Malware Analysis Report

2024-09-23 07:02

Sample ID 240620-qpca7azdld
Target 67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe
SHA256 67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45

Threat Level: Known bad

The file 67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Renames multiple (14349) files with added filename extension

Renames multiple (10363) files with added filename extension

Reads user/profile data of web browsers

Drops startup file

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-20 13:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-20 13:25

Reported

2024-06-20 13:28

Platform

win7-20240221-en

Max time kernel

140s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (10363) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21332_.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\CHEVRON.ICO C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01066_.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143746.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Nicosia C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\mset7ge.kic C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105234.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107722.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostName.XSL C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado21.tlb C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\css\settings.css C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01181_.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\TEAROFF.POC C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Kaliningrad C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\OLJRNLR.FAE C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\EquityFax.Dotx C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\SETUP.XML C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\SPACER.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\offset.ax C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00345_.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00670_.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VC\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FRENCH.LNG C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck.css C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.JPG C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Irkutsk C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Melbourne C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285484.WMF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02071U.BMP C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21435_.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Common Files\System\msadc\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe"

Network

N/A

Files

memory/1996-1-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1996-10-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1996-9-0x0000000000410000-0x0000000000414000-memory.dmp

memory/1996-7-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1996-5-0x0000000000400000-0x0000000000405000-memory.dmp

memory/1996-4-0x0000000000310000-0x00000000003FE000-memory.dmp

memory/1996-2-0x0000000000410000-0x0000000000414000-memory.dmp

memory/1996-0-0x00000000002E0000-0x00000000002E7000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/1996-4600-0x000007FEF88E0000-0x000007FEF8CEF000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 a98210a0b52bdee34397cc32c7f9612d
SHA1 515cf7f0d40632a51917b7f2a54f43b79b48327b
SHA256 84cfd29e21e89115a2848654a29ca2d40fd43e38b847c51ee578864090b2d6ea
SHA512 0cd9d82b1dc4350060c378c55bb1bb0b946f0d8f89433be9bd34e6641b748a434fb53bb6189971b57a17a241836b4d2e0a817a0c1c798f98244b2fbc7aeafc81

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF

MD5 46dd921f9aed45d0acc21dfbbb0bb351
SHA1 3d6ba5911b746acc0df769dc00246f7e4f95c924
SHA256 c88beb84da1e98cc9a99cdfafdcd1e98fcd1731323573a71e893af42cdfed995
SHA512 5b23dd78349b446e901ba1d86fc1283431ab1a5a4dd499eafc722ee31f44053781113c79b50d98b3e17ecafdf1b051b584ca146b3119c028e98abb14177cba0b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF

MD5 7b4782e3642493359ab76d4f2d16b0c1
SHA1 6693b4c36eca4ca452fa0e6e22c1e2d895d5e561
SHA256 27869031ebc4aca617a6939391f51f82d14379cb55a69cccad0252b53ad3a80e
SHA512 d62bc8869906f6bb7eb6c5bb1a0c2b88abc4266a4154de6de97ddc2e366f6c18762fde770866945e3387c030410aadde4e3be01e0f24b89e4288a07e000802b3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF

MD5 da394f0089a5ff46bed70612ab299d79
SHA1 b6e5ea4e170fff2a8a55301797a6e4cb99047416
SHA256 3601ff32d318e6b6b51371695f82c1bca37c5f1cc016a03d54078f62cab73c47
SHA512 2b056934e294be77a4e3b497178b8c4058c33198764ab7c09fc7db56206ae990db5979993685c03e8784afb9584f4de840d2615afc41ba7eb56d8cd18f2601e8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF

MD5 d54f947368da56406073b08bd9181e4f
SHA1 d00233bedbbc879f2665bc28b47503157880cc25
SHA256 acb2f14cb92b6bb76a1dac50624e7ba6ba42c66328501194e0e07c1fdb3c42c0
SHA512 a487e5d2007701434167d920ee3dbd32b73cf559164dd11f63de72df695f3ee285e8950d2e38c57dc9c3bb1e7784a8e931d7b1b3a3f29ca33003dd9c372926df

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF

MD5 d39d8274379e36a686134e61ff6eaf70
SHA1 559fd5b5eafaed2b555204c4375aad0167fb04a9
SHA256 b93ecc3f79ca63f091851de5dc8bfd1f5b0d13ab50147847b782a67d147b4c22
SHA512 0d85f4e405c398abbc4581b47df3642fd49230727c91e0f0c56f7d044b57a1f10737b067279ab9d6207c6f046ae7948c55671c91b1c92d3f6e234cdfd7df27b4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21306_.GIF

MD5 c3bcf9f267811a15d3f47a96765baf8e
SHA1 6dc61d3c909d59cef4de51a2f6f83290db8c0cb4
SHA256 8a81a41d186e19df05ff4174715fd3fc0eae952a777072fd2067e7e5bbdf69df
SHA512 3aa03db960ec8e94db72d1a463b3c922dc06c33c6d05a65593b38d89a878c5a6c8b81c6d97574d92b3ce0516492e5df0ad1ac1c0709d4f62475466b5a396a1eb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF

MD5 5dd10e6fe4b0b03858345efb64feca08
SHA1 3c649788b7ec766602b46ff5eb0aa27e336fa48a
SHA256 e7c5afac600e85e8f6805364812b5d02a83cccb4434fa9f3184cafaad4157d35
SHA512 ea3dae22adbc5fe2eac257dd26097c0ac052209c875be324ca356462c2602c1d2d7bd74323d9e1d5e45f53d9471d93563a5350a8307925392f561aa557ac1128

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF

MD5 b7839bd63b01b2cc068be940cf45ac6d
SHA1 23949bf408af43ee74e9df1c87198e6511cc2dd6
SHA256 44a0e32a596741d7c04a6e6fa6b3ef1a4c6edc6004c91a32e6c5e4376fdf1f94
SHA512 fb20cd26ce936a854e48d4869a850c4250887869ead73663e0788559fa910bc14f2231e089cac8d23cda35a1e493ed69704a563ad8779bfe653fd9f3ce1cc954

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF

MD5 76e06ba72184aff4155035978b45d8aa
SHA1 c94d1e69cd9943cfc9adc49188dd9930e168656a
SHA256 cb25191f6ec22ff95aa4b359234e3e5ab3ff0b3570a4e600b63ff198375123e2
SHA512 c7cdde74494dd0828ffc5ffe67b7b95d4a34acf8ad9eded85d698975344a4d0579e640560a68f71432a294cdaf941b04be81383353454a13eed882d7f9432cd3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF

MD5 a9d77b2e433a83b10187eb086f656448
SHA1 0dde0ef24199e24d00e8dddae00ffd083c26a9e3
SHA256 994aef022488d42e50894eb98ae728825e3be6497ea50694329ee0f28ca7bc04
SHA512 bac228d325b075bcfc4ee51ceb2e68e6b901b9c9a1cf83a4581e78dec1ba0e7598a01e57c38b4cc8eff370ab1adb6ff27878f9f582f73a188c42dce17c611e7d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21333_.GIF

MD5 25e68ac3012ed18bc7803b83e9467582
SHA1 10eec08c84b267bede68f26100456808d6940cd1
SHA256 24b8ae76666ba0e3ee9c2148ed8c34f6f21c2cf09f2e82dcbf5baaf26743a1f7
SHA512 2fa4ea0673581fce9995bc4bf71ccd3f44c4448fa0919e447a390012de42dadc9f40dfe434f9139a8ac084bf1791f97004eb8269f707ac126604c0e8588e46ed

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF

MD5 166cb2df994d888d1cd9e3a1c8115d26
SHA1 4bc08f89e9c9856dd86d58ba7d81157bec958409
SHA256 f50a9f76f3a0fe6c4c46b4c6105bbcb87d07cb3a5bad0c2d024e95bbcf5bf968
SHA512 3abe27d882766fe4d9a1a5da626ec8a0eb8e7002ae39ba43b3645ee1260fe30d17288f2f5cbe6be876e19fe6e76eb160f33292a215cf0359736dc58d422cb0d9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21339_.GIF

MD5 81b5377293eecfd850fe89029ead40ed
SHA1 fe3692942b549604f8d92929e6a14f521160568a
SHA256 82d9962724de03f1ae560870daa05eac5fd42b8e522fcb0b73d0d7b91988f0f9
SHA512 42349fc0dd52efc6329250885b594111ccb090176539bc3d0e281dd6d30fd4809ffa877460118855839ce942f88dac8a2fdd7c8aaefd3415394709443d5a8b22

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF

MD5 a0e9f1e2ee3913eb9930d89e765ecccc
SHA1 a9f36667b07f4cf9d65398d0786c7462230311ea
SHA256 91478e40f52b20505429825d6a691c39dc62511c1e8d622072b8998a6222e902
SHA512 2ceea05d63453ad0f5f532abf890a33ff74d5cda7f7b3ef879436dc0e5bee4122b3e20096decfc3b2711932823288fe49a30e856def687b5668cf43138203963

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF

MD5 eb9d8744192922b1120bb74970ca7694
SHA1 634b190f28f8105801a3a716b0ed581fc435e87e
SHA256 647406f70b663d37bb2fd43a4e3c81611db07db57454dbb444625c9a2b27041f
SHA512 c5822e02595fcc6230d8d29cf223b43ef1a043e30200a18884802df276d0039b806d4c835699149e2a6185d94b841ab36e68a358d7219c8c54b7123621ea661a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF

