Malware Analysis Report

2024-09-23 06:56

Sample ID 230516-hc5g7sab71
Target 7129291FC3D97377200F8A24AD06930A.exe
SHA256 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e

Threat Level: Known bad

The file 7129291FC3D97377200F8A24AD06930A.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Modifies extensions of user files

Drops startup file

Reads user/profile data of web browsers

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

Opens file in notepad (likely ransom note)

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-05-16 06:36

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-16 06:36

Reported

2023-05-16 06:40

Platform

win7-20230220-en

Max time kernel

191s

Max time network

33s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\CheckpointPing.png => C:\Users\Admin\Pictures\CheckpointPing.png.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\DisableResume.raw => C:\Users\Admin\Pictures\DisableResume.raw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\PopNew.png => C:\Users\Admin\Pictures\PopNew.png.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\SuspendUnregister.raw => C:\Users\Admin\Pictures\SuspendUnregister.raw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46B.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\currency.data C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02361_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\URBAN_01.MID C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Windows Mail\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099159.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BROCHURE.DPV C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\VBENDF98.CHM C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0156537.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0296279.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\BodyPaneBackground.jpg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BOMB.WAV C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Karachi C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\IRIS.ELM C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\OFFISUPP.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00265_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00808_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00914_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01236_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_F_COL.HXK C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RESUME.DPV C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\picturePuzzle.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sl.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Manaus C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\cpu.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME31.CSS C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR26F.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CONTACT.JPG C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Blanc-Sablon C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\ProPlusWW.XML C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00129_.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Qatar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Solstice.eftx C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Pyongyang C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\postSigningData C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00640_.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Pushpin.thmx C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0090070.WMF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10266_.GIF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RESTORE_FILES.txt

Network

N/A

Files

memory/884-54-0x0000000000110000-0x0000000000115000-memory.dmp

memory/884-55-0x0000000000110000-0x0000000000115000-memory.dmp

C:\Program Files\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/884-313-0x0000000000020000-0x0000000000027000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 01802e564dd300459541b65b0cc0772f
SHA1 a0796d7e8efbdb6240f7213eb77d3e1302f59ce5
SHA256 5bec401188cec8e7a7d76dea91fc9e72c118d8c1bd7a3fc315a01f1dd29b5340
SHA512 38b7ea9e08b3f2629cd416ada0c573921e19c898a38da947351cb865eda479eab7fad9d54c638877024b951ade9094d97b543e45442ecbe8af6b3c9f264f4cc1

C:\Program Files\7-Zip\7z.exe

MD5 65b1d71617b96db504b25f17daae2699
SHA1 0fd92cdd9a51f48eac71226c17ef8186699b176c
SHA256 2bf56369134a54b0a01e287017b0a7c49b9321e2dd6807daadde30c99a19f3e1
SHA512 7a003d981d309a0fa239a2e546696ec65646854f7cba439346a6b3d8ea94da27e1ba11d59df7905a406be5e494ab4243a16bf487be9da66491e30f9a1f3fb451

C:\Program Files\7-Zip\7zFM.exe

MD5 3d6369eac5b7fd6998b1739486bede25
SHA1 1b90d03710fd73f008322925ec69410ac96c4304
SHA256 599d21db7b0915fddd6dc76aec8d42e2a2c12ea4ad20000dcf553d696d6727ca
SHA512 af611349c0efff396bf74345902b6414bc584a864e837eae10681ef88543cfd402942cc958e117164dabc1665f03a641bf1675dd8554400031f3f8c6fa4b8620

C:\Program Files\7-Zip\7zG.exe

MD5 445b39d646ac0ee20ed1aba4cac5203b
SHA1 2d4295cb6f406f3878847ffb8dd1aefbdb37a437
SHA256 0e8f90f9d4bc03a555de6c8d92e5654a775da5a2fc907127b8269750cbad79e4
SHA512 dd220f2ed407f6e2e7deacc28fad44fd5812f3c2db4c09f3f34841797e8af1f901ce9e5fd0f1fc5ade7f6681f8938e4a4728a112f6bbfad928be7fd3e84bfa91

C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

MD5 3ce6c4d36ed70652b3710cffd258009e
SHA1 72437eb9b1dcad265379c7dae1794eb4018ba4fc
SHA256 6990a4bc968c179b2d8b35b566288a9e77e9675e0a50c73061dcf1ae96779ccb
SHA512 6a5401adc156a99820a20012e26f3292113cf37176d8c2435d88a6ecd2455a0e8b7f8208585202072c9910f82d35f9352f1345214b5be368e9ee35aceb3bb847

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

MD5 a105b8ae52ac351392081131f5829b94
SHA1 736b49f29b8f6343ae4e8b8abd86b8245194b49d
SHA256 d3ab475fb8148b25f6b10b3eb6d1ce8a5fac6fc930d7fb49dcdfb2b7ac16ff27
SHA512 be1240a44e57057e6cb35cb610a65a709d72adf81bbfff3f8a045d78eece139dcb94401379e50f7cf1083cd79b302e5f522196428d5f9c5e4b2b088f3fd62c29

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 0feae4f28fdae6b6bad4a281529713ba
SHA1 2864abed44b9c1c75bf7608c98176f386d129d61
SHA256 03ae89270acfcfbeb93cff13191f7537083422ed69408342b10ca5ea39c67701
SHA512 c4e2b82288605f877c287ba7c50d47440d66a00ff1747d0502a68c642cdb6b59beafa2bcee783b12875cae4948149ba260f7ebec157c5d359067fd717fdd2085

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 fe32dbbce254715b990704e30223656f
SHA1 4da277b72390c9f6a30467044a7d55890b1dbe83
SHA256 e7beec67f95d9f9377f6e1a051be5bc61675f366cd7a1b8952b857540035f394
SHA512 5223488aff19a8c8d72bc72e3943fd594038dddd655958391cb7d699cfcd8f6458f888dc7dbcbb4e52b8808617b4401f6ab3d6cd969352791f8be3e94902e4ff

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 15301a1cea62946061906ac676436190
SHA1 6580ef495c2640d083c843fe6da78e8a9175ef93
SHA256 259f65d2680537f86027792acd47c39b8f7c7139f9b4b89267ad55dbf5574aa8
SHA512 8b44dc52b7a7b69c1b2da0ec6f904a55db2760beb84c868d1fc539f061e52d888aa3b93ca4889df17588f0e6d9090d87264950bb0abb8373aeb78c01546ca2c0

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 80fb29206821de3687faaa4401c919c3
SHA1 35ea9e83a7c5d8ff30d2538e04a8bf18c7c56715
SHA256 5288bf34e2171c5f7e7cc133fe89ea5d26afa6183a0bddc063c1ff1ea935eab9
SHA512 9e5f112d80afa4e4431afa2c50e26b3b2ac99b0fc7b471cfe839773ab28d205641140013a48a3f073da80767a0a1acf326bade0db7ddf118d39e43141180b545

C:\Program Files\Mozilla Firefox\updater.exe

MD5 fd9f3d05e442c7002aaad77a0f3ed64c
SHA1 51d80673abf1b2b0fd6fc8dbc87fc3d3e6f13f75
SHA256 0eccd35c80aa41a2a09f1afe681a877a16de18492858b5bef085cd4d6d7c8bf8
SHA512 65a8301cac2033085058e689cac23c57a26d11f84aa64c4c3138b1aebd1bbaedf4bcedc02e3f798220f8e39e47ff0792d5726c4501ea3fcd03c11122e82f1823

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 bf9bda71a8ae4d081ed1d770b816297a
SHA1 4e4198ef5add1c2cf0275eeaa2977c28225def53
SHA256 5dd238ee9b0e480d4586f99f8aa72f84575b5e27a9957d9e45ae034a343aaf2d
SHA512 8bec5b33ef9af5328830aab58f6df7d7125dfdcca458dd93e44730eac64827fc2f5f2cb8e10ab0ddee76045b74806380a2aa0415941ea07744be046f88596a17

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 28efd636dbb5c20b2cb5715aa1029192
SHA1 c7bab77d341310d45c26adcf8237adc23d46aa38
SHA256 6d5808af491ca8f797d6ca98d2978707659b17eaf5d47b496b8fe0b6fcf26cb8
SHA512 dd06170af5ac2c5251624a85e2cbac1fa83b08c9cc45eb8413521176df86b76eb49922958e04d0819af667e3d8db3708423621203bf6775291c6719735d6871a

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 75947e9d57aa55124120722520681e71
SHA1 cea5a9f00bb5af2f766c27dcb04b441f243b190c
SHA256 76445fef3353a99654c42ac41eedcc2daca9ec8ca9684e46ed145651e2a16b41
SHA512 48bab1e7e0440e0b26369394d48680f0ef11090180722ffe196f09f56c6bb908451d7fbdb7da414aec8361fee84d40022a6416b722f87e48bfac246367abca61

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 984730d6bd24f13cd94f029e5cc21f75
SHA1 dd870466508f96bdf8da9b79c2f7b8865087c5b3
SHA256 b0b1f27a42c9f3ec3f8d83e641d0ef8f7d7ac01fbccf106379bf385508c4b0e0
SHA512 c0f9b8a0f727d6a2f4626157b7902a9792112559f4eca87cb436e4beae549152fca5fc33d0af55fa9739b499c092bd041c8583908f5c2ae7dba65cd16b34b4de

