Malware Analysis Report

2024-09-23 07:02

Sample ID 240620-ln2r8s1apd
Target 51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe
SHA256 51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459

Threat Level: Known bad

The file 51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Renames multiple (16721) files with added filename extension

Renames multiple (10350) files with added filename extension

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 09:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 09:41

Reported

2024-06-20 09:44

Platform

win7-20240508-en

Max time kernel

142s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (10350) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02862_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Defender\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Baghdad C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00157_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_settings.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH02155_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ACCESS12.ACC C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Mail\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0282932.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB02229_.GIF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Sidebar\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00396_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\weather.css C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.Xml.xml C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CAMERA.WAV C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02051_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216588.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Seoul C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.ELM C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\VSTARemotingServer.tlb C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_en.dub C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\settings.js C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01563_.WMF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14595_.GIF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.INF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Nicosia C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\manifest.json C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143758.GIF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe"

Network

N/A

Files

memory/1232-0-0x0000000000120000-0x0000000000124000-memory.dmp

memory/1232-3-0x0000000000110000-0x0000000000115000-memory.dmp

memory/1232-2-0x00000000000E0000-0x00000000000E7000-memory.dmp

memory/1232-4-0x0000000000120000-0x0000000000124000-memory.dmp

memory/1232-6-0x0000000000FD0000-0x00000000010BE000-memory.dmp

memory/1232-13-0x0000000000110000-0x0000000000115000-memory.dmp

memory/1232-16-0x0000000000110000-0x0000000000115000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/1232-5417-0x000007FEF9230000-0x000007FEF963F000-memory.dmp

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF

MD5 24dbb267c5e97f8adab98feed83decc6
SHA1 7d7ad5fa5f93bf63ab7e8ac66d46de659f5a483e
SHA256 4a14073ec162e6a02ffc734ff0306589d5bee7cfa13369f880670560f28b56e8
SHA512 11f849556541942e4c037430f857e2ee642ba27748fc7b2c109b22d777e4de5b7c5cfaa41b490e4ec93883515a7d9a0d0bd77c5284c57f77440eff70c1b0bfb8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF

MD5 f5700512cb8d7a5d667424bf3aeb79d8
SHA1 bcc774b9664b5b61221d18dbb723610df2f7fe1f
SHA256 cee8e66989b52ba7c489728426d0b198521ef50c0389128283c86f30f8e25689
SHA512 0d9c291e0a1ae4602e8173c58631b355df607f49c3b0841553f07434d08cf2e66643cf3baa38900247065b797bc448f124fec0fbfadefa71605fa6c705063287

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF

MD5 f326a1a094255d95e9325d904dc228d5
SHA1 bfb0b25269513a4f26f5827021854c65089ee355
SHA256 e285ddc1ca5578ccfa20a9e649a2bf6f99c56215f841b4a2645b9c9226ccf9da
SHA512 f4bbdf61758da2f0479d603f4ad3843b49a659a96603734893fcaa5e3554942c169b59a8240a56d34bdcc37322483964bc7e82a7098b820e419b667749cae31a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF

MD5 a75b96061adc23f3511ffcaf3d0c3399
SHA1 f52357671986816da1635dd69beba7b1957d5cc9
SHA256 b101e0140cfc86b5b731272b9ffcfe19b47e4af9f381e692778491829e0305be
SHA512 d0241d0ddbf553bd570f3f9d7a8ecf0785416a894bf1b2cb861e4424ce8cadd084ea6b8d787a0e4310362ff3e9f576adf4f684fb1e640609d35c1c4f68367262

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF

MD5 55820b22c8cdb586593406748c575788
SHA1 e128687c98208dda8dbd2effa33e0e180c49d32a
SHA256 21c3b2a35deb27510cf9f2bf06e5cb9bfc3e7cd1475f2c8a614997cfa9386970
SHA512 7d9848140a319d61e8d865c9da3fc9d4232dd2a50d86070f980f0ed0743d2d561623ba361851197697c1a04083bfbb6cfd0798ba8947adf0ea8c07602b8c8b9c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21306_.GIF

MD5 2b50f694eb2dfa6eea03e6b31c09184c
SHA1 09ee08e3e955d1832aeeddd27fbe69e813f20e39
SHA256 d73c5187d20ffc4b22655fb0e3296509ccb82093f0d194e6148500a90cc41b1d
SHA512 4a418d8b3377555fd02734defe842785bac59a7619550b35ee7f0c1fa6e7b9334ec7ec0f3dab107520bf6d173837c340161368ec1c0267e95023edcf9d003af4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF

MD5 9e1d9f58d50e40b1acabaf958dc4b1d6
SHA1 6b39eec439c806c7c1be3f433622c2bcebe50e77
SHA256 da43dbe693235d56d07a903406c9d8745bf9cb5d0956d96cb1a794aee830a07e
SHA512 7b5c645a54fb1ab614a592c2b41d8c2e2dcc6042806a1615c0de39cad52d78dcc4a63460aa6e6bb8d45add4cd73251bad8c0fa0db75ef9323cee16d83eea1bfd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF

MD5 184e930ea553f1438aa6851ea34c6ea6
SHA1 c787557eb8883a277ee3ecfebe3f06ccd8835015
SHA256 31ff5d206c91d582e52bf064a6d90247e03db68a447ad1402599d779f193992f
SHA512 91ebd8b2df65f6614dd9b5a6de47c10839c2fd1f422959a777c27a002c99ed82fe5b720378ce4abbf934122233fda766b192b823c751b590350673585a472a81

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF

MD5 8cd375a37db0884ce9b9393fae4d8ff4
SHA1 0e042632da00cf79af656fb3504675edab3733db
SHA256 ad4d35b2a5a6574470d71ef27eea309878ce3d93b77db3ffa7df7d350888c30a
SHA512 20050b5cddc069282a8048ca1ba9660ad544b418b45413011ff8b89625c2091074dba9df1030181fee56f05747a19d99f7bdb497de8648ca79c7a9be995fac0b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF

MD5 399396721f0bf7c8eec73fa8fc167827
SHA1 2de03a66b6852f8fd7711ca940d364e68b979e22
SHA256 f72e8fe11d69c50363de3e3027c9f4543d0d3afd3cd2e57a1e35bcea3d13e24e
SHA512 84223967579d7417b254e834ff6d8af3f025b9cc69206d44b1b77293763792245c027e969f1ddb6ddccfbccf5b85ca274a763f2be097b891a954a0b0068bd951

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21333_.GIF

MD5 626ad98da140150474f708fde778b820
SHA1 fb29264dcdc857a8bf6cdd03a788e70cf7051fcd
SHA256 d2dc6a7fe627f74e51c11f23741c07e6a748df3bf4be987397de6157bf694ca8
SHA512 c6906882ecad2ac9c599e766b91f2b1fd475e1dc1311a275ceefed7aa55a172d3c966812dbc45fc6745debff2a60eaf712aa6daa4fdf3e1c4c741cab937a59f0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF

MD5 7f7d246ef41f987491ac413da1e4c9af
SHA1 f1a5c6f8431c249fe79d937969a4c7d8f55c5be8
SHA256 8f566846cf00be258035f65d0f2038f08d684d1e7d954474462ec97b07ab7a23
SHA512 b13f7c39e3db1878b71983cabbbb0437e54242948f2efa291829bdec4b540885b9d19c52c8eb4dee4f6b1c7d79f1afe32b501af3e6ed33b94f13b0644df8625f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21339_.GIF

MD5 0d9fc7354a2f471c608425ab4032e4b1
SHA1 6235a80d90e6160fab09d618ba5487a2760f3c24
SHA256 bcc4161f1f5960f49907d4127e2e10becb1fc0f12e0a81c3b42847a43339b110
SHA512 9a8320f0ea940f481053b03b456e35829dc10d2fd47497295b6ff7db7885ed1188a213b72b85b44461933d5b7240ffa2025724600f8d6991d348c7c12beac2da

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF

MD5 06d41652446a7555a8c322daef646ff0
SHA1 2f32a8bace1d588f123d682ad4b820fc9ec5bdb8
SHA256 e7717b40f85998d7e1cd1682fba9c6e565e375db37797a5355e40e33cf6e7dcd
SHA512 f1344621ca010b89ee96c20ddeea2aa26bd69e689fc118b23de49e10a39dcd23003bed421de1a38e441acab9d47105782ceb694902dbef5e77df720409baf3a3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF

MD5 2af9146c471cca18c221b7fe56769fc0
SHA1 2665fa13894c714ddc96e52a25e8c0a498b9930d
SHA256 de79e3da2581fca15b5ae72fab56976abc3c0898af68e07a77abe49399ced22c
SHA512 2eb74cdc1938d0a657a5fc3a02e7451f56651b82d54521132625879def0b2ee1040acc9a38146667869d07c817ecbd4f4ccca3bb58122ff29b767579465ad2fe

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF

MD5 deec3d5215a57cffa3e82f0d34ff9321
SHA1 29d080fe9f600e965a8a8fc026b955115c027a16
SHA256 414489c52ec55ee0eff814cc20b29beed0f2d5a076e627465a26d020d402d662
SHA512 25f6d99a2227d4e622b4b32e7b1189c37912df56e7bccd961261e0a339ac8bb59e9ea6e7615ad9f06781abb5837b066f7c99a0f5eee8c2f3de61769cb4173267

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21364_.GIF

MD5 30906026e94215def42f9297331367be
SHA1 fb6c41daaccbd4ecb98f1fd5a3326e894e330301
SHA256 170ee709cec3d6067abbfc625e5b1e8e378201440d3b0096c84f3d36c6686025
SHA512 5e74af25c58f880243bbdabd540dd749d93140df9a8c788d9d1a697345715bac1911e4b191faf03f878bf7d2769cde44adc9e4e45abb8c0460bb53d556e525d5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF

MD5 28e3e3a2da2dbd4562aa01349bc92ede
SHA1 c56bd085b1bfa2f6c2c273a44aa469ec4288f78f
SHA256 5527e96ca792fdc69e1502f673e5894b73c57744fb7f889af4b90579d209f483
SHA512 b81ed39f796a36470405bd694778997afb19c02cb67ca32deaaed994c69579bc741e4d1b8b8a2db1d75abba5e0b5ff882825e90aafa5d4f50f6be97b8c525651

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF

MD5 e3486e22b46eb1bd71bfcc063c08d2cc
SHA1 7edbfbfa0ea47a8ede0af7ab7370c4debbbc3468
SHA256 6af0122a8264f78280032f340d680a81f5ed24675140246a28907412fff6f9f3
SHA512 00d4f115a4ce38f34b225fa6a29bd9373259ee2d78232b01b57e30076a505e2e7cb2403703a2d6702c48f25b78dff74ac3961e1cfe9f84e312278a53fc4c8e6c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF

MD5 6610946e99586c52e17bae3fdbb48473
SHA1 8f591a491f72fe34f92be06de49638d6aca45343
SHA256 0db3611d15bf660e9665e637a0d55ea7a46bbef56055a4af1abe1c4e2bab15fd
SHA512 e93e76546bafe929b81883f0f542f17feda343c916377f0487a5df3384f7abc8d437389b0484604fdb260514b4a5ed24817f3b27d3feb01311db84c008b32529

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF

MD5 bcdba67710c1bd173b92ff33494096d4
SHA1 4d75a120ed09a66976859c6a609076b4171736b5
SHA256 41dc56e2bebbeba4826d49b92bc7f305f0e62352b286e124796d7506f891d818
SHA512 985001c7bcfe284315d6e81d32ec093848701109694fcd0ce675754bc0223bdeab4591964666675194cd5d48572cfb389c8945ce12a622084469a6994b5e1bfa

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF

MD5 23a935862169773cdd61416e2cfd5cad
SHA1 702ad7ce9c17143fdb8174d37795003df993acc8
SHA256 3af06921a2d5a541eee9a9a6dffb863db5e5a84f949ec9b3c3ded8bf550c90a7
SHA512 e589b63fda749751bd6ecbd101dd0b6196a9e8ae6b358f37faee9522751d9d3e20a561bbb16fb012948529b4d2417ebf429257258c2d50ef8540fb8f0210d555

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF

MD5 b642e698d433bf432eec50ab3f84ffc7
SHA1 c334a3f8253c85afe4feae72f6a217fbcaeb0fbe
SHA256 9d12bbecadb219a9f5012122682f536447f0d67051b86bcc71f9c5dbe59869a0
SHA512 8f158514bb9360f08290e635a527fde37de5aa51fb002956760f1133870ae80fd1646d568238dcb7dff7a4fb0802adb642a175993b55dc29e8a1b64ef26fcb41

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF

MD5 0b07eb044a2b5f01ca2e45b64e7fe172
SHA1 1b0a8cb56f1fa845ad803112cfc755fe484f7116
SHA256 03b1abd8db490db8d2d47a0079aa1c70dc85931eafb2b4a14f4acdd2ccabdd12
SHA512 11977da14dea413b9b7def4bdad1ce3370707736240cd2cc2d137a39f14a5fcf4371c3deea888b014937a80196113f32443e28065e1cb22a4018936383008141

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF

MD5 9036a1b70f661adf7db152ca337f1392
SHA1 4a7dbf42ddd5ad7947b6bbe2be6e09152571a60d
SHA256 2c5ae64603d525d478697b377a9d94b4c48a91070bfead31ce83bcb061ef0967
SHA512 4e2abd4d90db6748f4964429991dc686a472b4636b650bc992ca86c5193b3af3e444774431348310229d2b786409fe6a1d5e1e0adf10df81931db84f66a20e71

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF

MD5 babf28be2ee7d24b42b03beda7f10e54
SHA1 92be00082589c3dad9ddc3d41da865e92eea82d9
SHA256 2a4afe0b1badb883fe675cb322ecfa38562de46ce9f1c5a0977a4fcc0cf7a288
SHA512 5996eea9dedc01a013fa184435196d1d9fd8618b36f235a8372ec969699f57549dce1cf0cf8bb9625afe3026c07ca0d5d4c45b0a0cbd34bc060009015c977ff5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF

MD5 e108c43a9664a9755f66512503258191
SHA1 ddce09a92b34b6605dfac709c097ec23274225e0
SHA256 0344448fb0dac27f8ed14cfe8f613a9d288d91549411b1a1c6ddc1816004aa89
SHA512 5c4a9cb2fd56f0efd4c7dfa5a7c9046a7224e9069be0d8b753c48d8998db5afa32871270acc54e60dab8b8c86492ee27d804dd5a2487162011b70b4d4f9f1681

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF

MD5 0f3e8b860e6f08559a9566929532c0f4
SHA1 ba2461b8110fcaf23ad6c4a71f4abcb6171f6dfe
SHA256 31ae8161e14621bb75e6b33f66d3e9a43f7a508d53c9d9578112d0e67d2480c8
SHA512 047a9ce1d666cfa0276c8dced547ccaf6da6db04ead7b7c8a9f097f74ed83d285d6f64d8c8a9e04be3e4c4875b7d6b1c164f587f89e4149fbf0396bccb912289

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF

MD5 d17b73940906c4bbee10c0a48ab0f247
SHA1 9bc7b21d1a4b7fd4ef5ad8a18d2f21a3650a0f04
SHA256 b48185f983d0e9b2537356dda22d2567b165ec79eec71c4708fa6063c3280e75
SHA512 0e0d9f35b7d037d2ef69e79ef02e2408f97d29f460a3f834b0d7f90fd3ae7d53ff7aa872b48931143c419232602973918bd6ee7ec2265d7769cef8155f8e5aa4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF

MD5 ec6831f658b2262678b7fcb8781d9419
SHA1 6ecb819ecc9e5628e11cc5d468c0de1f9e7cb504
SHA256 5fff2b5f44eecea3e089ddbb5a4cfbb410cd464826195e4dab7a378dc476e05b
SHA512 dd16c2cee987e4cc93b34aac12243e575f1fd9e0f3756d4c97a54933400d711007871ce24fcb2e7e1c3ace6ad5ff02587a51c544c2ca8cafa8ab4d1f75b5ca65

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF

MD5 640e07cc33309c2ff3c40b84c99107cd
SHA1 d4a83f38526998648b7df74ea35520e309fd862e
SHA256 1c7f7ec9fe8fc940a2a197fdea3b4a74a09ba155022a60bbbd46537d9f910d69
SHA512 b0a743a772e4eaa0762d8a9b9419f8efaf6a31586e11e455133afdde64484c73960b6b395f23449bf8484ad29a06ab502b6fb6a8d8fbc43d77b0be3e103bd4cd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF

MD5 820cd549b141e91e6d83659a35025373
SHA1 d10761db90a0e1cce49e7671e1ed09f4a8ce0a71
SHA256 4e686e2a3ba69b8235a0ffef9b1e7f3ee2804dc433e3d26fa14c7f9dbe17d45b
SHA512 a1f82442acfe1a35477c0c693368c11f3a82e7efa5652316f0e627b23a1d490c9d1652113662eedeb8afc1bb3b7f4fbe6036f4647da7c959e081afcb4d5fa50b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF

MD5 9bad24b75c81e29c45e2c42172cc6eed
SHA1 d03efbcf63f1d5039960dba99bd773d6eaf94520
SHA256 d5cba4a55d28274c669a2d6fbc9f9bdda20501593643e296eef45f8f53125bc4
SHA512 f1072ad75375dec2f198e193ad2315d9e13e37268c44abf8dae8f738670973a1927afe961a28fc089a72db73158737dea9c3d42f10306100aff5dfc0c4343e0c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF

MD5 fca102d1deb7b8db8ef53d947d5a9a79
SHA1 03d0139d1bc314477dfbc726ef2ec1713c767c90
SHA256 b13448cd846243431cc1415204c25a248e98635bc72e898b1c7470ca8f148781
SHA512 af7f1483f12f6ab938c6af2a522fd9cae35357cef9725b497a709369695d6c4d8a735bd6b43e2b3d5fbd8ce8ef48e6107242e317d16c1a09b94c3903d40b0a58

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 9b72493ef5a803381c615751d2017deb
SHA1 485a4afe882575a58dbacce9afe1f8d05f7b5217
SHA256 60e32c7805e9059413df9fa32480fe33dfb5c1c300c6eabfc063ce2749ef87a1
SHA512 6a5b78b23d44a0c3b20144b89d310696e75aa8115f2baee196ece91ccad72affc75acd4f4fb99ed4cd5d437b7f5f6200dd83bcd23cb1919a0d5b38ec7c27955d

C:\Program Files\7-Zip\7z.exe

MD5 6fcd20be011ec5c687dca967acb51b9d
SHA1 566037528108ac413c9ceab5b390697f0f4372d8
SHA256 5600f51f12405f8b271534a1c98daee959583d4854fbef45f09cf815ab238550
SHA512 7111a709eb9467a8ea920b18c5961c80bccb97b438a1aa7381fd6f1cad3889a971ba403df26408c823461dc8f30f9b78a712e2f51c652b92c210dffdad2d04d9

C:\Program Files\7-Zip\7zFM.exe

MD5 153c6185d1a7f81e48c575716f5125d8
SHA1 a65ef4aec1bd7bafe1655c4332d369326fc5c07a
SHA256 d8202e960455b46f2769296caabc53447b803374f62781e93b5f427ad2f6e9ff
SHA512 6e2247976f99e297e490ffbeea6ba21ed3eece6b72a5414e02517a5ea3473d5ddd174112fe8109dc268df25808b7808a6b4ff6b5d74c131fadfe245e0b3e9a11

