Malware Analysis Report

2024-09-23 06:54

Sample ID 231018-par8eseb7v
Target 7129291FC3D97377200F8A24AD06930A.exe
SHA256 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e

Threat Level: Known bad

The file 7129291FC3D97377200F8A24AD06930A.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Renames multiple (3823) files with added filename extension

Renames multiple (2372) files with added filename extension

Reads user/profile data of web browsers

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-10-18 12:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-18 12:07

Reported

2023-10-18 12:13

Platform

win7-20230831-en

Max time kernel

122s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (2372) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\kab.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Atlantic\Stanley C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iexplore.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.SF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Tokyo C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.docs.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Curacao C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santarem C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfxrt.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Costa_Rica C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Magadan C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Argentina\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Menominee C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Beirut C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Andorra C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\15x15dot.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14 C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Dushanbe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Budapest C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_fr.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Network

N/A

Files

memory/1768-3-0x0000000000110000-0x0000000000115000-memory.dmp

memory/1768-1-0x0000000000020000-0x0000000000027000-memory.dmp

memory/1768-0-0x0000000000110000-0x0000000000115000-memory.dmp

memory/1768-4-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 5326e04e66cbb30bd275b51aa22209b6
SHA1 72cef360fe2de770e8304429af27eea16921d01d
SHA256 9b0ad42ff8b22e53ceda4b3bc76aa65fdc29ab23f29c17e3f5aaba1cfa296ecf
SHA512 4ca145e5ec0d49ca4969248a1de473c2c7e747882fa0d4292b4a41c6c03bbfbfebc1f3e283f265dae12165d8075db6e1eee984eab23161a7ab309755aca3346d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 e872985d31c01993feaa1502b8448f02
SHA1 3c1c95056508d7f0e0868d639f7e5223be944915
SHA256 eb45e468f836a9a7842e8c5a3cbdd99916a3e19731f0453d0a130369fc563413
SHA512 fdfe81272d618ebc2672669335b5810fe9dd43dcb1bb569c3f151432f5c5ae2e6ec2aa2a34b773d6878d881311f614008003aeb36d569661be6e33726d410575

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 4dcb8f5c0df35a778b09e6f31dfcd194
SHA1 48ddd212601c354c4a1ecc0b4ee3e2fb03693d99
SHA256 5a990b0abe092cad014f92fc993715d6c4ee745d43f8b367ede959acf9a77f1c
SHA512 a709ae8faaf3032263535510425c8f6f77d36494b0b27a348e2d529d783d5d6e934c39eb82fc49681cd9b36f98d4bd524a751fa958c8803ffa2f807f71f681fe

C:\Program Files\7-Zip\7zG.exe

MD5 d6bd0ec053ba315327d215531d1a8a8f
SHA1 c8885af19a4061fd6a92f7169039d9346075527e
SHA256 b3fdd8aa34af8e22c8a8a7d70584221c94c622d96616818f34167e5d290dd8b9
SHA512 e32f2e6c958778497e5b5a25fb8ab18a4abedbfe05619297ebd4479aad70ebd409a8a2210cc018eb67aea6afb439059dbab7a2a68652306a96bc4d6be4b06b12

C:\Program Files\7-Zip\7zFM.exe

MD5 d95375fa54afbee71db84bb92cae4e6c
SHA1 4d666f56c4fef59247d116f9593d67e7f5098648
SHA256 4f7e7a511a15c1c358505c53b5715952a06c18c157a13f1224306120220e6df9
SHA512 73c52d017901ef775322691c1e78eda61811bb0a8faa3e98936a9f4256964aec4623a5686660f5e31aab9dcc0af076a03aa6898547ee5573be806440c892dcce

C:\Program Files\7-Zip\7z.exe

MD5 c58413165afb2baa3cb91251957cb94c
SHA1 8f7e455936f60e829b0141d2eb874cca76f57fa0
SHA256 d8eef2a4d5e9cb7b5cec581ccba25f6425b12d22429198364c4a7de94d3fe168
SHA512 3cd0bf1d9e13d030d272cea94570245ebcb6552d07a8996e54d832b7501eef70a6b138865fcc89238e8d0278e466bcf3162061c5c7f16221537c0cf097f7bece

C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

MD5 46f51c6d153fafadd355240a2cd7aae3
SHA1 29983c96eb20f6036e9f548a2386efb964ceb4ec
SHA256 4366f8410b9ec191abea59a5e69c17e686ca1d0c3fd4d9c49cd9cc4f4dca7803
SHA512 16fce6e3ff593332b0dca9c3f00c96deee468d8d8830fdb6667eb7c14e7b9402de54a1f61f6f62d2598b97523d69e592b9627b50fdbfcb8a639d18fc2ad4290e