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 eb75bbe94dd212ba52e0fb500bfa55ef
SHA1 11882779a8154f73dcf8143bbccf2c8ccdb8d9f0
SHA256 33d0864e9590468f942dc9dc7e34a2e7451ae76c9a918f5c940a9b870dcf4176
SHA512 5744fe0ea626557b76ab73175c7a370ba0729979e341d12901ae1172bd352dbd6cff2af09e1a6972bfd5827b3c5ebc13664df3ab812c18e30fe215e43471801f

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 a0c8913b10cf3c73864d68e8c00e4ef0
SHA1 e0a6eaf770732f8ca638e18bb3e3a7298df126ea
SHA256 fe24b36453eb4bd618f170fef4071ffe08665a9e65ec8ed096174a0fc240b158
SHA512 2e5207ee9c768c89fd74dfe18d6e811cc195e911aaab9716673cd03ddb2ca9651b6b6b1e81b80b27946fe71a4bae0f18423b5204b3e0b6fe5ceeef66e7390c0f

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 8e6df5f62ca4f31a917201de42fd7904
SHA1 658008a115113e4ed837ec3f1063a0964de48a80
SHA256 8ac1aea08d417cb88dd243ebc963d220f860074e151feb236db9eb0079376fd5
SHA512 c7d626a40acfdf6c1fb3602ec88141e39fd06257d1d6eed2d0ff085059bd8d00d0e4f8b6b6ebdbe02d3ae22efa5dc81965a21a3493a5042cf827707d53d1b2ef

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

MD5 30adb2a8a6c20027e372eede55400413
SHA1 0b9e534dc2aaf6e85c8a998ce918b69ecc8096d6
SHA256 d30247115decd1143c805642429de68650dc482796b73d9c06e8436467172291
SHA512 5f34a7380dc8541a5847f16dcb61d474f2fbd03321c99f8aa739abbeaf63f2a412d3f1bbf570be67a02245544f21697aef38b11139ac6d2b96e8f357fe968f93

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

MD5 8a29b1140c55e603d350db349e030554
SHA1 6b9a56bde0c72f30dc9dee266c76bce048aeb31b
SHA256 e1cfaf0a2cecb2bde96a1ad462786c2ba21fc1cbcbfcc9936cacbbe4a3e106f4
SHA512 015de80b12ca6ae9d7e3f8bfedcb6cbeeee7efeab0689225b149a53d046193305e5431e3c5bb6a42098e7bc05226d3fca048763a9394627b43616bf279d9b6b6

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

MD5 b39b7c2186a7d2735d56ae98a2f1dedb
SHA1 776f8a2198bff53a550fd57efcc2f201fe7319f8
SHA256 9c7d692517dbf7c432c6912f6bcf5cedb1e29d5c7e0a16a4f2bb1f80bcb09876
SHA512 205a15e969cd7cd136d7108258cf8f209133dbcbb092378be408f7edba34a07faa30b74db5a0f210f31f14bda4c60d85a1019bd518610e5fa257f684bb394c23

C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

MD5 0fa579a2bc93744101837142ebd24149
SHA1 6d18eac3ff229720c5c5df13db1ef90d0a4c98e1
SHA256 012f7025ebd3fce564a45845862fdddceb1be3e3f184db3a53eb00ebecbc276b
SHA512 f94227581565d29ea53750462698a50bd6d15953c1b900458e88c4c9aaf647c5f70cbabadb0fcc702ec4a2de93e752bddc6d385c97398a26a15029638023e64b

C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

MD5 7f6ab8effce1454a8e8e4e6781cb5b27
SHA1 79b86fafc648aef9674666dbf80c31cfd5912c3e
SHA256 542715225b6f439b1525af8c55a3c81ae21d82f6437fa9eee390cff6ae57de12
SHA512 98a52bc9d62f205b7e79123979743e0a37eda70dcf359e5a84f395b28d58ec8b8c21d8d5410af35d0469109d69547b93164d161202c3ac808831752d18a89852

C:\Program Files\Microsoft Games\Hearts\Hearts.exe

MD5 cc2c1c8ec5a6cd202770a8963d0b1ae3
SHA1 513e87a371e0c68ba39939b139001cd068bd2a7b
SHA256 d8f3e8ebc3950b59331c176172cd5504b8a79d5dba0f3704d0b53ce1a1d5bbb9
SHA512 646576242976e77aac6d7dbf306852b8488e755d2efaaf7a2bea79e75327c45825345f6465ec179ef733143ea7d01475628cb1b56b4c58a029509547b4d1e4d5

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

MD5 0890a9a182da032f99244bf72ed941af
SHA1 8fbcf66c99fe163568128b7c69d98588c66ed911
SHA256 ece14cb8e12e60f5913dddc84c9f992069f1a4c8644e1f8cd5e6c7650fdea45c
SHA512 04abe103e40a4412a1e6e8f86d9fb3b01553179730243201e8f822b2f0115d7d64aeb2e14b4401f9c4c6df147363d3227428327d17ede0ac00256df67b54c07f

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 464dc0375fbe927e20d96d1219a7a727
SHA1 03c2e7c513baa2d7f383710506afc0e3e0e5b6fe
SHA256 3455d565e9a870a44b42224029a8986e58e247151bf98be172d48fc52424880f
SHA512 7a1072e570431a5ac5985e7634eb346a7fa2b0ac1942b4337b7ec3caad9a70ee0c9ee4f0a1908120909c9d8f9c7ad3bbb45d3b77bf0a9027339f114a2a13aed9

C:\Program Files\Microsoft Games\Chess\Chess.exe

MD5 e63504e4b97223b0306058f85d53a1a7
SHA1 61ec6c950927012727dc684f3f79100fe03c0b07
SHA256 2c79407709ff5c7150d042676fd418f261e8fdb1541fdbc57c2c3fe30fa7c695
SHA512 8ba63eeda19dfd130cb8c46966d2f7b608778e0dea5e3181a3ee7bd0dc157620dbcdf79b31b8fef05ef7c70bcb69ef1175ca3a18e3c175dc7e4b46959b65461b

C:\Program Files\Java\jre7\bin\unpack200.exe

MD5 e2726f8ee3151b9bfcacbc733b55a8d7
SHA1 12c667b719d8d3152628534bd90482329969f781
SHA256 5fab764b0d5e3d21363b3bbfbdc849228d5bf30c335314e20e9041ff9d163f8f
SHA512 09ad435ded892ec2acb5507891a2cd6c1c78c54dad5fefbd10f7a98d06a7e12af5c33335798836a4bffa6c2adde4983bbbf8ab87f8fd97daeb556a050c5ae463

C:\Program Files\Java\jre7\bin\ssvagent.exe

MD5 27a67166040ed04e6c4bbcf3b1799ee3
SHA1 9fb74fddfa64a9f137668e2870be5b040d7cb7d2
SHA256 b9265ff7daa1e45d7d6738cf87433a7dc73042505dd2e304b9d48e8821ec1e0a
SHA512 49ca9ec70744fb2425aace8d598c5d6c7f846bb14f76e2078739d81d1042f6db63ac2c4dbefadf72efb921bb104099c312e8d1446855d38e60b5af9cdc1ed590

C:\Program Files\Java\jre7\bin\jp2launcher.exe

MD5 280c40d99a1f046c6383292a138a13db
SHA1 d5d267ce315a0138efdd06127b46dac4ea5396c9
SHA256 79035e650a2a16a56457a1ffb7066aa9b6b7da4dc345d5975c318c86e714a5c5
SHA512 ac081f358755cb2632cb78217938d3214de46a29a1b49773c37161a4873e43516078d175c3685e616fe7bb950cbdb414c96b7594171f1645c0cc9c883e95b019

C:\Program Files\Java\jre7\bin\javaws.exe

MD5 ed469474af72aad10eac2db36e754754
SHA1 31e5b25d7df1e9cd16829ac2ac7b17d599d4add7
SHA256 ce251c85ef33c72b33cdd2288b02a42e0cacb8266510593564096cf0aa6d2182
SHA512 39c0138cc2576cea35dee93876b351e010bfbb01111358414ea0fce8f6ab56d6246ddd1ddaa706ed8b50fc21656006183a8632b21bc17389a03cba595821adfb

C:\Program Files\Java\jre7\bin\javaw.exe

MD5 5eea5ffdf7262a5f6d483e2825978dd2
SHA1 c0c2a7d42774f1b765be894fa180dd5f5e7dc2c9
SHA256 ee85ca8e79b4ca78dddb4b4dccb92706d3cb7b5ccab724fbdb44ccea388eecc8
SHA512 9bc3133307b18b961266f0993ea6007f37de5ae6c02c3f5354da3276bd64e8c02bae072c65bee849865af3b312d63e6e8b818820379dcc68cff0a51045a98b35

C:\Program Files\Java\jre7\bin\java.exe

MD5 d67d28d7f2bf6b6c070ed768a578b389
SHA1 f2d5a5126a58b0ba209d131d74254c5136f7db0f
SHA256 9c8d5cbdcb6bdf66ff192368405e5f47b8ea8a797a98027ec5ca6cf18a53411d
SHA512 2ecf2cbf51f0a29b64730934f422cf71a46c62a8834cef5132d54013a51b0410a02eded88243f5ca95a6999457852ae0eeb54d4d3cdfb326185bbf0a4e21d4c7

C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

MD5 e9922e9d10ba9ae4808e2f2d7a2b2e4b
SHA1 86f72135b1e4823693cbc124e877705a514739e4
SHA256 caef6c25eedd10978860e752a9be58bd903c1d3b17675ad95304da64eea4fb08
SHA512 ac07b50b571235b901c8d71a0b92455e65c15f1d1e8c6dc65e2e8cf00e72d21877c19b5ee7e398a6e80cb15b324950b9382a45fa84410ea67153d86f1cb8e6a8

