Malware Analysis Report

2024-09-23 06:56

Sample ID 230516-ehfjgsbd38
Target 7129291FC3D97377200F8A24AD06930A.exe
SHA256 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e

Threat Level: Known bad

The file 7129291FC3D97377200F8A24AD06930A.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Modifies extensions of user files

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

Opens file in notepad (likely ransom note)

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-05-16 03:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-16 03:56

Reported

2023-05-16 03:58

Platform

win7-20230220-en

Max time kernel

149s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\RedoReset.tiff => C:\Users\Admin\Pictures\RedoReset.tiff.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Users\Admin\Pictures\TestApprove.tiff C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\TestApprove.tiff => C:\Users\Admin\Pictures\TestApprove.tiff.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\DebugGroup.raw => C:\Users\Admin\Pictures\DebugGroup.raw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Users\Admin\Pictures\RedoReset.tiff C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02451_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\derby_common.bat C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\calendar.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00306_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VisioCustom.propdesc C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Anchorage C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101980.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fr.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\meta_engine\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00578_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18232_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BRCHUR98.POC C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386270.JPG C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387337.JPG C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00223_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\bn.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\css\cpu.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository_2.3.0.v20131211-1531.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\VideoLAN\VLC\skins\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ACCSBAR.POC C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Reunion C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00833_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297185.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Internet Explorer\SIGNUP\install.ins C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\Rio_Gallegos C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\calendar.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\js\settings.js C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195254.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Premium.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_COL.HXC C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME20.CSS C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\localizedSettings.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01562U.BMP C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309902.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02441_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Network

N/A

Files

memory/2004-54-0x0000000000110000-0x0000000000115000-memory.dmp

memory/2004-56-0x0000000000110000-0x0000000000115000-memory.dmp

C:\Program Files\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/2004-426-0x0000000000020000-0x0000000000027000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 627aeaec97e1634d610aecad4479d872
SHA1 c2ad81aea17de75e9597ac9881ecab4eb9578803
SHA256 afc00248f71304a637d8cea3fae68d38a9b1b0f39aa75d888e3fac1e5f202dcf
SHA512 c0e7d20588915d67bb3ce0f0d7bc015d5f62365d2c10696b323cec54674874f8c3aaf4760b1c37cfc5659054a53e8c21373358a2d42306cad7ff30660193cfa5

C:\Program Files\7-Zip\7z.exe

MD5 e30157cc10449fcfffbe76c44788eaff
SHA1 5d5e03d9f380bc13d9451dcd87c27bb295b052c3
SHA256 007e68240f39f5056cab5b656f9b6faabba9bda545c2abaf054a302451ef8015
SHA512 d34b9da12bf2ad56e7294400ce84598c7a4ee4465985f3800842c4db6f0931916b518be6ff6ed44fa394abb6f124ee54112526538eab3ee3931e2d45b50f2c6e

C:\Program Files\7-Zip\7zFM.exe

MD5 453fc9d10457f9dda601959b03846039
SHA1 f010594ba2216c4a8063b1dd0b1bc9e536cae659
SHA256 d80215f7597578e879ae8655434522a78b8c4d6324ab1c7ffba5416dada69140
SHA512 cbced6aaab6216b450fd3f1620dbab32a21f8cf462d15e19d71132434e4d9d032971c3fdd2ae40e6c03414f612279d3db843ce06ed405f32cbc58bb71f336c8e

C:\Program Files\7-Zip\7zG.exe

MD5 05a61b8c17382edd0821a64d746da306
SHA1 6e01b9f03acf131c52975f631347fa75a52703a5
SHA256 542f3c9d02183977c56f43f81eea147a6609c639ff5462a9e14ecb85c0409c88
SHA512 12e913ad839206dec54a8f1607ba097a32c272a117c089df6e67dddbd51575042407ac3bb00c4f6bd7d69d071d9e313e87a1bc4b259d4fa29953dd05b87a9cbb

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 46e384fe7d3ce5001d2a7345595828b0
SHA1 a98def1533931d09173764607a6be9497e2d513c
SHA256 0bfce796fc4919a059758e024b0ae48309484d5c9a9e3360a606e277c47d5e36
SHA512 dd59cac0000547d775447b65dffdef11aa2d2dfda4e4fcbf71cbf5e77da5681fff8547aa1b011749ad31ef1cbc6c0aeeb86a4d9480644d0f40f4c70e985b0017

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 ac3130c6247641fc65ee2453c7a5d931
SHA1 d465d0fde85c2f8c3b84b0401147fa17562c16ca
SHA256 3fcb88469eed29f27555106c097926bb34e9254ad621d9ecec5117886b5ec3d2
SHA512 62ad52541a92a537051b4c201a403b87aa52e7595ec7a79a56776be64af5b6f146d8e136a8dc62985b40521157916b71f4504f3a7efe6e3c509b8f9705697112

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 6cc4c3b9834c8719f352949ed0f5c1f1
SHA1 442521e237cff417ea2a102433d268d4e771ea49
SHA256 e850b9fb5634ce38906d36d710375ea58de1fbc0af460f4f908cfff4eb96690d
SHA512 bf17413a4bcf21aa40c2398a75e527a25178248b1a0e3c83f0171cac75775dbeabc3fbffcbe9f7dd619136f89a5f8573f67d05b1d553d8c16608340aaf2ce16d

C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

MD5 6f1ba43754c7e9f5a2467a57a2746866
SHA1 8a08306a31e6f45adb4a1a865699697a5612229f
SHA256 839c8ec8602b396a0a6de97536c18da820f8948b60a2a40d4add7696aad10aa5
SHA512 f7ae12a88e9805c51c89b8e01d41ae8241144b65b42fccce1f820111a3aca931433e1156a3ff2adf91dcf17bca9086e930c2b39848205c44e3889756a106b0f6

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

MD5 36259069fb3a384bd2da92ef6d4bcbb6
SHA1 dda1400b45a05e3a86086e911fa422ebf4ab879d
SHA256 1f7a3b5d0db86ede601fbfe9bff35f71199e04beeda75c54b901fee278c5d5df
SHA512 760a00c7bf142b420b3f39719cc4ea372547a8f92e4a0b16a2875ec29e3aa57ce9f504120f19cd60e62c40cdb35903eafeaf450f1be368880c0e32749a1ac551

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 5e56f5abf5e943aade59e8917085b820
SHA1 55abdd25770be58915b54e364dfe796d5ae8235e
SHA256 d85d758d512dffab6ab1bd8bbc7fb6966dcafc203d236bf7588d36444309533f
SHA512 c420715e6db97b1cba884f37c7541c0ed8f9d88a74b71bb16d418859866cce60c49c058f2c4d493d189287a1b8c0f9d1f5a26803031c8ad9c8cc0ced00cc8c09

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 a18266a313b83db3d14c5546edc80605
SHA1 896899b31aa65e3ab16e3f044dd9bafada58dc46
SHA256 1297c9d8ef74ab2371b2d4bf9952807d404ebee0ff9edf0960f69e483e17842e
SHA512 d7cfe935be984aaa498e07b0335ea56b748bcd75d73cf58e53013984804b2b167ae20e93f1005fb32323659f4b538587b54ce8c09c05c2589a05bd568660fbf0

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

MD5 1717f5de11f9fc1de938f2166b647766
SHA1 5f14f7904b9828cda3fb4147529557667c95a3fe
SHA256 6bd9d2104989c5b6710c91bbbc2400baab7dce682f4e80f7d95f4e6981d4ceb1
SHA512 54fbb73eeaa7090dd991ae0cb9d3267aff96576655f902f284e0e2fc82a42c15d331e5ed93aaa6eb2b38172637134a468406a289b67dc979dc2c0a4feca52928

C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

MD5 a1997495c2ce25a7f23be6c27baff760
SHA1 b49fe31f0b34a78e53d7e1f73c62fdeff46ae138
SHA256 3f739316e77d60e5661dbfffcbc027ffa748a36df919e5243e583c7cee3a86dd
SHA512 e0e213c467cecc426d6a417fab743a72014890afaffa4a5039ae55d5161e79a4fa8f92630bfa55ba781597782ef2fc8abe9a9a6c4f64fd127c0d6ce07acdb552

C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

MD5 438f5b718115a577b00be1f3b9fb7590
SHA1 cf39e36224583098ce54c8e4e36ec8139d646318
SHA256 b8aea6dfcda76085e49e7894a8c1a173d5dbd1208e3016e6733f8f8755036215
SHA512 e693f489995f3c9a9771d6a79496a705432d7ff3e8254dd9e51e50e4609a1565eb903f3c84a8f28b01cee0d44f4dbdd3749892f96b2293f2b1ae21eb26d97bbd

C:\Program Files\Java\jre7\bin\java.exe

MD5 c249e11d1d727f4f238409941cd1d0eb
SHA1 7479a32b3bf820cbd072bffc9a25e50c7f7d67d8
SHA256 64f804dda82eb13c948666e58a02b80b1fec735892f55c592481c0b3b49a04b1
SHA512 42cd575cf0bcd08b3cf311b2696264d91f7340d39308d818459e2648c14bbfb6ac4b80b3556255a52b5955e0c747a1eb513dd11ef18d4f9e6608effd8cab0336

C:\Program Files\Java\jre7\bin\javaws.exe

MD5 6fd8ce01e6a1403b2e665a205c0485b4
SHA1 8ee0a8ec4f00c2d7cc5dcfa88e5ae096416c0a56
SHA256 cee183bef0ad4a59640475bc6a37c4858b1535cd1e0d8bf7edb8611df6658b2e
SHA512 7985c75738d64563c8afd571eacb3233309d17d99d85799d576396478f7f94046c88e1712bf6d22c39e4043fe7191304a3153521b1cc44911da52ef7fac7a0b2