C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

MD5 e6cccc194047b8b743a380cae4b0d528
SHA1 8b4764c7eccb8d323897505bdca72247ae12425b
SHA256 fb1ed717c8cc845f2163a3ad118de70ede84dda9cf12c0caeb8734a2fa4a3b7c
SHA512 65e500d76e541c76a7169089ac39a5934d79aa1bc3cf4214b5e55a9bbc4c8d9439bb35d643932b88e65893d447a85c3e215d86df3bfc612dfa4c154e5c82f556

C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

MD5 8dd3322b531a275074816b4469248e9d
SHA1 27ed8d5fe4276ed4d37c01547c1553300b88b54d
SHA256 cf0b1d52954c825cc3a5022f2d63164366bf0222ea956ba2bb5df9597d581cca
SHA512 86e57994a7a334503156b28aae4e21cd8093c2c980169ee8fda0ed16a53dc216d88ca66a7d9c934da818d90478f9509206b9ec6bc63001b1ef5e7747b02b1c96

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

MD5 f1b795a9625869165b8aa3013eb4f35e
SHA1 fe8e236ed426c8a5c61e9ca09922f7705c2dadf4
SHA256 a90e48ac610da4e0a808117c2db87d3acdb6ca2bbb648af2b4946390beb9246f
SHA512 844f8f0751e43bfa6abb5228a82654835a3ffbde924b8c0eeacef2d1512f891a18a84d8e647964aeac06c38bbbcbd3e079d848ef056c9b7ec3b3143a17d1d66e

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

MD5 b919c1740f986bae38e843446b1ee75a
SHA1 86caf31b4e6b45dd5e927c11782f4205933f7ac1
SHA256 99c9c40ec92576cfcb9818dfbc027f11d7c5097966dfdeb1aaf04e0459cc33cb
SHA512 b1b55f30141c2f0164941ffe18bb66f70fb3cd2b25e30ff3e0734f00a30db18b08790faf6d6190a7ec8aae46fd5b3eba580b3929f7df3ce97886be4ba035b36e

C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

MD5 0cc00b36ae92413ef96fa8767cb9794b
SHA1 9b640f80a8ac53205a3297a21856798404d83bf6
SHA256 69aaf7de642171742647d7d18f25e9e20c1ae77f539c5569ef37cdb67396f28a
SHA512 5b116abc134e8217c4dff3549f4f00baf356be75c18aa458357f9a97e683f3cc0888661930ef7f383a083a681f18bf783a8aeb9bf237a56ac69ed411cf04201c

C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

MD5 0f38bf87b1c0a067e925407775454985
SHA1 480ef5a4cfbd844168037202a0e13915261a2058
SHA256 0384e75844501a7209c1c83e9f03a89903626f227e3e13f6cea51b25e63330eb
SHA512 9be4d569cb64eccb54aee36e7f8af5ea25a48df68e31293fce09c6bc1f3baa6d967d50bcd4e08e4b7823fbc1c75eb1bea654478042f84c413632926e8a0fb799

C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

MD5 4a8df9d869b185aba9f38129e74744d3
SHA1 b18109e70689e63e536ea4a7d86da2e562c042f2
SHA256 2af944db1f523c6aedb41bcd953bc88ecdf5ac94a62107ad8122494e8517bd37
SHA512 2112429eba927f7f65c741fa4adaad50874c1a7f27766c171d3199bdd0ea69ac19be72067f20954fe8a6fe740f7c279c7f03336230a570b249c152a476e7a764

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

MD5 a6ddece2773bcc5f2f69b7e9cf5a895a
SHA1 730da3e9f23a534cdcefe35bb65f46dad667ed3d
SHA256 b1195b27420c759db2e548047416209d8e8dd8e40e3090f13302c32f494fc960
SHA512 f1102ce5bd2bdc8ed4addeaba865f247a8ae633ac9698a389b47337954a69a5b5a5d0106cb3cc0e9edadf94f96c4fa89f752247303dadffbf3a1f74f938d76ac

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 c16c87ed329826ad31402c73c353e919
SHA1 e3350c20fda66da3caf8bcc7e56c85be21a88eb0
SHA256 009012f45fdc56664351a28ff62088936e02d29025189b91968a6040e5a0df6b
SHA512 e23485a2f8b9a66427213188310f72bc17e3630cbf32e6ce1af1eaa7a3945197c2537c1a5644938801edc8aaf7228f51c90949b45000f54dfbc6e5879c6c5d53

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 2b75e345b2b06c3ad3be9466be820e48
SHA1 a93841a8906d1d561978dc81c620f0b0595a9d19
SHA256 b3000401bf41cb59a88561d06646e40bc687ae4bedb548ffcfc5087b6468fd6a
SHA512 84930425a70104602988b00cfd5d03665fde90a4493b708d138c2b13277872bcdc8a880bfd6d54e16e96380de80868517fccd1f348c19b616ce43d766d4bd2c0