C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

MD5 559cbd6a4c783db62540ddc18af26139
SHA1 d40f8d34241d962914f5e089f784407af23ea6b7
SHA256 16353f65347faee7df043f8c2ba2f7671a136f9f05690c77372dcad35c595670
SHA512 331f9228acedc1c295bb3921fd4e5e98e5ab61478c0b009dfb016c93ddf113b8a76ec4f3f94497a2dd9837f8bbb608aa1f2a35c41c1252680c9791dc535dddae

C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

MD5 a4f619c7d5f375784bc7c090e8ba1bf4
SHA1 2db607959656291a27ddfa2d17d64d9398716eae
SHA256 ca8804f5c32f72b70b70498b77a50729d773949ad3ed83adfc05755cde57c700
SHA512 c10e81a391324d64c49c028600d35ea795629253d633ac1048f9fe2d0fef17524c22c72992cba3290257cc88170e1bec7301aea3a7237e06192d88fd3c3c30bd

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

MD5 e8d6a2cc355928276c9051f042328594
SHA1 a5e016d53f2bb1d6e0e10b6134266e8b54bcdfdb
SHA256 1ea5906626910572ad389959d3fd811d77e0c082b747be9271e22ef53cc48751
SHA512 9d69c52ba158533f35c3e65de2487a6ff1cd523aee47508ce4370ec9d799ba78442507e920706219042e6521d5809529faa9e144cf551c72fc2374dcfc1aa77f

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

MD5 d61aad69d8b1bcdbdb3660a236e92954
SHA1 13e27e84121b7fd259c7fc5f6444d6550f9195f1
SHA256 ac591c517d1d5d162c5a2399fec762453b815dbb8191e05f2947f96c14be155d
SHA512 d83e4fe4a1f33157bbf99df39522cd854acf093f3058578d52f6cb52fc570c4ccd58330940ddda875368ac6b20c86ff89f8668dc05d39783a6504f7c13bd3c33

C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

MD5 413325b1b2cd7c1bbd702c25c991ab00
SHA1 e53686d89ecf798baf06a975071a264a09ed2c70
SHA256 46be7c1c9cd0aa8129232056478cfba01bc57fdbc834494e3f48bec10510f6eb
SHA512 c09cfc04c529879c3e49edd656d1a961dd5f643507ae1726d37256f83e9b5b0890033b010fec2a67204cc787c5d73e8edb965315c61feead664f29582397ad41

C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

MD5 609789dd3f7e34dbe6005c09d532adf8
SHA1 32c1695f922033934afbf4407bc54190b1d974ee
SHA256 fecb2994d79b81b35d9ce4d060456d0ab09098b7d4d9deb3681d612b1b2817bf
SHA512 194a81cdc0d92495395af3e987033b6f570391fb7374956d74268411f12c74bed855ae7950e29c84f7280328360413a6a165abefcf2b300973d6a8aebaeace5e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 a2be3a0271fa85c0d68768d83f327dea
SHA1 049ab7ad23b8954e8f652b1883293bc022162b78
SHA256 3cc1c706bbab4a3e37fafe2c55d33ef63aaaf826dd558a140b430edb7517d895
SHA512 9c48715990ccbdf3b8c3b4348477993b4a95d87883ee55a7f7b06d8fee547328ed27df1aa61d9f73e37af92ffd44810512c821a732fb96364e6fa4391485a790

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 3db185e367e9cf58f6792164661adb86
SHA1 26d6860c93afb170b2e2cb89ed5431cd8c07521e
SHA256 2c3eef50242ebb63e606b7c8cb0e85220da2e84c0a6e675016179f8253d300ff
SHA512 62e650c5f151f0372b0de8c5b0c9ba2954c5bdcb33629dd26e84768db3259833f376a0de9d0bda46d9230b8ec2f0162c370bcce875f2ff683d281622b82f71a0

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 058813cb3c830a00139863baf8f9795d
SHA1 b074a6f2b3d7511135cf7f32ce4824c7dc6efbb6
SHA256 d500aa2ca6e3e13f2870f5aca7b445e6c877e42b2e44ae0d51957a7a51e1393f
SHA512 1ec5b57c7d8851b2f2d78835e86f091931d5dd7504a7e3f2d9bc13cd04ef7cebc2f8dae81c33c950513a4d695493c09c9e08c2b03f2c660f1cadd3f55d20ad37

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF

MD5 5a1ce3b0e1d70954adce252ecf7aee8b
SHA1 893566372c4a1ec3d92626c844d4323046688803
SHA256 498bac9b585006cbd0659b7165476c27ce73806c4646ea986659c6b596972b2d
SHA512 d872ab945c96f6f1529cba261b5c3eb6e2a789345648031b29acf4910dd49fa982c7e2e636ea54bc6279ca08dea44b33323cc4adbbb483e3983b77de0e3bfad6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF

MD5 d73321a689c322185accab4662a60ad9
SHA1 5504cdb83041cfcaef5266d119ee7f1ddf7b9e0d
SHA256 d1d46803a5463cfe91c559e55cfbd4f05f73a6ddf8a4739b92d3170d3d9a41be
SHA512 95c6679fa653b0c5009d36ca596012349f743dbacd7dfa30cb39c58b589238af175a3f1324d18c0ddb52d236f8856393e9140deb1755c9b75679dc317117c6f9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF

MD5 f78cfc3bffa78defbe41e4f247dc3621
SHA1 891544297529abb488d00d9af2024a40cb333823
SHA256 4e4b2276f21e602af35c24a93f6a9ee8b7ae2ef313d0be41564c4be985a015ca
SHA512 5c386ac73a345b720eda2b6f0e6d00c1be55db94e72b5ae4ebc374b490bebb8a3be6e812fe59ce9cc12492a4722d4b34d027f41e67157482e3fa6afb87480a0e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21301_.GIF

MD5 8a5e25f8aba530516d88bc545e971003
SHA1 3d40b11890440935368c1b53dba2a22a849b6f0c
SHA256 efc3ff50061374fb157ad472b16fb3257445a1badf288639db00617e3029e85c
SHA512 3490d8b5737e2b2f89e474cecb3ec6d38405575ecc974f880d9922bb8249911dbce761c43c391129e0f75c3aa528497d1c70d40474017da04afc60ce9f6a9fb4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF

MD5 d8ebc46f9e85da44f70082e98f7272cf
SHA1 655a0edb3886b0ff11a767570eb9911b0b0c3fb2
SHA256 56ec398963618d227aaec58a51a9ee72e1541ee8a19e3ab7e2aa5d1ab8b302cc
SHA512 aded38e299ccb2d40f1396ac885077958d75abb126735a777309b38c798a19d05039dd2d458f6d885dae06939125953d41db4e0d98c43b4ee99a3c32b2c3dab7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21306_.GIF

MD5 cf1031e3e4342bc43e81c4f0459161ad
SHA1 a9ee8a959eeae01506f75ccc2469fba34e7c881f
SHA256 5b6a7ffa212201dff74aea80a4cecd877759e4df2772c1bba1a9061b023bc3e5
SHA512 0f37e3adc493d313388db53f0887d11c7118759c63a5976c7c0edcec962b6944a926180d6a1e69472e14ed944a3c4cccda6d9086335dfbe705f445c9a7731cb1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21312_.GIF

MD5 a002817e156e22a1a4acc9b31e6a4039
SHA1 77db5475a836f83232b368c03b3d05e57c10eaaf
SHA256 fb8d0bc7e8dc98f1c8c57a2cd3660925f8e34b673ae41ceb0006300d1f0ddcb2
SHA512 693a83933b58ed49ac508d90559b0c2075e9206bc3331f7953d7a68eb504e611ace19833ae72abe99bee2de79377bbf6e49818288eda6eb4065d6438c3d538d3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF

MD5 8fcc2a24d189aa4f1a8094398390e923
SHA1 5522b53453fde3add560524c721ec55a44909e54
SHA256 ede88253f00e770233cf9fec736dabf4af641fbf0b208a37b0977bc80b37ac0b
SHA512 d335daf073b984579061fbe0659a8e8d81edf6d06e0457eba3a68b63e3127a0755e62561f16699aff19991f46219683c7cb1cf607f64ff911cf9f227570c321c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21316_.GIF

MD5 7d7bed313aa75852e536e4bfe4e0f0ba
SHA1 ef609db238a09ecbc16f9ec3ecf639be267d63c4
SHA256 db109f78e19295d37cb6162ff6840ffec91a33f947605f8e89efe4b05bdbcd11
SHA512 3cab057237950ed8b4e63dd31c854abedb4867b88c2692c74049c74ffd266526cdea25499ca444631b9686f003b31477a05e8b8d322e0b1983c98bdacdfd31ac

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF

MD5 c1c1459725cdd6327bdeb23612be6fe9
SHA1 32682b94439d3e88e4def7fc0135ad17a670e55d
SHA256 b4843b48d2c2f0529c86cd9deccdd8c42450b5c293a08996e42e711753154ae1
SHA512 66102bef342c64d209f9205fd14b1dcef42ddd63174227a5de89ed26d6b657d355c87ed0a49df192c4c3e08bbc7fe7dfd4a76293b1ab9c8e98e8d2dfa543f740

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21333_.GIF

MD5 bbf31ccab4fa8465b0b606caba761dbf
SHA1 d9aef544e148ece17f56bbf316793d30e27968f2
SHA256 ac06ebcd4e499bb24dba0465a45db009172ae54fbf188dcc4b4bd7eddead078a
SHA512 32a323b60f3b3c109ca6814419478547a8bd9dafe790b38aacc71ee008ea6401d218fa9f8385e802fae26eb8817a501fd8671951cb917a823cda3cff787a2d09