C:\Program Files\7-Zip\7zG.exe

MD5 af08af2fe3925bb6b42eea05c541115d
SHA1 9474d67ac4b0a9d7a27b57c217fec1572fc328f2
SHA256 8a942bb5719fc5a8d639c7835b2c6e698f22784a1a004b15e24a17e23fe2e66e
SHA512 c8755f01b7dd50ae069c392ec55f9c8aa4afe514408c5b1e353e263d542e4fe07426212a7bcffb9a4df52cd5ceebb9296ae5719ddd761872db44aef6555e1a75

C:\Program Files\Java\jre7\bin\java.exe

MD5 4beae608367fe3f6e35d1ef0622b2048
SHA1 d3bc9bb65d4533eb791f7f9478222c4301bb2ef2
SHA256 1f00cd6e1b15ac54faa9ce426cee3796f9dc15ca11aba26ff136e3a6d3895719
SHA512 ad5b2a3baf2c392a03cc1121a07f2d58d54bf3d6833479e37638df10d94926779ce9ef4911801a799fcef5f894b66af8790e1264f083a3beca48282a971fefbd

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 1331181f2a23700d2904b3ce0d322312
SHA1 ca33eb6a3841d268f86023c30753b31668f28245
SHA256 f6b1c5970fb4640f95b97eda7977588d39c20f9e908622777bb9924e96e3576f
SHA512 4aef0637580a7ccaff7805f2fe6d38a2f941adaf567b2a387a248cda82905adb07177814c3142934b25482a678f4d4bb07642a11678e04a917dcc7ab9abaa061

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 966d81838a6344334561376861fcafcd
SHA1 5d1044e16121e9783c1bd2947479ef0cd7ec53a8
SHA256 8b9d6a08bced4159561ecb8fbf6affc9c4998e7222c9a42d40e4454152d6d2aa
SHA512 c9be21b1b50963a04a432839f631880a3f4c984c7ac10d257088e2ba24d4d35c6dcb7e79013265a2138cecafaa6a60b134adee3dea0ed340e21f2ae9cece91b9

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 9f31d12c96669333fe91e120ddff343f
SHA1 8d54b3cc9020554fe5008edf1a81c2fa041346c9
SHA256 6dac25d6ea900ac346cfcc72d0d7299795998f0e820973cd20b61405527c706c
SHA512 7c8a9dc46d6f2de2b397f847758b8173072408920086aa98538ab8673de95b1c5d6c6ff19e81ebe919cf223348cfc1c172430aca1e9925974d3fc997c92d54f9

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 b5ea1125529c32b03e2e3cc20af1f653
SHA1 151926169cb4896ace887b53eb8d2be5228fd69d
SHA256 0b39be70fdd7ee9d601ef63be2b3a78c85461f46ed92d18c3ca8f4223cbbdbe1
SHA512 77148d76cac37b9308d03907f1afee4a9c268c2c5553f35c21367ea937ac058e27ef5afd8f82a64ec8b5e1de05552594b8b4a5512a55ba95d8bcd25c20d67f42

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

MD5 a20f3b45c0c5844596752779a69e5bd8
SHA1 87fd6152ace76aaa68a3e1a5f61c07208357dc41
SHA256 c455469be3e32927b9e9aeaf61fea5f6012c175d3f9bc22b988f03f2c249e0ae
SHA512 73a85cd652be5c734a4affec9132ab3119f23c589261f3883c9b24397b5156ac8c3aa584108a2f251e01e16d8313622b25780d6908541dc34569415dec5b2b02

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

MD5 e9cc3c1376b93cc03a6f86ea2bdb5234
SHA1 1c892934eff6ec00343295f15540d86b6bcf7d28
SHA256 a8693516f699377ca3401c7361a00c424090cd6e887c69203b1c23005684eb33
SHA512 26ebafbdd709553414e19c628a66457bb94c37404d9c5b7844fc6c50c372d121f2abb7810af9c6bc596943bd8ab680cfe40ee6971336dc9fee9411544e4d4ef7

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

MD5 2f65408612c094f39b625eb61e8f8657
SHA1 63a7ccc6819fd5097a62e407ebc73b34c5a7489a
SHA256 d76efb7c38e134ae26abebfc4699003f58a218614e2578309ff1ed15ec14a9ec
SHA512 033f1c3f89054def6f66ab071b832740491428175ad9fc9aea37f860ac62c0bb277a5baf853b5a80f3ec21a4d4516579acb8c49ab8603dfbc16e5ab79386e849

C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

MD5 823932ee0abe8d7c51b716c6d1b9ffab
SHA1 c1510dab944424774dd5293a6fa748d532e99484
SHA256 23b1b333717b89f0cd4ec711f53d0b7311f2fa39e536ac48e589a6306fe199b3
SHA512 309ce76b37ebe8ca27c7d61550e81453b24db9f46c5fd7501ab51ca3a9e9cf54fe0e37aa9e34fdfcc411c7f74fae2ae708f1d0c7fea761ac3a1d689a778399c7

C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

MD5 7e376aaa45a841d2ab6fb4b0d4fe5163
SHA1 414df78794eda84cf9a5b1b744613a2e6e76c511
SHA256 d965b9e4f0bc4f799778a240b520923cce15719e07792b5b141b2a4010be95ac
SHA512 9a37b5ee1c5e983d05c2bfbb5f2f9835b7a62618ac1623e66b0dd12e206a85b34260eb7e0cb4837a0e3ffc5d9fa1d278f30e57a79f04aacdbde9c396762bbbb3

C:\Program Files\Microsoft Games\Hearts\Hearts.exe

MD5 9f503e29556fa5a53ef5705a7c80a04c
SHA1 ec3499aca45ae71186f6ea913515ddcf0bc39c67
SHA256 01b2c05ab331cdef8e0c909638775c66f5176f26a385b8c83fe202443030ed44
SHA512 6152db14e95a8791724f1f898dcfe717a2dabc29866dfb057a8af0f999dbcfd39e8796c9189386f8fa01a76f4b8cb3aec05faf65f6b8af288aa1e82052a92dcb

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

MD5 ec77f3ee552fc3aff60ef3a0204fc4c5
SHA1 f61c198ecdf880d6ccd0cd2cbfbe350c78b98d4f
SHA256 eeec16a93987593392a4a6609d5b670958cf0ad89e53779b8fa03b506c406b0c
SHA512 6123203d9ef9a7224729a70b2a90ae745385ad4987687e5d93655aa082921bd90c1bec190c5ccd9198986db84d83ff283041473767aafd13c9bc9050ebd64a73

C:\Program Files\Microsoft Games\Chess\Chess.exe

MD5 9b736092aeba58af70f2e6390def4c61
SHA1 8673571558d68b7499d6147a3e8faa56c53e8d8e
SHA256 a446e48a2b08ef5e8f0bc748ea21e767ce7017389f209da8bb8fcc6e4347c658
SHA512 d585e84eda16b66382e4def8751f94659cad7ba4d0171bf8ffd79ed8452d4088d561526bc67cd1f487dba35cefba21f7af0427956295324774394c261b5b4dbb

C:\Program Files\Java\jre7\bin\unpack200.exe

MD5 3db8c2c2c0191506fbe43394cdcfc7cd
SHA1 e82356d3016749e5140bf1c93e509e0d2622bc83
SHA256 cfbef95c09543ef8d950c998e4071ed37e5e9f81295bba608f6c14bd1a59460d
SHA512 0fc875ce2f03b62850e227f5edc559afb11d304d96223bd4e295e9095368c754327893d4606462c1fe2c05b84268e17acf4d5130816e97cf6d687270684b025f

C:\Program Files\Java\jre7\bin\ssvagent.exe

MD5 91ad046d6eba22db21ec0b2245b73a47
SHA1 3644e545f4b74263332150e66e4ff5447e0f0a1b
SHA256 90f381c3a8b938abe71f9f50f665fa66d24eb0b6f281fff154e4094a3814af2b
SHA512 42c78aef856d659ef3945688ec6aa565d991fe31465d7b2c06226460dd8fa42c45fafdfb4f9bd7a81949709f5de02d2cc0d0f1f3cc2b3911b45752f99022f41f

C:\Program Files\Java\jre7\bin\jp2launcher.exe

MD5 46ccbb3dd1f98ea770c286aa1a2094fc
SHA1 17be263c39c416bb15d4d41c8ab2f4f546db5a48
SHA256 d5e254efa7ea5c30cb588c92f4036411774f4e97487395ad65a8a1e6567a3f58
SHA512 044cd6c8bcdc80012ea7b2376e5ca8833271a9667a2ef57c4060db3e73ac844ae22fce7e22246b7b7a3333a6fab532a1072172001e6ce040df7b7a88a8b6d0f8

C:\Program Files\Java\jre7\bin\javaws.exe

MD5 81df0c79949aab09054bba6a6b4875e8
SHA1 09cc5b88fa76cdfc1485964322cb2bf04ade0515
SHA256 4534f7c0206110324a16a87f1071cafcc9c2d4c0c55fbadeb65d77d0aa573f64
SHA512 69e66eee550271a6525e99d2cc204cd99c20263f188ee9810f75ecf2a46e88860e9a14e1e44f1cccafbeced5275752927f7379c535e9904e7dc66f0d81289af2

C:\Program Files\Java\jre7\bin\javaw.exe

MD5 806f81c30ae5d1666229347ed2d38f31
SHA1 69c6d48fb7d1c96819e7020f3edb950ce3750be4
SHA256 b947362ef5c379d6ab80061b2972d356e2a791b808bc64fa166c5041a8f38e71
SHA512 ce84d28d0c541576ae18e182f262657ec30a86b2cab2deda68356f394d49d64a4bd25bebbf6d8c54c03ec635c423fe295c75ee59f12724a6528c5660d38fae50