MD5 c46f62340d7d7f052061d98bcf9ed720
SHA1 5a874f557bf28da5da0e1cc51efc21e51cc5c14e
SHA256 d30afeaa7ffd8479d5fc87292650af0fc9485e6d9d03deedce6e6c5a38b07e22
SHA512 211e39968d6dd2975b0f32abb7bf6eef37739ca90f6d2c5016696309deb91660360c876ca2b7920447dd1af3841814b3a332760e5801d14c20d4012c6c1d87ef

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21364_.GIF

MD5 6d3013949ffa2a3629df572f371c82b2
SHA1 c21f41d597d750e5543722b8ef3ea7d9bcf69412
SHA256 d5bdb779478401f4747aef1656e78b62548ab8b52071b1ba69bc1b6d417e34ee
SHA512 eaed1c7ab67987ef62c07b6f06c259562f3e8d7ee7bf18388bea7fc83ba3740c270f87c0208bd3acf632a57b774eef6ddba89c3fb1fff5bd95eebbec173c3791

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF

MD5 27cc9b41eddef7b0f3a495a991cf1353
SHA1 666f558d05fe71c8a7bc08e45d1beca1ee3f568f
SHA256 9729e724d0787b49bb6fd2f64bbffac3c44717404aa3efeeb9de9e624a93d0eb
SHA512 9b092a81c4c5ab25a45ce82d71316841078f6180a46e793d177feac62e8f7799d29689a269fd978f5038f66b2ab6082921133e13fef116f25f94e69ccfa38825

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF

MD5 756b839212743355e0f864e263e55c63
SHA1 9692fdc2310ed70c4746482b91185dacdc9a38bd
SHA256 2749e1ac89d3bcc20b069e95a6c764b430acbd02736e0d62b73fe3a65afbf870
SHA512 ebfa73a19b062815c0910bb7a7362e5bd6c0dcaa7bf4acd923a57bd051309245330137883602b68098ba77c92a810aec0c3267a7b32db6f92f53ffb1795eb9ec

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF

MD5 62e9cda2ee7e3a776cdac2bfdeea3d03
SHA1 a7fc3c3cbbd5cbf0a49e30364af6fb6a4548434f
SHA256 4cd11e7af4de2097b9e752ca68c155408dbb424d69db0aef51653c84f539f84c
SHA512 9e4be1caf63a8254c7ec9ca16f41f66c200b71a9abe605be6c1ad864b71983d7fb4c0659d8e7effbddf51c96448e706dd31182fdcdf6b0127d20f1fb19b91b15

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF

MD5 641904b3ff13f6f6bbdc5759f6f0eb58
SHA1 2cfecb7178b4831ee7c44fd9a9724c782adc4660
SHA256 60d9c506d683fb84f31225e5b71d972e7bdb9a35f1868bbd0d63aaae84139059
SHA512 2eeff8a98cefe5625c554cc8cab2cd90b3df1572dfed2216d73630a9d5f58287ee9f0cff38fd3ccec400789406cc76f051f1716f594b8277db542a5bbed343d8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF

MD5 465270bfab326c4a2482b7c5a5083fbd
SHA1 7f8418b3522d059fb14ba4b859810d782245d360
SHA256 d8b4755bd634aaebba61c903f491e5407e514576ac71cbb6914d27006a947c98
SHA512 524ea3bd434d52ca38a41c507bc4b63046a6812953f96b629ae21c493fa597818189bb5376c64dcc035001079d6f8d56bb1ad670694171e3be69a8e44e97901d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF

MD5 4cbe02b45cfb200ed05f1d5976858e7a
SHA1 58c21402711c7e947a953a40fd7b75f70c154d8f
SHA256 d30c717e7ebbfb1ef20820fba7a529449f1e90872f35b5017df7c8bed1c9d52d
SHA512 dcd3843792d4da1c9e48ae59a2beca1982607876abe2875d45d1a90e0579ac7343bb2402a2f4ae10bada7393dda61d112af087e489e7582423c6a5e8b635566b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF

MD5 f758275b23cda209dd2438282bc455d3
SHA1 37b49236bcfba2c23f65a7d1fbb82de77259a7ad
SHA256 ef01c493fb23319d49b22fb03ca3250e7881d6b158ab90e5bf2e83ce9f3d00aa
SHA512 67d4dce6987fa7c6df0b1e60bf5d2ce32b460e855a55f8bffcd193517537c2c94074f8c72379fd3dfd7479dba21cc47a502227bf0ad3ae43c57a7ab85d20948b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF

MD5 927383f48c77af7afb58e6cc5983da29
SHA1 093f7261330e45ffbd705626ed31ba0f49f0ce7b
SHA256 36a189ae680eca72ee1d8665c12e6807f8495fed6c9a6fa92f25be547eb84529
SHA512 04348f3409cb623b535e437313c3b8873609ea92b62f6df41539235b85b5aff9af430826745c781b440dc976a559666328c902b7ea1cf58816993568af976603

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF

MD5 13ff96f4a6e265402f0fc29d3f94230c
SHA1 129346d72c71a9587a2ea5fd56a388f58195f888
SHA256 ae83d35499358fff13557d1c285ff5effdc86e1df7255ffd03cd92ccda7de4c2
SHA512 25910430bdae928779870c8e70ae9f013f293f5c6a7cc7e6896b9a9185244e268dafdc45a11446120546974d8cf7b368ad7ff371b65898f0026c6b499f21b08e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF

MD5 072a2df8afed1a75196d5fd6bdf8a023
SHA1 44525a23b3b66d2d8757e6d45068bcd53f8ca4f2
SHA256 d372f4d5646c67fea210256151386ef5d494edb81e3cf77709a41ab3413e334a
SHA512 7dd3b38c3d859ab02b163abc877be2d651dff080e997a0a0bebfefc648bd2f94a3a30d29292cc795646f13e2845e48d338e2e9f02279d22a907259550d897a03

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF

MD5 ce9be0b9e355334dd70b0c8bfaaafa6e
SHA1 c502814f06ef51a78e73fcedab90092705277d1b
SHA256 0cf6541c0b5238ea2ba77baf50cafc3438be0a63f7e30cbef454857386856e7a
SHA512 422d6e3c47ccaffdbdf45890dbb386077b1b03798a7906901eb0396c04c7d4553221a00792812d1d5414db113b192308866b37c1e19c0195c53ab3dc1d481ef0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF

MD5 6146bbca7592b6193524f943e5941b47
SHA1 b6ae9b97b344b30092f3b83a4019fad3deb97823
SHA256 96a3914b4922b5e74757a25e0b6dcd480ca8362b637157f16fe0932695d216ed
SHA512 055632ea22fd072870f5642cce81e44ca0249d4f279932d311679de168532c340889e586859d85101ec5b519ab935827966704ed9a460f05b854fa7232c9cd3f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF

MD5 b75d10616071bdf62e21c984ac4f63e9
SHA1 a0fceab7331eeb806d83776816b66d272943cdf3
SHA256 12ff0eda36b5b1a38ea8477137517984080959a4ea4137844a2eb01eca4a55e8
SHA512 bbf6a7721944e764c08cc9678870e214bd59fd38d159acd1bb9f1df3f29b473bf37f01ed23a271f2accb2c1638d01772f6ed805ef0b23426590dbe002229a48e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF

MD5 2a44f81041b72353b3dcd6203fbac8f5
SHA1 81f94ff403052b7824e02101bc6b204ced2b0af0
SHA256 7a71216d4679c402ab2de309993491d2d572bffd90b4706389171fb56d0897ab
SHA512 6a75a0db7daa976f7259d34074389d40c4aae249025eb702b6169b01f2ca62a8098fb373c4483083bd766ae34920abb1c50f61a9570b2246c642d7995e174cb9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF

MD5 5bd57b7c320fd26089c89cc383ff05d1
SHA1 623af9c4e35f3a4435da25ffe82e6bfbdf8bd9f7
SHA256 d0690b4a63bdfc8074586b6fded62488022100f1880d3ec5802d571bccf6f378
SHA512 90d323e58b9ab73e3fa38ffe9a92540fda802ad5d9b0fdeb4e5ceabb4f53014b20d0fcb8e91824d89e54136b25d391c5c9aecb0d6f6f6698c817bdece500df72

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF

MD5 147c1453c5bb77752fe58d283444505b
SHA1 33eb2d38d6f64e52fc2011c21d1cd88150f61f3b
SHA256 10c0fae2b754f917f9162ce0757789731c18a9b0f0be885a38aad3ce9d67cfb1
SHA512 a4e225c4c28fccebf6e6a1598a5b9d056f18d71f48058d4bc1ae1086d97a175ff1c6f18e124e62ceca22c65c950945340cf97242a68daf482d8a8aa713f56823

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF

MD5 e8c9d2126cab6c8f095e0e601c6b6542
SHA1 6b482b1e64940f7bff59acd08459aae5048b64a5
SHA256 407d79f00790d2fe2134706af8e46ad3b0598dda85daa2a23eaccbde9d802fc0
SHA512 f95ee56c8e0e47e27db6ba4c50796eca0b0d9a9fc0c717d88bbbb0e039c867a12ecc1981a0fdd6aff77ca0309f4f86792d8ed40cda7caf512e5be96cab4e6a42

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 eb3a2d713a181f7cf6f6384426637a0d
SHA1 f5b037e2a01210339b7127bf00aab50d412715ed
SHA256 44d92784e5072ff0b92050369b94ab3417bf47604f37d3c0ce66ed6fb28411b2
SHA512 3274153e114a728cdab7a90dfd3f69bf4d2ee15e42c6c316ab77ccecb1cafe3305feff96a94f9570383c9df97926ad28927362daac88d5f258b39b3879452ac9