C:\Program Files\Java\jre7\bin\ssvagent.exe

MD5 9f1290411b457a2e4bf44b2a3e96aafe
SHA1 1b758b43e1fa5170b155f48d1d545869fcd91187
SHA256 74986fe2dab88c7201e9c87ab20e317b49635398143a7a1746ad9704fc221fd2
SHA512 2493edb0b0f985a63de9cf55bf7cb8abc2dc26a05dde7878b53f522bde9e8b5f75ec65df867237b0e4b0e8784db012148f4d759b26aed840aaae31ce9ec937e8

C:\Program Files\Java\jre7\bin\unpack200.exe

MD5 3615bed9d5e6dd4edf02ecc4d106a4c5
SHA1 80df0b396fa47e120e41f1f9f90bad14a29f08cd
SHA256 41abeff866a94636ba1f39793a8982bb5c53239160df3ad3bee5517842bf4db1
SHA512 3f14309a36bd46d07a6ca89d04420233024da2b2545c032cf61dbd08b1c74f443131048427780891b5125527569bc3194401a78b4af3f3012eacb93b423bf5f8

C:\Program Files\Microsoft Games\Chess\Chess.exe

MD5 32b22c68803087ddf05b87c21c218cb1
SHA1 9985dcfab6dda6af68f449c415f10f75a591827d
SHA256 19b55714055f226d389f3554014d4ac0df8667faba8b40db4168945f90e7cf09
SHA512 4108e5c201f9c5c129ec51e438a249a7d9cc51fa57c50a768aa5229b5b06e0557f60e9d9c6e74e77757d27ab343a08cce988ca7554e09775ade61a6e7d2c3509

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

MD5 1f48c7fd51e6f0be453a88396f7ac6db
SHA1 9409045410786ffcf4f8641399f592c946968a0e
SHA256 3c8e4e335cb1daba3240d0d2564d6d3b5457c5b87a10a3be9c7933a55d5f7f9b
SHA512 7965a8b9d3b0f425d62923a359fbca788f69c75435440d7acaaecc271fa0ed56135ebe8d1ca8a97fabe879e32449b8153b8ba6dd06f7cf9dbc84ef0c0ad9692d

C:\Program Files\Microsoft Games\Hearts\Hearts.exe

MD5 35b02266d0203c0951ec360e15c151db
SHA1 6c6e18f08821cf8e5836d3809b1a137c452ab761
SHA256 0f1c373ab327034e60f6115e464b067ac7ea606bf4dc19699910dfbe4939a1b4
SHA512 0173cd3bc2d6cdbe6f820ec515cc4668eb0c82864313140548cdaec842a082a394ed0cde1c3709644d0fd7976b65d29c93a905425c9d438a7c7ac323cebdf8d2

C:\Program Files\Java\jre7\bin\jp2launcher.exe

MD5 3eeab08aa9a4b6af9bedd22bc0d9aa1f
SHA1 6300a0e0825bfba5128c5c101be3e9a2700fbef8
SHA256 e67938fc8d62b79b8eafacdb2ec38e143f3305b647fac3f48e074ad715a9b4ec
SHA512 e6c7d5da2b96aa220774b7ca24a31ff3743f89de1b3042a1763069a7d604a1ab6e04f3c27d1b9a00bd646a81cb72ff76a6262c8015ee78e385f7f9da9331c462

C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

MD5 2a398634a3345a9851bd17654fd8405c
SHA1 7c48f9aeda982aa4807f7817a414152f04dab87b
SHA256 0ea7b8f1132707239e430313c47351bc7a429a3bc1f4b39a60bb889d58a67987
SHA512 7246d4fabaf3277d78f1c57b1beb6d7aa1c46fb81d340a707be78aa5f44736e327830e960b203315281c0fc85fe45122fda19821cc323ee17f26a987c73ea787

C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

MD5 2b46a7dfd18118b480a89692030abb4f
SHA1 5da440b5e168bc360de3bf87121e1325776e1313
SHA256 5ce5838c419bc537c7346e620712fb1b600e0d456b3fdaf109f1cd522f92bf8a
SHA512 95d1c531ba96add32681d6489a9f4beee36978da091b626e87a9cb72712e2668befb762b9c68b6a9d69e3d00f5c332ba22d7b3789e278d2b82601a6fdd0d004e

C:\Program Files\Java\jre7\bin\javaw.exe

MD5 00394be5f80a9fa480e0b621ea0931d8
SHA1 e8a1f32ce32cf7fd66cd65afe85c740e4a8ad112
SHA256 6d0cfc854f47f72b589939e968ee587c22702518adf893ede3717168d8bbde3a
SHA512 9bda2f40aec6688d5136d87e1e91450520986a33009230d16652e29b6559765c638e0c47582c9784302087ea88be6f82901d8f48ba4974d50210a031d71134e5

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

MD5 2533fced7635d9fa57d672d9b3d5cff4
SHA1 f17f7821510eb26f96135abedcdc3464fca9d221
SHA256 ed4c638304b283dbff12fde4bbccb063cea2ac378047460aa707f6d67fd59266
SHA512 f2c7c3909adf10c350e21389bae9045dabdd079764ef917f7ccaa50efc5cc342d84eea907e04a76d166b774a0e650f47a5446302f440f366c9f3159657aab8c5

C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

MD5 8a9fd0e91d61ad3a46a0c1e6027f768d
SHA1 712e289fbb77b46c4ebb38d146f390fc89fb3aae
SHA256 29b55fcf7a043a9db648fd7d206c6f5f6b037c9498105dd01dd1ab53622dc3f2
SHA512 8b832284b98e449daab6b56e494a79e9dd06638c274d942576a8030e6ff212a35beed49c641e295984e5c4cf8db0400902fc9f7b6bb6ef22ef627669eec2fbac

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

MD5 d7e70a2eb303f6741d7183436dda4c44
SHA1 2e16886d9e23b89123051d041deef58931c02127
SHA256 6b24774f3018c3ad2492222d01c53b8c813739243a729bb9706c4ddfb32f696a
SHA512 b3945935cecaa17ce6bc60d8bfe2e339b50068b6456eee79131aa9f2ed236e6a5ff2a5e9c28f6d37b6c62efbcd8bc5a00565706f6cee88ea669f3501f80ccdec

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

MD5 ccbfbc8245497518f2ab529549709c0a
SHA1 a306d5712d8fa1b821a8a9531f347c8a5639f71e
SHA256 f6531c87141ac18f64c49212083543513ecb9fb3176b34705b1da7fce5820218
SHA512 f150595e53ede125c954dcce0325adcf9671541a81bc7d509ed1ed85569736bf75f0ff838d71404588c60750f60106656fc36f262969363983cb4ad03094d082

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 ca4693b4df5af1aa20daa1377cbb8ea8
SHA1 d136fb38d0509a60134574025ef2e420824343b9
SHA256 21a960a1c1fdedf67ccf0b8a77911c1ec1dd4f2baa51850646a2499f21091c09
SHA512 ce8f541981463a2f5da23ec79af31ab947fe981913d6df585d1fc17bd507efeed02b0521b3310254c9995742349940b7ccaa36d20aa938eb4b392d9d6b00b1e8

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 48aa1860397b347d71cc50b1e11a69eb
SHA1 1d24199baec2c5deb3f5847c2e16d89161843bfc
SHA256 520ba9660a2f21d75542909235a0ef7d81144ddef0609051b0c1e9162e8ae329
SHA512 a560a3b43d2a203369eef19aa26790ad4b2e2de8fad8a3da028a4325aa33620f64a0e2601fbd5f858e82aa127067ae27752a7b67cb70720253e3d2454b1f0696

C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

MD5 b307ff98b196132d8abbb0a6851db91c
SHA1 ee068d2b797f17fc09a053ce2518dbe69135bf50
SHA256 86badf3090ddecbdcc950d51150613a135dd0403ba698f99969f8f9d24e6f100
SHA512 2ea90519dc851dfe00fe92a5ee86b3b206bb43c9cab6f3eb9ac3558e45739e6e1ead11d27b40063399baa2700faff70ef921fc67cf93096166c22bd3298fed2b

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 09a22f20961f5ad9662239dc422573d3
SHA1 d7638bc5f5b720d3ade4de87aa4cd2e58b129d9f
SHA256 4cc0ca2939ddea107dfb6bf409b5bd00a0067af4ab307cf920e8815e95233ac5
SHA512 a1899b55d7b53359a5287ae48d193b3c1372489b6c9d6ef36faa00f31627ff081884dec53e706bef4a998c8519b9f73cc286afd0d2902de371c22016a36d4e07

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 57c94b001fb90e50b6462d0340e83aa9
SHA1 34d742f67814ddd26aded7e4c53dcb11d64c768d
SHA256 d6d7a867c3e8fef4d9e5358d5d798d8986882508c854241bbbd593bceb0115a1
SHA512 a2edd29662fb98eaea1800b3a066b652858156b0ce182d395de8deac7c032a78a6c410800e46952ea334f4d0943ad1191b77645933ac6af4671dd15743a07a03

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 6e184b10b80bccc1e71c68238023a284
SHA1 0fb15293aaa4086c259250ba54a035d86ceae19e
SHA256 f1340d7ed3baf30b0530ffc59049bfd4109c6497b552c04f2206708ab3d91a4a
SHA512 a72c10585e9b92aeec977376bbdc94011b0c43a6a6f71f20cde76369db37fbe0c3feffc3ab31c9c559f33be7bbb762c6993b1af6ac3567a3ff634e728b904bcb

C:\Program Files\Mozilla Firefox\updater.exe

MD5 2f020e6cba99c91db5f3f0f464b28b11
SHA1 8ac572b4a79be41fcf43abc7514130400ae2978d
SHA256 77cd840679310a9415a36749354d21bb56e0d8e7a06319054916e9d6ad759cc1
SHA512 adeec9d7db7053425abec788d256b1681e859e6e5e999540ca153d896f63d28afd4529aad45077b6984b299981535b46ae4a7dfbfd7b637bcdaf81983abd74ae