C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

MD5 68a77bce292c2a138381f495d60e8939
SHA1 002a88f81f2600180163acd6fbe4dcded5be4761
SHA256 9c23df001a1c345fa1a551ff78a4108550342de8f3818acf9ac32591ff1084b2
SHA512 00316cea2bdff7e3990a81fbbdc168bde0f5e501a4a04b4287cb5dace3119ac70a0f5f4e8962e65533a56a79571e47d21a41d237cda43adf299c50c91787a260

C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

MD5 c71739d97325293459e9ed73cbe2ad0d
SHA1 8fc89a5dbf1981a1f3bada1261ba95f69c6054e4
SHA256 3062cff315ef7a9a0c28b4ad3ec4c33215997441c111cfc0052087da3d12be3c
SHA512 14b23394374295e31d3b70b33eace844d52ea2bab27ba4af67de8222bbcc8301b4ba4fe7c443bc3cf0b1565ee0f6295e22ac692cd7582f7ecd673f26c6c7d5ca

C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

MD5 f1df33b3a32dcdbae493ed80bd51569d
SHA1 10437fc02436b6479e6be4b21c528b43dc561717
SHA256 7aa4946e8db0b83ccd1e7dc98954356078884833c5dbf7488b67f120b162acfb
SHA512 52963b69d0e88c1a72028b0adc2e27a61c365c2f4a1c32b01fb01fa8088cfbaecd41a8519fcf2ade753d552aeabddd78df4ee4f92100cafa7f4c215287858e6c

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

MD5 10059ff7020468a9c297c184d65d4cb8
SHA1 deb75d0587dbe045465aabae323700b7ca240a19
SHA256 3a4718c5ef253d47ba5ec857cac8e99fd82fd8222340847a2aea221f51eb1fe1
SHA512 a7683831e137e304a03b7efef1bc282c4ab897393241c95bbd298b5a9b3065b0c914b5341bb04b3cbf58b9446e5fe3a8c223689c6f5b7fbdf43c8a70b9926266

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

MD5 77381d9ee42d70c0d1c5ea3b2b72536c
SHA1 93aa33ac812648f90260476bcb240624338540bf
SHA256 1788f9c7216f8f9dae226a5f40da65fbcc568ad499710587c42a34d779a4ea36
SHA512 a8b4fedd10eb6002c1fa6e37e27672da003ce7c12952876e29e62cc4de2dd46f9c540699101700caf4cb6d34c81a3a5df02e2c1920dbfddb6f73cfb05501e9ea

C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

MD5 9c673f9ece0b854182bed2d77537358d
SHA1 7efcc009dd6150068ee877e3a72aea4a54505194
SHA256 0cbf0bf85d2b64cd99510413d9d22b6f6f58feab3b6032b44020de748480f4d0
SHA512 d6db583d2cb27091964cc8055b697c3a22d1711711b0a694b823ea1a326f9624d9acc8dbd3ee9a7f6b74ae5272682d5d51e8c6b69984eb4ec43cf48ff8739d0e

C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

MD5 f13e66764082c624042036bb2f5401ec
SHA1 7226e758fef19e5f7b611f7885eeef8a25de811c
SHA256 c173858ec4b206d514b395bdc7aa745f57a456a1ecfb18e4940f2c08d1819a3e
SHA512 725e4e4e779eb24e8be2711ecfff7b21c9d0fa351934fa90476e6d79502f531e40a7e079306d0b378e1992b0843be8619d983497eee44554398ff1a5f0fcdc0c

C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

MD5 518e24e4e7172835d0a1291cfc8db71a
SHA1 c40e40b2c4bf1c075daabbdf0906232d45749def
SHA256 8c77e322dbcf8909f9cc671136fe683837cfb111c5f522840561e5f055b0cf5b
SHA512 9c3552415f013788dd55809a03a25dd3f73997fc901c50211698ad7e536e6d87047f82149cd003d9b869aedff8f2647ba0593bfe7109150dbb498440e080dde1

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

MD5 5c13549eac84b8de26213f8369f78e82
SHA1 05ad876ac36679b88d64910f734d609ab08e0444
SHA256 61b2b13eb3dae42620b65eb4fb8a6129eab857fad9ca7b736a84a487523aa1c6
SHA512 e8442c5f66bc1ec2f7409fd515029261c990698caf0e5acda94c9e8ab540189018c860c777341e440b2132c80521b7943b0be3283a7c2f987f0209f36036566a

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 6903be17c962cf819696d23e95ff0d4b
SHA1 58da193989d2131a7d9a1d0d44a6cf97a8a0883e
SHA256 3a4781fdd77f8efb5100f1312379cfd78e843ba1c759b428fc15d7e9d68500d0
SHA512 740f0d2e1e1cd15e51797eae31cf5816d44bdfd0dd72bdb77afad7a8cb9404a127620a5736327ab9fc9a85edf0df0c38f81801365b755dad32fc60ed3fa50330

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 f24c6dc69e15219453b01c08ecfb8b10
SHA1 b9540dd2f70cddc54acac1080b275766558408f1
SHA256 756cc31a26f8e9b0c9307ae0a8820e02735ec76546782d0df8f2b1aa9b25f2ed
SHA512 4fdae029ad2a6f597d52ee1b160e906178dd9554253b2ae8a2a45296356d1ea3b5fc97be869db294dac6676a900d88e5e355e54d3d36cf30a6685cbbc7d73af4

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 1a3dfef310138018caf4934b79baca88
SHA1 2488cc6c981a4c9b633f3161e6607ae3ebe36197
SHA256 22d2f602799933bbfdbccfce241670b728fc571094aed0c5fec86b53f76673cd
SHA512 3bb14af7bcaf3095350ba692476b97543d5b2263765e9f4caf46f0c14357eec5ccf1b1b2dce5032cf6b7c8f5aa3352191e96e8402f87ec1617178f073826c08d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 afcf1d88a5f80fbbf7d2904f01289495
SHA1 9c47eace498f6fa5dd62a6a33b4ca2488dddcff0
SHA256 2ee08f44f188ff7ebcc9c2b52d22fc8f5cce15b88726ffb308c15e14d74c563e
SHA512 1e0c4e20bd37e281973c611e32d99022295074e76283d6b8292adb236c6ff085f39c2af0667dd257243f8c6f679787a6039f6bb1243500ebbd9d7f395925bcb9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 d29fb03cbfd8bcd88b358f44cc9a64d9
SHA1 a8e13dd9fd021c4c9aa5de9b13758acb2c18e84c
SHA256 a87f80005099a8c81d511405a0e5c244871139feb206ab76c21fb248999040b8
SHA512 af70d104c038a0f0dcdf8495c778b98262b231fbca6f1f3c13458bfdf4bcee192d861c4f17ad2428c396f068c17937b2ee9402cd6bd0788b9a7fd19fa131c3a5

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 58f80eca6b97d2cf06a4042a19ea2d63
SHA1 16e115c71517b69deb339af415e1324c8ad38528
SHA256 12740c11c978fb78c56831bf940aa4dad083727f63b6d80062ab0123160e6a49
SHA512 eaddc77a0885258a96d08287dbc180c3231918813645ddf19e08c826ba1027a060c7f61387611a99beb77209b22dadb9f155a7281c1fc4bf28894ea1606cd605

C:\Program Files\Mozilla Firefox\updater.exe

MD5 44dcbbf73f5f165f2bdca0ad8c1c90ed
SHA1 e6a19d60eb6edbea82cd7b4255ef3d922e9a3195
SHA256 5fae85b4932179e7c5861deffe150ab86b110a4710ad29609d9c84c59b6abe42
SHA512 ebb8cd87196b08e1e21488c1b58a4d326e2aa03cd9fc8ba7da13362908315a28c9c40952250c44fd50d71c016f0a28f17859b7df8c0ce4ad6adf9b4f11fe79d4

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 e519b3f7afab7aef243c63d80a3d2312
SHA1 84aea77324f16e840fc19f0a0fd915e8f15c13ad
SHA256 02e5c0bd8677dfd66d25cc499fa1afd50dd36e1f49072583ac21a588a4d9c105
SHA512 11114f874b43c88ec77705474b7f992fa7e987359ef242c45ccdff0f7995f905a9b108e5fed4879ed983149c3725cd0e41312e5c8449012d7e2dc42a50b0914b

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 349944b707d23611892e55c315b96a63
SHA1 81dc26e9b2c3bbeabbf8c556fb7b3b095312859e
SHA256 17e635f7605ee623448e4badb4a4f5b83b0c555bc5b965a6228d3c1ef1009243
SHA512 c0bb123bf3cc34aae450ea58619ac8cd23b7b39f1841f888c65bbec7174774b362e228829fb8ceebcbdb32879013e7efac8227ad8240015342b57ab1670a5a81

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 fe4be420008711eb72786707416c54ef
SHA1 a572d86a577e46b8f4cef545fb222813a580fa25
SHA256 105b0d37036e6e08c13f7c0f60cd25c9b3b5409d51bc5f7591bad5a4d647f0c3
SHA512 f101423b74a97987c81830344856b6ad3926379ba5574053744f0fb1e0ec268e8ed4333fffb65129f266e66f089aed2303159bf32ffd9f126201d3b344561f32

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 1a41ed6cc66c6e341c0a701cab646bcf
SHA1 edcc9ccffba9a81e3fb236d0d994b51e1f0508dd
SHA256 1268bcc7500cb7abd3afcf0ee3d1754ec4be8ca8e92fcecb5aa594839ba81768
SHA512 8c1ce786509b0272853a8726a8e6e94ca5f352ea705314d90a3c933dba9cb61948d3a3ae7ea4a401abb6684ced7c76fe3d6cd3233d9b47f80ed386ea02c68d18

