0000000000400000-0x0000000000674000-memory.dmp

memory/1808-204-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2852-194-0x0000000000400000-0x000000000073A000-memory.dmp

memory/1220-206-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1104-219-0x0000000000400000-0x0000000000674000-memory.dmp

memory/3068-222-0x0000000000400000-0x000000000041B000-memory.dmp

C:\ProgramData\Synaptics\RCX42F9.tmp

MD5 24c43a46e3ce028d3487a991e3b5f202
SHA1 3e47a2fbcfc35f7ee787e59f5e7f578d5cb54d69
SHA256 a4d6976ec3d988f43d3960623a8513de6cc46ca54af289a7e827982a0dee3a2e
SHA512 8e17d67efb54e679115b6b0265be3b15e1dc09bfd648c20a54f2712b6915095364febaedd1ca713b87c365c3861b6e3668d31190395b9ab18bf47fb0d862deba

memory/1016-238-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/448-241-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2312-259-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2812-252-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2472-250-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2080-275-0x0000000000400000-0x0000000000674000-memory.dmp

memory/2680-277-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2904-276-0x0000000000400000-0x0000000000674000-memory.dmp

memory/352-299-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2572-292-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2308-311-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/2580-317-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2324-362-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2328-363-0x0000000000400000-0x0000000000674000-memory.dmp

memory/1684-364-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1084-356-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1676-349-0x0000000000400000-0x000000000041B000-memory.dmp

memory/992-348-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/3048-328-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1708-382-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2252-387-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/896-398-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/2872-397-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1808-394-0x0000000000400000-0x000000000041B000-memory.dmp

memory/924-386-0x0000000000400000-0x0000000000674000-memory.dmp

memory/1880-385-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2284-405-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 4e125c05c3c52106512082f82aac0717
SHA1 8505fb21e0058418415b73921e4d5d872c4485e1
SHA256 d450a68cb3fc838b7658dc7d0c0ebe239a29285410b1af7b76497779d23f27c2
SHA512 3d6caa724b358829dca51623e9cbf6cca72512e19d027b0f72296fa20ffa47f31f24d72b45cb5d5fb767756a5a5469bae66dbca94d97f1e33ca134d1f080323a

memory/1944-406-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1720-423-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2736-425-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2644-436-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/1584-437-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2200-446-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/2024-450-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2776-456-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 48666032bcbce70055a4b8477879c103
SHA1 080069095e146772bae92f4281c9a8245b4bce69
SHA256 4476a30a9745e1ce4ff339c4d4e3fea9be5dc2238e4b74f4106c24f14f3d88f4
SHA512 88488a7545aa2225864c3ccbeb41edeada19402131f34cae7d4981612efb868f7ba071dded738299e1a6dd9b081bcc43eb3921d6d6c3e453597a3f02af4b18b3

memory/2400-459-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2268-460-0x0000000000400000-0x0000000000674000-memory.dmp

memory/3028-477-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2084-482-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/380-498-0x0000000000400000-0x000000000041B000-memory.dmp

memory/704-492-0x0000000000400000-0x00000000005AD000-memory.dmp

C:\Windows\directx.sys

MD5 10320b53df6530a542f13adf5f36d39a
SHA1 386dd879a3e1176b0c91328ce8254174e4220569
SHA256 9c4249eb6a5603fcc10a8c8c3c4d8f028a98ebcd9179c0836faacf1d03a48ce7
SHA512 c8007820db892b374dee1e6917c6caa4981d3f230ffc11d6753951ff46861ee4b0035544b3309b3008a2a769266639ce45ebc023b1748730cf0cf67844a065d6

C:\Windows\directx.sys

MD5 27b81f62272c4fb29d767dcc7c54c4ad
SHA1 4a7b9dd9c6e3cb6d1d9ed951f72852b7009b7aff
SHA256 ece9360499614dc21a8647ab5b5c9f7d6516f7e27278a1cd8cdcadd984c0d3b1
SHA512 64b0a19341af5a2c1d6616930ec3d487b696f03f710111ef0a10ed95fa82e58ee6289006d281f646c67def44ce56d5d574664d8906e0a3de5725b95a7ff44ba2

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 00:05

Reported

2024-06-17 00:08

Platform

win10v2004-20240226-en

Max time kernel

31s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4000 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 4000 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 4000 wrote to memory of 3984 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3984 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3984 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 3984 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe
PID 4000 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4000 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe
PID 4000 wrote to memory of 4964 N/A C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe C:\ProgramData\Synaptics\Synaptics.exe

Processes

C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe"

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE

"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE

C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate

Network

Country Destination Domain Proto
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
DE 216.58.206.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 i.pki.goog udp
US 8.8.8.8:53 i.pki.goog udp
DE 172.217.18.3:80 i.pki.goog tcp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 42.206.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.18.217.172.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 27.178.89.13.in-addr.arpa udp