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF

MD5 6b4c578081bf518b9f2390b1d69d8776
SHA1 eb6bd90a165a9e937d18ad779244a82624ce2320
SHA256 3af3d48bd7e9cbf4d1cc54cabbc91ff3ead76582d1fc4dede6ecf0bb442c7da5
SHA512 72b175de096e4f0c0048ae8195dd9c406cc1b0291ed0896d1c6c4afd90e9f3ff366a59c6a1bfab57616f3da4454e02962338b71f943f2bc49a00444cd96e30a0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21339_.GIF

MD5 7aebbcf928fae66a1748a5e1426e3456
SHA1 d267350787ceb3e0750f85a23c637f452c0e886b
SHA256 6214961cb949345bab45db09877ba4f1b9478c5ba0123cad7958911b72552ba6
SHA512 aa90adc7c2d78b7fc65216ce7d9c06229a93597abd848588942c0c00cd12267353e29c30137746262824d65cce0c1041471260dfcdeb7c20ce5d18393c5b80b0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21342_.GIF

MD5 310cc1525425ce8331954346a55f7cdd
SHA1 e37d5017348caea531851a6a855c980a425b72b1
SHA256 0b264b26022469ebe6399a62db22be70617b5a09d272344e0c5f5d03a975069b
SHA512 a1bf9865d9895e4e0115819ebf8809f0003929dcf47faf68055670297c0339e14e1552e035e14f33ecfac7d005817b57507501a9dc2e09bccf7bbd72a7b62d02

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF

MD5 d32430b3473937e02e6605afc8077857
SHA1 8b185e069323b7d293e4cf3c7c2aec6ce2757173
SHA256 0c291757fa952f7afe4134e8147a227aa2863b8a7a2ec57effb323d443e08c96
SHA512 d3e472abbd8dea26754b83bec04b7949eaae999eee76e2cd5945a18f155d8b11b32c63730a039a1f538bd1d4c93d5ea32522ab04fb794dd6c23701bbe59f268a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF

MD5 bd344ce0b76e3c8ee0a2a827a652be22
SHA1 4d87cecb6332851c20c5b1a175572dd8957e0211
SHA256 eaf03b5a64d6030d9822d39b71e7f5cca759c81371bd41829adc68f88b47746e
SHA512 84d87a93e4ad26892c92156a523cfae87619b0ccfbcc1b33ba43e949af2d64603f10223570b414738a487f2f1b6fe5e7b61b283ba4a137643c6e7f74391d4a08

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21364_.GIF

MD5 d0e697339c568aceadbe45ad6f09e09e
SHA1 30d0d9338c309db5fd9246ca6b7b36329ab18755
SHA256 13e376afc195ec065bcebb71899377ec7be45a801e22971548d54755c5910450
SHA512 e59d7a73bc3c8ad861fac941f498d1f567e4e64807e5a8f054782c6a64934b2a367ba66fade0568f3f2df5e7e30a86104509a322a944ea973bcc434409cf47e0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21365_.GIF

MD5 b592067f88e0b02a083b294bfd4ee8c7
SHA1 2099a93e20944dd4ff05bb018e149b45a222b5be
SHA256 2f8738db7061d6b2b6a8de425840692d83078d4f983a0f259315232ae09bfcee
SHA512 63282b7670d598a5292abe64d369305ea31cacc99e656bc61d00e7243bcdf4c9b1cf564ddc9cdcd1c43d93640e83296ad6627b43f0aca1169f6826d4276a1a73

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21366_.GIF

MD5 c2dc93a5c89e7ec33701cf93bb4e7f31
SHA1 1697951f532328fb8892fe94993b98f7a665ad51
SHA256 8e495d27a3a399a2013e4b0de447981db920074b56c41db1586ceaf117bf76b4
SHA512 fa0d53800d900792aa7523e28d9a28caf58da645e3039ea6d5df6bb0147218e29f4ab644eae616bd7cc3e8a04b668d7c4878b624a660eaf6b56e2c4082b999ee

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21375_.GIF

MD5 9da70c7f1988c72917da14ece0151e33
SHA1 985e567dfdd2ea68e992db72aade8f4c7c1cf219
SHA256 9d66faba1733fcd5f17d14c3900ad4bedbe056de0dc1c0ef22a208cd67c416e1
SHA512 f5a116392b466203880b3e60915b06512aaf96c3a14b77f34a8b1d8bfec0785e724d0369789ae269bddd47541ffd56bf824305d8801263af386fe550be01b5ac

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF

MD5 64ecaba8d18d93d11ca8372efe9311d5
SHA1 7447fb97e26736232c8003df85abba2301b1c6f5
SHA256 f38d2a82b8c3b9d1fc7d3120daf4264adb5dc966c2d2c120511cd087b4db1e49
SHA512 50b9353c00d7cd474e5a4008bcfcd9dfbcc741ebad4dcd107d4e12ce8d83b571599d525fd54aacb76d2deb5eb60fcb42fc78b21139adfbaa984c77ac52cfb293

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF

MD5 e252d890014243c2e83517c4a1e385ac
SHA1 bf2bc675f671ad7e4c8350e7972a65e2c3d1ffc5
SHA256 2b8fa204075c9fec57c01e4e5be8bfd9e1cb4a57a8a5b4e9fd2eca79e0d75cd0
SHA512 39b25c961b2e9c7e19eb5e634df6df769e0b0ee65955d04f717b9c47bf4624d0b103b8bc0705face1e6e442014c858bfd3cf779844df746d630ad4ae485fa1ac

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21398_.GIF

MD5 b963a72206251850b12fda88878b1a48
SHA1 2f97f8c5aa432eaa7ced41af1c8e34d29712329e
SHA256 867120765cb5e2779550f4b22c8a321da3d93bead226820f118735416a2966c7
SHA512 2b308dde4672f5bce3aaa189e8bbb8895ec8235b95f7cb1a5d59f16f9fe9ef2c8c419e01f4bdec8bdd6b12efb30c07a68ed38f3554c01e46dd66095932e73153

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21399_.GIF

MD5 d84efc3157376cc73c318d909a0da2f3
SHA1 026913a6b073edb154fb0bbe1d04d94013b36461
SHA256 65de634bb973f3db0b06bd9625855a6be66b58c500e9cd8b849e2ccd92c7df9e
SHA512 941daf9256f6c3128e2e8cae84a1ce9bf409e4d9862702ba3c34c44d56757627e9a0e4eca2c5ee02850aac6f900972c9b9bfe12bce2b3caf53b85904c5d47026

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF

MD5 c0139dc3c9d5d331019c53cf9ef54dd7
SHA1 5a73f2656bb2e698bacbb6d66826b846773ee01c
SHA256 3795d52966f13cf32890ada943dec3933a9b53fd551f706c3a3b153812893dbc
SHA512 24551390d2b588f0b59376b5d9bc44f1328fabcf19e5e55cccf0e90fac4bdaf0fc69c17052f23c7800771dbfb2c7c8a004b701acb7ffe371404b8f16175ea7ff

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF

MD5 f5634b8e8239ddd73b09f45be1055763
SHA1 266fe3143d00e5ca17c0e1d4116b87aeca619713
SHA256 49349cbd498384e06459b3d5da5f47b9c16e4052a90b78f0ee0ae0027b935708
SHA512 2b9672ea9325942eeb82edd7df5cd98892cf6ffeff79ea66def5cb78a7412245e36462019c54680f96f9082ced583caf0485c09de742aead27fe1bbccf9f8a4b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21423_.GIF

MD5 75b32b80467d389271360dbbddfb7c8b
SHA1 6c5b70ad38e752e7fc33869222532651c96d96e0
SHA256 5ac9226adbc9e44a3e9b2bcbdbec23dcccad6587585492230784adf3ec944b0f
SHA512 e8ac6fb30098d3a0900f6cea390081ad6bd9dd304c620696770bc477995ce85ffa7dc6be76873617fbc96961842c8020266cc07ea63e65fcd0cf90e3d99200c7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF

MD5 d83b2a1a5526958d38dd6032bc4089ce
SHA1 6aae03e34816a7f635e8c5b565db5744e20a21ee
SHA256 dade3e507f4cc98a7271b0d6974268f577e4d20a3204fef3316a9ac9c135c5f2
SHA512 fb8ad0114a3ac9d271deef5511883cd664cdf07b1e98a5b87a6276628d8690e61d65a7ff5716f1e7245e645fc9d3641ff8aeca29353384defe88da4a64f6777c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21482_.GIF

MD5 e7c52bbe2ef682999948704cec3dc679
SHA1 891cbb3b25f7480243d4ce16d4175fe66348a059
SHA256 de92b5943382c14a58b9b136637ce8d979fe414361bc334f1ad34c8f84500bf9
SHA512 e5d9ce2c57292cb6c878aaf73397a4094ff78a637c494e8fed87d2250968c8945cf8e68ca904c90b7cd31ad0fc5365efa8b1436c52854028a86acd80ddbd7e68

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF

MD5 7c9ac56700208a53c26dec2f99c60ad3
SHA1 69293ed038f6a6c7abcf00e5b4accdfb8fd64785
SHA256 642a6e0a976d9a20bb4a0d161aacd109d53c5bdf0267a199d1c5f48c5b4911e8
SHA512 aa61ab6e072b72f5eb1a5842eb84a522b9a13799c2fa921f65dc5c47bfcdbae65b5bde0e2e2448c1f1f21b008c851b1b33f84ba16a118dce6d8878f1b80e87b3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21505_.GIF