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 3ddd78df47244caac64d723df4c7e935
SHA1 cbe0c350ffabdd78bfcb90d8e74cccd9dcf5379e
SHA256 7443f84533786c094d601e0f8b6c82a958472b88c1f786276a641666ae2d1af3
SHA512 97b4e1ba297e312346adc267446d91e2e534e41ef754f59a8b68f9a3291ad62769d4d20c41fe6def0d7fbacbd92b2a67ce5ddbc71f1626188a0d6557d70c66ac

C:\Program Files\7-Zip\7zG.exe

MD5 3fecaa8dc9827bb7ea92bd640da16bf8
SHA1 2f127ad03b31f201a4dfd9efdb68228cec836eb1
SHA256 1ed39ea3a40320e394d681c43b91458b014ead14e25d7fbf773e6a49124b8226
SHA512 3d97e940d890b0ca255ba8378a0b48a2fef9212f31965e48458f11e5d02a99967570f91c48fa474099f4fc3b9a65996fd073791b7bbad4ebaf1a151562be4edc

C:\Program Files\7-Zip\7zFM.exe

MD5 3e61585ac6ada36e7bd8b19ef3d274b4
SHA1 2d4a4f9b762e72d84ddc5d91757a5eb4f8c6f2b3
SHA256 c1a6c8be3b411c3eca007ab84c1bb518918167df2f1e3bc874e8f41df850006b
SHA512 d1952ca6a23ff788eadd99b301bd97c23748d3d64a72140c48fa48d39f01b0cec7f9ca51948c4ac91b0b6e70ae2949964a9396feec51e7ec1c268eb6ba692de0

C:\Program Files\7-Zip\7z.exe

MD5 00687328422af14f24e9afa99f8774cf
SHA1 2418d161a33709b014c0ad62c9de8b07a9bfeea2
SHA256 a3140563b38f5cfbe58b4d68af7a4e5cafdae681131c2c8095cd8d78b6631af0
SHA512 6238736b41dea09062d7a76b2510f9ca9c57fc08371b8e877bd8237de205178013eebf102dbd0e853cac3b61302b54c9cf4647a0115148af0be1518bd00cdd2a

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 f88898b692e2bddb221b8265747acc5e
SHA1 91e918b48fccf32ba3ea72c83e550fb77c27b25b
SHA256 7b5ffa8c7b73765504e26233ff58a0d270ab049a9259d484d0f44aa4d28c1692
SHA512 ea322abcee4c5fa44312b9025d073feed0b3f534966285a5b955b74edd6e2b48fcc60367096cd06b46c4d2ad5eb1ed9e37e68a95a266b42dbe0b3d349dc13603

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 0ac6b2545f98479f5ccf68024493a0d4
SHA1 5e265f1b261c5fc140a1718290c6c944e92646ff
SHA256 df7f1f9dc426a2f70ffe7e7a3e7931a287f4ba79c39c39ac84ebe9b67b444d0a
SHA512 67784a8ed612e9b83166d5d7ed1ba299a005662e1c6ace3944fcd321ab5d662cf4fedb6f29511de000748db9d5543c47974cddb50e5cbc1a332ee43af10e28da

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 b703928a7fdb0d61f2543da71885c8b6
SHA1 a7192965c2558b2ed9dc1da51ef3584f494cbb14
SHA256 c7931e94b314f491c7c03ef5f91e0b3826175096425618143116a7767e96f0d1
SHA512 89d8b9e8af3086ef9336eafdceb831866f47f1075ef4ede127781b973a7af93659201ee99580565df5d1bb4e59d05a564d14fa488f6da89762b6e59c32980e20

C:\Program Files\Mozilla Firefox\updater.exe

MD5 24f9dfc4da0fe7f3468b16ea95c505b4
SHA1 ff3b01c5c0046ad8b976bc2ba334b5b88cf56c9f
SHA256 4461f7de1d9c2bd5e57f4b07570547172f40f0b797da4eede1966411bde15f48
SHA512 1fbd806e53d0c34272ed5695369e5d4c38ab1a04bc66f901c2c88a5e108e275f7199f834d7d89e8bdc24cc01f9c09906490a2645eddd629f00571742a731f49c

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 78bee1a19d22003de4c870f131258422
SHA1 1f327eb2e8008ccc9c9cde92eac0e5924455477c
SHA256 fa9ff6028c756141937ab20539205e75cb8bb81d4e02607012189417360bfb2b
SHA512 1bf71455329bcee9b76c67aa3fb05bade442a5fc30584d6f3bb69ad0673178adec3961b90fe78597a625a6ecea10f0e4a380ded97638ceb2cdb4cce422bae7e1

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 cbc43ef633ef412ddf9413655116428e
SHA1 57cec53309d2889ee2fcd357088c04e68f834ff2
SHA256 b790bcb83c8caf85cf43c485e0f7d970b005fead4d5d5504264453384da9a891
SHA512 45f0b75d26e8d00b70aaa7b3d927b3ae94e62e932be3533d3417db38f56ac9f63563501ad0a4f578d82aa217aad7ff4a5bcb53144a0cf2424a5ca8354fd06733

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 921fbe0a5b5abcff10def73b23e21398
SHA1 bd17d4637966bd01ce2b1f632af302e414996002
SHA256 f6bacf51b9071e318b0a0a1b4ddd1d6e9648a87012b6a7b120fcf590143fd72e
SHA512 a7d6dd46715e9d89eda47d33c05c279a4ca2f2cd2d50a0737bb0de7b510fa3fa34379d1a6be4f022c9f335c864eb9bd29b39d4ea51b5c335066e4684a2da23e8

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 7023ecc612382873e648386c568a3b39
SHA1 e894dd3ee2c0511a4fd3c2237a16445734ac1663
SHA256 4ad5bb8b01e1dce10e88f4a97d6ebb274a2de54369060f27c3b56170f43f41ba
SHA512 b25e51817387c4d6e6d83f0a9758ad820fc9b3df794ae7c3dcabbe5131dc8ce774cada2b9bf9bbf55041cd37375f99b1c6e4e402e4666beffffe01907c06d7af

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 7e72125ed1c019adaf434142d4871e3a
SHA1 2309436f1eaa66546b4fb1fca864c0017ff36e3a
SHA256 50cfc4f42e2c89b13b4941ee8fff2bb23d0f75c08c7ca24d44dee8418ccf5399
SHA512 c257a1822da51fd1dd01c8779a8a0fbfda2d18f6cdfdf775b044f26041921b502b812c22b87f3b33c32dae148df4e87f0dc7f9eae41f91fcfcbdcad7bffdc1f7

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 0f211f2072cc73d72c1be08e9832f465
SHA1 0c8d5497ffb13da60370146c4795c5bad61cd312
SHA256 e2c59339ec7c6deeabf0b244398cdbe8a18712f39dcfd2d392542b1536d38115
SHA512 5031cc07776ae5157dca00e521bf81593bac1c735cbac140e256f144d9fcb4e4caed32bfade95a6852b1ae22afc1ed63dc00e4687b92ceb3f5c4ea467e0e4fe0

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 55281f99eb226780903dc3a38b3ade9f
SHA1 df2ae534fbdb8700b697533dde5260224b7bc61b
SHA256 7d783e3e53f3291cb14693a0c31e5fa4369a67370d7d9744edaa24a3d7838a94
SHA512 0b137b16b74afdf5b8c0108bdbe446c8b8de7730b456a54fe207fce97b66fa5a4a5d9246468ead6a0b14d4c838b382c86a16ce05ac5d337c82a66ac635345cec

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

MD5 34a683d94c579856cf500fcd087b7617
SHA1 7cecae6da3dc82ff3c0786aa54aaa68cad75f6f3
SHA256 119f201103500ec0df3caec6df12fa22bbed76e14592c47e2d5c74233a5ac8be
SHA512 00bb0487f8d7b35b32ceabbf16e75ce2c65673d2679a35ae4ef073b84b565eb64371ba4edc877faebb4ef21791f452fe545156c21e9d9b86e681ddc6118e13f3

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

MD5 b264860f05eafe07c3d3feabfcf79881
SHA1 6e0a4c54bcbc18e89b4e899579374ae2f1b2a546
SHA256 9bbd8358d6efbefc44c581481bafba931ae3614295601498520fbe8bb0e378e1
SHA512 498f1a174ad727ca1e542ef44c0ee5c9deff83792daa49e52d9daa0731dd46174bb2aa77bce297bff81bd31a0c73658f8155c2ec45494ae8e6a5e6ef672fe45c

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

MD5 56ca2042481d6ea8199a945513ceb060
SHA1 e9e472d6aad5e040b0962dda3a5247e8c1be212f
SHA256 6d940615d40564510de672c606b3cf04ebf86d20c70644b669eef8682b0560c3
SHA512 5df097544c00fb58828372c515ca98572dab318c9ce2aba75527acb9eddfc1243f59ff6c54e79cde559ea5c6086a1ccec31460843c20464368f33a3fb90ea0c2

C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

MD5 ee34b3cc2f78548704f0aecdab5485a8
SHA1 58d5adf5a9e704618074e8104a73106d42a9318c
SHA256 fcd3f5da93011fe6ff32fa32a91b9b9676855c61937244441bf35742c5392a64
SHA512 c1efc98cb8298cff0a07aea2c3d1d6eebc20e5fe6373aee35feeeb79d3b6ea9cc9ba01f6a45c1b30467426684c9215abecfdbdacc923f6655a8093bc0c7b421a

C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

MD5 0589e565ae8a8f9d81511e9558a96146
SHA1 69ea17851d55657d7bbb0026acfffd206c193609
SHA256 1c5fa32b1d1c491df2f008a0873b6d90b2d407bf834ae1d0d8348267a5928da1
SHA512 4a0f09329ec68900f264baa9df36ce9f4e729ce8ea38b4cae8a0261e4af9e5b1e056838a5ac9163ab4e3d86e2eafd6d5a50682901290fec7504604d6592b6a95