Files

memory/4000-0-0x0000000000920000-0x0000000000921000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 7fca799dcae0469e49076bf81a783748
SHA1 4d50c0dc248967b3e8c311e5a726810cf5ba198f
SHA256 7a242eaaf9dbc3bb01bd4247c3341feab6019241ce9194eec0383f2d67f12b7e
SHA512 91153bbca28542aa2451541e45349399680825c108a05ec7ceb2374535759aa3076a3aaed68779a3bcf03ac31576705cf56eae50a7c0b90ee646157922cb808d

memory/4000-27-0x0000000000400000-0x000000000073A000-memory.dmp

C:\ProgramData\Synaptics\Synaptics.exe

MD5 22174995a9896b9c8c0c8b1c22036900
SHA1 6485935373246153f0bc485544e0f7356b355622
SHA256 1e9ddaaae02815fbbc4f99de6f308df0c1a1036e0af5219b1797a939f6bf21a1
SHA512 c1b9cf67aaa5eab474b3ef06329ca2a09ddffe2465a1c2b48f4f3c9e1b4282eb932e039a03e003ec2b42a6ece5ccdd4c11c7fd8396cf38104c27efdb8bce59f4

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 6a86c81aa200c1ce3d4cdd9e9d232ef7
SHA1 b384eb51b9ae978d4db3307d55d8798af0212344
SHA256 7d97a2e9598da5350d3ad1f8bdce7d708f8852a3ab71da75783eca5d7eb32ac4
SHA512 d23d44ecb18807e7483b7010e2ca7a00fbdf613944587394782666e8f68be41ef8326aa65963e00d3b67a12900936a8b06bcdb3480010e8f6a10b72f5c241d4b

memory/4000-121-0x0000000000400000-0x000000000073A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 4b6c12ce2bb8cd0d3a24254850a13d4d
SHA1 11070e23fcdf3968d334d013eeb7f82257e8312b
SHA256 68fe3d7c846d040fbcb8be080845a9ec727ccd9f72cd5d748d617e3c43788c22
SHA512 5cd860c5b0bb52bb33b5e6fda5b49022763ab61df7d7abc6f3dde27cb19217b1b09ab2910de8808c39efb55ae2146a6087d3d4c4a32df0a7c19091fd76a0855f

memory/4520-189-0x0000000000400000-0x0000000000674000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_._cache_22174995a9896b9c8c0c8b1c22036900_NeikiAnalytics.exe

MD5 dc3a4ffda9bc7970803a7b5a0fa6a78e
SHA1 09f9aef7fac8c17ab6762746fdaf31f566b57277
SHA256 d9039fb6656b6d2a625ec73dcc88cac9c6641529ff55bedaca994cf0e0520fba
SHA512 253dff69d0aee508239992b819798d2e282f5cabf9200f9275d49221e7b272513eb841c5176ae7c4df785f6323902024842442b9f7315cea37cbe576d86239ee

memory/4968-201-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\svchost.com

MD5 223dd32576ace5da898257671c5cdf36
SHA1 87474af22e6a24ef24de43d2e798c87bd986514c
SHA256 8d4dbd3013a493f904e0863bb55d910bbb640ef3bdc6fcbaf3c78e95fbdd5254
SHA512 aaef06b777e4b015af8843b2955af6fbc4c6c7a0630729737a76464d9a443cf673b5b583ae7cf2ea2333f81bd083cf104bb4da9add41a5da48bc4eb1bf0dbdc7

C:\Windows\directx.sys

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/1236-218-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1956-221-0x0000000000400000-0x000000000041B000-memory.dmp

C:\odt\OFFICE~1.EXE

MD5 02c3d242fe142b0eabec69211b34bc55
SHA1 ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e
SHA256 2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842
SHA512 0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

C:\Windows\directx.sys

MD5 6b3bfceb3942a9508a2148acbee89007
SHA1 3622ac7466cc40f50515eb6fcdc15d1f34ad3be3
SHA256 e0a7bae2a9ac263cff5d725922e40272d8854278d901233a93a5267859c00a3c
SHA512 fa222bfcade636824af32124b45450c92b1abec7a33e6e647a9248eef5371c127d22ccb7cc5a096b4d5d52e2457f3841293a1b34304e8e5523549856ac02f224

memory/3428-260-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4964-267-0x0000000000400000-0x000000000073A000-memory.dmp

memory/416-270-0x0000000000400000-0x000000000041B000-memory.dmp

C:\ProgramData\Synaptics\RCX6C32.tmp

MD5 24c43a46e3ce028d3487a991e3b5f202
SHA1 3e47a2fbcfc35f7ee787e59f5e7f578d5cb54d69
SHA256 a4d6976ec3d988f43d3960623a8513de6cc46ca54af289a7e827982a0dee3a2e
SHA512 8e17d67efb54e679115b6b0265be3b15e1dc09bfd648c20a54f2712b6915095364febaedd1ca713b87c365c3861b6e3668d31190395b9ab18bf47fb0d862deba