MD5 2f67b3303ac43de01687a6221f9fc028
SHA1 6a00b0a83ff8eb77b283d5b369ba7f3cc8ddc6f5
SHA256 d105b0e6490d86e9016695d1f71ed947d2eb76e3aa70e87fbc81ba62446e7843
SHA512 871b29f5a85f4cba0b46237e39bddaa12427e476f84fdf76c1cd1c472722b2a6a4460887e763094ef8235bd210c2c3a49d34253cf240096ca5a1d103cae56ffc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF

MD5 91707c46a343b7245cbfa7f6b3f54573
SHA1 90411239a7ed82147a9bc2016a4ffeb3dd2512ce
SHA256 db427cc91c6aeeabeebc37c380261bccd721f97ca6db9747e2116e7563fc683e
SHA512 75de38b8770fe927d8f97b35b0050c19bf63a527e09905cc6c26a6dd657eee66e66f5beb489121ac864a99338d97a8b61f5ff351a2a0674511022843e765322d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21535_.GIF

MD5 bc374c39403b238ca7d2dbc342f11e36
SHA1 b81f1149380665d725b0b8155fefa6856735ac57
SHA256 f9281a8e3ee6137a9943aa5ff26312ee2f310c96f22afb924c8e935ff0c6e15c
SHA512 d39fda697fcc3128758f6b024f070ef7a022b76473d62db19795e509986a9b09a020dcc2cd2fb38973979447e7d7a462376d3ed0ad75ed3115763eceb74529d7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF

MD5 e23df56b4371294129f3e7506f578d14
SHA1 cc7a61e4f1497f50f64640eba7b92650f5b155bd
SHA256 f0930db0ccb9cb1200b431f50f73ce81e5f8dcd8b7a49f939edeb27c76f70e81
SHA512 c22bbe11617c6edc2eaa8a1b210e83d68849ae9f4dc233b1565ea407ab59788e5f29f3915b2b43775ee74e37478a3cd30c5691c5f6b0a48a86acbcce59de2dc3

C:\Users\Public\Desktop\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-16 06:36

Reported

2023-05-16 06:41

Platform

win10v2004-20230220-en

Max time kernel

292s

Max time network

179s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UseSplit.tif => C:\Users\Admin\Pictures\UseSplit.tif.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\CheckpointConnect.crw => C:\Users\Admin\Pictures\CheckpointConnect.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\ImportClear.crw => C:\Users\Admin\Pictures\ImportClear.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\OpenPop.tif => C:\Users\Admin\Pictures\OpenPop.tif.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\RegisterGrant.crw => C:\Users\Admin\Pictures\RegisterGrant.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\SkipClose.crw => C:\Users\Admin\Pictures\SkipClose.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\SubmitUnpublish.raw => C:\Users\Admin\Pictures\SubmitUnpublish.raw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\UndoDisconnect.png => C:\Users\Admin\Pictures\UndoDisconnect.png.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File renamed C:\Users\Admin\Pictures\CompressUnprotect.crw => C:\Users\Admin\Pictures\CompressUnprotect.crw.azov C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileForms32x32.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_ru_135x40.svg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\flavormap.properties C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Georgia.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\LAYERS.INF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarBadge.scale-400.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-down_32.svg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x.cur C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Content C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\MSFT_PackageManagementSource.psm1 C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\te.pak.DATA C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\icon_play_prs.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msador28.tlb C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCache.scale-150.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxMediumTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview.svg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ro-ro\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\selector.js C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sl\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare71x71Logo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-400.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\es-419.pak C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ir.idl C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-64.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Edge.dat.LOG2 C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageLargeTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 20.42.65.90:443 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 8.8.8.8:53 126.211.247.8.in-addr.arpa udp

Files

memory/5100-133-0x0000000000190000-0x0000000000195000-memory.dmp

memory/5100-134-0x0000000000190000-0x0000000000195000-memory.dmp

memory/5100-137-0x0000000000020000-0x0000000000027000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 75d641386f18e9b71ec80586a47a52d3
SHA1 e6abd8262584c59f9229acbca436bf63d174877c
SHA256 5b5eea27377651baee3242635bdee879850f65b87f627a21ca8a97f71f25164b
SHA512 dc265abde39a014e45dadc0a2cce1c924751ea2a14b0a0155cccab3acc0fe420fd79358e8e90d1685850eca4b6ce18b2ba37e18fd230aa26737d0d8f63d20247

C:\Program Files\7-Zip\7zG.exe

MD5 1d77c48a9dfa77ac0d09aac663152ad4
SHA1 86ff00f872e897fc716634e88c64ccc287f30aee
SHA256 776994b1c6cfc2303e6cdd15f9c2897609e84d398b58578c349cb01cc7e82bbd
SHA512 c17c11231966b66d82f1d295c645d9a39b6629bc73354d9804701861223b4ee2d588c484755ec84b479a39e449dc5f26654ce398d930b0285e13194833fa5ba8

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 efda3aac8898582a2d7117906bc2c759
SHA1 9c0b071363cb27ccee5b8d55aa833c8c1b64930e
SHA256 a86c92623a3366568cf4de57930598eb3b4e2d7cf23110fc5532c3c89ef5dd86
SHA512 942d746f1fc273426d04a5a30cf7077e58e56a25d8cd7040efb369d9e9330ddc82e1252df94d08dba7e6acf6f246cd258586c8b1b21e0fea251c76a48424bbd5

C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe

MD5 5ef549c63129fdaaa1d8c0c3c65665f1
SHA1 970d35768548401135383f3504f2022782c4e4eb
SHA256 8965c95547fe28a416965aaf08d107342636ec7e54fa121449b12746407d6539
SHA512 d74e913f8463238291c948ff4f52563a24e34259e6ad0cc9a30c2e3447fa871ae6ab6e0c2172f93d131c0e5d3b395ff319fa83bf0f0268d1dff7efda194b059c

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

MD5 7d4b54269b7926d62f86702708a89966
SHA1 8b10c459ab7fa8c64d4c3fe899161a49cfa0255f
SHA256 5497ee8215ace47175a906be96d9b025173fc03d0bab5bb6d857b8967c6bf752
SHA512 fe561788841fe6e6835ce9fc70818094cc6b191f10fb2bcaa57eac93ef2dc6a476723c21388f540d6ddc5444b8ecc04a0616d7161a186b91fc31f4fe748f1db5

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe

MD5 9bbf0492d7d74d45daa8ec1517b3bb7a
SHA1 ef2991a0e4db7920ea66b540c93d7ef160eee262
SHA256 01733f4ab6016d3067dd1fab65ace60326abccfd3661975445552c3e8c98d9d8
SHA512 9263b9880edccd3c374bcb724944ecda05d99d438737acf52ac1bf1f6279eacce17e839b4e37fe465972ec88034cb0a2c3a146a56af6fc4a6d3c02c8a098c311

C:\Program Files\Mozilla Firefox\updater.exe

MD5 03dcd843cfe0602c0c717955f31ac1ed
SHA1 46aef02328c35636e8feba269ed5e5056fce0449
SHA256 b9e1bafe369872388cd8e10229ff02885cdd4977dded7fca79e30f96f838369d
SHA512 91a674194d1129d891c770d67884b091a943bffedc75329e2c8126ae18d36bafb87b42373c084257d7c3134a66912ef1571cc97b70c99967e3024b89e52a9f2c

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 8e71223870cc91ba1665019cbd892b44
SHA1 a8e2d577cfa5474ef14bed1fdd98bb2bdad6ff16
SHA256 cf72eef259aede4930f665c344b29f987b7fd598c573d8e990cf1ee05f0a6695
SHA512 dc444d3501d36366d766dc96c5f6b83fa19b1f58cb8a70d160236386d5d7bcd21982321978b623721615c9d4a27ad7fdbf2e5a8a8cf02025fe61565334fa4c8a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 ca15baa3ebb2f469e41c8b0cf531f236
SHA1 db030438c1b82d97920868d5350fce2a35513532
SHA256 2af10dc58c2c0f7c7e09191dff9f550af047e9c03018a2b2eca6606921d60484
SHA512 2df0fd478dfbcb24d98af6f7ffa3672f83cb65fc6c6e49c3a2e3c9e3467c647f5b193fefa9fca9b313a2f96f66a5993b67e9655b943ac7da65b4f899312bb0ba

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 08265ea4adfe2c79b8b1a59b442a3524
SHA1 34f717aa70d78ff7a593818c636c7392de295623
SHA256 e672ea67462d2e02a7c96177e75fc8e3bd089a77e564658fd32eb7436871e703
SHA512 18d4ae86468951cb0ceb6cd551100de65aeed670ce30bfed2631a8c3b775c78c74684ef859b0bb0b3c3394db749d36a58589ac755d4f3d908de7bc0e2468e393

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.173.45\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 3da240c5cacddca9a41a179325bba724
SHA1 46b37907f03e9a86688c54474411dda68fb059b3
SHA256 eeaa9190f2bc91d38ea603bcd72f60acd3aeaa5be8a0b8865610f8435fb19bcb
SHA512 7c1fa30e8257b5a85c56e61e4ceb7f5e1125344f90f3cd9c81b7a5aea51097a787a95c02720c4a14f056730cae31b27d8f3b2e6d8535fc39701ccff8a90c9178