C:\Program Files\Microsoft Games\Hearts\Hearts.exe

MD5 9b67538626ad4c1cc67e271e9199d010
SHA1 dcafbba432e3ff686d0d4531300f4d4112161911
SHA256 630f652f20c4a9ad5f753d505ad27e2946830bb40e8e5bc117c23e72d43e34e6
SHA512 8ec65bdefd72ce73e428c18402c1a5d8d3dd10e9a9289343b582c4dafafc80e5e1c6f1d8c372e8646b7b58be8b191a21d201269950bf57bc0b6eb295c1269c00

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

MD5 0f9cf21d3e5400ebcd1b962a69cb69e4
SHA1 f979f0a47eafd94b6c58aeec7d1138fad1e249a9
SHA256 abbbdcc862d31b815c05aec19cda8323ba20d564e21e485f6a8e9b55b048d702
SHA512 5970580e8ad46d4851e64cf96651bd855b2e283b6877c44cddc26ff72d01beff44c5951021c2f4c2e26c1bee9db12eff41aea972b8022223610803d0d46904bd

C:\Program Files\Microsoft Games\Chess\Chess.exe

MD5 4ce279fcba4162aacfd2ea77b9438f13
SHA1 27521ff39501d7f185f357263c51200dd553224b
SHA256 2a2e3bb8fbbccb26e95106c1db1857dccc826044aeae7b14c5e140539a54f4ad
SHA512 d06a269d8ca97878abd1cd4dd1f9f1671f9242574b722cde372a58f2725e8191faf57825eac70d8b15ab086ef90b4bac1f784f355a4fe4011bf2a85f93722e1a

C:\Program Files\Java\jre7\bin\unpack200.exe

MD5 b493c3e5d37b680789460c61bde7fc97
SHA1 13ece73fda5616b0286886a4d93509093fae4df7
SHA256 76d5c48d83835968f08e890075bce6b7e894a3d6fe654270fd46f472b51cfb29
SHA512 1b54c0a4663e33b141f341a065e8d5171e372c5b9ddbf2736d4b4d20e67e830030354a038ddd814ba4e4365caaf2bde3e269408d5b7a78a333e5a96f0d9b0b5e

C:\Program Files\Java\jre7\bin\ssvagent.exe

MD5 c77fa18aa6cc11cff0de4c359cd8a748
SHA1 6dcad965db2b6604b05bcdc5833b36064261b1cf
SHA256 99a8f9130cfe64aba851137ad55922745f1e9d2841dd3cc75fcc984e15f0b9eb
SHA512 d6aabacd74b3a9670c7e9f53a0dad6de14c6996601a53daf1c734a529d321be25a3c4e0cc95bddd351732214dfa1e16124d9af588171e55b54207458d62f3ae6

C:\Program Files\Java\jre7\bin\jp2launcher.exe

MD5 19ef76bd4b41dd1a68ba75a8e4324f36
SHA1 288648a8f254193ca103918c234e0e640056064a
SHA256 5807082c56d51dd2f522cb90ef07fc59788ffa3fea333ff27977a2dd8f27d7bc
SHA512 decfc692e76e22b2f2dd18f6d7a0967c2b2d201908ef012074882bf0db9a1d504600d0f11146823c33c7fda2c6bcdbc974702983e0201af93c6ae17f9e88e44b

C:\Program Files\Java\jre7\bin\javaws.exe

MD5 244b25f771c1629b213d9e46600025cd
SHA1 c2acdacb7c179f2c6805c5814708b25432e5c75c
SHA256 087bb997ec7036da978acd89c4920c514189b6d92e3cc2388a1cea73caab9b82
SHA512 39c7da28a2ff9b3a7ab06c5cbfbcb303528e596296fe04a2d08b8d6d58ed14cbf5c8971b5db2018fdfeb8f72b35bea2d16c3965fb2ff8a154a89c43671691737

C:\Program Files\Java\jre7\bin\javaw.exe

MD5 873ee04d6812798aabdea24abcea50da
SHA1 afacbd67546903f7f374c01603ea59a8484276f8
SHA256 e3d4823b3d0aa1bc413d8a8952060d4dc4f306849d07247da24ac0f5c8e35459
SHA512 477f6f1cbeb8f5a56d6483e481298ae1272f314dc272b7df1cb3e792386ab604260f95837d79e188fefeafd397d898c8d97fc1db850eccad1cd16d338ad0f7f8

C:\Program Files\Java\jre7\bin\java.exe

MD5 f712c947facd5e95fb351113897b4078
SHA1 60ceb2e65c1f80e753776645f1c866d804b9ff95
SHA256 a0aaaf5c5e604be94c753a46b0b91b3aaa2d411e8eff4ebda95f30c4b37025a0
SHA512 33062d5cc5c417d1d11d35531465489f0e74dcd1297c7bef4e05ab04f0ed06c12b6072e31a46ca9f354f972c5ce188d74e8945014d555d43b9596e5eca6b12b2

C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

MD5 12e9826f5b04c894777904f9c597f7a1
SHA1 27d98242e4d8a25c782a68ab20de9594e26ffee6
SHA256 57e1ca0ab62fb26548ce595056720ce405782aa6ec1937ff4df20907a8a70caa
SHA512 777d41c341b31c2ec22dacfcbe026f70f0f074ff8dd407d405bcfd548e2b89a7550dc4fdf4fe629a2d6a67c664e69ec7b4fd0dae08f17de41af7755292044017

C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

MD5 ef11bdab563522f1eb2694b83d3d8666
SHA1 dd6c8107adb6249c3a296367c8416cf9e2a8ecf7
SHA256 3b496e7e284d6eb20521545bef6709aaf5eed974f0462918a041e31fe1f256d6
SHA512 f29e12152532e67b5b060e2f241ed1655c30c59548124e57ba736315ac9d81d2dac32df0286c504e08c4007136d994a67ccb0c0dd716b9e8f270c8f601d2bdcd

C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

MD5 756c7824c437432e68a269b9fd753260
SHA1 ab7c874ba3d0833a46ad604b146799a803ae807e
SHA256 a4e6e195f877699dad1af88853dd1ddfdd6d02dbe5589958b3cc462e6718a2be
SHA512 55a6b9afc10815e125d820e7adf0747b530b873f1d3db4cf40e87d2b7182f7b1a02150aef4039028e4792dc2a2b8516964ead5faf91b39ffc69561c1723b0bc5

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

MD5 e3ef0a8ccd38a11500b7ba722b61bde7
SHA1 5ec7eb7b89007aaef3bf0b4d47c79a11467ba3de
SHA256 29b43692eb1b13c06b67ad0cba795a46daae7009c610442e4da7b86129fa06c5
SHA512 2c334a279a6df811787cb9e112e0ff0cf165b857ff79d435fdc3297f8ae592050131a0863efe04c229e4803df98816f49a526eebe26ea89e9a56b19b004924a2

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

MD5 e2016319693b75f6f549edb04c7fde51
SHA1 e80b194037a88c19d7d72f0c6256f7f18f785b78
SHA256 418cf2d94f5f03c98f24314fb52add9e64ee3ae527d62ec8a44604c10e273059
SHA512 ae4049f1b06d4f8ed6093a05fe345f3e9a30286d0d7b50d8b6c7ba7045724ba1e59445dcacb2f346672451b9467745578ed501f503567677557252624ec4e19e

C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

MD5 e138278051a3894bd7f7c5c2b1c246e2
SHA1 1aa343e4c108525af3f1fa1909df5794d14b0fd2
SHA256 cade7afbe7f48bdfe642c2c210d72485470845ce36541df466655214b9b914fa
SHA512 2ada0c3c478e179b790a44cc28c36011c72a09e4214329fe0b14e57c1057bacb9f1b4616ba2e89cd5a6a73cd82036651191e5d39adafb75419440355bfd73304

C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

MD5 91e05a4b31740b7ad360c8780213a50d
SHA1 2ade85f421ba49dcd6fe5343c278c611e60146db
SHA256 16f861d220213d2c79fc4b4f90b5ad596ba68241f08afdb4d71d9160e29e7d47
SHA512 26dad7f2e885932ca9b36389f9e93ac7c885adb182eaa9a23b708d9462148ee9da61a702f9cb14cbaf94326d2741065fba38b4334b727672e1dc859a31d42dd7

C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

MD5 99f3372f5ae4716febc3bac2bc606791
SHA1 34f7a683a7c8dcfa858d9a3dadae56485ab1e3ca
SHA256 d028de658491a0eb892834780df3da1696eb2d605cc07558371aeb49dc841a7e
SHA512 1e17301854a217c7120df779ebd5588d5377af15a898803a9e925af3ac40263470ec41a25ab3414f46b321bc91713987a475501710c1de1d15b2b69abbd01d00

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

MD5 67f637ed0d15fe54109ebf1396228b0a
SHA1 acb464376efc59f0c947a41e9b7f02a648f87546
SHA256 58df4501633a1c2f8c0d220b210c06c2efcccf596176590d12d7e7d8a90b799f
SHA512 5886307af65c430951504c5aa4dd086a5eef3471b63684e7f934b19ee6acd5e40ca5b8b057553c57e17687113501c96ba87a0cd30b1bf270fdf060b967fd2ac3

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 71a67775c0a6a462382fa14f0ed6e570
SHA1 526386322c236a98c2d9ed3ff6c1b03e2a0c83a8
SHA256 0dac1e038cdab65f5fad91efdeb52e877a27719dbab9aa59339ef9480319555b
SHA512 a4235a0cc844a48ea3d11346e39fbf5e1d87dff47c734f9091e4eb8729ecc4925fd99d8f577f8f6cb5729e87e571736cb15e493171bff3c865e0f4ac682519bd