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 f706f22ff8de218ba1f8d1a32e3304f3
SHA1 cda4281aaaa0aebc466ba2b6f9da696e7915393d
SHA256 2898d2c3d703959c7b302253abbc4362a438a94a474bc384c2e31042b7270d4c
SHA512 e2dc9d7aedbab82af15e003fb1affb69c64a1c17855afb6133f73f16c6d9a04107b550c0be7fd79a334449a9d1bdbb611387d85c5c73e630d1934281e429049d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 a3d92b84b77fca29efeb7578496dece0
SHA1 687f5cfdb91e9f071c91aa21173fb0007577531e
SHA256 8d1be2f6fc1b9b53d2f3ed89b131050eb7e3ce76645817a8e430faeef013170e
SHA512 d6195b88195175f942ba3f03719cb642e7ed496c4f21c880b562a727c90c519612c51f29d6d9682b1638b21ec62ffbfea55cff2fe1ce4cdfb4a286d89d2f744a

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 15862f16e51e1e854ec62028673b34af
SHA1 c78122e2190dda1a80436ff46d651600bc974156
SHA256 aedd64fd1a60d276acbf5430e750ce08dbee6ac35c946a3f1abeb580598d57f3
SHA512 e4f632281c689213a84fd68966cbde3970c43cc269a78732595cc318a7fb53990dc33ebc676e4a5f23f2cef1c83d3d07b2102fb0e8d88452251147921866febc

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 be3cf0e0c647d92beaff037e2465b7ee
SHA1 b04f7dbcd81a9d3924b45967829073a01f23cbcd
SHA256 d79d9b6de04c46bb0154b31de2169101509ba1672f989ecfa642b7cdca13e665
SHA512 58c38436ab3d1b51a93ee5717513315f8a5147015b9221c8a627bd483bdc85c584ac14b417b1807745539b69fa658af57bc830371344fcd31b7f0cd02b8e39f4

C:\Program Files\Mozilla Firefox\updater.exe

MD5 fb7f19edc12519d5f4fbd342cc43d0ac
SHA1 acd2d2297360753ea2724ad104619f80eaa15a14
SHA256 ee073b57da389cfa210a83c0c7f91ebfb07cfd608169498ccd6acde9f53dac20
SHA512 c0bd7f0acd0664835df03db479e1fc76c236e01ded96ddaf0cade47fc8df1009a4b3f476235034f076b6a73c12b4689104e42c8f750088208cb95ae82c1d3ae8

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 297207c72fd18f45f4c13498d0409d0e
SHA1 00d54a8b5e32b47d181a65c6a0c3040b07c1f57c
SHA256 bb7219b897dc96de61e3d46ec41c21b71fe949744297578c1f6d5f283e88b46d
SHA512 05e763e3215bd1d4746f7480009080ea12c1e1cd3e1494a257535053d2bfe9a1377b76b4ae8f14a0b9f043c3ae8ead8368e6d45c4cc75abfe54e15f0c06248b5

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 ab0158f45bf2a9d680dc6af6cd67ffc8
SHA1 568fd0c93f141d6f7301845f6ecd3033562f674d
SHA256 590917aeb3163ac45c1536f01e97ef3cda9f39c90ad5b375ecd5053ecc05e746
SHA512 dbc4cf82e4f7118cb2347be0a23df82db6fcf7df9dd00cf7164bc66bbc433a5db9e90881e783a3137f9c428eec97b0a7ed957fa64fd7e15878698e8aef0b4f2f

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 0af5270e5b3a2f5c5f5b3cd88e072805
SHA1 c2ea2dd895f075d3f1920c8071ad4f3e416f5e6c
SHA256 ddf47ce2ad347dd24a144e5f59f26ed96a8bda2e18606da0c65ca9b78a20678d
SHA512 4baf26be51793b7c035dce9520dd95803d22490369b8d61b5b3eaf29133aafccb12b31261103be6e4b28fbe9d555c89d104833b2b7462d22c561148ead70fa84

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 074e634d95b6b6819c887a6838031d7a
SHA1 56f2fe49af06ad75027906c3d4e63a2efca36a42
SHA256 0b4fc0599f0249b71918ae3abd721d3738a20608a79d6987f8dfa423639073d4
SHA512 91f5481c5229d9aa300ba000c3db7d71ed1c4121ae887303125a0c06a7d44a4ab7e7e62f880f336879974c2f37a6267145f6e9b57fb3dc8a3ebac40690e772ba

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 c525e8f53d33d28ba2de5aef1e4cd0ba
SHA1 53e5df3594b48ce71dc922171271c89b4ea4585d
SHA256 526c94efdf80d283ad949ada51a521e7c4f928b66e9f1da18b9ecad3338c339a
SHA512 da5ede24137441d0de78d92c6bf6500fd5e6bbc19e594e353a090fdb18d9375e8fef2782c11db2e958c03582b26aedb88334acd5db8863bfe478ff3c33b36b3a