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

MD5 9864ec67d2dc6af0ea3355452e864a96
SHA1 dead5f6eac117e7a04417810c5213259f983aa13
SHA256 36aa89f4a308b43a4d7069bd2bd36f66b7ff307d511c6e0fbb3f0055d202d2f0
SHA512 942e51ffdfe77f65869ff0acc03f44750f29e6fe76b3b926b6074dacfb9c3e36d85531d71326cbcb2978c5899ca41281fb79e32303ca8ba36019c5b59d1bd505

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

MD5 a087721bd82f75d515fcf38ca0c2f368
SHA1 e05fe2b706008fb74220db5022c7dc95f564a72b
SHA256 81bb373f8ecac10034aa9b736cafa6e172f24c6a9c8f9602b9c4a014b448d4b2
SHA512 7bc0f4ca0a0b9dec45d45a14071051a3cb6b01a232a7418e2e40cf89de4b8aa1f03c7c588ed6f7f319f404f868cdfb843bd4de97459f1f7e90fcfea1d9ea4659

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 701be07ee70c84031bb32af3a7e3bd87
SHA1 62f25e85307d97ff841cbf831ea6b63b7b75612b
SHA256 17a9d7439385f5a03afd16c1d11b5d93808ef9a71d2446f2134d334eb4197a72
SHA512 a6f60c2f5d038ca04bea43aab1b10c844e45e85746626aa6e16ded5d88d7e635f72fd21d837bcd3b63f275ddfb297b6fe8f16719b00f0a2d135097977ca7c3c3

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe

MD5 50b371a5f9106474f0d61a5c9adaa5a0
SHA1 da77de14c0a7ffb65e7101a99a0cbd581e591c5e
SHA256 2a2db2eb63d89068205d6680ded6baaec143a7bb13d06c6656c21dc844b8af35
SHA512 1f06927f4f41e14a430cf20ed61fe66aaf44912f8911a5bc2317e2f34dd168e3034716f4dd4db68144683ba1e3628ac21b8730d3338f3da16d5c9b64713db159

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe

MD5 34de50d498ead85159b5db1ee3d268e0
SHA1 c90a19ce8945334fc5fa7454989338ae1158f0f6
SHA256 17ad667f5795595b39e8cb13a8e33a31f8927fde576f7b7ddb9dc5db79a83d17
SHA512 96b570f3c7c989c84916b70dac7ae49e92284fa2c7e5f0770a5da0563a815690700315ee87fed5a99566a88ba5d6acf770b5f87d2ec3f9dbb0f7e96d856e85ee

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe

MD5 99ed067d2d168aeed9feb5dd7fd119f1
SHA1 7585d5bddce8788e79fe862292c6e8ea3e1496b3
SHA256 5bcb697d5e1b6acc1f4593333a9bfb74aade31910a0d84783f5c3baa43015f9e
SHA512 f1936c9636836e311872ed70b8e9e106991855c1f22055a5aa02f105f44b900a3215a2c33da7e84f9d39994798465d274f2153055859f941a3e8810acbd4e172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe

MD5 0adb4042fbc01b8bcc3d3768c799b699
SHA1 0b7a518adce06c9fd6df7fa2c0c49a07f4178997
SHA256 3e4a63090c8e795ecc4e71d77a92701473b22a36cd974801816f70711cf74b26
SHA512 1c249bcad0d2174d0123bcd93d15442f90c292eacb15c7a2fc8548d18b6580c7cde79e892be57a2f485bae3dc229853920b3530d2f418517bb750960e3c543d7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe

MD5 128d8e75890e0366a77c68b43abcfdc0
SHA1 fba2c1e31aae16472336636a065c225c1f78c59e
SHA256 047afbf9ca623d183c501705f689b04a7a5d4d77613ae86b96ae4f378e7d6609
SHA512 e5eaed9f42b77c781d9cf816aab5f17e5a0e9007bdce8668af466cc959d1223018a78e24be067656802cd6be6d82a221296b9058199f4ddfa3c2fb27a2c4abcc

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe

MD5 86f275916b9d9d9259325889cbd36819
SHA1 3576bb9db6fc5e7106977a8bbf94ce6b02ea2444
SHA256 1e1945a2f5fad8a4458cbf397c551e78d4c3702b49d339fb8d83a121fa777868
SHA512 b719deff29b9e5ab86084a405b17912b8682a3ed7f07642d2e854acf0125c68468f8658a364efdd5801d6d314519478837ad485832d4bddc88b54b848ab96524

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

MD5 e435f94da6ce077f2ca5c804801bd04e
SHA1 10f3c87d8996380a80deff224f5bd4890bd52dc1
SHA256 5d0976a254afe52ca852336d1c4d1fa90cd712528531c5c97d44363fde3baa61
SHA512 486b2628e18655227cf9a5b7ca13a7b31f9dfabe0d87915e25c1efae0ec56fead1256976eba12607727c37682d98ca89c31b34290348b8320a8386a10b148386

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

MD5 12e796be793166c404fcb0236162a07a
SHA1 86aec5db1857c2ff2c0af6b233c13bc39c34c86b
SHA256 126d9b21f4ccc906446409e46220a307944a98ec413b43c6c8ee36fd4470b259
SHA512 19c7824a21b2a89f3a1732a2be3306fb72063708a45bf3e1010f0b677198721109a953cc2beb2a710ebfa6438c92eeb9c48fdfece40535af0701682a60cf176a

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 931b39a5d11bbaa3ce4ba22aee8f9121
SHA1 de44fb2f12bc191b9ab90d85ce8868152d046d81
SHA256 c802c522c25352d195ca47d5838a93ee44cd94283d018f60a072e3aa15276b55
SHA512 8b1b36153c1c61b8e4cba198827bd13b395f1d19f457843cb843581c458cbe4fcafc2d9a049feb929fc7fd7aaa1c5d07d805129814a8b2801da7550469307319

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

MD5 0474d817d13eb8c7b29ff5b30b5075b2
SHA1 866ad4837d7e9523d7980913a4e2e5b1c359b8f2
SHA256 71c7d00adbb4efaff96b98f8e4b897229cdf21d90281d06f11404d9ede96080f
SHA512 c7489932b3210917246afdb1e4fefea8b2dc36b3ab44479a15bb47bca2365d3e255a92775bf05d954ac00ebee7e822c9ec19508d2c96f0bf3bbbf3d563b038d5

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 fbab795ebf860500e81f1e22e68b4448
SHA1 8682f30460ba7251b10ce326b0e23dd8fe8f511c
SHA256 5f51f76005305de38d0c982aac9b0767a89e51b657e84d7348b3eecba23526ab
SHA512 5bd6a5ff93126a6d32ed110c22949f23ee520191775ab4bb9035fd556fca0a2b6a81c30c410ee8b489eae9a722accd02d1390173f22cc16fcd621b996691af68

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 ee82d474e60e228faa142bd86608763c
SHA1 7ef467c0d59db356bbbfca321df5943948b1f250
SHA256 f99bfca352ef9367b6d784e9dfde46f70dbbeac7c1250d2c1dd987559db02a27
SHA512 60848b75f1033c6a9d37411b266ae475634e6aeaa380c4a9f2411bed1f08e629b88216ecc2f0247edae28e926e2b502bb80216b686e56db3ffd36b57a489d04f

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 b8577aa1500cafc96677545ca1b9fb98
SHA1 26fd6f8073cc0c69b5296a5f0cb78726ce56532d
SHA256 338eba73bfad408d820a25ba813d7fc03ab5b574e8a6afd85af55d173c566ab5
SHA512 3832944c1f4956b9225560771aa2d268c958b9025060cbb632e5206eb6edd34973b33dddc65f2eaf7b695c2bc7d622e8f643d49b342eaf5fe8bdc2725f54d45a

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 be3101c4d55c0c0bf1f67ee4823b0803
SHA1 2fc50e3a593400a6ca5637c7b953d8313e8000ab
SHA256 29cbd7b4f7ad60a739c969d79a62344395277a0972e6509ee1d5079f94e3f08a
SHA512 52257932f760dd31b2d934b6667b6f5441ab3c6b43cd302c7516159a5c1c8c672be8904a7baa965734b4413b2984224b1c26b6e0997e07796935d2029274677c

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 3c4440858c160f3594f073e3f1f5beb1
SHA1 f615f2b220c05205e5ab64c7f4a94ddef04212ef
SHA256 f41f98ac84d2fb963348f61e1b3c5a06f963e4a24b765813b326afbc05b780a5
SHA512 7e96a886358636c80cb53a4cee45c85036d74a1276432b2c362202b7e283df5805712547b4c038650777f60fce0316db8edf77336c941d48d037001261b97090

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 08d831c5227eef56e152cb2933dbe60f
SHA1 1f22d10888b684396234b1a6ab5c370893b5e648
SHA256 4924e5eeb685f052a450419418db23f34535caeb1528b4031c9047107f2aaee2
SHA512 bf7f723fba1593edace45666417a8dde1c8d9a2ba50001d6e3448358af127ca9e4d4b4609765a34047cbcd8c44f8149f2274af3a5b41a6eb2a949448f7b4817e

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 14753f980600bfa43193402a249e00eb
SHA1 410a69f2f168872ac6c4d089e432b1f9877877fd
SHA256 fffbda9004aa212a0de8e02bbecaa5cabf62a439b1503c4e3d681c717c8ffaf9
SHA512 5a43c29b1ccc784ba52a6df629d637b7b579dc92484cdab02cee7167a08cc6204c6fb5073ef1b680e775ba6687e91b25b786a2e81ea2a078956af0109f6aa23a