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 df3a1af42bbe9f759615c19070985e86
SHA1 1244cb9cee377305a9876f1c48a41b19d436a087
SHA256 42f3fb3ab893052195dc489eb03c4814acfd1d60e906537a85b0f3b9ae680e11
SHA512 8c9621a54bb0e5648d48f0572d75fb1d3087666c026588164a41c00084820636cb99e0d9e2155b8ea19d9c45db7fbd8407d7e61d278d716a99b31f7afe2e355e

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 54f4dc68c1a0410733583aabbf5e1b21
SHA1 8d9dd9507fe7453f13ffc4a23014bb0818144d14
SHA256 69495d5a912c24872cc594c89bf0483144b0ff13e2053f8f05c63b17a71040c8
SHA512 24469eb2833f9fa39f3de6947c22db5314c48d2d14f6b17f1aae7b355fa5443a58842abdf0bbd6324f02e252ce0776d632572fb316c0c64e1be2f3fc6e4ae978

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-20 13:25

Reported

2024-06-20 13:31

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (14349) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\text_renderer\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files\Windows Defender\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-150.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Redact_R_RHP.aapp C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\DEEPBLUE.INF C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-150.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_opencarat_18.svg C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-ma\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_BadgeLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\require.min.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\AFTRNOON.ELM C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-32_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\WideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-256_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\mesa3d.md C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\EXPLODE.WAV C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\versions\framework-dev.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-140.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-40_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_SplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\th_get.svg C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\ui-strings.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\Extensions\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File created C:\Program Files\Internet Explorer\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymxb.ttf C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\67c6f60c7103e359f782650819bb42abd21faf0179214bc13194166248494b45_NeikiAnalytics.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.187.202:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

memory/1620-3-0x00000270D11A0000-0x00000270D11A5000-memory.dmp

memory/1620-2-0x00000270D1170000-0x00000270D1177000-memory.dmp

memory/1620-0-0x00000270D11B0000-0x00000270D11B4000-memory.dmp

memory/1620-5-0x00000270D11B0000-0x00000270D11B4000-memory.dmp

memory/1620-4-0x0000000000D40000-0x0000000000E2E000-memory.dmp

memory/1620-7-0x00000270D11A0000-0x00000270D11A5000-memory.dmp

memory/1620-9-0x00000270D11A0000-0x00000270D11A5000-memory.dmp

C:\Program Files\7-Zip\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/1620-509-0x00000270D11A0000-0x00000270D11A5000-memory.dmp

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\notification_click_helper.exe

MD5 0b8d8e6e80a03ef0c9a22adce5edadf7
SHA1 2713b17d14356b68afb59b55c7ec4b3a5af0a01c
SHA256 7f39f6003abd13f5969d6d0e52a6d9cdbbf4b78d78f83b87d5e5144c9c8c0d56
SHA512 002b979ac3f6de11c02b56626a138c2390a60432e36ab42570b1f6565e59f0eb67e0d182ec0063aad1c2e0ab1d81ba514b92b8759855d360e3e3f05aa34c5636

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_helper.exe

MD5 4828c87ea62fe13cd470fc5497f7abd9
SHA1 c211490bf505903cdca9b3ef4758aecf745f97ed
SHA256 621bc27ec3d2ceca1fc708b067a71d7085d5274b9ea18acc12c6eb93702a0792
SHA512 053fe56fe94e92bd2040a388b6428429b54e749868b5f09c59d974070ca97e5e25cc733fd8c7eb5f8631edb8d73904b474900b1bdfc4fdd1ee313d6ed22b98c0

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\elevation_service.exe

MD5 dc7f7100c27c42e2bc134a0c41b2fda0
SHA1 4f54cc4081f57429f68a3094df142d84506dcaff
SHA256 6a88db8c2b552b55e2009d351e02f948f58da9a22fcf9aa6b610a963fc1503fc
SHA512 b10a71258074018e2b92da4ec096de28ba841c46b5f660ea2caa01c7cf8a88967f553e0385f297d0d64ab4d79823d499fa5b961046cf644244fccd5ebf29243e

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\BHO\ie_to_edge_stub.exe

MD5 c619f4c7b08cd31fbda736653c799cfe
SHA1 2df7b665f1eb9d83c868f02235c98241f19d82f9
SHA256 54ef1bde644af3a346c3275bd0536257af8b92f58344876c8451be91f423eefc
SHA512 b607a973bf92762be6aa4efd08c6a3d927c8e365cfada29c6869da9e4313ab5f49d09b4862563d4f0ebf5262b809ca3e13b47703ca9fb7a45a4edeaf982eb66a

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\pwahelper.exe

MD5 b8cc62ee097145b7783b5b0751aac590
SHA1 1520fd90966a091e0770db9caaaf22e2639cb355
SHA256 afef4ee311f5c52248c2cf2376cb2d4e06f4794b06e1b44d1c987c3a97ccd526
SHA512 a8107255fa57f000e220497d0446f9a2893fede7a3d6a35fcbd2cfb97e984b2627d9f1dad2b78c95d77aee39007f9f1cdcef8721c2aeaada03fae7d8313854fb

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\msedge_proxy.exe

MD5 45a5a19324f165006d0f6adbdeacd179
SHA1 94e0115ef649360df707bb65886fb631cab67fb6
SHA256 1231b3e6a82d81565b0ee9c2d177d71f9967b87633ed25f0ce0401d60995cb4a
SHA512 09210ef4f7dab9cfdf091d5b7c7f0735082af14a978454c51915832fe555241d52ec7078139589c4ffcf6271848a602f1a518bc035ef58f075ce24cf52a6376a

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Installer\setup.exe

MD5 5cd7a20a595fe8254266de7a11bdbc9e
SHA1 5d86825bd393f11abd66ffb0932e90b37ca61e9e
SHA256 65467043cce3a9293c139af908724e61d7d2379ebcf55db6447ef9de419440e6
SHA512 0c6e681f9f85fa53f2f18a1a5e69afec8e2ad5d589025b0fdc59cd4d6b749070542ac02a1d7c01812556845d157384eb7a769824e5edf04809462f62c3012e91

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge_pwa_launcher.exe

MD5 103d9cf7161979dd73feff611013a37d
SHA1 3a158c8198e602037c3b53384844e98de04cc346
SHA256 66e962c7ff3c5a7038b9739a5dfc5203056401ddd52e64425ceb47766fed55b6
SHA512 4863586e120f12b1e0667f5e6d9a3153fc8bf7dd65068c487ec2ec51d96276a6d1b651ccdde81808d48ad262f2b3293179272c7ca2965e1b62866457bcdca1bb

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedgewebview2.exe

MD5 22fe290057ea2f29a4d2b2d2d00c7703
SHA1 f5b07ca2b834e02f8fe1c3df0d501264c4624e1a
SHA256 484ee9f9ad7e4f277f9f70442bb5e47a4f5fb59f25b0fc9fbe22abd378ce2f01
SHA512 5615e7376a7872eed808370a54e0222e4ee6aceb7b442c75048c3858477ead3575acad23a755ba441caf6a60c8dd4eaee889d023e1b91db15cfc9a391f3f6230

C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\msedge.exe

MD5 4208bbd2a343139f2d2b9613677134c1
SHA1 5f54cf3c7252dffbbe9c4c1dad7cc9abe3c7ba68
SHA256 dfd7963def78029ca52d29858c9c7c477faacee2fe42522a3f5372a5d573e926
SHA512 47063e3c87d1b5e127e551e46928bdb533fe43f2b96e92fa3f300ba8439e68d839e2b70ae4e219dbe20097e9fbcda9b9c7301964f5d9b2c928d07138fc9dd514

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 6d4d5556df62769c6b97b9efac4c2230
SHA1 89158d3fa5998e0ba8e42f7218222a10e432394c
SHA256 3aaa35ab5823da010cdbae227e57d723754c1b87453fbc9b5b51234309b777a8
SHA512 3583f5124c5722ff97e15b3df09a39e1a02c9675f5b7a3d32a18bc6e4ae582cd702ee863500e84bb41fcb31827843f1f758aae5c9301ceff8cda07ccc4d990d5

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaw.exe

MD5 7c78d8f7a07d593fc77e932017be765b
SHA1 cdfa0e9ba5faf62218998e9017a6216b6e464519
SHA256 e1a46dad94fd7afe6000774d3ce41efc6aae2de3621ab87e6ba769d8c3d533c1
SHA512 d545ace6191ed9cdd71caba2736a2495141664798e97a0df1b493b420d9dedbe14748f2a893c445ec91392b76325812ead179d4bfdaa83f7b922a01be2d75f1d

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\java.exe

MD5 c7757b6c7cde8b598971437c24fc2f48
SHA1 4ae9779291c427fa82567042e4066ab76c37f140
SHA256 73f1d81485f9b5dcf8076bf501c76a675662f2ab5d720f0367c5a4365d8b5bff
SHA512 89504feab620ed3647c1ec64fec5c7cde967dbe2e65ca4eeda2b71dae8ff82132d284e60a0ef9d21eadd3290e5ff86a382102b65695c6c7e6aa2ec5cef723c5e

C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe

MD5 8763a749302c2f040ed0d957b0345ff2
SHA1 e74eb608c51565d2bad7029afeea1a78e63ab59f
SHA256 ec27780494764cae1857bc314b497812bf28d046bb6961d8a28ba579b8e77962
SHA512 73cfc4d1e657feb22e3ed48950c65ae4f0679d2a6c1e0fe03edf3fe54113fd86e25839fdcd89ab46f6719e29c38c4be2232ec9e7b7dfeac82c276b8c5cdae523