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 3e9be58f4a9323971b69ff006e4ae130
SHA1 34f9f7980fbed7c31e6aed2e212f12485952ca52
SHA256 84cf8851a32f26d2064e0fd13c781d34a21936da30194249ba603e2b4f99d8d2
SHA512 a0603ce7999baae03985ff9cb86c7184c04d1487bb0522fd47d5d026efc636bd2e1c0bbbc8ad226db6cd109c77a802e958f40cbbb05dfab8f9aaab8b850c44f7

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 3a2e91db71582c43279bd823d1b54675
SHA1 1d2eafed55c423377fbbc545a4ba1e5fe11f2663
SHA256 3d4c398a4fa154257b1383a7d2f73fda3808f8564c661e5d7916013adebc3d02
SHA512 182e03f5f9a3e9be737863621318726ab83f07c0e1fa648471f009b4f17e99d2c7f90add72b27303041546ba3fcacb551c2b462e6f49c9d0e21a8a754b73a1b8

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 b63c17e72fdfbed73fd97bd8627138d0
SHA1 a768e6c256b38d12e3eed9cacdda7eb0a7b00384
SHA256 079039b8e257d3d97d9ed170da35e2bb4cf7616bebc30e5ad7a22c8119f5d015
SHA512 c842f1ff18ee739482b3d8701862f89fa4a48f51c7acc77b8ea2d86a51c8ee5ccfb8fa880171fb143f12f1a4278731ed0c598e5d830f4765ac3e82646dd08223

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 8a0441e00b108a84098e987ae3bbe9f3
SHA1 e5e771d6d4ae4542f06617116f0744320f4e10b1
SHA256 c5734ac5a86c4ef24d4d051dec5f37b86f3f4138ba20ef353e59827a096c86ab
SHA512 5f4ae1b192464fa584613ba8afea01946a66fe8969d72e081cddc9fc8f21fec2567eb276f81baf4709a3ed3bedba3997159ffea2d8d1d64082e607f3107b0a7e

C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

MD5 6acef1ab940c8d039073294b34920ad2
SHA1 c8e6818271f02c2177f9b67981187a7cd93a6825
SHA256 199c2ba5dae18a33eca9575f191826d697eb4e69f17b0ade23ef84a835406b30
SHA512 f8fd4557ed1f1f73d06da46a53a6be535d18233cb53bfd8f136ed7bd707e56588de818a88e608f0c0512611da3c3e0afdb5421e9f607fd3ba38e3e77ad11849e

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

MD5 048a2fd38b3c85dbdb567915b7c28a1f
SHA1 af7150d20d1ba8921370f65779b2e353e7bea1ee
SHA256 2fafdceecf554fe9ab674df4272329d88aa8ffd6dd32adfb8bccae84f765e9a6
SHA512 8b9e26d461577a08059a18b06fe56e4a328e0472346d5b0b85fc2181d348c5f5daa64aa539297f88407df36fe7fcc89d99951174d101c9202310eb1edcdc476f

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 d8fdf6115e17f4fd4fd72a86e93f0275
SHA1 7f012b7babb5b9cef8762a0cc1132a5896627a33
SHA256 20eb4cc3ff5ed160932d2c02b206acf0e5da9bae57972f4120d4083441f382da
SHA512 393f4aa978774f2968833872a62e9e9d81885eb41a0e67cff733edc8bc1cd57291d2d1c0dfe51f876963ba4a8768d2edbf3f966f273b0631f776cef7b9c64c73

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF

MD5 57e4f9bb9bfc8e662d665391cd313d17
SHA1 1932fbc73759c495f86e8a4dbf661c714b2931e0
SHA256 8ad5abc3729cc92a782bf52c2ab5c981bb28e0dfd41692b3e870ffb0e5450a62
SHA512 7bc527b6b5edf1a9d93e63058932ca3788cc16c4167272179942d71df9bc8fbf702de5e186fc09caa946a18914125bc2d507852b2b9087c6579eb7079d3c0317

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF

MD5 19c4e09893b4dfb7509c885577bd9393
SHA1 ab13ce04c1c06ad527f36659cef43bba7cb8b90b
SHA256 a7942fddaccc7521e343417a51c3d295218f9bfaad9db6943d67b5708d45827e
SHA512 4abfd90ab73359e6107cdf1d2d17365d946bf245827f6016469cbef60cc82cc7a40d34f5f3b2830670b5b70648a1a0da90272f4f58afdfdaf4a19c4cd0b6d5b4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF

MD5 4928ef7898e511ad02b8bb4a856b12c1
SHA1 87f8c4f8aa45588b717b94d235b9ee16a11e3f9d
SHA256 3f4a30afffb23156063fc02da267be44d68e682225d593d4c6f604ed07080d69
SHA512 d09b7be4c4ee342080e8a335a7e8249744d4d1530146ab1ceb46cb5a837234545c5c43a20fb9e26e3b751993bdb095c5ef20213dd7dfda6722a1d930be0616c1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF

MD5 6ee5137e0011eed0f332cac4bc7a6302
SHA1 6d830d58fc449b4d3ee6b1b5d316c56a904c0446
SHA256 b33e9d48a6095c0a3ea35988c39f6f66da2d447742983ffe8dc78f950ba24ee2
SHA512 3d9ec4f179b4fe21c0d7160ddd8e9d8f30e3df1abafa95811568566ce8ae624fc0a24142f8edb3440f363b4262ef7faefc497c55411c937d67e19806dded37cd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF

MD5 4705b47859cfc5f4f447e40612f1fa9a
SHA1 8e678bbdc6b704a2e76e970b45cd3c10f326eb46
SHA256 6c3ae1abd9dffcd35ab1585f008a3c0c60671f0e282d7cb8452d1f5d10b6751b
SHA512 c44e5dc4fa36852b3918843384906be1985a972c8f1191881700c265f2f732b9f2595f348dd6bc7fe655250d130998257cb1359a3c5409eb49f807a54679a9f5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21306_.GIF

MD5 855eeee736b73b9d883b36cac65a3847
SHA1 14a4b42fc5e048b78d37c23b714cfece6c154075
SHA256 2a46bce5f956997f8c2cf111c9ffb5f3cc95be569ce919f0055ead4897bce218
SHA512 abfb0709b956189cf3c2153acd16938944d8237a10c19e1845f37f28cc409c9094734fdbe16ed9fddff1fe402a2c2c385420cbe6bc11f631ee1c83bd4f850ebf

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF

MD5 fa05b73b6ed1e4be179617d340d322e3
SHA1 7f64f1d3099617460d4b0c8369d4ac3c7d376dee
SHA256 029ce90cd771c890237c3c3d2a360c3bcbac84c3eb5cc5e9a50e935ba8507af8
SHA512 3bcbf7470492a1243a7c30afbd116647b98bc01d3274107c1ee677b474b26ea8e674616e744b922e2f125df31faf851c78ba6f373afa1b623a0dcd891d04e7dc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF

MD5 4b1af16ff299bb38e22668f6c27ca0bd
SHA1 a8ec39fe38ec34f04c0acf56f6f475bfaa7e8675
SHA256 2086f06b03677b8e5064ef3826b970c183d8543742616d02dbd4675a4891a675
SHA512 12ac25bd74860c3f2c53a353fb6470f4a79fb532a2ef3af100f0806cd1389a8c78060ebcb421b4bc6b56a865c2214fac8a666bed69ca85ca226eaccc3ac443af

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF

MD5 c4d0be625d370da5ac70a6ae7623737b
SHA1 d55258a6845f3aeec71b2ed334336de7258df716
SHA256 21d2114052fdd280b9ae90de2478fa50a9bade4c269f6a1979cc3e8801f7f2cf
SHA512 31e43780f14f9f62427c3d436ca61863e5353b649f2ffdd5147ad56c00a0058a45b75991ba231495a3939803b3b12f7845e92a9672af2188fd44c439a18786dc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF

MD5 34080b08cfd1382a94dc91c69349ab1c
SHA1 366012134c27da82d5cba4c81dec04c233f799cd
SHA256 f7c784653f0c486e7c58dc29134a2a535793c4b3e33a1f6c16831aefd3e8ce20
SHA512 6d933226072accce11c0e6f6c18648616bddfe6a85bbe8ec328273e718e097f0f08c9f50c21a4c4691944242a81a4b847cfb7002c53b815dbe8d4c99e0a0c964

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21333_.GIF

MD5 973b398b5994dd7cb5597261c397639f
SHA1 dd877090a1c0d10c5379bda1a306e2a9b9348f93
SHA256 d458c0953bd842bb48d3583b8b24d93b218aef1853b5717994784fed6d213204
SHA512 c4a9478d067121dd10c23e602e0588707c293de6ffad82b4c31b866728bf423723f036203fe83c5e59d02c7cb88f2f1d7d63745cec65134de80e5bb7a99a9f1f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF

MD5 6336ac1612e52f51bae8a5df88963ce6
SHA1 f52f250fd2c9760833e433579bf2ed41e853f44f
SHA256 0d8f3aec7b3a2f8d9b7ac63dfd5c3853e9b4f5384076561ef4e8f8d65ebb7798
SHA512 cc42b286c5dd25e913414d36070f1a87a6827e9b0065b07729fc093473c83fb0703bdfb3feefb8c19a970964628dbb8c359366ef6d91100e4a46cc1331075fa8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21339_.GIF

MD5 66ed31284d67d6876cc98b26a5664386
SHA1 6ea41e435212141b33fde60bbcc392d80a598e13
SHA256 7281d27003d9d518d0a39245089eeb5e77dffa618d4a8e449f1e9bcd8cfabb81
SHA512 4e0f27ac615f65a25c109bb7ebc378c5bc899bb8cf3d15b9ee52d33f2680fd0fe3e136e9e32bd889e0ad840f0e8fd4e4c73611fdd3aa6a72f1967394d0aa7a1f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF

MD5 50f7d761a69224f7f5710045ab8a29b5
SHA1 c44413f58987e0899b80edeb648e194ff53bc5bf
SHA256 068dd29bed597a468e210bb1cccce26c6e9384fcb4fa25bc9228f40fa55d066b
SHA512 65b3a29c2a032d3b646626862a36a84fa9929fbbf586f004450bb7840b33933d9a6fccd83058328aa893d9fd77d7b4cfb2161802be2608b3f8766122fb32bb17

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF

MD5 36621f1a240a2f749165086b75886e90
SHA1 0c6fac73a33ca7736a387242a78498949498a549
SHA256 c58d9d14d1da96958ef8bbcbc7da23bcf1cca49bc077e810f4ef410961222a1f
SHA512 45da8ff5e3ba1c1109c5b86f09d596b9f3b11665be7287a152b962d59f4afe2b484729c6c3db2d7ae95e9a4221dc76851eba8fec18d93a99d768b5da1fb1b314

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF

MD5 7fd515c19d722bff5ca12d2db0410da7
SHA1 d9fd7f227202356a7940ba8776d727f9bea9f2cf
SHA256 c70357e9c7733fc97b266d3eebe9ef5f3571cfe2d45c17d1b120fc25092c294f
SHA512 46325b9acaec1e6e06cb473678076f0129ce2a698d129d7c94ed51f0396760ec4d707119d628acb20fe60d3d9133b4d2ce7e159e5eef26035e9432ad4cdc1c05

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21364_.GIF

MD5 bc2315fd10bc6514c487e9dd78620aa3
SHA1 2140f14002b5482f0600e8db22978e945e3d1daa
SHA256 462cb72ac012040b47212f41eb41fcd25d446fc88bbca3a4d39bad8fe75636e8
SHA512 3ae44a2979c309e224b06ce8310c6f89fb57ec1947f452e838a490906acdb4a6ae7a9be5775f713c8462908f3b29675d08e07edc3bfe71838575cd9031ba418c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF

MD5 fd90ebe6492afa1099c89fdc3d610652
SHA1 8f17dff0abdc03f9041c48774de617688cd0e786
SHA256 0836432b6b1321f43d1e71b9f47205aa7af7785330771040ab3b621d03e4f156
SHA512 00008f6f271fe3e6912ce75e1c12ccecf8bdabf45172bf6e71d17626d80bce74beec20953d17f5bb2bd72ed262caf80dbfd9c9d4ce65ff2e0aead4b8e127de6d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF

MD5 b2cd56fc649a62161aa483dca6ecd0fa
SHA1 287ff8ac7b2614b4c582b8e9f412f7a210a64c83
SHA256 d5b7b66c66fb4b000b5028312a07a7bf1895cb0ca4e2fa0eb702283ff85028e0
SHA512 ab95a382041972367d33adb7a169abb603ad931e4f85d1490a967165a827057229a5dc400815f8874b2b2682773b29d8e95b30468557e52984447e06b0eaf9ef

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF

MD5 5eed6c564fe9ac446d8943202b664194
SHA1 aa055a471818d80ad4643542b631d7943cd52c3e
SHA256 08edd1a4b5d4c5667f443bab2cfd69047a3a05647abb62449d4fdead290af529
SHA512 f2936c3af227355446c30e0e218dfcbc7584632c3b635176ea1771c14917176975ff82119351ad7a4981c8b24cbc3dcb3d66d1dc68a614f973292d5a0f58f98c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF

MD5 227dceefd973c07fc10cf108efc78c16
SHA1 deb3d3855be253ae6284cf057ba0a8388e03b06f
SHA256 e427aecc7044e84a154f979e2e53f614b5d9c00e30aeead377b20b84f903c3c1
SHA512 80c4aab0ca28a75d3788d9865cc680574f7837e142d4f2c14c7320b48fa2b0d3a1355dbd94a07b09c709890ee6737e7d98d9c24b44e8429d92f38ccd95e08c60

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF

MD5 73bd5e97659b5316ebed00599ca8757b
SHA1 ba7445895e5571f7068ba565680efe764ec8946f
SHA256 7296222fa4814fb2a88b35c33eee5dfd92a2bcf1693151f4054e119bd2fb8865
SHA512 32a7a6a0a104ae51d67099d086fe8549f22d84250375a29ba6a349d1375cfbb88f639f81938c153251a184d87b8e788dbae12ab292d9f6072f4612e626d59f1c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF

MD5 37ad79a2bcdf9c7f778ee8ef8334c939
SHA1 4f350d57807de37a99cf672da1fa0c8644d308bc
SHA256 2e2682c7c1c7dfae3feb61aeae6dbe0b85babb1b33537fcce61a8a8bfb85476e
SHA512 5ade31af00a42ded86e8737bd1c3e44c187089bc295854cfa362bf5c8dd02a0f148a8ffa58a0a2fd25b9fd49ef478ce2745f6e10378bac56144e568597efaec3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF

MD5 cb8ea22d442c3df0f2bf7ae02c9d2094
SHA1 481ac4b2ed51aad09590b14dea9c8bab4e5b94b3
SHA256 4d97667f173485c64adc5bc71f7918839262eb1e94204ea33b1b9b2f52b2b44a
SHA512 b83cb4746d797bc01f8049d8977dae8e82a84659dd1c462cfac632ce76c9498e08ad99d3a2e6dcb3d14c8515e3f122774940c6cf4bf5b3af4f1cf897ad12fe1e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF

MD5 6875ad629353dda1b5776d2985f181da
SHA1 5e3726ae1b2fb0abff1f6435db7455a7b384c935
SHA256 3816ee9fbd4572e1c0bbec41f7a6b90cc01e3cce0d7582e7d3c83b61ced457af
SHA512 b618a832432e6840daaf269ee3e9ab9eb6f1e242181f928c1cd7dbf0a7181a57bc4d9325f9c424de6de0109050c3db374a43530ad542f2618af86c4bd657e2f7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF

MD5 a05e3696e4d8b6b938044a33559cd8c0
SHA1 85e672103103a195564802a45fa66b372ec1e17e
SHA256 fab1d00acb1aae93ce22f3c4b574a94e7e59fbf5763202009526ec9da053cca4
SHA512 0cb94e73320303c787ecf7b008ef0d1235f77706f30d43b0bd812f8cff228006e2da8a6e082606f906237c38bce17327acae4d17b381c89240db58bd643d4954

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF

MD5 25c757725d5b71fda9179fcad2d676d8
SHA1 01faf40295af5e5f6de96a5a4971dda28b1fb44f
SHA256 b7aede8f7c70c0c3130038f0a537dae408c95d852d9fb881f9996363dc23d9c5
SHA512 91b0cc696330a4e2938c6de4e44dc310c9ed689898cb11555e696650424432a3ca76b50bcb65cd469fe7f162fd6b6370b4cce91473ee3ac12cbb75041941bf6f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF

MD5 ac26e87c4b1391e07722ed02285a88ae
SHA1 11dbe492ad86674ad7cbc9afeddc121eaa4b7380
SHA256 a9040414b6916e8e37985917143fae0040c4845571c63ed353dd355102cd3d4f
SHA512 ce2e024f6743024c9a858d913ab61b3ffb43793d2533b3856c75ae3d502e5158ef9f31a8b5d90e3aa256c51ac00b9fe962424909bce4fcb400c6f46d0f7c26c0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF

MD5 4c80e76ba27398ef71968ee8aa95a243
SHA1 f5ac703787612068e04dab6a1542cbd975e7748a
SHA256 cea4cb527a66f66e68e1291db7fa9086e5fc997fae1ccdd90911e615b85d0de4
SHA512 6fc8b6e183ea230a2477881dbb7861904bed4cae852592d5154c7a93eae9f6892978dd557881cb44dacedad11c7235c6bef3327e3f000c1bf07e944c668450d9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF

MD5 8b8dab4d022515366f201bd02044e804
SHA1 a7fda598fed0162159572b2f2b8bcdfcad03c184
SHA256 312763c7a06b10ba5e689639e80c3bb5bcbfd27a4a5dadbfb860addea8c56a31
SHA512 7a680e9b4b654d32cfb4425d3b7bce4cc3cb48056b6a035956ff8426ca3c7aabe7d6b2837f4d7c4a025712ffbfe95894c10aaff53593d387980d5cf137f2c1c2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF

MD5 3886a83a0432801da2bad510381c2a75
SHA1 1f7e85fdb550af94a119798a5270d4009fcea1cb
SHA256 9171e213ef497ff15ce00f357623cb2a88c209e19f4ac0123746889e6f305bc5
SHA512 082e8529d417360a7e4b6e38b8a755cee743d7dcfae057735a28854a047a4252ae1f61ff658ffa5b932ec8920f7a1ac3ac2132158cf5b553d6caf1b2e13bad07

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF

MD5 ff3403df9c2f8d5780a394f887ee119f
SHA1 01c0bf87d85910be39631a078f34bc563ddca23b
SHA256 1dcfcf9a59a671c839298c7b6b2ebf6187c0071ed78d2b995832d35402054864
SHA512 0b352f1fd7695019a57198fc1dcb4b857eb1a97cee4d89079a41cd1fc9e9850532dd52ff0082c4cefe15b6b03a0bbd5f95f7d715370b695737e3f91f3acc613c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF

MD5 40ff778676c705d836be6511c77da1d0
SHA1 6eca23004a96c4ec754d8bd2b28f4b0ef3e8e4fc
SHA256 9aa8e14b9a69ba44f636310b36a7d9b1dbebd6b984ffccd8e66a90ddb1128eeb
SHA512 e14d978a8e21d91b7a4c5735cae817028aa50aa810afad6aae733eafb03cae4cd486fe406460e8d39cadca408be33206d41285e6e7387856d64d651df7858d5b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF

MD5 571cada8db4d66da01b32a7ad5e45f41
SHA1 ce8ff1731fb22fe533edb7611e707123ffc1947c
SHA256 9ca5ce3fc7a4c3fd15335106637a0325dff554b25c6d876e92222c2acabd65b3
SHA512 ae266ace90fd3411190563aef8f6398cfcad3228e3b328aa48ca305f153c7bb843374ece897e2be8c58ee5a315679fa88273727a13b2dacf6f806eb7f1e30bf2