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 fcd8f257150216d73284d32e3fa6cff6
SHA1 a4b97eb76f8b02119188ecaf402d2c6b16c7fc1e
SHA256 823ebc1220e21d5cb4d384fbac467b53329ec8e4dcd727ef61f97ea88a48136c
SHA512 358013a8da7d642128adf649060d091549ce07089799a02104490ae101939b1e73f3d2a10ea22fc5d7dba1066f48a083a476aa9339c9482522f44ff9fff17bb7

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

MD5 c113b383859dc62b74b084f24a80b755
SHA1 c4ecb8037943d3e46ccacf05f598cbc085a339bf
SHA256 78d32c46779e2ecf8340af6bc127164eec3437ccf73b3648a2a165376f748ae8
SHA512 305bf5efe524ef43bd36725e952abc3c64fcd3095629f2118c6f1846e6785a5c7e004db98dec4220fcd2c3cf6fce4e5eace607cc47ece47c396361985a6f602b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

MD5 bc414c90c585746e7d4d3079c4fc9fe0
SHA1 a867b60543791893fc2a43a6613a09c38fe28830
SHA256 3ba23e406859e984314098e38cbf09ad5d7ceacfccd7d1248f90009fec38e2f4
SHA512 fed9558a113c0ac8db5a8c820056b02a528d02924284a31da21a87b51dddeafe31d7283133015417e6dfb03ef45e8411eca6a1a2db63b4365b8f2d5eb6c4cd58

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

MD5 b1cb18285df7a7b91e3e0aa0bec0c0bc
SHA1 56ec000783ba60603cf2399bc5ca276663189e21
SHA256 212fe20db68dfba53b3b989f73a995817556a1f5de86e5375f41334d29ca94d4
SHA512 4ff6505d453c9a5e8e01381a86249e93b584c023168ad9ae0180b581f1f32af61e05e6d7ccd61af1b53ddacd7606d26d93e4e32534dde4454889f8d3ed04ff5e

C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

MD5 fa86a3e5c6169ad2287e2dd1390c777f
SHA1 50c2308614139bf7ab463fa3e83ff60e0ed9d278
SHA256 6422257064b513bcfaa10976ccccca139a773828ff83031b1c155c456327e688
SHA512 3f391745e89e21725814c18d83c9ded49253a24976bbc08d06aa236c73650895570f56906dc108e2d3acd51eee0647e8fb823b604b683ee81328116e39000db7

C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe

MD5 0089496f6d679a286257b235f608bd43
SHA1 570b1e25d8dff0073dbd447db422efac9ce71ec1
SHA256 323b9dc7bc2d03fefea2d4080650a04c522f32862e67f8805e9a7e5db2c98763
SHA512 c087833edafbb7cabe1cf03f9192c34d6b264a42443c854fbb4e38ea23d48aa3b46bf93e37cad7a4ff1fbc94f5f58db41caee9b4ab9df51c914ebd445f99d0a2

C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe

MD5 3c5c918b895896f43a6e068632c64d06
SHA1 a87bd909af37de3dddd4375c92bd2e7aa10b656d
SHA256 2a7af7f6145cbda22686146d6df5a0693e70ded30b0319ddd52cc109e556e28e
SHA512 c73169a4ebefb8c5c25907a624485157c792003115fb16b3a437941c893961e9a238bfdd2dbde34aaca2dd2c40f28970aa79c7f1d313f7f70be4a4c3ac80e179

C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe

MD5 29f2c6f0c50831ede19c999f3ef85c4f
SHA1 4d23f927e47ef2a4ba0ca7b5d87656c84e99f5fb
SHA256 fcf81c47decf53f9c9043583d4f8db11b4845b58fedc8059c73c6d45e006756b
SHA512 61b5d90478e3f2dd8a8efc419f405ac41a64e4a439527fe6ae0ed192fde7d25d7f25da1132ed81fc0e7360f519db978e490373241bdac44dcfb8f708a0794ed0

C:\Program Files\Microsoft Office\root\Office16\msoia.exe

MD5 4f97587c802cf294e07cde3450d98c30
SHA1 e76a5815c07ab3f07f5faa5b250bcfe5a5f99e27
SHA256 4ce162a1db392fa3757b24c0bd11088547483b216f86f98f2166423e8a339b9b
SHA512 8be8030d7f4636771090a69795230c5581b473b73f14da4f495cd70f6b4f695e1d4c4c57a3183908afca71ada0e5a578f6fbc03cd405bc335cf9a73c69c936d9

C:\Program Files\Microsoft Office\root\Office16\msoasb.exe

MD5 a0220ed94237bcb3e167714245e4e317
SHA1 6363cc20ec56b5584e0c4c456ac1055100daaba2
SHA256 b54a87a9188980a11021616d7886323366da5da17d9f22ba5f7406230193d81f
SHA512 fda09be044dba4aa9af91365c300d1cc7832db9264eb285a68b57835f0ca524d875e87b4e60d2789b6f4f5366aa10d3aa48c3ec15a67c599097aa8ffcbd657e0

C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe

MD5 feb5009f0980269ac4a3b4ae01f1eef9
SHA1 e7730ec25a8065bcf34ea2a1a594bce7a45af83c
SHA256 7fd05bd6ca1f114f63d9769a4bb17aca8d79d5eb201f5a8441b637b830e9a736
SHA512 3a2de4141d2ef472feadcfe9686d8ce4a553b08af049f03ea9e18da195ffe0577e9a37cb51127977cd8898182c5315ac8ef570d268ba396b3d2bd1a943830413

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

MD5 7afb746391ae7b8b544f1ed364c8d492
SHA1 aa76a32c58803b414397971710fa8ca3ff716917
SHA256 498ed05d2f83087e8f5ce672db44dcbfafbce3276de68a95cc6eee6a566e70fe
SHA512 7216c26c0f51db98a24ae34ed0cd2915daaaf4f1c341f452c494a4ea430a9e37453d3ed3cbc5102945a693932f29bdd37b43e3129dcfd0d3defe592a3a66febf

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

MD5 4163572fdbdc1836611499f29a51a0f8
SHA1 2e594500094ecf3c6e881c3eedcdef618a156bb3
SHA256 97c80c0d1b0521a69d194c4b2ec406d6e21bba9a7865d63d964cb77ed7699a92
SHA512 f471f8b33994972eaaaf2247171845167fc1a33b013011bc0632f92e4ea6ac3874fccb02f3b3044ba642e6840bdeda5bafea8478828bc1df24933c1c5b34812c

C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

MD5 25fc9941ca2fd1e3d88a67a43f37367c
SHA1 a5d68259b6733e8881c26b90cf2bd325c484ce80
SHA256 6173c201712d38fd63275f358cd4a9fc47978147d26e43159a9fd9e5d85be418
SHA512 f7e4a84208ff36106a3a79584df4e58ac50a77df8e8732645b2de6a6ea08842df51732990c629a7a45232c304e67670f46981b4742c20ddd3f3222b6561262ae

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

MD5 abe6cb4a087784ab66721040d80bb6bb
SHA1 3bebe0db5b9848da375b31086b90c8efe5a466fa
SHA256 26614c1b8acb6a4a1e96867670daf75c755af750d807892988e177a3c1d929ae
SHA512 5dbeb5d4f994fdd6b0eb6cd9050f917d18c96034d05fdb4e9741db8d3b93b0a89affc2f80fec2e2c9585191c9d827cd018a2c83f2e58468ccf05b3c8df418a7d

C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe

MD5 3f76f0b4c48f6994e0368a2315bbcc4c
SHA1 847ae0137584cf41915bd9236a005305b104a53a
SHA256 2dc253387a1e3dea20d3cc2a6fbd035895b20de715dfaceae5890ed518147e8b
SHA512 7f6ccf1f8404d9565b70e50b98a87cf52d21698d142c829e3acb5661ac78fb2580e6e1136a2d96da2fb1fc19ed7d6e05e701e3d2a0a04c81c40c732b0157ca37

C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe

MD5 106bcecd03619c6bb8e0ca555bc3a838
SHA1 3a50cbcdc886d932e3593afde03522c6b8e03ce1
SHA256 32612dfc036d6db9b5cf6e55e4ef8e7adf6f9e870520497dc6b9bc782ec05662
SHA512 3364ce6fa557e59c966dafabb4fb3ee93ffc11a27ad4bd4a33634bbd75f7cd735b391079500a61fed074def11156cdf0a68805a38b7fab53cdf4d73edf346ad1

C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe

MD5 3c4c1560581b888b9bd46d720ec1d07a
SHA1 c9a63d0e60260f197f540b2c25dccc52063d59ec
SHA256 93df8c31dd84b3b3fe3b550cf687b425c64794b9762fdc0c77f4f8ae887ec750
SHA512 2dbc10df09e15b0a7bc7bea12206b418c64ec1ae1ed935ad2c9377db857dcabb87a365394f17bb76ffe31b87e48bada3d9e162e393ae4394d70a7433b6cc00e4

C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe

MD5 a7d91a0acf282f5816cc0eacc2d8f0f1
SHA1 322e2ae7ebab255a70bcafb632fb80812f9f77a0
SHA256 24565b7d5da36dbee3d2214c76e14505270a638d6be0046ec48c9310b7961499
SHA512 8030a4d9fddcc295cb4748db432bf7c3fee6787988932bfce35f835a6d61a9bdbcbd511d7d8868ac15994466b64bec021b1415e65f2fc146f84f284196c662d5

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

MD5 22322df2e04f20adf793c89a72f55a04
SHA1 0deb6f59e1a6270b0e232a526357d270388ca843
SHA256 4c777aed9dbf46fd229654a0e337de5c03e2638537b9d602e962551eddb1148e
SHA512 b3b46d6dbebfcb80a12b833c7786fedef72f1b50610ae2507937766cdaed42eefadeff640b9a7d38843b0f51ccaddbc1360e8368e6241ff24475c52ed392f1c0