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

MD5 0d876175ae178a49f4eaa47ed7a080b0
SHA1 a5f78da2e5b5d973fd911910cf72902522c5dbe7
SHA256 74005b683d2ea4d0460750bbcb4a4cf5258c23f6e02b99734309a4bde1b7d2b8
SHA512 7b397230384e703ae217f2728b94c9e97231005aefd6f25296ffb92ec805cb5ec8b0e8ae68c9131352827a69019ea61448b44784875c462500cac24a52823403

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

MD5 8df1bfd98edf7fadae64a555adfaf30c
SHA1 16e0991357400f9903d49856d9becafa31532642
SHA256 1655a120e41955d19708361458fd18cfc24f8c97bc2b44259b8e0d2c6f19ce80
SHA512 96a2fb868513bd73a44d91390b60bf77d424fccdfda5c80074471158b48e8a81f6f7c31289a886e424b3013d9522da79a5f114110ca55fe66ee45465e71e8508

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

MD5 d952fd727526f1dee563685c1e4beb76
SHA1 326fa878d0064fcaf373efd1960d1fc876866845
SHA256 daf5f288c57922f68d512d42daee8b4dd29644ddc7e35614265dea9f28b95f00
SHA512 12f06f9d80927558c9d3c0cdb7e0753259af4f118658632b7c8876abc631185a1c25082341a8f4bb6595ebc9e8233fef356965c96493ecf8dc94ef51b3554637

C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

MD5 a2937f159ddd167433bc17cfaccfe473
SHA1 9b5ca841883e52e1c3f7fd76bb2006907e7df18c
SHA256 63d59c6c694ad71378b34224d050075bfa29350fc7a9598158d25859c8f10d87
SHA512 bc66014e49e42ed0e321bf6622099a47f90a6496b36a330794fe4258e3ef4c73e23439e2ccf75e61c1fb7bb6d6297680925281ea6b7d02bfab958b0258aca475

C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

MD5 00401301610e20cbe070ff6b73b304af
SHA1 501c3c1bcf44e452d48c56865d25a3384ce25edf
SHA256 e031180338a5bf802721bf976c3dc0b767faa9c17639f318c32cdde0d1ded27b
SHA512 37935406703fe133180817642db262da8abc71bfcf96dd81aa4fa85a20d258e1151e8b5c03e935dc3ba6313380ae508e7b4b75eb1b87641fcab981a4d1196503

C:\Program Files\Microsoft Games\Hearts\Hearts.exe

MD5 fd1a0089ffa106e3fb13336a8c5de73d
SHA1 33b5fbc547b3a54257a85b72010e8208825f8d35
SHA256 599490fefbda8b97b287639afc15d22cfd348ec7f3c56a8e98196d6bd90a287e
SHA512 d0255b5c2f549a6cb4635b164ce895d11d66e2713a705f271f76d6f923a24d0d9218ed7e1681b00b7bfd2aeb1f4aa006d28c845d9548e7839267e345bd43f837

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

MD5 9dfe664bf70cfd85f4fed74bb3d4f0a1
SHA1 41c605ee9a838e3ae700bd8bd7bc47cf5a813edb
SHA256 0f3346209147efab2ad99a617af15b98228149970179ebfe4a7518b4b1a4dae7
SHA512 a15e2d0df44785684866c66f8d7bf505e0ebc94b61798001d8e9c87096526b5cb176ecb1cab8555c5025a6d2ea808d0bb7cb77d19b67b9a59ceda209b4ed803d

C:\Program Files\Microsoft Games\Chess\Chess.exe

MD5 eb99328be21585a9f50506c796dbef22
SHA1 03aab3fcfbe4327a256597b600d3624849aed2ed
SHA256 899938a77d2bc09d004a4498f987bc499ebdb781499622137f0734d89475d867
SHA512 4417d33cb1bf2b7e398b48d5e39dc89ed0ccad550b924d1a22271e722d1396450f70ad8c629945a6182fcaf1eabbbc4cdbbe2d505825912abd0232b29fd0de88

C:\Program Files\Java\jre7\bin\unpack200.exe

MD5 e013137a89ce759c55b015fde003698d
SHA1 5e6b81f88465ac387921caa3825f641e92f4d4b9
SHA256 c0f8413cf39b678e1ef3883cd4010240467640069a46da104aecd3bec1b3c32b
SHA512 bb9767f760359d980e925e6a2d6dd1e198bc3162a0058496b451ceb36955e99e7b264cc9eb35ac59afeb8f73c106bcf35b0baac1bdecc89ee2937443c52dd73f