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-16 03:56

Reported

2023-05-16 04:00

Platform

win10v2004-20230220-en

Max time kernel

261s

Max time network

263s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\ExportResize.crw => C:\Users\Admin\Pictures\ExportResize.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\GrantSwitch.crw => C:\Users\Admin\Pictures\GrantSwitch.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\InstallSet.png => C:\Users\Admin\Pictures\InstallSet.png.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\css\main.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-48.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\sendforsignature.svg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ui-strings.js C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\197.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeLessThan.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\19.jpg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\zh-tw\ui-strings.js C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\Movie-TVStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_closereview_18.svg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Snooze.scale-64.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-72.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\168.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\3.jpg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-30_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\file_info2x.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\Doughboy.scale-200.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-144354903-2550862337-1367551827-1000-MergedResources-0.pri C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\6px.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\MyOffice.RuntimeComponents.winmd C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSplashLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Cultures\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\da-dk\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateVertically.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-30_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Dismiss.scale-64.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WebviewOffline.html C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1560 wrote to memory of 4896 N/A C:\Windows\system32\sethc.exe C:\Windows\system32\EaseOfAccessDialog.exe
PID 1560 wrote to memory of 4896 N/A C:\Windows\system32\sethc.exe C:\Windows\system32\EaseOfAccessDialog.exe

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\RESTORE_FILES.txt

C:\Windows\system32\sethc.exe

sethc.exe 231

C:\Windows\system32\EaseOfAccessDialog.exe

"C:\Windows\system32\EaseOfAccessDialog.exe" 231

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 20.189.173.4:443 tcp
US 93.184.221.240:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 8.8.8.8:53 2.77.109.52.in-addr.arpa udp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 52.242.101.226:443 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp

Files

memory/2156-133-0x00000000000C0000-0x00000000000C5000-memory.dmp

memory/2156-135-0x00000000000C0000-0x00000000000C5000-memory.dmp

memory/2156-146-0x0000000000020000-0x0000000000027000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 170fe423cd459ed288155642ab422dce
SHA1 7f9dffd7ab9168d925ffa57522d81c6b424af8dc
SHA256 533cedfdd06f92507fee9a5291a38b27b9a409e48899252be7c0de29a2d34d6f
SHA512 ad27ad27e2374613f5c44de360d3591bd5e23f9a2cd441989ccdce520cea2eac86c7dcaa20f91dcb1349d0e1d3df4fb3c0bf451a416bee1f55a09a9eb0d84617

C:\Program Files\7-Zip\7zFM.exe

MD5 336e723429e195f475a7b1a6584489ba
SHA1 e0f238c4b29d946c638d581d09d060d40d7f714f
SHA256 6ac7507448b3740773d71b6acbc6e9379e20fd4cd1fd18a6566d0e99aa752535
SHA512 10b67381ea32b14f00c5069677e88169e8d79271462818f20e1f67cae9e0c0d91271caf06e4adecec7ed32536d7267d329a9b92e874ffc34a6c60a985c2cf664

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 4e4ae91bb70feaef2cdaae0fd1aeff2d
SHA1 0a41320eb9e76acab22eab245f6f0795bfa519e9
SHA256 3868b905680449214c379770d22326a4d0b4c2820a1fdf34808a05985a179790
SHA512 88d1e8d213c654b7d3e24a65d7bbecdb56ffb159bffa3c31751b79ec241310b1f04c997e751362f4eddfe943e55d1589a83eb2bb367ededd24018bc79552bd86

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 f8dfc820bad4b35399b0d2dadc132d66
SHA1 e81461ee996ef2c537cb67355184515987c0e630
SHA256 5d33e3dc1771b895621465817cd012801956435b26374a9b48404f40143e0582
SHA512 d14cbae5d1c1b5f94a2dc4c3912ce3d4eb4434ffcfb36a226bf8e3a18e429963e883fe19ba3d9587a56a464442e9870c5c889d11afee1ebc4c07a987e908213f

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 dbd5840b6763fd43f7359dad6e2f9de3
SHA1 b49a71b653fde10999659a3b7dbc1966febd7f34
SHA256 32b73d259e88dc8b67a8737f8c34eb7f12d1de616387dc7404fa931d09f8718d
SHA512 fdc8e48a8c192bfb365d8127079e3809b1fdadb1a48555ceebcd83e70373eed44f626210fce0df36c6149b13e2528257dad1f238c840bcf5e133d02268d23dd3

C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe

MD5 9d2b027dceffd722f270b418638e55dc
SHA1 50c38000317326accec6d25b042b90d2d99f4136
SHA256 d1a7a181e5e96278af8e09e054c659a0b1ec442ff620ae0ab2d02574f50158f3
SHA512 28a2b32d65a619db00f04de865b8755ed2f8e6d0b982adba97cbfc6f7a2dff69dfae19c7a3d0a6b358d85d9b5f07c06f3ddd4a9ceca36732797617c8653122af

C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe

MD5 6de09cbf188e22b0cfc2ee4d78480208
SHA1 8a2642eb59bf4915a404b378152ed3df73df0dbd
SHA256 01c7c7b2e2a2ff2aed04568396b1831446aa065ca86026893ab436a4c5d46cd4
SHA512 caed6a9ecb54c96d06fb9f3332b17c9cb01af71d2446aaf43c3469f4ea0469fd248fb699f39f9112141c098978f3a42057fda36bc7da027de3363c49ba3d685b

C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe

MD5 09e886059c6b444c61339f24134c04b0
SHA1 ebcca51a9e3c1077cc16a5434c8e4db314cf5138
SHA256 a048cca6a2beac5b1ee28615e65fe09bdd59298aa44b6752378bd2d53c32dbba
SHA512 a86ecc9831d407824c0a0e678ec9bf06b350be0066eb4d1d6e4a0651953d88dabd4754a4e644561122c0a4f0a523c7a0af175df1fbab5875f421c788ea4080f7

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe

MD5 3bb5cd5aae07e2db21be56242bb36747
SHA1 0f10b2cd22b22d32439621b779e7568bb73ec453
SHA256 bd91425c880b9a837152a983776686886081fac71e9ef3807d0f188dd64b5548
SHA512 bb847181e0f2ff0acf0f59584c3f2ff8221199c2ee418f0762b50d26ae1fc8a2a839eeb85534aea793f97eea0c7b1dceec8d63a90cd1d750512fc9f64965bdab

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe

MD5 08931fb229188badfa5a66a31771e564
SHA1 beccae6d9f1768b61784d40a2430e0090581d651
SHA256 66390c37435cfce1754bd038308f9f1fd861ec3d8c3e9d60ea4294feda6dbc95
SHA512 1c7605d237d68a754ec71171eca20d43d0b9f4b660f065f8991ff40c81e5ffffc5a3bc615bc02b4499f6ec25b97c1249ae8f2bcbef616378cea2054f61fcb050

C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe

MD5 97ce6bffae2dc9f6a58b7df4c07cec71
SHA1 8a81bcb5e49bc25ae40a42225b5efbbf86bd4957
SHA256 abf53280b88199facb606d74c827f76d3d8e9aa0204db54ae205b9b5374a10c7
SHA512 1534fb3bdb9226448995ca07155ffe04451a798d3eff8e5a1f6c7db7b4043c256fff3b75dcf31061a48e7de998fc78140a833fc148e21770296218830df9ee43

C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe

MD5 3cd921c00749be76a613264a34f6aedf
SHA1 1154acdeed7bacbd5c5935a0258cae22a99b3c7f
SHA256 1e490cdece5dde7eb51c0a9d7a56bb3f66b155e32dd88fab0bf078bbbaa62506
SHA512 ff93e3c0003c7d043b3643526970be2eb1c9b2e31ddd88cc6acd73639209c2d6d8220f648a119cff4b451f2fcb21bf82402bba762234fe988772e9b78dc8ba0f

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 88fca670ee94b397117f566f67fd43a3
SHA1 a2578cba23b68de77a29e5792565ce7fec3e46d5
SHA256 f3718a4007924fc6d4cc7cd22dfb8068fab75bb7babb9ffd4ce9094eb648d1eb
SHA512 0c247dd620d5561eab7a828813beff7a5d5437138092c5c57940597d85cbb8f68ae8ffd673770b93149152c5f56ec4b3a2212ba1bf5d10e80600e5e7545704e3

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 bd20103bf9d895f50d016442423cbe15
SHA1 739db269d40fefde2a353d74608b2df364ee20e3
SHA256 dcd61264b2fd991f895bbd1d03853580daecf3e06a822fd89f881f1edb939a36
SHA512 15c88e4201d5baf8db00edb1a247100253cba3c7e4a9a0b49397ad3477f50bc43de3209998d606073a294342ea12c9e82db3868a1b99fc90ee35f7bca3c89202

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 9d9e7b56b8fea50732c88bd9e9045d98
SHA1 33a4177a7bc0557f2e5cb6593b9b4a3fca59b53f
SHA256 a8f648e31c09c4d8318ee734bfd50a85c03830c04b3b64c4d74db6fbe5dfd606
SHA512 a0b56ba7d5e077ae6055fa7e750a07beb995e1c3bf6db19496d333e1c9df67d7709864fe3e54d953402c16221fc433affc5138feaa11e6ff22881c48b902348d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 64f3937a788a609b81379aba4d4492d5
SHA1 d35b78e8391dcc9a2419cec1d7be67e4dede9480
SHA256 5489cf9c6a37e3ccd42810d321572eea1bd362b8fae650c3a5fd95d2cb28f651
SHA512 a50a493226ad9994d16156927d999bedf6e5b751ee11c39257420cc01ac71fa4637b772cb8afb50f5ca222a66b396c42204b578c7c36ce3c3281888fa04fdfc2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 c8ad7a11fe199f9bf67237b7b5886e8b
SHA1 8d6b9b6d779f8542eb690dcea4bcb6172182acd3
SHA256 150aa8858fde0d2fbadd427e834f20fe62720cb8adfe16485b8f790a75cfaac1
SHA512 2b7ca7cf6ef61fce198e01fe0183649413a53e4f11faba4710f2deec3693e3a52fbf48a09d06e3a9e2a9672ec41dde62306f1696e09570163617b8017b1df597