C:\Program Files\7-Zip\7z.exe

MD5 c45bb736ed97211ffdc4cfcc6531eeaa
SHA1 1a1ca8a679bae660a8bcbe92be1d48b0efd7e19f
SHA256 9b2661acc587c46695e9adc756fdcfe9bebab03f059f0f0834d5de09c7bc7046
SHA512 513b789a7dbe348922cf70513927b36bc3f2ef838ff4502d8f15e1cef82b828793035e83a1a1b7078e4fc026de8007146b223fe40ca0fed1eba47936b660b626

C:\Program Files\7-Zip\7zFM.exe

MD5 a61df3f415c2026f6a21f1aa0b780abd
SHA1 b25db74d9d885adacf35e0ad26b25d2370a053bf
SHA256 0deb7a8e892dd1bc3142cf766794f428e0a749f59df11c9e25a7daab2ae6ee4e
SHA512 f474b4e71a33f6859138e8eed969a87c31f1970d65b97cfb1c28d4e46909a467f30c13c5ae9a0b24d58cdc9eb1c1054bd3f26798b9bf121899e109c2434fc664

C:\Program Files\7-Zip\7zG.exe

MD5 a9dd7ed3472c5e4f552851747fe6483d
SHA1 8b3a609108d5602a2f74d39a85d2e52bb34d5148
SHA256 19a46e19e84db2b9e696156808eb576438c02be868dcd1d962e2d3014c1e3245
SHA512 6cff8cfb311b80f044d25341ac8ea0122f02d56d9291fb801d71afc5207b5b5d738df670f4144f8f550afd8d00c8d07307f47e96df07d297429d6ef3d3753d12

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 4a3f16f56958b8c7a4c4aa891cae011e
SHA1 90d473ce1a326aad6aaf9004e86be4868eaef550
SHA256 a081a44cbdd944ea4d3ff77c50e24444f8c9d86f0396f2f41ddeab0f447b3de5
SHA512 64dc79e4bbf424fe14e096587c6d01497c657fb893f50d41d9dc7ae37d5a2120341ad8ba365e90337f20b5c1a8ff1e3ed380206d4f11f81fd37e036d4c8e5a20

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 48745b2f66790dc61b082445b1d8114e
SHA1 0ad1e0b9001da726e0773e8a6279525e40de7dc9
SHA256 c9400411da768a20e89cc45cd08d95d9d1bf85990b777bc038ebce4721cfb13f
SHA512 dbd4011a047e9986ade4744d11eee9dc3c06d6664b9a64a543655b200c0379d2c28852246aa02531a66dc193984c84ddfc9fe80c3012c033564fa3f324a31cf5

C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe

MD5 c898492af04219159c04e3ab8db26f6e
SHA1 b2e13b058533e79ee4d9d4d8c4ba5a991e684979
SHA256 da8095ab0810ff06fb2f7471c88dc0a5ec823f99aa097bd834effa87012ac91d
SHA512 54b5fe65d2e3a25e47fcaf849e8cee486caf9298058526aa55e17d4cdde977abac1d87e0014510475ea0b6df8fe31bd0e73f31ebdfa53d81c566e4ac76c67b4e

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe

MD5 61aa4b282214a797d6592a52049c8b2c
SHA1 81c1a7432cb9be4ec127c4208c63a34df4a92b47
SHA256 d63d0071ae83261f9980378a438054ac09e1ce45db876bb02fc58523cab555c9
SHA512 5db9a3edd4dfd3db8ca29fce8d5622506b6297f6b988966f0e0f41e2c3aa1f1046edf39da15b3b9f0db0cf4120e0a278e07e6befc567120c8a351bbcb0c29a04

C:\Program Files\Mozilla Firefox\updater.exe

MD5 5a1a9f71687a02b215480db9e5ab85df
SHA1 c4cb939636cbb37989942bdfc0b03e6217a0b3a5
SHA256 dfa6d6406d4878cb257562256413c7a08161cde05fb70a28da6c4071ea5b5589
SHA512 34e56f577efb3f002b16a54cbc298a00b7d41a1636675eb1943bdfb106ab576092c6d3426baf6d4c23fb457037d761c3a4790970c3edc6f33429560f16f42d64

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 b24f7ae0385499eccbac7cb74255c619
SHA1 506a7377dad4f71066de6155862f3b54c5c042d6
SHA256 1e7a228b81fd59449d27a2380d0ac5374dd410197dbb250e2be59bfa7d07e7ce
SHA512 a9382b64555448b5cf377658f90c616c144145a5ffe537675e75f13f892b5002e1e56fcb4560306299e7bf90e562265afe9b450ff31f75f6f2c7ebbab895101f

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 907c7db517507bb7b17eae1473c9fa95
SHA1 cfa264cad5536a8b4854ca0fdb6f630f06db5d34
SHA256 a9158505f44c4a132befa399e583432b800f573967272926ab46731eb4840910
SHA512 249ca64ef7ce25c1ebfe8bc3b46751c6074ee373a8c80669edcb5c95f088be478b6ba9d22b2be748528dae8283de663caf96a5f34bc5942bce0da128c285548f

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 afd240a3581de070373b6fece90ea16f
SHA1 016fab5bcbe4173400da033bf6777f77388688b4
SHA256 56dd21e9b2db35a647811bbfcfd31956de593de352044ef6179694c9d4730dc4
SHA512 5d9b9b269326de7fd8eb1d37b41f9d6071c258d2b952f76c21d3cf0cf66bce4929fc08aa60dec238f7182bfb384bca2969239ed28833422ec650ef82631bf41c

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 0d7113d74592b5463b352e2d438ab256
SHA1 8899f5ff0faa0b276e7f936ef85e3bdc7ff8f679
SHA256 dfac8bf75c6b6b7e71556dddd031b1c69e43ca5fd06048ec150049f1a3355afb
SHA512 885582b5ea2ec140477237184eceb038769c20f7a4455171fe04070ef7df125fe2f65ec9947a8fe575f6bfe680537e261512ca688f5fffad9de0ea2a6f76636d

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 38aa4e934a753bbe3f890eabcd18e42b
SHA1 1931cdba1a099c66e7607c226b549c21310df5ab
SHA256 9427780831a72608d1a24b3a21191a6a93188bf3b23e23593d0efbbbae28b8ec
SHA512 02284c2b9661643b7c575792aa9f3b73ce02ae64e3cdc83e9f5eb04db808e4363bb9808d783bd8e98fb66f4732f60c43015c255dca9cde0bb40edef09063b5a6

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 5121a31b00a3b1171576cd8d03b29b5e
SHA1 1592ab3d43747456f428ab1a5cac44356ec096bd
SHA256 a3fb0ec2e6f972db594829f3d5934c3b8b47887f00351219e1ec84791a0e2010
SHA512 ca2bd210bc0ccaa9e8909f4a47877d0a8f7bd317b52cd9891b29b3f616b0bbb92ea5e8b90cbdaf31a74b357fc7e88dcbc1be14193a3e29b6e9ebbd21b807f882

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 7200e1bc570d99254cd1851ad1ff4017
SHA1 11395d41995c56076c86f4b27c1ecf22fef79e6e
SHA256 c15a9687f45edf0434f474514842038e5f13511a89b3c6f13dfa22f28d8face5
SHA512 81d41d4bf8d518fb30dfabfa1d61fcbe790d7dc569ae46dd83bf39b81556c0d5067ea1b66f6bf673500f2a4fa55ca9138c5fabf60b4e7167fc6409c642e6bb44

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 ce7b6dd0293f87f441c6a8e3a660e985
SHA1 c3406ebbdab343271ea69d71c8d2d287411c24a6
SHA256 3c881e7788852417422d3fb2f4d6356072f17784121cf1786d0bfd0960ede08e
SHA512 9a523e624e68b1f44b2980a239c2e5b988916582e899ac7c4ecbe6dc16b47a12ded4463488fa616b290317ac0e2e9b139bf0f1e9414d2ed6b4bc9bc547a547fa

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

MD5 d8c20376be599e2a6a1a44923db18374
SHA1 f578627be7f8649a77721a1482d2458adf754eb1
SHA256 5dd2e576faf8a483d7349f80cf63eeadfc43719ba257a436e95ac7e001e4bacd
SHA512 bfd6abb6ca03b2d75c73c1d3aff6d37632b5840f1d8aac8ee3225b5a0b39b00057333b785380a9c100538f8c63232f2a63ffbafdffb1bd8dccebbe260e63b3b4

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

MD5 e311f8fa09a7b5b16ef9af3919eb15a9
SHA1 ecc6aaf3c8e765d1a169206cc1c176f2012a06cb
SHA256 de1269f154ea9458880a65c6431767f61b1170ab862e2ce949573b675ed7cfeb
SHA512 9c3d04878ba48d03fa7da56fbfb4a27ab3fbb1641b90a342ab4a8c1b8dca1369f316b72bfff5acaf911901149550ec2ced5098ce5a0be7d296f6c9c6b838e928

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

MD5 b7249ba94fdc294c7202acf0376c31c4
SHA1 06ce89526d8a2347c8e69229533c6b854b4a7f01
SHA256 53877d8326ebb85119c19c4abacf199fd916b10e55378846b29443b188d5a594
SHA512 eaa2f024e08b836d8a775df16556cda190b578ab7d25b59bcd0b05ebd7c54786da33168aaa926d09341be909c3cffa2e960f16fcfdd0fe68d5464ae3b28ac620