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a53543daff57b9be88b28dcd8012575a
SHA1 b34aa9041d42a02213dfa8b796c742818e1a71a5
SHA256 6fc7c635e4c3c0f13566c5bbd86f7d2421f6ffd2a8430739f524f4d3b45b3d4e
SHA512 db137b1b5adafe11605dc99b325fd625fe49eef6bc2285e12fd2c7b5b43e41fc04b4e0944fe35d9adac5cf49664b321c4ffb2242d77d479a39e451041823afe9

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 09:41

Reported

2024-06-20 09:44

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (16721) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\5px.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ShareLogo_15px.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-16_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-24_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\MSFT_PackageManagementSource.schema.mfl C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\WinMetadata\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ko-kr\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ko.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Sybase.xsl C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-150.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_forward_18.svg C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\156.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Sunset.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-140.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.INF C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-96_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\VungleSDK.winmd C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVRAni.ttf C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\GlobalMock-A.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ja-jp\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinOnboardingCommands.xml C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1949_24x24x32.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\iheart-radio.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.AdomdClient\13.0.0.0__89845DCD8080CC91\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\es-419_get.svg C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\variant.js C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Fonts\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileWord32x32.png C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\51685da80c82c17769a8875ed72ceba8023feb8cba099162b39437e4a0ebc459_NeikiAnalytics.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 97.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 89.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

memory/4848-3-0x00000184CFC30000-0x00000184CFC35000-memory.dmp

memory/4848-4-0x00000184CFC30000-0x00000184CFC35000-memory.dmp

memory/4848-11-0x00000184CFC30000-0x00000184CFC35000-memory.dmp

memory/4848-10-0x00000184CFC40000-0x00000184CFC44000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/4848-9-0x00000184CFC00000-0x00000184CFC07000-memory.dmp

memory/4848-2-0x00000000002F0000-0x00000000003DE000-memory.dmp

memory/4848-0-0x00000184CFC40000-0x00000184CFC44000-memory.dmp

C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe

MD5 92a521da972ad0994e14330c01b881cd
SHA1 4f1f64b7c40f4337c7637d7a40b02fd4615acb22
SHA256 79d11955ab4ef8db474061fdf472f4397ee0f3a9042acfb69c6978c454d4a8a8
SHA512 9cd377f0bfea6e7cac9de45a392ad61390804e173f55d834dd814b136bb2445f15c33838edacc76a3185bcec048aee05b90f816fc46db980aaffda713979bfa1

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaws.exe

MD5 47946217ea22caba374a6c9c07921e63
SHA1 41b99d52332337b982a32b797a1daf8487e954af
SHA256 5060a5511579619ee09ab1f55fccc7f7381ee98314766f5900e8820c2f1de838
SHA512 01c3698bc29835b2457a27f76cdff854d6aa9c876df072f83551d9afb2aeb7a3ae176d843ff01d4776a1c03403dd264493dfda0d81db5eeee36c06b0ae921828

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\java.exe

MD5 12d0c5bdbd29f02d970fe98696521b20
SHA1 4742bcc3674b97dc0cfcd13f199d11e72e37d562
SHA256 08e7fea766175613ef181927b3b4e1d4c54105a41edd11ab598359ffb97f9be9
SHA512 bbecccbe9dcaca9ff0475a3aeacc14159a20d75a9529fc19bcd6ded06df02a3ee02ec1ec815bc0cc8b480e07df655340e62a9e3a7c05d40d9ab87267246cb53a

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_99718\javaw.exe

MD5 af798c99a41d33586698a1a1d76d2a69
SHA1 ce7bfad52112581e4b4c37f7fbc0ae80e2733a4c
SHA256 efb0bda02a93cf1922a93437d4484dcc6c9da8034ae431ed8c6b6f6db1174550
SHA512 8ecbb9d7f00f5a2aab66b0f8d0bd293498fae1d1f9b20cbf7c09dab70fb9a6521b4e0e7f5af95c79c0dc93e2051246ff901a27b22e4906c76b851032bca9d461

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg

MD5 69df6f1d18fd1d0f715b41a49087b024
SHA1 55df7f13e27f5be4f97b1c8b1ce315e5625951f7
SHA256 6d69980960c57ef48b23a67089e8c22f2c688980257831308dfc2ff430509a72
SHA512 5691a94b53bbc2fcb7cdb2bf6cc8c3ad63d3035d8587dfdd163f2d815d65014df73a4004d604d47e5b6cd95bc0f552791209cc94f8f61c43fd7b5875d5727433

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 8aea38db85f96f1d367ac1c86093670f
SHA1 6743440db1f3bf9db70f05447334806a4168c4e3
SHA256 ccc59b9bc0625e9d23884bb88745212fa8ad88d46fc2b15b2cfdc312e06cbac7
SHA512 32a01af33f75f6ce4db394818e103cd763be6c86a998d66194db75e8fbc8a07d45e4fd141de96fb53d6db4eede9b3ed375ce6689f1bae6648f93bc0f87d5e676

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 bcfcfe1cf0ff187b561cca089df9368f
SHA1 2acc58f687895be96090d094b5bb7b8d601aee53
SHA256 20a2cd328bd8070dd788e97ef62eb489c597a1f09bbcfbfefbf386442939d0b3
SHA512 185042830a8953a14e1b7d6bed82466a47442283edccbeed62d1d16fff6afd5c9bbbf283d5a5617b70b2d34ba97d3211e077f0927de7b03dca3a2cca869d5f99

C:\Program Files\dotnet\dotnet.exe

MD5 bb46dff57f4bcd1b6b5c8652eae759b9
SHA1 fdb06a7a968883a0f1b4513624e609795c12b341
SHA256 0412df2375f91f11b76e39adfc849382452046eb3b85f58948087e400aa81d80
SHA512 96bfa2e4a32cd9d8995aaf979dfa3cfbfd377fd7d9a65e44570c7865ebcf68632c236c50c4755dd3d838552369eed74f3bcfb7581c181e22c23fb27e2050e0fa

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 acf35f3277bc218ac199bbb5c48a2926
SHA1 a92243617bdd1f365b93263ab0ddab17e9b4ba97
SHA256 a69ad7f0b286c6b565322eeba7bdf3055b77e8afd015db2e944d0cf16b78f2ab
SHA512 379f286405e0db42929cc67f80d43c8b38ed24415db995a2f1cc33c6a33a0634b05d07d8f543fdc03291bb6c33d6ab93325baf372384378d14c6ad9574a48056

C:\Program Files\7-Zip\7zG.exe

MD5 a1889c8e0eb9aa5b4d9054327884a17f
SHA1 5d9b2d6eb1e324f3105d3344817ce35a146e6736
SHA256 3fef59187f3a82a3496ee4a1394200a7cfcf9a0d18408061dc45d7a474facd45
SHA512 9cc798429298644e91048c03565cd4d633cda77050103524dfd12fcb79ab841492df8ef97aaf7d727c878c20a80d279b9074cb00750224f7772b19892274e70a

C:\Program Files\7-Zip\7zFM.exe

MD5 67ae8bab2a9ce7348efc25be2efdd040
SHA1 ef26eccb924c5d6b8b97019edf39fb63b30e10da
SHA256 a52ff632ce33ad89868996fdd4c0a64f4fa9beba3e7c3a0cc89572118083d3a0
SHA512 702f51b7a320b78815ece19cc11888a5e22b199c58719ffda1b519a6239e5afef6931fbf21a09a37fa2b2a419dc91f58b99efbeb2360a9a404b140045d00277d

C:\Program Files\7-Zip\7z.exe

MD5 470591b0c21457a7bae2ea85e81f2813
SHA1 745d43509e1bcef124b1f2ec67e1e1e23ba617bf
SHA256 2eb314ee31d91d77c47b53e9a6423d0c6d933ccfeffa574dcb0215723ac99428
SHA512 9952abdaf223d0502fcd46d561d095781f4937d56b3bf5dd97f9e92f77db2cab484a68306f34c508d00838ebdad693f51aa9c9552d392e03137ed7136d31cc64

C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe

MD5 021f043d6581ea300086efe74bd02a3e
SHA1 8d987fe3ae4f7940fedcbce5c0b87fdf3f911609
SHA256 56714ae873ae24ddd7dc29ecee3886c3d684ddca2d2a1e58da2e10a27d331906
SHA512 9909f16a0dfd75d156504694c55a73ec7a387ef4ee9cf2bf7d63d62654b371d64c402aff0af34db0c87e1940370f7bda1939ce942c8350fe42ce2188d54efe17

C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe

MD5 83e7edf54228251883c6be2b087fbe39
SHA1 f47d71419fa3a1aed4088a06c009305f4671f034
SHA256 eb86ecd4d4e0c8f6b80003cbe6a8dc5978eae8884f27064bde1fc8f2b690aece
SHA512 3bcea1ca55c0c33faaa1a935303a6be3eba878f4eec8be8475f48dd04d54c7612c5dffc5a537e63c1bca4b10897e354986e9c891f741b8d5b60053d7144637fe

C:\Program Files\Mozilla Firefox\updater.exe

MD5 ca3d66c8d73f0dcc0e91f49d9ab76265
SHA1 cb079fa1be82f15d550af0f8a6345ea3ca80e420
SHA256 b6d0433585a5eac82e9b71e0c3eb1544fb0749edb2ac526983272706360bb0f5
SHA512 7799a30c64f18226f7ebd0283a53a2beae058d15ed6bf479861b481b170318e53947f01609d9d924aa50d2fb4e006a4a44f6e2856b8bcb646ca3dfe29fee99f6