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 da7b4f71a825ad55a124cd0877b16c39
SHA1 3ab968dc61a1988ea29b76e583b412e8469217d5
SHA256 e6fe32e02938f6a54d9fda2adcd5ff60daddde9774396c61005e80dc0f8f55db
SHA512 d45a6c44fd035bab42ce3842d5cafe10c76922e4a9c45aff4a1b725504904377a2d70fff2db0f5a59579312adc30b400e4d8e511835e20f52987d198581c82d4

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 1f2b0150e5f5a72ace5104aa079cc895
SHA1 01bbc02a210a3e4b819f636e6bccefdaee10ecda
SHA256 127709da113b2fab3dfb911883f36c8208bb808484967de0d571bfbf9de4ff54
SHA512 5cecaa1925e26da5e11c9a080f41d389693dd0c3a1835c89404a195ba5d879e87f03964f81fcb2528753632578833f320dbae3a8fdf375f13ea54e7d4fcadc10

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

MD5 f42458fe44e4bb36a8cb764db3b94aed
SHA1 be57002f45d6ce57b421898df94c11cf2ad27f65
SHA256 ea752cb9e53ccbcb19e83720a78297e1d6f9aac898944cd1e17248a3dd0541a9
SHA512 a2840f6f1f8be15609ca60832a851fccaa9ce4674f5940152fc5cde170837580a0e4a2d044757a576ea75454815d8085e1f102b1f38ff3cd58558531ca39c01c

C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe

MD5 204cbc1120f6724c2382868db2302d8e
SHA1 1fc8f76c51139f5a24171198ff85d7969b8a89a3
SHA256 c6e9f7cc8abd9465a7f8a1e916ab1e3662dd2574c1eae1e625e39547edeb2376
SHA512 ee274735c349a1caf06e02f39e3a92febe21ca26afd250ac2cf321cf78c56c222438c0f2973821c432946a0d16e9ae45bd718ee97e2748f210cb29dccacf6ef5

C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe

MD5 d295147f1e89029c9de91806f9c0ed8c
SHA1 00025c1cab7dc312bfd36fdb864dd8b142c81919
SHA256 5e766a567a6ea937c6b44400051ecb793dcfcd8c3c7fd422f4089da7ea581fe1
SHA512 cb0f8ce55b6b543218f55c6627fe0e17116cd550ea27bd1280a869716d10deab9315b20844c03a4b9a8c61a9508f08a29476e025e14f2be681268e952087a63b

C:\Program Files\Microsoft Office\root\Office16\msoia.exe

MD5 cc28e69f52678e406c1c999490e903c1
SHA1 59e1e9f9a926d864860104508acc0f93adcd4338
SHA256 f675a81cdc4e9fc56d9d09807712e4d7325070ac72ba68e5483f4352b99c2bab
SHA512 95656ad7102f2e0475e2e7671b566e648a1b9d4c417a63c004ceb9349a8db33b35eb1e8859525495047ed77845d36869171ec3a52dd9f6fc84eb75e2d8d89974

C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

MD5 6856f0eb2bbaf3ef7d63a7acef6b97f2
SHA1 4acf2d731d4b418fffb639fe2f2a1da1180fd516
SHA256 b56a02dcb3c38a3930c29c60532bbc7fd8e62c9f42d4b0cfe9f05e7dd4c40b18
SHA512 f5d2d3797ee94558a5c3a34268ea9a7acacbd925091a78a8294bb1f1c2d239df38925f6545e6a370d480b9305b4b0f0f1716e8b98dc7d1b0df5c29502070f724

C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe

MD5 e8147a41693b26e8c9b56592a5ff5bca
SHA1 4bed483701ae5ca71866304275425fdf839de32b
SHA256 634dee47e1239a0b414a065d6f1744cf4ad03c25f1536e96de082f7480038971
SHA512 403cefed5b6177d42f0baed0db30620cbb04e0fcd38b64ddd9f1c52e2783379f093b42d912c65ea27c5ee00c4bd9280315d53c8c0c577ce0a2946fe993086b5b

C:\Program Files\Microsoft Office\root\Office16\msoasb.exe

MD5 ea377b12cadd37fc7663fc1cf59a810c
SHA1 559852bbff5debd27d98ceefa33956f7a03faa8b
SHA256 0144bd1f7654e741f46b0bfb85d3367ce05926cb62aaecd48565b6880f7e9a4d
SHA512 e935d4ea61a609381eb9a451afc5af36b2908ee9bb44b34dc1ffa46db47d01a0c0bf1ab27d1d33bffd401f62aae0e3bb5fe2063eb21ae83a657103f862374810

C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe

MD5 c1d1f514fefb86d22d3b932e3d504ef2
SHA1 4fa0c123729e2736cfc9514e5aed491d9a464737
SHA256 0f3c1f2ced4a1742989cd69a66a02814ce822ccec4595883ed943a65f94939f5
SHA512 0f71e92c8aceea56c55f07ab07abd8e1521be20e8f39f776d0eff36411242ff8163607df8ebd1881413349ecb20f22f34a0b9e4b598e72686fb344cf1a246488

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

MD5 649cebd8b7dd70ae7094af0666d7c16d
SHA1 855ce6174240d860362922d94a77980ba36bc1a7
SHA256 18d4aeb3a2d494817747413c137c5682fcff625125eb89b9a955600c61a8f68c
SHA512 7380d1ef43bf4b5a62baf14d78cf7abf13f75046200fb3bdd33a5e47b526d747270b6d6f89ee7facf79032c5dcf14d457645211e88d5dc9fb0a8b3c1247748bb

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

MD5 1670eecaadc808a69c2fdbefad622407
SHA1 c6c9ee377ecda0216853000868c4cf96495af19d
SHA256 3a898b9a28838cda4714c6d13443bda2f8f53549279b2091c0ebed37841104c4
SHA512 91118f859e848f11a3e4873e1bc99e0bbdd9a4c45644836864a31744730c13cdbbc4a4dd355589ed175e6c0f60d16881466925b3976e7aa4fcca5c7bd88e2852

C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

MD5 350df3c881d473377649381dbe80109c
SHA1 566fa3a0770d50c8b4263cd0ffbdf84ea6be3722
SHA256 a045aa818e6d91daa7d3d4258b3509ce95883354b335abc38b53d3813da5d935
SHA512 74bad42b7d298851da1563821e03c65ac19757cd034787a3a4ce6191ac1d0443593ab185609a9214ae041be389f06fec6e1207ea9bc25f8bf0c00f7966f1370e

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

MD5 cc3c431f10c032af62311cbc28023db2
SHA1 e9bffba8fa139f9a95307dc9eca7de7734ec2410
SHA256 c84b2402125246ade4c0cc76d6927c1e6cc094598f850037757982ee637482af
SHA512 861a85105c079ca0b8ebd3242d2f08f7b8f40a119712ddb35b69a84ed9624601c6b15cc98afce8ac35fd8854c768a86205c90458f2cdd55885bd125f0c5ceb37

C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe

MD5 15c0698548c9b052eac365c8ee9bbba4
SHA1 e08c69aa5c9079e191773e8d190fdc8a685ffec7
SHA256 92218e356e7845d4a3be9bf70d60870674926d4290722053b1ad0b1da4ee0682
SHA512 ad8edc3c663d6a08989244a83c646dd79279757b9625a1ffdecbf481887e987bb63fdb2d9709f599fb4ffbc5cc9896066e49efd93ff50147a154d8d5bffdff13

C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe

MD5 83d759399ce8368074960b4ced2e69bd
SHA1 c2926d232889ba27e8860c062d450e661e022cc5
SHA256 3c1e49d01108f1c4c0a58b0c17673c72192720067dd260dc22515285d369e3da
SHA512 0d53c880f1d2fa9f6e4eabefd529ab7848bceaafa43990db83850a5be6e762bf0c4959ec20c8648a3f89f9f9d17a9c06332416830f85cd262d39be35a193f9c2

C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe

MD5 ff6e310bcf4e3d73d38f208634916433
SHA1 46a9fb49e7a040b29382492c82d70ca0fb6be99b
SHA256 635bf0be0037b9d7401a3319232d1e89e7ce501ad0dcfcf6ad6673a4773b67ce
SHA512 54411d5c95bfef889440edf8fa534257f0afec8aaa56dc71329a0db76ccf0cb9149aee5fb4360cd3e69f9026e99f238cd806db1260da74ad7b9683d9c1e656e6

C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe

MD5 896a80ba2f8c2a4ece1f838ea3a2158a
SHA1 cf6048bebb5d6fc935faf26c82ccfd1e0f0302f5
SHA256 1e1b5901038a9aeec87764d61545a9f6d955e7be0cca162d2f33e3c71b74dcb6
SHA512 e45675e7ed738f7efb09781b341fa175a0dc49c20cf9e6c865453d77809255c2b1ed4d31ee6126a132fd620a66aa46f32e750629c1c1725fc838cf6916034ba1

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

MD5 54fda2948d5098d08e32ceb715b2fdd2
SHA1 c321016eeb64d6899d598d9d803704e1d93aa4c6
SHA256 7a9510bf045c9ff86d555dccfbcee0a4dcb8d78468d829beb3e65304214323f5
SHA512 1aeac9cc9e7948bced13ffe7e4638738cae47189bf71279c30bf37544b9180d178528724aef102c31847eabf5c31b4cc1809e4496b725cd638dda6e6cf1404ea