C:\Program Files\Java\jre7\bin\ssvagent.exe

MD5 5d6db8e137116e5c98883709384492cd
SHA1 9254cb5788f4394e51697dc03eded2d32204e865
SHA256 38c242f2ac6bc36b1fddd24cc8de595ad37ce654f76fdd6d5bc787e6d1cbf4eb
SHA512 6fc9623ad656bfbae5fefe3c6a3b2105713236527e8048882e3bb6f3d221663adf39aec51992a515dd753f4fb7a0ecc2a69d786ecb1d00e10ab87925216110c9

C:\Program Files\Java\jre7\bin\jp2launcher.exe

MD5 3e4be109c91957cca80a0896fd8c787b
SHA1 34293c71234fdd4c490f6c2d4eba765beb01ce19
SHA256 2811fc1c1bf36860cb4090673dfd488fb35709eb1ed786abc027fbe35e1c890a
SHA512 fa792da86023677257f14c883eb95f34afe1aa1035cd0ef27087582fcf3f55a6db2ce47b8fdb6a54a04a8c540535029b9706a69e649695929c1c2c13f589a245

C:\Program Files\Java\jre7\bin\javaws.exe

MD5 54fe96ca66b0a3af1c470d0b179b10c2
SHA1 d158d9105ebad9ca436365e9f6d901b1c463c9ed
SHA256 2d3c213edb15a37a93560c069d7bb6a3e2534cbfb2296a3cbc85da37d181b0c7
SHA512 5d51c368214a8f74a6228c1a7fa65fdc05b41527f7a66973ef0681f0739bb4c19068de994c3165535f48d4ec07bbd4be41d55d64eecd38a669ea796559941bd4

C:\Program Files\Java\jre7\bin\javaw.exe

MD5 36c6e43a2d20584edf6968ac410b73a4
SHA1 d0c0fb820acde0b495620ca594caf6b54c79f583
SHA256 ca39630d3123d14073e0a96190d15a9f1b19060d38d2924fa91250e96b5e1e90
SHA512 920170504b8f71ed86099e05811f26f3902ffc72c15ceb1ff0913e256a2a528139b0f5bade8fed751676b76b9567c3ab9ad1241c4a73a3d3501bada384973190

C:\Program Files\Java\jre7\bin\java.exe

MD5 2ce0b46ef773d523662b1d5deab9cdbc
SHA1 b6bee98238b3af45506d8421ce238015604ae43a
SHA256 9be4e8bb6fcf4b0d4fdec28da99fcb3c309b11f477ff83024dfc829d40b323cb
SHA512 d11e34ab1ce1551228b1996615b0befc9edb3e3ed23272ffdf70b1e80da0c596bcf2a86b72092600b86982f521034f8df85f072848918466a10a392b7858f71c

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 85b28167bea79c57f9ffc05abe2f4f43
SHA1 6a3d6a15cac15069e40665400a168116d926e883
SHA256 2e87b6a53f3d536e4ed3f10d09a654bcd380fab7daa5c57ba0d7dafe3e43d0c8
SHA512 dc329de95beadf00c08017906dbdd9d63e2daafc5f9da12aab46ab47e7a544665f2dc2e88ad9ebb3789e4593e871fe7fee99ca2b8278c42f5b36131b7fc2e044

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 5c146b0c84582a85e727cf88175a9963
SHA1 e2c0aeaa4233414bae9af4c039aed7f0d3ed7c6d
SHA256 3605ed44e2538ccd7928208ed9556e695fd6bfb361d56048ee57f304c4a8e5ee
SHA512 e5078489035ada0e435933f0a27e6b32eea10a03bc5f32c1fc34f0aedadfc29e61bebdbfbad7e95bc891a84eb5296dd89dbb187008d6b0b2bd4c8f0c1c02385a

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-18 12:07

Reported

2023-10-18 12:12

Platform

win10v2004-20230915-en

Max time kernel

145s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (3823) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings_0.10.200.v20140424-2042.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-windows.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\hu-HU\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\System\msadc\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-dialogs_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART4.BDR C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\PNG32.FLT C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_KMS_ClientC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-outline_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui_2.3.0.v20140404-1657.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\javafx.properties C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\ExcelCapabilities.json C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymsl.ttf C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 126.24.238.8.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

memory/3996-0-0x0000000000020000-0x0000000000027000-memory.dmp

memory/3996-2-0x0000000000190000-0x0000000000195000-memory.dmp

memory/3996-3-0x0000000000190000-0x0000000000195000-memory.dmp

memory/3996-4-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Program Files\7-Zip\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 76425b4ad73ce637173ca4907918a39e
SHA1 f93974df4dd6d2ddfcf16e062998e00fc5face44
SHA256 0cb3b38b29501a5865640518e31d8bb9c554f307636419ae524872844a73aa30
SHA512 6d92abe5cef32af891154798e1d64cf17908d6aad7a3ffd4df1ee00d6769aba2848d478e1337174779950d243242b1d21acede3477bc4d18d70992f2ea9a2f80