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 6acacdc7a82d194148252bd7db8b7c3a
SHA1 3e8505eada6ba1f1b342a5eae073a5a1a4bb0cba
SHA256 141be930508df275af6d1540878c6cc18cdfb022ba708d3bf4d06c6f55be0840
SHA512 d652c83f29d56d760ecea4be751893d9aa28eeb3d99f120e704dd396083efbed773e6d88953b84feec27466ce90da2398b9095a88e041b96f47db45f7c8c7aa1

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 48ebca34af06511e1a271c4c7c242746
SHA1 948032d9a2b3606a0e1986292721bcdd64dc1e41
SHA256 3024fee8b835044144051b3513e089d203eda56a64aa6c1dbfea2c9f83a4a183
SHA512 8bfc7726aa476d7379df0b9be2d01f9551456675f6beabb2cbf6ccd43df165d237ffe64fb90094e0591fcd39ae3e8c7600166506c86ba0efaf266e14e814f257

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 8d5fa777f1123f91d85edd14be840ea1
SHA1 db7203c1dcfb35931175ff91a94ab68ecec6e580
SHA256 196a714f62e206d4cf53cc376674763abaf5f44325b69070e209f6a1a9e2e20f
SHA512 b8a44dff9877af2276d641a41344f46becdebfcedb876cc3ba7b53cd4764560a4fdd787153668e53bc442d3eb40f71447b86f2a43eaf92ef566cf19e8406f425

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 601fa10ec5a26b94fae5c40775c0a998
SHA1 89c12ae675100dca3f1dfacd808d86941b0aabaf
SHA256 f93fbd97dffd9f637249edb6ce1eed23ea8ec066be6a10307349f3896dff285f
SHA512 3f74319175ad8c8455d92dfcfb1ce94a99dcf95464509c5c159b7aaf03680690fbe626a0d8c54a20f676766d2465acbed0420464bd4e78ff986cdccf0669c3ca

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 1feb389f5ef9bab29275833642a9ead1
SHA1 40695c5f9b522a02f362c48e963a32e531c3bf40
SHA256 981f444982635d9287a318ecaab7aba7490de7a766f3cd7e51ee5de3eafa2b5e
SHA512 32d182bbeeff639903c45964805973c9038b22464b5d4f75aebd607e1c49228f2c7915b2676de2415e960cbe2554d6e64a81b2d0d3457a89beb36e98b2c75e9c

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 de1c11123418f42b27dbfd05bc663519
SHA1 2cd31c743ff166df34fcc3c17f18c1b3c747ef6a
SHA256 3912f4ceded8962a265ad09b61feb8482777296f7ab7f39d6241b7ed3fcc30a0
SHA512 c98900414e08a21648bec0616249f7f2bad3ec31a12ca75ca91dbb393e69466185dbfc59088324c35913fa8960959cf1f5e48343d7862de1ad3287157ba240b9

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 273d5df9bce1d2213fe01b590a0d4912
SHA1 a3ee20b59e684d70b9463a9a5be978fd791d305a
SHA256 127ab9f3c84509713792f83b9302bdfcb22d5371f4f948bb4f4c9daba1b4b751
SHA512 0c489259f05b52d2fbb8133fb5585b7689c1cb383d6983f6e59bf2af8b490626c9f1e19c04eed0f66dfb4c557679f59af95baaa75eea1a9b56230442b3de95af

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 e45bdd5b814571e9e2cdaef4ce2badba
SHA1 02f0f9bf07ff00f5b69b190f62133b4d80315438
SHA256 07c45ec6660f1f304638a08b35ab21b5fdf9cb23338b7fbb2fdd55f4f092c7ba
SHA512 dbb4538461c934af0e21a9246a5131cce8a3b74bc101ce0de0f3df4dce52b4f5e24c34774b6715eed0b8896ddc429c7101ac0b7cc592dbf6e835aa7fcc311cf3

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

MD5 864c356a11bd6fde177c9bec7e4e987a
SHA1 297c0c464ce6f69875c0eee3e5248b84e4f1067a
SHA256 374198f70dbc4a9306b6cf2377b28197a0ced02d82248a8b942244a010f81599
SHA512 1a254aff88f45d47fe59d0e13f3d1b227cb05ff6abcf415740ed9d11de34fd4c200f0a510e1a7a573c1d124b5bfaeadff1d7cb2a4d6cf91a2ffcc7324fd2de4e

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe

MD5 c179420742ee5c67e2a9bfb3fbba9fd3
SHA1 de586ad86874bf05b561e4726a9868291ff1af7f
SHA256 14447e2eeb6f6ebaaced0cc8c1dddebf44fa32bf53eb322552f01240078e522e
SHA512 8e8710f6935d6122c52ddeed7920e9af1e243d65e764f243439586838ad10731cabfa912d518099678e198f1f21defc885745bddc958874701ecfa4f11f5b17d

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

MD5 431dc8016db3bab113be394c6f5ab2d5
SHA1 92f38e9b78428d38a1b987a9a48f110c1e08ce36
SHA256 f038a44c47f67d96a82379591687558dd4651ad90666416ed8e59506e4fa0a1a
SHA512 764703cafd3adff0ec37e1e5e4beed0163642c09ae9f6b7ffc47050cb2a4c8cc24aecc68a3f72a0e83c29c76f72b06a4de767269141523ea1a5b1dfc4ae2a5a7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

MD5 a29ad9e1451c2efa19cb538a68a014db
SHA1 c27266e9edb5501785ebe11f29d9828fbecdabd5
SHA256 b4349723d3c5daaeda2943e203054d6303caeafe01dd512d3431d8a659306079
SHA512 e5dcdeb56b8cbd60a431e539f8b88bab421f7ae173d7e20dc59bc0ece5ea1926029adcc581e72c7a65332d40a62e23c08b5b96d4336a613256e6671ab8187e9e

C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

MD5 5ac59311cdd998d4158b49230d69a5eb
SHA1 b0ab4841b85b17cd7604113f191590ebbfb53197
SHA256 7ef22ea31a8878c27273843bc6133ab3e29ee6199278c2ba73d6c00268d0af1d
SHA512 9e66051f523a44fd4ff6b60726b686ae2c2f1145a986f4c2603a1e9ca6fd9ee56b656ce82e78106b358ff003cd0fa948bd07c253d87f10a3a7bd9b812ada8caa

C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe

MD5 a879b282add503635d64ebc9932646e1
SHA1 3a4a5af6393c8dc361f5ee8830bacfe7a41ef26c
SHA256 106f25887a0d6d398433f97169d5a836932f6d65a48f6f0db9066ac5cdfac801
SHA512 7bd3a494a5673b1dae3fae51498b5a2971254b17066e8f9e5ed58f46683949b9fbf2b3412664f10be9e8bc8f49b404d3a734a8112ea8b11ba5d76d785160dcd2

C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe

MD5 af4ecaeb196e02f853ed893b585408bf
SHA1 8adff12bf66f60f8787adcc983ac9d45612ee61e
SHA256 d9dfac36867fde8bc193c48823005f0565c6d4cf31dd51d8c7df698389f4ff3b
SHA512 3e0c47c7af16cd397bc204ab0fef1c6ae7adae9161ed0efd2e7c4f1d2ed6b94566741f00e0dabdecf2e4c644a272e9ea4f9bea76ca535a1b3b0337b02c33f761

C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe

MD5 a9164f2c538550a9742d886e8ab34872
SHA1 0eb1733bb6bfd5ad8b436cfe9e4a35d295da89f1
SHA256 0a1749ceaf9725c734b778c110c541ddf5743e7da1d3088e3086c98456a883c7
SHA512 16ca20b5e0f3984a1bf608ae4c6e41655e61c58a894651fd048feb5fb7b4ef6c59e8b3c50a0aa43c4b44c0e4d1a01474ddd0f04f9f8cfe3caa67be43484f684a

C:\Program Files\Microsoft Office\root\Office16\msoia.exe

MD5 d6454d8c43e2276f0e5158e145e32e00
SHA1 30b04051ed89657bafed1fd14a4791b98d4c8954
SHA256 c72c10aab34f5d21f07f4decea9b1419ae8897f114d041eb779a10d3d4194819
SHA512 3a2a0e473f908ac8b7b4383db067057a13f6af4d9474072063c349d4578c42d3aedc2544b2e158b6d62c71ffd17b9231c3a756463be63ca8229fde47ba957e50

C:\Program Files\Microsoft Office\root\Office16\msoasb.exe

MD5 e1400d06bf4853e405467cabfc1787b1
SHA1 b42428c8de55ea49139dee3cec55ef1eef393b80
SHA256 62ac7e79b76267a5b577f995dcc0330a0530caf35c37c4899cae5667a094019e
SHA512 b17c35985aaab2b4dc7183a2993b05f6755f4470cd9c38f1ff83b3c41596cebdc2b8730e094dd9d55b09bdbde1dd2f9eb012ca116050df608cb36df0b1ff1d07

C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe

MD5 5340fc7e07ffee855f7a490558978d04
SHA1 0c97998b526ac25f38b51b392a6bc48f40c9f916
SHA256 e9c887454110c0aa4b45ac522bda8babbaab146ceda2747bab56dd1daf6c3aca
SHA512 f77366dc1358355b6cab192060630763f3d65e768127c60301f2dd55a1ade964d86b771eaee871f42c2c87e5edc9eda7b1f945fa0254a6e9972e94c4971e1d61

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

MD5 e9c315cef27d860021a9cfcadcdd4892
SHA1 0056fb138c9ec4a3cf181215029a91d6ed155e36
SHA256 b49254ab16f0578b53a222222112ac56eba8357adfe5846bad5ac24d0df5be9c
SHA512 b0052c3f66107442ed6b34c375e8b1325e3946a555b85c2735e3f59c99c7afea1269feabb3e6f509610ddff0c9d4b98bc14bc7f7c1a1b829e886224825174d3a