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

MD5 81afa81de29e31e8a26e4293ba1578f6
SHA1 ae5c03e763c35a516262d7922d123bff6b456051
SHA256 ea8c93dfae81d0e3d4e3e8afa026e0c4a86500251f14fbc2753a981d7146a7eb
SHA512 693be311d3744ac367189ee7dcfdef2a43322a9bb2be53cf7939e791446ca23ac1d7618bea997834f2ff5fb0f1bb8d0996a09eb648c0ca8e1b47bcc3c82eea48

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 75f6519708ed4122181663cc629499d1
SHA1 d2a971d53b85bc9d4ab1f2000a450054e5586d55
SHA256 485ea91aa7068963cfe86b3699fea599678a01dd16b8a8026b9cbea86821740b
SHA512 fdab3d398bcf9128899422f618cbf7abb4310bf53496a0c47bfa5ab7c2f66e59601db72f088d22e1a71ef77638ce4fb188dec7550ffe19b654dda8e6a4499533

C:\Program Files\7-Zip\7zG.exe

MD5 34ef93f494ec8d5e551f025460da9be6
SHA1 9bc46cfa3b9bfcbb07b943fd5274209aa725daa2
SHA256 f54bc6985cd1cfe6c57926c71ed0a8b0b49159ab3e8067cc71d609817d2b6cd5
SHA512 93012ed24f0252df06e3b3b8ce78a96377a7523f7589070c4ca42ea5075b43624bd12527578378ae01115b326c07ed24c3d2f547f86f4a1fcec995f23160c90f

C:\Program Files\7-Zip\7z.exe

MD5 066f1681b4796be77750915cbe1f3b97
SHA1 4bfb1e7e1e14d4b6ef06335fe4e2c9b633f2ca18
SHA256 a250c2a8476057943660f2e6d2d246a71ee37f4ada3f21c97b730ec4d203b391
SHA512 3bce5385bc2acde4f67d0dcb6143a1cfb7812621b69d5f3eedde996a2087115937b5baf9aeb4d963a5b4995252c4e37490e9234ba283ca7e0144223a3ce31974

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe

MD5 77cc8c3d4937d46005694d44e3f8d0dc
SHA1 a5c4aa780670602434d5c46e0a9372be47bc8ac4
SHA256 2467b91b233d2444e8abbd4c38e32948257ea70ce901b3917cc8c55fde5bf439
SHA512 eb65812d2bd9b10c049f8a5c93c67568b339aa351a7d117e9b471e8c2929dd8d97a372aa8bbee494fd641a56c7868fa5c2a32b44cfaa722615e72ab80152cc8a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

MD5 d9062917c158b798b2269136b6557d0e
SHA1 e68dd4f1f0544334d24882007e834d79e8a9399b
SHA256 04e823bb819a3d52b44b1b3002c12e35ac6a02b167a5c6992fa38a61e8bc190e
SHA512 f30573a677dfdd33ec1d51aff6c31a0a8267609b5cdd392c5c4a9b20a401be2b43a29fca906066c476b8a5656d93454009ac15ada8cb5d0d8a5ac413cd184e18

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

MD5 f29e806f8e9cf545d6b58619d4580b6d
SHA1 95ccd5d53b1fbdb196c863cb19c71272f4c60196
SHA256 f537dcca768d9679162b2611178a6c30a5dec2fe7aecb807ebb40de9be994844
SHA512 7fd271a857e288d777c19f0087b77d48351e6693c0d08361fd15adb89e8eee7abb5f608f2cd07e9690c0cfa5a764d06a8c5972815acf7a8e9ce9052dc6e1531e

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

MD5 66c99fd343d09a488d5b2b8287a95e8c
SHA1 4191510fa6e79af77e483ab984a44db2cffc54a7
SHA256 e189425103f5a251d0be87819fe0190c6accb396ecb1a13fa3c0273fda032d6f
SHA512 9d9325bb1989b3962ece0f96e81f7256d099004d6e25eb8444f98ad43f5b44c47ccd989474216103302ea8b54df40c28a96060d8d407f337a0678b604ee5ef0d

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 db5a1b858c437db26b17e140ef0271fa
SHA1 667062325f64b9f27a4e821ab94e42c61f038665
SHA256 df3b46d3d9dc7b45b0fa8b463259fe7f400a1db343f8faf4162ac460e1f20e6d
SHA512 e27c49f602cfa4c8f3175368898b5181860e87300303f0bd8871423aae0250ff852069f4c8348b5d678ac45d905a84cf155bbf838064121cde198cb5c8627dba

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 00fec97a2365f58e1e66412296528aa0
SHA1 86136662a13e51bf3a2d4655f17938d2378e0ac0
SHA256 6ba62169a7d09b4c15839d89e7ea41911185b6e7ebf3ac35e2dbfb3ed5471d54
SHA512 410a8cd2a6d2e5611bb9fee6ed0f54efffe427b8e7313c5e0af67de70d6783a6a01fce43e88d6feafee914707c08908bda02675f35904e07530dc2eb48d5910e

C:\Program Files\Mozilla Firefox\updater.exe

MD5 b4bed77a374f74e324a95497482d0a72
SHA1 bfaefb6941043afb02b3d339b43739bcd440b271
SHA256 6dda327d015114dd217a4bd1a018d50e94b0d3cd1477b1943e952a30d95d3c8f
SHA512 441782cd0032b18a471fe506374c489d6f93378d8fcd27a48209bb86337b69f7e573edc5938afff12d5a075ea0424aa8a1c1f9461b5fe95dc1da52fe44093d82

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 1471435b378dd6da0f87e2b59b8fcd9d
SHA1 2bb41224c5a4c318d273119ed6cf15917e1da163
SHA256 86a595e3162929f3071683bb76955d6d070c6223cf28502185895b0e0010c998
SHA512 e7bfd692faa124331de07b40d44f29890aa9177f189a4d3635ebd1b5367a6e783549bcc821567c87b3caace4bba142e751a919db1481a9175d1e01ab3e0b6a8b

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 b8352e4b9a0c13008eb6d4ed870989fa
SHA1 dfbd671d8c01a7776810b946a9dda1b69bf615ff
SHA256 2892bf30be7428131bdedfa3b89ddacc742b80af0ccb397f8a47b548133ff2dc
SHA512 1fa3efa4413ce8b2fe75e4897034a643294e2108d9a562146ead7dd9daa1c52d3572316408e472b5fec859f659b6a03d7075ee1c8b05364fb00487206b149732

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 ee05cf6ace4ffdf26e92efb0a86687ff
SHA1 064962f8cc014e22242fabfe6b259e81c593f1d8
SHA256 8fdac57e7d164e141fd215cbec5a192e2d69c94d211b60cec2da96455e29a42a
SHA512 d8a420350d69d2a81327991736ad78a402df1deaf630dadc4c3a761337b306a219698a13f4b6737310f552dc63d630cb1433945f84b5ee7b26a69c41570e7649

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 4c7da5d55067eedc002660b118321261
SHA1 bea4f99f8a7dccb32ee1d4ed04f6598a25d8445c
SHA256 83d7156b4af3d0dd3d6ef11a3e078e5634e69af1198eda80d96a05ef46413f9a
SHA512 79ebf62ca67430b89bbbeea30f45550827b2e1cb789bd80d44fe7796e0249274a326c78873be6225ea0b81f0bc9c83318d30d52edc3f1b24f1a2e757bac43725

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 6de9882f6dbb65bb8cf85dcedcc94821
SHA1 fb30c3281276597a3bbfacb5bf37c5947dbb50f4
SHA256 fcd98c16644e899dcd653f44b8ed1dc3564186439059a735850e952df9dccbeb
SHA512 c937eea9d1568dbd791d0efd30fd10c0b7f0ec74508246e36d0da9380b790a649e3370b0065b2df7c8350d4721e7f304f6c9648d9aacb55dd86afe67b5ce49fe

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 c538a3da2721d66823c55b2d00b8e436
SHA1 ae4b42929293e46af4b2714af4e523dd0148c208
SHA256 b41d4370643e9647ead9af3b434c5af0c9d4e72b13afb3aa00edcec37be0fc3c
SHA512 f8f0e6c1985ba5f0f4a2a467e22690ee2108baf110a80d820910a689654e0f34c2f9e90937f38c2e249aafb2307f63cd4a5336e9ecde0379197e767777d1971e

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe

MD5 ff4440aa1bcf504dbe0e3de2eb72f61f
SHA1 9d91d2c1e760ba01a36df5a7ab739f2622d43a76
SHA256 7b842cad94adabc843bf707f6715ee4b49162893f738a836d7e77850e6e435db
SHA512 231ffad0d51b9c25505ce2dd6aa07f2ee51e9c04122a1c63f41f78bba0be6cc85b7281148c7245b0bd46e938d187b1ef3cc2776a558f382894c2ab76b306c2af

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a8adac4fe0204a8da97d76c9eb1d24a7
SHA1 c05fc29d6d00ee277c850b5ce913c7f11de418ce
SHA256 5a37f3ea497945dcad1874650edcc4d2b2f5f8379461bebc01d3228078bb7561
SHA512 b59a9ce5def0087cfcd6e94f5d568dff7539483b88424011b11ab1cdd223b8815b028fd9490292487904fd2962e157dd31d2ecc45a4e0be48ed2ac82d94ab1ea

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 c6d64af774d686500adf37f8ea8c6d81
SHA1 4ea69c2357ff28f53c5ca6de009497d007c1db69
SHA256 e69f49e394cbbb8a0cccacedb67a4c27a024b893fce0dd1ae9492de8bd202e79
SHA512 c2f1532db100006c7cfc0999fa86fcc1c03ccf9191d0a6e804ac4c583b7338f94e8f4e88582e686eeb4edcb1fcf1ec5e773ad62e15acd58952e05aeedfa191e1