C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

MD5 792b889e1bdf6211db86a46487450841
SHA1 150e3b68ec982ede976692e4270e8df31ce7b459
SHA256 8708e0a775267fec425939e79797d4a8f61cb4fff50ed3e234dcb55f13c18633
SHA512 03de10766ba9af232fe48e10f7f02d182ab78d3b11d9e95e91ecd9e84692c22d0889f7a9ea2149af057c93fef58f4784b79d422939bb37aefebd878c2a96b755

C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe

MD5 7a82bb84dce9fb213ee00299af09b9c9
SHA1 2e3b8bf0fc54640fbda8d691279a82094b321444
SHA256 7e769f3696d0916b5f5b09ce26fd1ff2572eadc1c4e0135051ed9057bb0cc2b0
SHA512 ea9f1121d66f2bb438b839f5d178768db4972087719a9703ac7d60d13f89b894bc65ce077be9762ff2d85624ab66037623f0147826a26a174cdf9bd1d6964c85

C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe

MD5 db6daff3fe99b9082837dc98613f3ac5
SHA1 57a36645fceadaf4d993fd27efa3d4eeb77920eb
SHA256 e6dc83e7aaf6aac08dd5cef63e4515cdfee3843442e84b5b5c9b3cf068aae395
SHA512 23bdf886cfba8be768aae05934e8f1b1d3cc4221cb687d0d259b2b4a9340ba405a05e53e60042f3950d48603ffb5d39c5d6aa1954899bc39a09fb0bf54414d87

C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe

MD5 72bb85c53590a8dfd0ea41edbfaaaa63
SHA1 8b21bbeca6a3adfa38fa24e27a3526773e6209d1
SHA256 124289e3310a8fdd41510acbd76b2cbc55eae662cecd12ab39749d6a81b5f98e
SHA512 6bc2fc6a24002cfd7903310199848cc2ca64ffe928e4d6713cfd0f167e8f374f306f8fcf60f6ff460ba975af5411549dcf17ab19d71a4e93a94b90a00776b008

C:\Program Files\Microsoft Office\root\Office16\msoasb.exe

MD5 105e21bc5c4524c040bc0428fc09e0af
SHA1 8dcc52297ed791e70f93cb278f82588b68c24236
SHA256 f3bdd0cee867476af3ffe8d902c43859c4d87b8a63bf2529a3d17794482d6a50
SHA512 8f4971ce4d3679f11926c1a208145ee0bbae1707d3480fa11a1eefde0012129ecdafc27fce8933106d0fc6295d9bfcb6806309eedbca373f2013ee5a8a49820e

C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe

MD5 9f35843b8b094915791c6abee2460e8c
SHA1 1e77084c0e255cd7c64d2e8a9bc9d9a9efd38c41
SHA256 848b18614281fd5fc58541821f84f3e36c975367806a9ec3b1ef73e1c10b13ca
SHA512 175220b8ba9e97aee34875f4a1efd9f674108a8f5382f6e2d7c86461fe95a4e81b11b66a243e633cff17c0e27642424c494b3d7a67c8da2d09f23752e287aed1

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

MD5 7831e39a766713141a57e10401f926ad
SHA1 b5cbeff650233b00c2c9fc9dcbdcbc9ea7aa5d26
SHA256 752a48e36caa1ade56741b3ae70162dee9ddeb6cadb9aeccd4253bd6012494d5
SHA512 eb1410392f19a5e2bb9694936e69804b63a3c812f693ba0fadb6983afd1f7f5715597b2f22aa05174f77e4c13456c8b350cc1da8b3c65c6f3e3f77a58912669f

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

MD5 7cde5e6a5e0bf294fadcdd8e3a15f5d8
SHA1 6fe2d4620c518f91b7dfdb6fda3b70350719bfa6
SHA256 4652d64c2604e48e5a685efd3418c03edfe4cec89ce0956c8d176d905933d588
SHA512 7ac6a27ff0fcd18c5df6b8188d609e901c1d04b708e53fc960d18e5becd748160287b9f15fc8fb19930b9825f0cf3e8db763144120635e621023200a0dda31d4

C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

MD5 619a9018ecd69e4a4eb9ef3b8b3d1e06
SHA1 f11d0e5f8ab92c098c423dc52b23cd49de482b5a
SHA256 4294ceb1fe2c7ece422e2051d9d2a732c2ec998c25adc6cefbb11460418a0bd9
SHA512 88c7d07c382841bb2417be5e536141e461cbee2897b36a752d860085032e5dfe692d6968628632bcb51e42867d5f2737231a453fa19b0519a3b3aaad3dc38062

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

MD5 5351105c75563c3b4d951746a190e947
SHA1 5ce8e807db9cfeb5f3d1cadf5a07eda0e9ed0611
SHA256 333369de87d763204f2144f581d26b2c1b034f1b6b2e256493d698761a22e4c3
SHA512 0952f79dbf29fc86a246e2570e67898789a4e3a9b374fcae8c8a9efe57ad4070d9ff814fa28799f3347da88d391cd29f3a54cbe40fb246b59da8f9529bdddf82

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

MD5 543f08bb89778fd98a3b6f993f9f974c
SHA1 55caeefb88355c973c75727478dd2bb085fb4105
SHA256 34fef02831bb077f70ef9be89a9ba1fab1a6cbc52a6b125b3614e82e0db64a10
SHA512 b8dba41a6fd6b9026b3eb77beed341ad87435035951566bd7d167a2f423fb77d66bb350110f5fa90b8bc3fdde5b101e5bca5d05f0162e4cd93bc6992848b2e0e

C:\Program Files\Java\jre-1.8\bin\ssvagent.exe

MD5 bb6557c1684f8538a3a57e9f5c03c222
SHA1 4c6ead232434aa420eb58dac6c9329c7ae75da64
SHA256 5baa7fba043530f5aa87b4eb5f71df4c79b1ef0064afed1d200bbe13940911a5
SHA512 9d8ff9abda8d79f1098cefb310c5e03cd6be7a025e226007789c3f40f2077a763b8e27d0d5f0ef06499370ec45ac03a76088b45efc2a3f2333d4cd5a911e8b96

C:\Program Files\Microsoft Office\root\Office16\msoia.exe

MD5 3d5f674119f3d82b444e1b9fb439661f
SHA1 d8dfe3cc61ffd9a7ef00a22616bb79bc232df040
SHA256 bccdb2260eae260b1305b9c88e10310ded4981512ef609a470b49ac25a637856
SHA512 da198dab550c1349d60d239a3d8973cca80f2c3b17348dacdd987451ad8d1f467136ade15d1b48b2ba92420a95c580af06d41cb354f0245245711b4afb84ce74

C:\Program Files\Java\jre-1.8\bin\javaws.exe

MD5 3d2198f62b881140a1bb37aebe1f40b4
SHA1 196ed9715e5dfd53bd6deeb668c9ed6e8d26c608
SHA256 e44bfe66ebd1c7e84a4669225a96363edae2749d21b3029283b18a9e739dba03
SHA512 6b68b7e8dd93f1da5e05d8e34825fe0d4ad735aa18a1f5bbff644a936361239c1f4c6663db971a8b2a38f25398b07d1b9d1b666b2941dfe2293aee5fd2e62bbe

C:\Program Files\Java\jre-1.8\bin\javaw.exe

MD5 42d76b59ed65dc60dcd2a48c6d494f63
SHA1 48872bccbb96a464fd03946c8c623617909456cd
SHA256 2de2937c022a54567849c6a56e0ba8d0b9203c66d05f36b40f9020516ab1e6ee
SHA512 857e58cc0167a3c14f6b046b6d8ceb406e467e0b2f83f62b7ce82a9ec2274489985e63956b6b8a2c3d0b518085853e2b915c07b751c2992f944fc234d8d963c9

C:\Program Files\Java\jre-1.8\bin\javacpl.exe

MD5 aa03478026fd417122533f521775b573
SHA1 5452d1eb781aedc05dd00996628c6527114a9831
SHA256 733565cbb5a29127f16b46ed60b630a3f14ae5ff34db1afd313f7b3038b0cac2
SHA512 73e56e032e915444fe18f93a6f9a4590fcb1f5e508d1be99475ac82cbcb16092ffb95ade5cb88c691f704354e6d805c575f2b17856588edf81d5668a56142a5c

C:\Program Files\Java\jre-1.8\bin\java.exe

MD5 d1c040ea2caa34c7adfc5424f333957f
SHA1 7af66253c30428257132d10f0802993eff576156
SHA256 9a12f2baebf05e9a723503e8dd1d32ad1fbb3a6bf02deaa1ddbca480f2a161ec
SHA512 a181ed8c3979eb5a50c40ed37d2d9fd729c049a237404aa2b2ca535bfbe9166e4431ac63a58d1138b6ed07f45696f24e52ba676dd31b1e190a6d10995f855f2c

C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe

MD5 740c11170250722fb8d865c1ed43709b
SHA1 c1d63df3004a00f22032ce624449d78d3538233f
SHA256 8d10928599d7fa1a2fe522ec1846ecacacf557b1d7b3044fddb94ff865d207ed
SHA512 a395dc5e1985a34d4203c7c8711a7529bcf460652b64b479cdbe7423dd608cdaeb47132383f2856def5023c6cea649d39eda05ffb53500db5bedf1d7151450bd

C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe

MD5 144821b9ef2b950eb8f9de8d05783c0c
SHA1 ef2bc3811fc99b0e241ab6d63ecdf7c20f199908
SHA256 02ac5fccc2d3d077a464af9cffe787aba7f935578df050d589c610c4ef7ebadd
SHA512 50afd2bc73ea03d9241d3c30aac7647fb725f5663f99df035613e47f7740b2256afa7cbb1a4a7e8f20ab7ab53ae94ecb798f9e6e18a1d24647ad5242f2e64e5b