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 2c7e781faff5378ab164883434824bef
SHA1 461be1d98f9e6bbe61d25863b7de9f10843265ff
SHA256 1b351733c0c9cfca3923cf41b0049ee9fff80fc9eeccab3e872382aff7356c89
SHA512 950ef8814debd1a930925da82c6238fc345af1e11f6fcfc5d20a34dbdaab32dadfa65d8f8b3cdaa4cf5acb7d631e7dc3dfd718e111d8807c01f83175a8051c34

C:\Program Files\7-Zip\7z.exe

MD5 87d243d7c104b39fc1fa41e7ab9dd6f7
SHA1 f5a1713d1e79a6445819b3ea6db467e201792a39
SHA256 9e69ca1157af0202f93dc6dd3b65a9b7cdb7e66ca5a1dbba2b2b455f59ae35df
SHA512 610e65c0ce521d61f3c4aae4e8fea1b0098986140c73756b16658d962a8fa1fb9852e4de50862b8459ac0d518ea7ac79119d00b8fbc430475b46da510267e32e

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 da82d5d1ba4fde926dd5cc962f64ebf0
SHA1 add00d67e3fdbe65e27004fdc0cb94bad0a10b34
SHA256 fab1cbea436de2ecbc61b5927a0976df3c4964ace9090446f7b19ba45a910f28
SHA512 4d03682ec41697a687d5e12a54562649bd84690f00a6f8e92afacc248c5f70953c01d4a5805dbe67ccb88994f91c12b002c07e7d669c44aca909df7ff61396f7

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 6d1d6b250675f6ceccdd4c73e0e7820d
SHA1 1cbe0e600a59906580ed2c6f796eb4200e06b8d4
SHA256 d630e2a4bf983db96fd19df1cec27497182b9bdd482676ee044cd638ed90f3ce
SHA512 4a7783dc306fcaa006a94262232d828d667624b5acdd51573235fc49e9a27b2d21b2b7762b02bb42a2cf39a010b61afa9438e711b86712cf987b0af09f28ccf7

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 27545cc7f9d1996b8ab434abc2b78f2f
SHA1 16f5dc4e7f7334e9ec8836d4062f0bc6d317715b
SHA256 419834752296551bb0a7b2cfd09dfbad245c1b70671377a4ed80460b6f4efe65
SHA512 1cf0cf246d202e851c256cb2d0b32d4adcac2f3c5f9cd7cd4cff6211adede7948f406df69670d31989894b4a013bb3fff62fe7c10947f46d7a55248d175409f5

C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe

MD5 d543b9b71a6d927e0dfe7f0c4efc3eef
SHA1 ac002fe13669ed961ce6acaf29dce4a935ef8f78
SHA256 bcb3d6739178a8156a60ec40c59d13cb2580d4691de9e9ecaab12b9b40f161e9
SHA512 76ddab6906b52c3439ca8de26bb110959752bcc9f53e7e5f0141233beac05f9de9bed8e2a8a3bc34230b0a666ef4dfbe1943f7b041ad08fa4d54a4531ac719c9

C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe

MD5 1eafbba948e34634b51891f8d000ded8
SHA1 b5dcf2e968001817471c92eddfdfc68c07e7a95e
SHA256 3865fa1657dc4db8f38ff2e40f73ff1df2c1105236c94e036b38f8cf5a56446e
SHA512 6db00ac9fd117d3af7161c6a9bfbc4b0c1eaa5717fdf6543d33ee002d6a0d2e454d2cbb13a2aeb727be5bfad922a5384ca68ad653b73f66fbbeefff6ebc3fb41

C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe

MD5 ce34f2fae47c9f0dee0131072a366780
SHA1 67956186e5f87fd7bdef311d6e09a046cd7731df
SHA256 b94973a850c239879c3b510fcd39dd00ff34983fc75906c03f9ae532bbf09782
SHA512 f451ed83c1a9a1f9b7399378150ec5773b6ac6904d625e0f34a9c453ad6d15692a02ba4934ec2fae24239be1abaf362524fa88659b427f418f63f35ddd0235b6

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe

MD5 17b8f960a5c34e12dda6e82f683326d2
SHA1 b85482666acbc92764d6c35b9ac619c4790af3f9
SHA256 1d7c53953596652284341f74373c416bd5d35fcb5651543da6d6e00a42b94a95
SHA512 e6cef15006890c4cf11028d7e795901862f3611ed487440411cb236969793f7895391a32c822687de17e2447ba614fd8f3ecb50e7e1119ce1ef71c313b448b0e