memory/1476-265-0x0000000000400000-0x000000000073A000-memory.dmp

memory/1372-339-0x0000000000400000-0x0000000000674000-memory.dmp

C:\Windows\directx.sys

MD5 56abc40d1e45c091d8afddb90a4ce6b4
SHA1 08db549484467b32b79958700300cabefc659848
SHA256 a43fa861957415e3b0f25e2b54d931961cd309ff1d5354a9362852895b90b3e1
SHA512 51625c015a7c8fcf6fb51d3396aa08d2068772e3fcacaf32c409e82071af4ba1eb2ee94f36c06a98c32ba59d23bbaa6b540f7bd418a9472303cc225151daa698

memory/1012-347-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4296-366-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4340-400-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2252-403-0x0000000000400000-0x0000000000674000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE

MD5 748bbc1c938500f4b2d1390ebb8c5f7d
SHA1 40cb480c77be512da9399ff35b711a911735c94c
SHA256 4db2e2ce516c3a232f4a3d441b4785862e66ef0faaa2ae07c875abb3dc471945
SHA512 c02605af649054a160dab76bd7eeb058694944b65cab9122178fb7d37d008eb6a13a44a0c52d5729850c4d39e46c8c305ac3dfe66ecab05103dd37b42f248382

memory/2812-409-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~1.EXE

MD5 fdd26a04bda85ce1418b6cfe529d03d3
SHA1 fd72ff6c98b92cde0e1db73b4fcdb32807368c6d
SHA256 750fc3a9547af96b2d722f3ab8ad964521fc820732dbf4c74882d4cb5ce61ed3
SHA512 6f63fe6bc893ca346bc68ffe32cf1aae92df2c618a88e7086cf9d145c3deb591fdc7567290d9ebfd587fdb2385e74b8828785b2a2b2d1d58f0cc9d1a1e888b89

memory/2760-419-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/3784-429-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5012-430-0x0000000000400000-0x000000000041B000-memory.dmp

memory/772-447-0x0000000000400000-0x0000000000674000-memory.dmp

memory/1628-446-0x0000000000400000-0x0000000000674000-memory.dmp

memory/2652-445-0x0000000000400000-0x0000000000674000-memory.dmp

memory/4036-444-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1468-452-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4912-461-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2096-474-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3128-475-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 b42f2603883dadf133cee3ae5d767bb2
SHA1 dc4161551044405353e870b029afff27c8030e22
SHA256 998e1546bc98d29ffccb70e81ed00a01f3dbd3015e947d1aabca4cb01775ce28
SHA512 a4c33c9b87f84b4aba84ecf8b0b2d8a90703ef8523f1d057824196e584451072ab5bbc96e0c95a319baaffd16ba7a26f940fec2e28e9228e1275c87fb061c02d

memory/3380-476-0x0000000000400000-0x0000000000674000-memory.dmp

memory/2596-467-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/3452-482-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3540-483-0x0000000000400000-0x0000000000674000-memory.dmp

memory/1388-491-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2880-515-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2416-526-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4892-531-0x0000000000400000-0x0000000000674000-memory.dmp

memory/3476-533-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1804-534-0x0000000000400000-0x0000000000674000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\._cache__CACHE~3.EXE

MD5 8b52f470ebfb33a8b92925e917a04363
SHA1 645eed8ee4d665e964ce7d686e425e70e3815612
SHA256 14015f6d254f0e2d045ff23d3f7865b745f43335e5fd4dfcf658cf6d037e7e03
SHA512 3daca356c5bca113526c1ef249db7252cfe8978b18b6cfc419afa407e1e62a991df6dd6352eb098083675bd118e25072669fc58ee9438890b45c02d676b3077b

memory/1628-545-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3092-546-0x0000000000400000-0x000000000041B000-memory.dmp

memory/5052-553-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4640-554-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2412-561-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2092-562-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3456-564-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3984-563-0x0000000000400000-0x000000000041B000-memory.dmp

memory/764-571-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2820-572-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Windows\directx.sys

MD5 8e4bd9619c227ef2bc20a2cb2aa55e7b
SHA1 a6214b7678b83c4db74b210625b4812300df3a74
SHA256 84ba3f2b07e112efaff6ee034b84db960521db9e504a4ac77a5e8e5e988d86d9
SHA512 12a6a559b89441983e9aab70f0ea17dc790bc48c7938dd573c888e33811db8fb210539ebebaa6c8f5c04971d72d037be6603de15ea3a1ffc0f5ea3dd5132b4bf

memory/2168-579-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4212-580-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1312-585-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/2324-584-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/4220-587-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/4136-586-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/3984-581-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4984-583-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/3456-582-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3984-631-0x0000000000400000-0x000000000041B000-memory.dmp

memory/3456-632-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1312-640-0x0000000000400000-0x00000000005AD000-memory.dmp

memory/4220-642-0x0000000000400000-0x00000000004E7000-memory.dmp

memory/3984-692-0x0000000000400000-0x000000000041B000-memory.dmp