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

MD5 26a919ac2e9a268f544ff17d89a77195
SHA1 a355d6c353d28dddcb6ebe968fd86e531848f6f8
SHA256 2479a114c3d4413eda0f3ea5a3934bc9ddf8937a274e6e1eac36b28bcdaac53d
SHA512 ca7f4bc8a16a29e2486c6cc48b9c76d360a02e89991faa4dcc30d37ba52c2d9b16221e2845e69edc7151cc2b817197edfcadefd79e7d46a9d7b7565d29dc304b

C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

MD5 ed446e6a91919570ff0b46f722e6f6e2
SHA1 f452982c6922e1faac447b79749a8a4ff8121d01
SHA256 a22302e076e78b634cfc74e1bed852746938fef9caa8702f237c77b020a2d27a
SHA512 ba6f48a9b7e0b4e9302702f1117468d6560504fc5da93a148b633c51855412586c10ebef10f41c7a8c5aa76a25c72f304e684daf80173d1c1ad4c698c938b559

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

MD5 85c8ac8c5e00c9944a18a7c3c3c3fe65
SHA1 32bd23f9b36e5e76dee0271df0cb5d773b1b5264
SHA256 44d8a3f4e8c4dee35e42abb4a7882a1ed23ce831eec5bd2ad2798398b28c8c7e
SHA512 61673bc92dd0256683eb98637f9b32d6e372b5b51e48237c3659b5bc8e034c4f7024c40344adb28a672194ef33efcb407d342d5ce2e49d93e966e810edfb8e65

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

MD5 23d169fac84f9bef046837f81f7dc472
SHA1 db15ca9f289834c0edf273a3fe0fc9145458a8b3
SHA256 e0766af5b65cbb694f9f5228f5ba3739b5564b7da9114ea90c5905d31ebbd827
SHA512 33ee82e951c4b5e18fd325b713034a0efadce8b70face4c727a6fd8affcffaee43f335b9a799ec1f236bbb52f323c266b1f189b4045ba1804cdb2a5c1b3acbc6

C:\Program Files\Java\jre-1.8\bin\ssvagent.exe

MD5 9c1855224777903824616d91049b646f
SHA1 1a8c43b41fdb7cfab2a0eefc40b3d1d90ba8c644
SHA256 a34d910def9df6d46da938f08aef820ad81c1b4739029562d82a7e877d75ead4
SHA512 747ec5bce862b210c79518b1c0b1405aeca42ccac4afcc6f58490c96f255d426b73cbd92beae1f0b28b20eacd3f00a3b6ea159b03084601ede709f95fcb77fe9

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe

MD5 8386f0c20fee724f8948dd0d01b6faaa
SHA1 fe876394965e5ce551012f2b12db3c71dbdd6953
SHA256 5da3f62050e127899d93e05d255617f4b061f782abb6ae42694042ec88aaaac7
SHA512 001b8343d43923ed47aecdebaec210de603b20de05e249d1adbc55c2b0f1f91099dc4a2d9bdfe20db47b9d01ca6bd3cd8c7cc31890101782cee68e65208d843b

C:\Program Files\Java\jre-1.8\bin\javaws.exe

MD5 69d8caaed43d8a394d9fbf9b07a5086d
SHA1 98005be61d341c269fccfac4daa41dbe693c1501
SHA256 2075d7c594c34e12545b9d037d6ccc2486601f110afd5776c5b468a24ae6ae26
SHA512 c87a124a1b5d2008fa7b6d2948c9d515ff3558efcc1cb000531e42f437a7bcf1d9add3100e4b2602132ff8ad6f059818da9ecad2ea707d8ef6bee41ca460201d

C:\Program Files\Java\jre-1.8\bin\javaw.exe

MD5 593023cf2bfe90270f50eb6f32ac2f4e
SHA1 4737ae646cab8dfe705296493e0e1ada21ce50d7
SHA256 5fe6770279dd28f47cf19a21025c310907cdde8c99a3e5c70492069fded767b4
SHA512 19febc531ddbf6e4a4ad4fa3c513172057f8e91c5b62462f49f870583e21f633b347283642a598dd9aae69f24522c2a2fc0cbf7f0fb61a52767baf0c6459d510

C:\Program Files\Java\jre-1.8\bin\javacpl.exe

MD5 583bf3bfb152829a4efd662a95f5757c
SHA1 7abe7a0e7fcce81e581a3529153abcff62bedbca
SHA256 2c362fd29cc3a6c96e3a74e4c94cc517eaea971a54c4db7ecd6f432a4be019bf
SHA512 9f99fd85cbdd79270a3071f3e59875921cac939dc669d1de4142c53a664113bf25cf5be6e28c06691239a9a4378d51bf30d5d98a7e0459e8f945e6d4004afcb9

C:\Program Files\Java\jre-1.8\bin\java.exe

MD5 4c9ec0714f9c9efb6032c711e0fc58c5
SHA1 ed73dcbd1835d6df70617a820c27881adbcb20d6
SHA256 8d1bfd92832e11557630f3cfe49ac95bcbb9552180c4526bacb51941d38f4195
SHA512 9a682f02b721403d3d75a0a72387bb8ca66e3f3f19ac774135e9c4afad698856ed627c7badab81d27f3bf33d61e1ab9dc9d23650e6b8c40fc64449777725c0cc

C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe

MD5 6c1ea1790c2b952ae59d62ea24221ba3
SHA1 864204968035f0e899762d6b166cb715a13cda39
SHA256 944471339156efa88ee725855fbacd2d751a40a2cc26983154c2fa7791222cca
SHA512 c74f8aad6ab4291765ab484c8e1853866d5df5171b3896bc82713bf74eedde414a7acc59d5eaf925806270bbcc1d6b70d7b6a793542373d5df830c153ace2a41

C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe

MD5 cbb57a6d2952b8a8959ac9a280a1631b
SHA1 4afed2b4452c9651952483f2190b2011b8be5ea4
SHA256 4b465777ac0c6a0d7d4595a1ac5314a796c9a8504b2605b5c3621f228dadbeff
SHA512 d2b9693e0f9e42faef025ce5c628b645e3bb0cd6df6afd3bd78bff6b72fc3a877a0e6fa5d91148eab861341b760b746791ef71c24daeb9c3f9bfa3b010d74f61

C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe

MD5 ec8695c60195b7665c0a4fc2e74f4dd6
SHA1 3153f71944da661de64148ac04609b4358f7bad7
SHA256 49966a0c396105ff6969a36d32ac214aa70d072b13da72c4c4271385f6401cdf
SHA512 54e41586bba9a7bc5f4c5969ebd1d469b7077b1f4cb8391148ae1142048f199411c70b6c3cf9346850ae7638d6457197c5b430079e6ed5c9f5a9a97636b2a5f9

C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe

MD5 bf2dbb8f6b0d78da314cc4da59ce2b80
SHA1 bb22f64f3244dc5b555c111f0489193aed53c10b
SHA256 1011aeee31f72e3f381a4dcde9bb8101b31913361363349595794868fc989a0f
SHA512 b500080fd4cd156f1691be75f68697eed7f6d73c7b97c9e606cdd76abd8517a985997ee470d5cbc4fdd8174b2ac8d47d64df60001ed5a9471b73610f0b929892

C:\Program Files\Java\jdk-1.8\jre\bin\java.exe

MD5 8f5f42cc481c49d62a9d4425e684a0e9
SHA1 51e9b4461ced7fe86e9b7c5af4a42282f5355e53
SHA256 004b1f2e6e4fa219e620f2d3e90f97c4d0883f8ccf9992c8be78cf057c62cf0f
SHA512 28254deda408ef9181d708d2aed3d46bd465fa85d3c665cc32b15ac5889b527467057e2ad263203861643b75b030c0aecd8cb311828893b6dd3aace9bbca495b

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 5a8e8cbbb0e11f076ef40e5e456c3edb
SHA1 4e987f26a429bb7853f927cc9b477a4ca76bfde1
SHA256 51d93043bfd5121ef522bb0f699ee4c6e9ccc786527a47032b6beab87e60cee7
SHA512 46eff2a366a8fbc89270c7726df0b6eb5c393e7c77b94a71f40e3ca48787f5e3826c0209156e13063b88e17fcf1754759bf724cbe510e8a92a5b9a69d4b82297

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 b7f21ff69644b3deb95662150b6e3aab
SHA1 53d3cb9331e8a16551dbc30acd32e6e576825c6f
SHA256 5de23ed058ef4d2ac9b12999495b43d458b00daf5d4453ce7af4098e01716ed7
SHA512 162c4475e53132bc49103ebfb7e93cbd02d6ab7f29bc29dad3ebd6b42186a102bf1263b55ab3dbd3f607639c517a1ab2230862664d568e5261622bc48da0be9b

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 4b4bbd76446fadb7fa09472f599ecb0c
SHA1 02d887c1d5b4f53da5f7f46a54551f334676c466
SHA256 81a6a2628918c6886226a28b7b6716979b293faa18810a7109bea055ea7a2e62
SHA512 aa7f2716367c09b03945030001c977b68611e1d879b00077df6c85cdbebd5f7f9893956d2bfee652784bf920a747306ac547dad9c12ab26a833ff20db177d69c

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 67ff081cd3f879e4853591917c63f6db
SHA1 768a6127f29189d07794289273860983e958e3d2
SHA256 ca4e037ed59f5b32b0c21ff90c8d08f879667c075b76684646f82d595bcbb5ed
SHA512 83555f89cd66b8d7d8303fc8ae84c860f8163f353ed3ffef1e55fc29337159f5a01524fcae82b75401a42f231b710562278a3e6ef8e437695dbe6792117dc747