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

MD5 37da7b9bdd6debdbd8b9457ee4b9e8d1
SHA1 392b8fe147ba15c720f017bff6e385a2b018c781
SHA256 a30c9074b255fed0a888f6ebbf997efd91b973f6702b7f1fea14c937b679578d
SHA512 98e4a0e41dba1f78882892139f4b77d31bfa86a7d51e9943ccdfe9d6200999cc9650830f833c842f8720f5de82e0c5b3af2c926da2db4dae49244ee67efb9161

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe

MD5 3b86709ffa558b86bb5854a3b349185e
SHA1 33e8a74b990c3fd719524501bcad87f9be73867d
SHA256 79b170da54fddacf7c8d510c5ad48de4cc6ccb864777fc5a6228a279d4bd786b
SHA512 6fb0d52123bde2a8df208daad5142662658b39b12b020bf8629250f12f83ae17cfd26072022c126bec7b0a84b4ef7f74c2ef179d49c7e27afd23706d664454ad

C:\Program Files\Mozilla Firefox\updater.exe

MD5 9a744ff89453b68ba41fc1bdf612acc5
SHA1 83e77c81f978295b9a961b4433c749768c6877df
SHA256 691b588c597109c601b34547d076110a09c8caddb2e095b908075f8924f009b6
SHA512 f53b64d1895a30138b250b642a24dd556df370da33a1cb8e686864190d06ec084300149fb1b45753071b0c1ad4bb1cf07e0b68307bee5ce15dc2388528415277

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 c8d4b7a3d653527c0f2dc12e3f1d9c3d
SHA1 5d2ff08c6c48754f9d5efbc215b7cd3389b76139
SHA256 73032fec7261de307dc309cc71d355abaf883816b5ff2dc97efef36ffbc5d14e
SHA512 a1cfa62899956cd4921024d33089297e1a75133420a848843d440cba0a17f7cde2dd76be55c4ec24fff114d12d1d0a0364f709cd01f58f897a6352f7d31f6d06

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 e5add49753803be697335c25e559440a
SHA1 5da2664166178f351805297447204b7a7b1708b4
SHA256 9ca2668d95cb6c0de20f32e5853c3546b055f4424bf08442bee46264eb7d1739
SHA512 00f2d0b258a09446c2ad0acc63594257b14a93baeb09f5d84479e0b485e3f6e113aa02bc7656815cf300536357c25a384dc28554465d6caf192b318ec88ed273

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 e299b3ff26542619fddb5f007d221e51
SHA1 8741db883b983162e18e15ec6d91409fc33066ec
SHA256 69b4acecb6b13fef7e9104856d79dbc4e372dde6b1712f6528609390d4f54f9a
SHA512 766e0330af0c5ab5c99ac7f13c780c5161fa663514f6cd1d40eecc0807be70aa07fea1cc7f1bb1f10e9d3766acf49f8ddc16a356668de6cf37df5e462e146b5f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 d092f22b20dbadea967e4445631ff2db
SHA1 d54bc853f2bfc5954f4dbca433a88fd78c6782d0
SHA256 4968bc0295ae3f8c432dab9af54eaa29a514c890145521d7583985694298f1ab
SHA512 381edc0cfd08fcdc5cb65f5f4c4d39d1e02402299ab9d0337b6d41072a29e6ed77f4ec876156bae9a2951cf5019cca2990c388d6c245340053aacda43dedcd69

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.177.11\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 83881dad2f299b9ab0d08edca2cf6603
SHA1 ba0a96b4e852064d6151fddb3f184bd23b337d7b
SHA256 443f576357691e0e795b8a69198fd2ecf34ffd6e3f49023b5d4e0b16b38cc319
SHA512 1cd839ce3abff314f5e614b55fae79328b5c32c841e4488b4f6b9235aa9835e504090c02fb00b7d4d8b7a45cb342c7b1a90f4c2403865ee6035282ee9c84eecc

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 1bce633da6d9f36cac1710dc5cf24870
SHA1 3a08c03c0bd2754e5bacdc4c4d6cee0621651448
SHA256 d99b334c6583c1c872e04919f8903b2ac69b8f71cf0e513c557fef01b2487ba9
SHA512 6fa73d70c04a3e0ea6ef0ee363f63463e7db10be7ab0ccffa7b83983a36415527ff3d42826e4a80905e9794625c3e65d3381c3cbf50e112691d064c2a7a555af

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

MD5 bb7c63b7efe07d2b6f2323b53d05839e
SHA1 843fd270db4bbc56ec278f414c33bf33e14d7a60
SHA256 f6fd33593743bd29e9d05900a2afdf40f35240cb784ab389a9c4fe2d82a4fa19
SHA512 48bcc78650181cb830a87df68d748fb9c269984ee5de558c102421f97e051153350e2a3dfafe7eee7650416832e3931596e824f4e95d2986f0c9b443fd1eb48b