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

MD5 d9a4e156d284f1f337db11bf320f28f5
SHA1 46355c9254275146b2d69b4fb9b2e461ce9b1e33
SHA256 22d89dfdf5641b67b68e09b46a4ed44025e8912cab1c078199c50351953d36e4
SHA512 153cad742d564bb20633ce64b1250572d418bd4cdaa035dee0b5992d4683faf3097187713797eb940a703e51d3fdb5032fc6c7222ecb8ec7e8b85f8ca5012a51

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

MD5 1127e10313f0bdfe5c39d73cefdef7bb
SHA1 4028ebe6f63155f4b75aebe973e7add47f404d26
SHA256 9920e7a6c9f6ed11fe525afbbf2c579db935a95cbba9a6e3bef3344e1a334ebf
SHA512 54b02a34aa9d36a7695e05d4eee164fc821eef64c3af469121746e040900eda9d0d556b2882b1825635a4bfdda9036fbefd268eb614a546a4a563b6c333c89f7

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 9061f40739f226ed22cedaac21062032
SHA1 446685229ef8f690146f80a41c3d9efb1e108dae
SHA256 af13d4a3511f44faf58bb6b39fbd41fba0e63422ee6d2bbdfc433f7ec17b893a
SHA512 f09fd4a41eaf77389f7fe197d55a441c78f9821a4cf4e719e038e9cbdbbfeeb6ab7b88d5e0a7f0068565dced49ce9848afe980142b23601b7fc8b274fe34247b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe

MD5 d3ae26875751bca8a5609a988037bb8e
SHA1 220305e26759acd1a6a68fef83af608f62461738
SHA256 0402c4ed487f02a090a56210ac1b1ae0e9bb43741b6b1006a5914c5fb6be3863
SHA512 574a07c6ed0f3132585c23065dc95dd22f5f7c0038591a3cd325beea1c001a4f00226cbe25ceb3f97e087618af727dfd5cdb6a9946ce499306f943ac9dc66026

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe

MD5 6782f065d25697ffed9a4d573107c1bd
SHA1 a0faa1e099556a021ff072a3d54a6fe7daeb985d
SHA256 7d566839705dbdcb3a7e768bbe9cd5efb1352a0ef8c9c6222ceb096d20da8066
SHA512 d0be4abecdb1b5a5b4697aa763a5ed9823e5d72c31f015910edf236ba8aac23aec2eb2ced54c0b8901dd4622558f4c83db8380d376cedcdf3936eabecb79d5e0

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe

MD5 8423736dda407962c5737a187e55fe17
SHA1 6348947cd25dd5f4917ef47c2698e1890bec311f
SHA256 d3cc753628eeba031e7d13c49cc63bea80ea0e9ca9465677b0ec627e034df1e4
SHA512 8d62fe68d5f5ec6fc4bef524167dfabe8cdbd7fd2a460f652751cc6b668c3e6c5c4b2a2dc887db4ef74e8d2f9901ddf61b27d366360ca2034ab799edf869947d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe

MD5 7dbbb3a0c7d4b256fea49cd693e61751
SHA1 d883dd858d9f8e3ba2860cf3deca8ea393aba61a
SHA256 f222ded0803578fdb8307ee0bc890110a921b157bd88583eab5e6810c8cf631b
SHA512 aff8e94f732c2836421d5fde18d4c711216835d113d01ff52fb91d926595bab5eee31321ffc75621eef17f474b1e1644122a2cf1e95922e991b093c8ca19a4aa

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe

MD5 a9465fa9501ae526457cf909badbfa6e
SHA1 cbf83bed724549f4a46f742c177914a667a97185
SHA256 2cca07c097bcb8ab4c2f40f6f11edb1d68f74d54865ca3c9c4a8d6fcd7ff621e
SHA512 dff3c7cbe0fdaae4122a2654ab19e0677553f75f84325f8c9bafac58f92761dc3d66c44e2a6fb2392802f7b15ac50c3b16d9e38f55a0a64316aae976170588fc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

MD5 c04d0ab59a51abbcb19208b7af6d286e
SHA1 feaca07030bc0fe9630788afd3c2bbdab890b817
SHA256 86af56d2262fb8c070e15a1f43b14f66c99bc1de26250dd87abbf6c43abcb7c7
SHA512 bb57fbdcc14547a9f4186cdb9d9e127d0a9173ebb4da91fd617cdd1cb284f5ca76dfe906f60c4fb7e6f109fa6f1e40f762906b34c64bc3fa126f24dee4ea5463

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

MD5 f8e0eebdb8904699796bce1045b913bb
SHA1 fbb5662d4f2c4acbcf61104dd460aabc06981219
SHA256 790c12df20d6388749fb9fae92a4659d65e92dfa4c47e41b2967e8de227124c3
SHA512 c511a32085d825e329bd1393b42df69b1e22c5375d532b385bae4504b2cfa9967f94af7a8a0ab016e3481238fee90bec4f60bb0f52234c613bb981fefec210aa

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 a35409b391bd212817cb2dcb1c756f45
SHA1 60aa8f43b09a04f00f08d84e9f0159f05d44a6f9
SHA256 a24d22387da445cc7696a3fe56f80047c21427e51b8487f2a7a8782bb3641910
SHA512 53af11ffa2b04870d3a46d63e949bdbe2c1805cd84ca44bf5b3cd125a8cd16cb66d3fb79148f5f460d2df78d1aaad51583486fc07bf31c2c840d984c2189f4ba

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

MD5 1ac807b51a8dabddeb54793ed3d95fa2
SHA1 f658f2503f813872f952d8403b5761b14dd29765
SHA256 24681ef0b736c7d8f88f19de44349889b26fbb843bb72bb34a728df31e7b414e
SHA512 f6fc25b7715d809473fd7d0ef290686790d4cdd15bd57dcf8e6790d3e95f69b9a8c882f85948a7531cceabd2ba9859cbf89319b0bbc91cc4cdc287b1983e8f01

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 d36eabb0d2a2314aed2400ecda68cf40
SHA1 fe44f479e53900f8fd4bbdc26a2d0b973f77b46f
SHA256 4ca6ab160c5725d6379b715852ee71a8b77c6456f594da29d583221f76910eaf
SHA512 26904495e451243be84612766f2a87fce97492da3605900040dcf75bed9f30555f0cde4d445fe13bc9a5a7fd27291bd4f4e954aa8987d51acb8fd5b662bd0f0b

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 4fe97ae07f469ac033f4c289dbd92f5f
SHA1 6233aeb8aef96aaccf8dcfccf04a10566fb3fc27
SHA256 a2c0fd00c5ae199335ef5187651ed7eb2ce8a91d938c835fd8a4ae71359e95d7
SHA512 638de17008e14af4696d7c38170226b5d0dcb9fe95ddd4283fbf5715ee59059123fa0db9a85961ac14eff89e7bb1002bd9893fa6973458dddbf1d30c11dc26fc

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\DEEPBLUE.INF

MD5 f8f9deb0dc230eb5e94a20d70537857d
SHA1 3b9aae74414a0a4b7e0052f50649b55cc56e22df
SHA256 6dd47c949f285f216184737f268ec4fb77f2866c8745e4f2eeb9687c629b09cd
SHA512 bba00df461c0f52d5a87e6c6806c4bc1829385882c466296b5c4a1fbe9c70bcf12cc97361a9a9d229fa1301dade6c4ba502e8aec6750073dbb0fdac55985693b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg

MD5 ebde069cad79f05c82db35d3b21d6f5f
SHA1 0eeb287f08a2fcaabe5a601473a22c41f5b78d46
SHA256 ef2cbe522e503a78085ec58ac9d7409a250a412cb894dc8c607618aa37161c49
SHA512 845683379dabe9decc87b7595331a19eefe1c8e328245afc3f81af63e5c638ced054491a5d3a06aeebb5e95b83ece9d57d787ffe6fa0444208c74f416f01bcf6

C:\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f7b5702f-165b-44b0-8762-55cafe628c92.up_meta_secure

MD5 9886d029f313b63a663be5fc208d6278
SHA1 1d83f785e01a380cb26f56e91a7e385b170b77d8
SHA256 eca138fd4420ef0e8f31757c50177fef19df24aafb5fc1c8944cfe214633fba0
SHA512 83f76f77190b5b454b3d1d0acc10fc910310e6a44f8d8b9f707cbfac6a9edceaa642647891fba811cd4462aa5bfc5b8a8bc7b35af81af0585d540aabb2836fb8

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f43676e1-64d7-4600-8996-7b083a6eed1a.up_meta_secure

MD5 401651df6f60c31189d32408815c3582
SHA1 b4e6de2debf93972d9f589333167b60dc5da3aea
SHA256 e25873f5b6e4c483374e67f3ee0ed526d8ee876c25bd655f26dba673eec247a5
SHA512 845e53eb5d58a9d7e0a25587cfd749a8a872ee074d92058ed8c565c992edc7532cd26efdb9104c1d6e345df1d7f2be37eafe94e0e7c239df17414dfb701472f1

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f33f042a-a5ae-40f6-8d95-1f84d76a0619.up_meta_secure

MD5 e21a64b25c1d3a342d544c1c7a83fa2c
SHA1 91eca5058983b30070e9077c52255a20bf22e468
SHA256 a9252fea57ff4ae3e81780ec7ca2c87e53e1ae486dd6c0f40e3e8e12f3a2eaeb
SHA512 372b1537877a3246ad202e14f7e9968055a911371f6fdcee5debd48143bb86ead8ddd065cc83c090a32d7d4bf4d8cd25a52e8f9e1ccae047f9349c280894bb2d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fa2d4bda-8877-49ed-8679-e7a96706b84e.up_meta_secure

MD5 d322c49d680f29a9cda3a890cafd3ee1
SHA1 0073aba71edc755e522f7f4a6a5ce6185e22978b
SHA256 1a0bae5a807713e35b325b55125f18d61c7aa50d9f543170634eb62044fc59e8
SHA512 d76bae859b5e05559a5944bb09639eedd966f67952f355ad0bb4b328c2ec18feb2d23283a85015da1bc28cff232d509f9b4639fa4a5c6be0d53946546e120619