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 ba5c87908f40ac7e0b72c6a90799db11
SHA1 ae5da8f02bd9ee754221e7d8283e7a09e9391832
SHA256 792d2e74c054c59c43dc3d13f3d23c0b47d4fd489d32607cebc5ce84fc97379c
SHA512 59705aa5305507fd051b0cfe7ca09548dfe05c70a3b1d12c883b6667f12ebaef3345f1129d20135180e60614f8da0337dc918fb1735a5eed7dc6fefaf8265282

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe

MD5 e64b181f194c7ca834acb2d360413588
SHA1 af41ae7dcef346673bf10c13b004daaa4b8d9560
SHA256 6d284d748614b9dbc9a760b71f3a75b6033cab8aba7c1d216a837ac94c7fe0ca
SHA512 6eb8dba0813f38653988677e5858ae76ce17420504387f94c040f647ac112116c1a55f2caca4bb42f118122773aff40ea3ba48e8ed64f0140d5e2215a114cb9f

C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe

MD5 ea1ee7cbfe1df5affa5543298ea1195e
SHA1 b557965b43634a85cef48e40fa75687dda5eaa07
SHA256 09adef4b16b5c9edc52a12ec7f14224fb551fa1cd2a5514c0235190d2bdd760f
SHA512 77176ac9d84408c0bb2a3a65e2743032f51bbe4bcf2733085a10b5c27362743d359227e1e77ba839f161e2d69f5777ddb4304806c7706a38972c888a86be5b68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 8e6c57ec007a665598fb4ef84b8af01f
SHA1 d8d1f43154f8aaf11967a461e9f2f0e82a6a5ba8
SHA256 95fba6a0975c20cf17d667b11f5c166bcadbe28b190e9046f38098e02477c1cc
SHA512 b9b20e0fe721323ebda916a942d548c7ff4017b6cb3c3d03c507e1c3453bec3d74e8bcd0d173922657133eacc179fad5b34c03e9fd415ec87ea4ea1ae4eb30bd

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 6c07e7b0fd22898ff9ac0947ce963cd5
SHA1 72035e754dd9dfeb881e84ee9f073554a68b4c84
SHA256 00fa81d4ca21b190fcbd7b0a26764926cc0a249cae802fc7563cccee780437cb
SHA512 0f655d417be054651297a3745d1d3a1d8b907ac0a25d1db14dc1bacad226828fd67fc6ab7623292475b270759892944169b6b086bb64e68548e164280142ffee

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 164cc446ec0cbe9bddfa3bd47ff77d51
SHA1 89eb7c160ba687bb9b28eb9317bff42ab885469c
SHA256 76044cc30a8d353c1bae383c8b5fb6947f48aa87169461d9f6bcf7302782b95a
SHA512 0fec82796921c7a741995fca4da8f0881ec5096d3daf80c8076e0d8c889f8efb5ee99cdb20b4aed3f04929d1e2c19a8599f231d235e705a22001c895aa1814ef

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

MD5 0f45537baafb1ac07bc7f31fc7602481
SHA1 a2ec983666ae356f1b9f1113b3b1a181bbcd929e
SHA256 25d14efbfbecec972ffb0e1544c9f5e8339e1951ea80e7004c0143d4101efd46
SHA512 3799b04d73c538b3043fadcc721a58936bad3f2a54158f2389f7b5d8dc7f9bce35a79219b6c0e290e08d45a139be9fa1a04a96f6afb4ef6406f10a71c638d7cf

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

MD5 1c135b7972c73e1c1cbc92142397918c
SHA1 3b5fee638a8b04ee44ba65ad27c10dc22fe17e81
SHA256 b9e6d17a4140e9195d2992fc3aae5254585a3c354e9410fc70035b55446a4af9
SHA512 86b159fc48d56aeae0c54b39a86be84525df3d6edbb6df720e6d14ed9dd4e5d71142cff46a118b869415272c564ce2c655506675c484b3cc7b39c92ac9c11116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 cc080dfde27f51761c64e39bf285f8c8
SHA1 7be390d74566333419984d9a7c9b26c6cd535e85
SHA256 278f7130f7038b65a866025c5076a984f581c1ad6b453c272e3e8fedab4a8464
SHA512 24d22716717a348addfc38365905e27b6ff71d0f4e52ffa15d52dc05c4241f64a7bd08927debdabdcb0aebd90daea8a4c61e237bc4c34e145c4e48d17bc4ffd4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe

MD5 d138081864f8ae085f5fabcb1c8bb281
SHA1 0cd6e84e68871ef3fcebfc12a40efa8fd1c1d588
SHA256 8f342c4ef46c0947a3c8110565a649ccb5b0b47ae4022047de7e1b2b3c8ebb36
SHA512 5659d1a5dd418cb94de6e0cead60990c83b2ea2d7b8640b3bcba0ee38552ec1cc39346cd84f9d9acd775c0feb553ac4fe51ce737e9e58fe4e855d43466a1d642

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe

MD5 c9fe7cb11a0bae5c44436f6d6c9be095
SHA1 78f000b047d42c3728b34085b900334cc4b21d74
SHA256 8fbaeeb800a34fad33610e837185deb598b63fd49a09a6fe733b894532c08af2
SHA512 bc7678d0b5a0d39d009ed41e683e0e08b1b74067976d6b34150b2bbbfb7f2f82cf571fb01903f13c0afde421b9c79aac08f3775ed06aa736db9ae2f068265078

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe

MD5 8a61274f85f4aad263108631e2f5e8bc
SHA1 ed0d657e5b0fc837790466897ca0184134814b6e
SHA256 d44a14f74673cf86059a45ae115284c3236e153c36c95742aded020037177e2a
SHA512 2b746af8addf986bcc1a6465ed9cb5c5c93c5fd03dd5dff38fbb3e244142aadb881644a6ee26a412cfd351b36dacebd6f2cfc152eff391d6c360818d4d2774ab

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe

MD5 9620d75e5d50b61888d4992e243ac414
SHA1 3f3145f13206f3603cdce1dcfb7c3dde55e14c8e
SHA256 c2b2e1608130eb152cd9d5cb83981d1a9ab2f3140b2c8a8ea8dc7ea1085e0caa
SHA512 58ab5a7b0e1b1de2394fd14cf608f84c23247ec4fdabf920b2769e1ae84e6400cd745b4bb25e036e658231f97b93854c23bdbe8c2adecaed3d012b3dc336164f

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe

MD5 3b8136fdee6d1e42e34010f67a2afc0b
SHA1 87b3a3a70bbf18071dc6735ef4d0a648da949990
SHA256 2e0065ae7577b41031957e9787753c327ddf0e2054f94e018df3f92dd3abd82f
SHA512 d6d5211d98868b752e505f8c1d6f50e32223e2a03444b02292a9c53eb2ee99b10c9f55dac8520c8034cb1225fc5534bafc42d03d6ea3c7e3e4dc8749ec3bd6e6

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe

MD5 c5a502c7fc128325f47c56b48d3b334d
SHA1 3a8574e2b17819a5e5712deba6ce75e414ad6c5b
SHA256 17fd9a1eaf6699bac1e75603a6ed30f432c1b23b410d362913eeb753dfc26b49
SHA512 2f45e182c77aeac176b82a420b9017beddc561575f01dcd69136d166199ccadaf0c1420feed6c85dc457babe15006595c21f49dbc0b7fac6efe8afb29d00b25e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

MD5 88e2f71cc0a37346bb5d99538fb6af57
SHA1 f8587bd0a0754853040794b6e0f36a5d3aba4e90
SHA256 7c7168dd38d23e581666d71888fee7581d1c1daf526640a38295c3f9ac83f1ee
SHA512 6e6cd710efa9dcc5857f0fa806eaf9cd9685ef574c1aa3e108adbdd6149421d12f13c34643849d671fd7b587f887060d1e4a09c6c05f4d9d9ce8580c6df4f182

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

MD5 a03bce39df27b9b09318e94237b12d53
SHA1 faf0b6ed1f8be80b8ea80a057f7602e88a08c230
SHA256 c7effc24f6b831cbde2d8250de31dc9bf570a3415d6b1a7008c7847e86074bc5
SHA512 26b0f465fb380d416a580176e6dea3a8b93124336273e4773119fd64ca881c9e6c3aae879e069ace82c0595d7d322447bb5d60951d1d6c661555055098a8549f

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 788bfd1a784f40bbfa0d45a0281d9d98
SHA1 182abee18eb7b52a9cb4a38bc4aa01928f5f0ee8
SHA256 5413480bf48be11cb713533243a5866409b59cb05f2a1dc7b80174d6de7776a3
SHA512 b8f30eb59ab9f9a9aaa3eba259d22458a6649f11d917772832b28aa6fffb79589485695d2df8f6fbd51b449e054d2f7ee2e053bd2a6a6421c886489a1272596b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

MD5 df5120df827a0b9649e6af4cf8f56e68
SHA1 cd78ae959c16165f6f17d98d4d01e9dbeed98108
SHA256 eecffdc6c303158c4e76d4a9444837968753873b976813640513e94b424cb736
SHA512 f8dbb5c02f593e384b2a0afc8a90a164a80618694b48fa75a24c527028b37e7773934b9ad7d5e5d14439b3560cb262b0bafb24922f953f64088328acf93fe5de

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 c189a3286cf24f34eea8bbe91b402449
SHA1 4d897899ae55f6e633acab8ab74632bf83e7212d
SHA256 2a55bdb3a21ed3ac5f0465223c255944d83945a7b5ed948a7b25697876fd31d8
SHA512 7a54b7e3aff2519d9c8145b8d11dd6acf5340c8fb4c33c3b38ff43c693aac0579fedac5a4e1978afa25b32690c5e86c01ffe8fe7d58a6a0b0bf79fce1a269999