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

MD5 47fc5d30921f4c2bbd72a653d73285be
SHA1 4f92e946363ea380a2a6be74117cf6ae26febaa0
SHA256 d81c4e627d34c13c60e5e0c2e0c00fc522371f27bb8e31608bfa4e99efc71367
SHA512 f093e83ad080379f1aefdf869a44845e677edcf4bf822a530d4835d162fa33b420f0855d26686d95024f4e838c8cd6044a724fba76ff27dcdee6df42636f800b

C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe

MD5 4fc216b86dc7524b249860199dad44e7
SHA1 4a65ef8c036d65fd8194c5938f737b76b9f08e05
SHA256 c69e9b16b1b38fd1090a1fa8b7eaad5cfa8a5ae20d8bf0f688fa52e31f5b3a52
SHA512 5740348c73120f151ce365f96eed5afe9223242bc5d38da1c1213c39362516133adbb2bdafe9209c54275dbdb4b97fd5a5517601c82b1b2af0646d7f32b89baa

C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe

MD5 1ce2e08b01df07644dbecefc2a7a19ea
SHA1 d34a0bde7a41c8ac0812e7f754a06c4fd845dbfc
SHA256 563da3ae975c0ece12bed9fd579c112fbc245407307be911068d72e6ee743d0a
SHA512 7008ed454843970cb83ab01d91fe3043c77f70e6bb7413bfb983cd2029fba8e6765fdef24ebf323298263c0d8d8e7294b0f57bcd463ee7c46bedfc8874d6e99e

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe

MD5 46c35242e8cac9cc48524f44a8a9a85d
SHA1 250ba52cd1de2c7311023036cc7ea0f25a52b68e
SHA256 f3883df9fc4e7a909419c564bd15f3fda4fccad203f3d9e9136b42a6b9ce3e54
SHA512 fff4deba1023fc2ad01e9e6f840ca06022ce9f81d910956228687c28be61c758514d0ec5795d73d36b1a9230f7367663f3360709097a2e5389a65a953e829e69

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe

MD5 f1b0e5c2161c668b7691d550ccd59265
SHA1 dcfdc067358deeeb79fa09b69b9da9cb4566c3ed
SHA256 28b0ee4f621152f034a02ca12edcfdc24c5c39b1962c84c732959a3ca6e12776
SHA512 3c0c175ef844c41b7b251953e1e7db0ad41c708678b5381ce5d7be1800384a7100c17e96960a6c86759f5f05bf37179ae81e602a1c42246e1b27409c9bea7002

C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe

MD5 d4662015ac90bd202b483d74f7f8626b
SHA1 15271421af86efe9c361a6bcfd6dedf016784ee1
SHA256 77eab832cb09cc2716a212261313af9fd2cc80d818303e4dd2c53b1165da2dea
SHA512 73acef522f1a3b899ad4271bdc31df1c7343285805f177b7cdf0f042f7760e1e623d7deed71b25648b520b403e2f39bf460bbdf84f50a3072835af1ca6c76ffc

C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe

MD5 515527f08510fa822de75f6fd2e88c41
SHA1 421724d8a0130c0cbf1ffb1d074d2cb9e4e716c9
SHA256 577bcf068c19bb7e139523c0217dc83402cde8af0ae1bee59e9852404cf5891a
SHA512 fc822c865cff49cda89b5558b1eb87accaf4dd5878636e1459a73249e0897db4507a83d4573bef7479cc6951e0452ffdf747d2bb1de194d1a22c76faa0c9bcfd

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 fd0441363d32fd25799eed34a7459874
SHA1 174d1827e8705d7f18b1cab7af5653f9e7fadaab
SHA256 e527bdef741e82e81670a85a362ef32585986ea9006a812b37b3b6f9617c9ca7
SHA512 f92b07872a8e59dae444ff75c0c46b50f8d112698db9c704f436802ad9730c7dfddc0d85f252565e0783df16454e1c159e191554fa005075c285348f337fde46

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 989daf4b54675aeba1c064ed8cad94ce
SHA1 567edf8f329f60b1ab9b23b508dbce673e6fa993
SHA256 620fb9cd0cd297e350e5fb191fc69cb8ea09b1782b8ef59aba615ab717f90987
SHA512 368f602ede5ed0761be53051cd7f76ac0d82eb57140f14547480986a9f0323cbb50c3698d070dadf3fe983b93863b51f6db70e7fabd306ef92f19109769ae850

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 03fb0fbd5b288ecffe8f2aa2d5d4fb08
SHA1 ee7d637e950b5f521ec54bd0617177b0262f7c9c
SHA256 b69acec9f75428331780a77950eb03401959ad3badf0f61d62df642c27a73b6c
SHA512 0c8377730512914de7858b9e7203a71b9cf1f734779280d0fdb4dff9e412b96d2a13701d9220fcefb0cd038b63c4052b5ff07e3ccd062b9f91d4ad2db26bd304

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 741f70478adf989f9430eef3b84b0c23
SHA1 cdbe1fa584c3c66163e1574439e027fe2f667653
SHA256 70a71b55f3a03e7fe3a0c902596d1d3aa3f26b0609636a6fa794de84db6ea1b5
SHA512 e59d7f668b1cb0bc95eea85a2101ca18741f2f1165ad8c52db33a7fe34effc50876ccf032d8e2817efc8b1857f3ffc607254657d64b772140d0e7f5d033a0956

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 dca511dfbf9beed7e408f1a7cf1462d3
SHA1 32070a6a0d6548bcc9aa5ce3318a6ab6258e8142
SHA256 f1b3d31c944fea2743258135c5ae41fce04da08b8d608c3999b2b666703f47fa
SHA512 3495d51d77fcd816d0dcd6670b993e6ddb1089b4cbfa44767dc8d1324ca7f1675596bcd66abb8da0e56e1a526b40cc044e9048d5e5e29ad9334820ca666bf58c

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 ac4f3b0b3194b4d9ef4bff83785b8097
SHA1 d5d22ac5e5001be0fb18d2032d6c758e10ef8a6c
SHA256 b6bf586376534ecb0f5948c841742d66c9dd634279c5f18fa5d27aa7989f92e3
SHA512 2ad555a826c77b36868e0b7a77944b7b81a282308df01343eeb236b398ca4c52d6691673eca2916d12251fc9ba3a180a539b1067a367ff75554bf96c4ecc5764

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 dfaae9619d96553f36587baff4c4e887
SHA1 1e68a2f60db494be7481c522c0bf760e536cb77c
SHA256 e8e53d9faea7efca67d0514175ebf4cd16c16e5e93ef5b511745278c4104f3e9
SHA512 24d3cf7999c06c4d67c48f1ffb91e3447b81dbc8e97f4e6762c6e791a00154061d39a2132301bf6db76b6fd7b4847c9ef03ab0e2f47e2ddb4eacca5c3dc53757

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 a08e8410f1c04270dafacea831c7fa00
SHA1 ee18fb85ac65f8a4e04677e5a8dc8f0244639929
SHA256 e0f7d19422e395e9ad8853c9c16eb01068d5fc18755b925091e884a55bd48580
SHA512 834102e43fa718705d56c8b24b33169310e15da23278937d1f205816a7428631756d724d8e76d84fbcf1c94b014226dadf64f02db66f91f5fcb599a9a47dfaee

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 bd314c4c182744fa949529917f87ae39
SHA1 22468b7151ae53f0ceb268e0d6dc2c67a5d50716
SHA256 2939d466fc7f329b7655d2ee48792d6cab9b8b3a8d7174eefb0d7adb5841280a
SHA512 6f483068ff783ed939386335844b739e4c8aeabad9d764022e940694c4ae13dc940e69c3ddde745116d843591edf6319ab431b98d3b5792f947a784fb5ce0632

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ac6ce1d3a1d9567c5a98de1657bbc573
SHA1 a7b112127e9bf8f406c0da34d01f9b37f5e7f59b
SHA256 c5c0b5d0ea3dcddf65f5c810289fc0719d0222a8e59c4aeb428321f3d24ff072
SHA512 7589cafd44e53b972502a46e4fb4a58b57a82a5e1f17d201e61364953f6f0a76bc4a2cce4d1baf31ca0a3225881632797462b546753714338ca2f4425c2f6a83

C:\Program Files\7-Zip\7zFM.exe

MD5 197d91d769ea21247e0ba6cf7fd5faf9
SHA1 95a166c3634eb2a9ff7b77cb0d6e08f01656c166
SHA256 330f5eee48ffd19c772af51ecc2e6f22f8aef75a02f751d68949cba04a24aaa1
SHA512 13fa0e372dab302933481a0952c05741774d76dec99dc244afea21d5bed96233e3d1269dd57fe5f03afe0315ed37b6bce1f0991963cd75b347e22764e5e9e94b

C:\Program Files\7-Zip\7z.exe

MD5 b7f6c48c2a8aa9c0382e63bab67bf32f
SHA1 e5d4f1ec98f5d8227d98f20c008b6bf4f5e8c08f
SHA256 760d64cd1b77013ba1fa637f142bb8378e9439db71bcdf4f2ec1a618b1304cc5
SHA512 ab4130739e68ccbab3c5db3a407200d016956fe56ad4d4d29ebd7c9f5ce446a5cbd65d1fa86a06cd95e3b5d0d6f6cda540c52dccc02ac3d319421e1842233aae