C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe

MD5 39fb12506ae0864fb2ec523211828a30
SHA1 e46adbfe5c9eed9f96fd20a4feff8040b7e7fa66
SHA256 61d863c48f4030302525b9e44a09c880b07bbdde17d875df4ae087ea3233281f
SHA512 1ae67341d442d5b21a3d09cacf087e246af5a81473360eb6fcaa05e3079f99422fee6fd8f243a5780d8767cd21cbca9d49bc7e4136ce501b91979a5b4eecf119

C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe

MD5 87657fde2102c536dc3cf5bc8b7da36c
SHA1 56f30d33e1ddbecc5bf902be334637e27b28940f
SHA256 1eea13ec9d4f07e44190b3640f0a0fa4a641e23df61cbc5dc27bd75a26e9a4db
SHA512 c1206276a5c2ef89389ab72c80e7c6b2e806e1ba6393e3f80f9573007c1a7eb3e6b06fa30e008ba963555176e5736bf51d5f4ebfc533d00642e6e43524cfa23d

C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe

MD5 91bad09bb2c7f24ba4d8a406af52beb1
SHA1 a8d2aa26395f492c733d03e5952078f129247659
SHA256 34789187fb747cb51377400806442d1609d8f9e41eb440992615b961c3dd6692
SHA512 a77c19bf9f8cc33e922fe88fd4020d5ffaf8c99bbd8044d9b0e54eff938d09a77686b952ceee3e135ee7a59f528d38d778181ab47e534686172a181fd4dc1f8a

C:\Program Files\Java\jdk-1.8\jre\bin\java.exe

MD5 9e010ed78081db705812499a1a33cd96
SHA1 92048b3ad6447bd3839b3bbca554a75e504b0ed0
SHA256 3e3d5b35b692c5a4156bc8aa36221e2d0e3b57792c2e8c7eb938c939fe2c5abf
SHA512 ab2975f359e4231e319f5444aa4cdbc4b7fd24f4a33d466268fbfcafb8da49df64027e31f2b073224162c30fc8a83e0cac0afeae27d3ab7d7662cd9b0d10ee5b

C:\Program Files\Java\jdk-1.8\bin\javaws.exe

MD5 ff89fa70f88c5f858a88bfd39c1f43ac
SHA1 3c9c57a0d5aad002e00db1795d98754b0fccc09b
SHA256 20ebbb01f7e63c23b98c8b53841786cb24ba867d9529f9233be5dccf0c545c49
SHA512 98e7b9d78ae83aadcd7f7346286041cdfbaaf3431c602e1e9032866f0bc076ce6f3d246f0469c26ba7b8ea9ea511292473e24787e91f8c61788ac6e98688d1d2

C:\Program Files\Java\jdk-1.8\bin\javaw.exe

MD5 58f4e5fefdefa95c678026c0c829166c
SHA1 b641ab5790219757ec74b5ead70df260bcde53ea
SHA256 2783c35f4685585fcb91b20f0e76643381d448973cba90163d74c93a8e04a1da
SHA512 8ac1797679d5531774ddb33b5402c6bf7884f4da5d4b43bf42fcf393ff2dd87f334da9ad942d7bc89f132796caf9e2cef1400c8c80699fbd5edd9f93fdb978d3

C:\Program Files\Java\jdk-1.8\bin\java.exe

MD5 d4a36b322fe4736cfb7c904673be82c4
SHA1 002e8758a13927efb3132e29972a02285ed7ec54
SHA256 a1cf19965313804246e6cf31b37d2d89fb901039c9bea4bc1e6d443866cbd7b1
SHA512 336211d98f69d700e26abead5828d131ca3ca0395522696cb99590ae38aeea2af51ddce3ac9bdaa115486b225ff09f564766ac0e425faf1a33a6fd3ad6315efa

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 f08e7ddefaf164ba80c4c897194e0cf4
SHA1 7a61f277d5dd738e5b5365facae32c98b4f9d68d
SHA256 ff55b6c088d35bd58cbe268a4df762fa4f374a80a611b414af5edfef4e5b92d4
SHA512 c18eababa3d35ad22ef2abcbb35f8ad924752f525130f842b16a20904ba9f60ca8de77393279ed84b80f0b8431b3f85209ea8fdf5a7447bd383e346c042424ef

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 d4179c57ccd5c69a4fb457ff16fb8b49
SHA1 a28b1ed9eb6f2bf201cdae21e65809210652e9c5
SHA256 b27f67f0272ea9a87448a44f8de8a866deb7121c32762b35c0a4e25fcae0b7e4
SHA512 bc8256f78f43bebd055103cd55293406927fe73edbbd9649616f586708853fab6208c754771ca6edf6b3fe08d3004317aab3296585ef543c7edfe28fdfc0da09

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 1761477f5ee4ecfb4d412712f3b51ea3
SHA1 9c10081dfe56e701011d78ccec5c95ba79bf893f
SHA256 d5a46ae6fa6539a7e5c2cde91af761b3149d387510324079757dd733decfa2c4
SHA512 4d5b065f6c38c2b316d501614b476993c501ce38ced23c4f9fe81214da1aae49182b2b298a3267975926e97c6f1b4bff4aed6777dc68a6ecd61f57e8cbe26d2f

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 b296c30b8f48549977bac4b73f2da3e4
SHA1 0181a4c578c4ddaad7c683bb8c6d23f5457a19ff
SHA256 91773af865aafe88c8dd49cfad57991f411562f8ec57beee64e9059ac76a2856
SHA512 0e8aac73861ae4f0bcea67e574b4a4413b24f6059a55391f730a8f99bbb53361aab90c2f373250e107ff7c97c8f0760f833dcec114cb553e9c83191f310f0892

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 5005660f99314133cab1f0feb5f03bb3
SHA1 8a1482b31c7ee7a58ea0ca642daaa7fad55c8ee6
SHA256 14438c77b046f26c152b8181d0f80ed2bcffd87f7e4148a661f5de234f67c1f7
SHA512 dd768fdae68365ea1464b217e3ce05c12a78240c7af39385043334ea0d3f0e8edb459954865a24ef082a19e8473c77a900812ba45f01c61d9e0dff32d3541b65

C:\Program Files\dotnet\dotnet.exe

MD5 7a68b8bd0ab4d0447e2dee0e1bde77b9
SHA1 4188ecb83b1aa703e080aa452ceef7b7e0d48f67
SHA256 a5b0d8664f754935fa0b4d76071df54001e4265c9f30de18c504f8c8ccf8fc36
SHA512 4ece2b7af0d256b671d3e5c10de1d93a5a9d5c15fa5dbff52f1ac020f232f1a4b5aac79d76c6f4b0dad934374f18bccf014556b97795ab77198e5eb434718a0f

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 bc6aabebc02f001527d66c279b3958b8
SHA1 15b0e91bc52788991155e0c8abb519d719522011
SHA256 035fa2e9d66609396e56462e0f7ef47d73dda193180421505af5a7042a3fac02
SHA512 250cabc2eb425a452e5520166cc31d43431b8c2698c8c201ae153d757da825e0928dfba18e286170a5014d9b33f6f3ce3e97a409ce19d7d460993d65c1dca37c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 60f76f8cffc5516a325c4bbeeca44293
SHA1 23c5fc2358ad8a5561738387ad188581435c1c80
SHA256 c92e4623f212dc902b65759afa177409ad03577fe9f52a532e400eefb4a0a57f
SHA512 c08f0dacb0716dfafa3d7bbed814a866a3b4b5acdab111fa05e5c14abcbf7a286d171e36328811a95a1ee451180bc0174723044287a19a2d22f697411cbb553f

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 a534f946b44105a02a19642ec12d8c4a
SHA1 f4fbcb9eafe27b1b72327f8236708a24b8891c4b
SHA256 2ec4d6f0a67c88df22663cdf995a7b6f1c48dc9b8e8ec4da5777cb1f5d2c9bf7
SHA512 40db868849b4a8b2312844c4cd21e6a34c427c860e8a8cd06cff99ba72ba9f7a46c90cb14c43dd10c7ba5c275ad01d5d5f01d2231497a7f6bdb5fde3f00b82d0

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 b6cc134bb782950316b71de4df4d951b
SHA1 c54dca03ba28285edd671b48f1878aba5b919971
SHA256 672f37412c0d0e3c4c25db3b76d194e5e6e61766876cbd3dfd0e94de0a794125
SHA512 1df26dc0edb1e88fcb0c8db231b5213d5d60687d5cc3021ee858c04eeb3d82869f50c57743c0f0c83841524aeb2a660b2a36f6cea85077185e5ba1dd373ddcb9

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 c15f2c4d7cad2c0036ca7cb23bfae70e
SHA1 a343b61cb1fe6b2efc3f9fb7904a487e506ef8a6
SHA256 f46b5f316814c91af115b9572073f235ee46b5a83f6ed9d88d274a056e7bd730
SHA512 df31ac0a8081997073f8ecb78987d133961c18b9a8b93b43ec4748ae88964316ff795950f17a04eeedddcb0baec9e8d1e9590ea0608cbf572fb3827d27798999

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg

MD5 363fb7638abf2ff2906dfb4834055424
SHA1 07a2c98e224597c418cd480089b8f3ee53e379f5
SHA256 55681c4b8e7dace74692da9859af87d2892673e569d93152cc4bbc7bb9ebc666
SHA512 16cd67fbd43eb28ae8fa4d4e60abb7e5df5368a01721cb06e5fafbe49649b6eb5d6a5197e41cb48d46fa9aa3e4108b3008f6b11869bb1d4ea4977afbe493487d