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

MD5 2212decb4c6bdd6698021965c7f81fe3
SHA1 07deb133fb1c77051d2d470a42737100339f8838
SHA256 3028cdd8656d6342f5189da1135cedab099bf377a553a5597386dd79764f0c58
SHA512 f20bf3425e2d1b587ff4d0f3a1c68f63d11c74375516586d57ea998255cdf76945da46d8bd487ed67fcca40ba5fdc01cb5caa5b3d50fb609981a25fadeda9ae8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 59ca136064951e675b49a61ef4b36f4c
SHA1 7a7f19315755073486c7826f966b3ab403c8423a
SHA256 7e95a184c908d6b57d0f39ecfb0cc1b38543789063dfe29bfd3054da5afa80a7
SHA512 34cc58e625d7c37a941caf37cd615f8e8ffa0afc5c9428c96deff2b42703bc2321411da269e159bff76a1589e63885f3ee042ab5b4b9b1b368729638b246c1db

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe

MD5 431be04fb7f89512e5d006c0a467d920
SHA1 7fd20bc3c08d8197be90b4497b7be0d086ab3eb0
SHA256 3d564586c222d02f118cc1eca655f5ce0c08a86725f572b12d91743aec888ab2
SHA512 8facc57ec4af643202052856ca45ddc50b00dd6f03d92a7e36efe020e7bb6ccf60f85acb2c59c73cf35975693d5955ca6cbf9303406f9375badf507d3ea1580b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe

MD5 e7949ddc78c50bf83fccc026a2034716
SHA1 09a9b03ab86e4420bd4a1b473c144c9a5709f38f
SHA256 e0fc77f4b897e2479776e7babaf90995c10c9743ba397cfb4a0f0ded91137ff8
SHA512 a6145e88ab698296bc4ec1b0b08bd25f3d5fdb542765f4283bedc9a4ec92e809365d5385dba4dfd7871a3e464e2f853b9070af9165d60e00cea8c04961239bba

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe

MD5 56c2643e573e54e6824df188d236a59f
SHA1 51405f51b7dd69abd567185f90deec04e85ad0dd
SHA256 fb4d128297b5f832d928223dff727779c2f1a793aa6adf9f485418fb3ea9bd84
SHA512 4c8de3f1de513307e9c2aff07c8f3222a81d73fe55d32c11889552fd1952adb6b888002cbc12b04e80742c142df8464cf65030d7e97ef3c7e5f500f82660c8b6

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe

MD5 0346514473f5f1ab64e244ff2d600a8f
SHA1 778ddc2f070829ddd26d5e2fdc61f66aaf37bc48
SHA256 9063b466424dbe0a9a2db0fc8eca89409ab3738a730137c51e3382a95a83fb62
SHA512 8e51d8eee60c6a07edd0408906897d3f24fbad9c6d859dd9302c962763e7f41fe542aca32fa50d57f1210f2f3ab5842a75639fe2bf0dfd37cc9257dd3039ab28

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe

MD5 3c76a752c9994ce78e64261e813fed19
SHA1 b2f38c5e40f327a2784bde8af00b66f4ace116fa
SHA256 d059b4693098d48a9aec11da6abfc3f03f68322fd9f985972535c4156812812d
SHA512 3117f59852970098bcbed08bb34bcd06fa78c94a60ab44497528462577710b35f430234a00be107dc77b3d32123d25a279a8d9beface3935c52a07a2ee12ea3d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe

MD5 93392db4024bb540dc11d11264bf19e2
SHA1 e36bd94bd4c57cc62af62d345e333d72bff19945
SHA256 e32c181be2ac73ca0534c64fe9146d28d3209170f931fe2f2a6560a8dd2de7fa
SHA512 0e9dd85e7ee42bd1f00349fe4075cd08ad2fcd914e236af709b7fb464718fd6a491f76f93736ed08b1480dacd0c95b20c651871a9849bb3c37727ba68761b826

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

MD5 ee0eb1bca69cb408cf14c4add43f55f7
SHA1 3a1ab4fedcfdc024af46853020eab99aefd25643
SHA256 7f8c003d82fbe57c93fb5b122478a832ffb1ad15002f807a048a704212950187
SHA512 be2c28b96d2a39cbcaf3513ea555626272323bd83f83a84015d0c87ea8371920d1664842b724a1ee7d828594ff6f1a13a8f8853769b2210aefcb767324b508a5

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

MD5 cab109cda6df51741a711550494cf78f
SHA1 bc390f146e0c5b3caae57118a6f1bf7bfb4aeea3
SHA256 dc58e749ea883091cbc6d066b95adc0be2db680026b407cfdda20ca249bb1059
SHA512 cf3a4108e463494df13ec408670d6f1a374f8d2a570fe076856c6c00ca753be23f153309ccb1d5b702b67dfcd9ee773807ee2031d5dff8f9ce485b23b85dece7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 72d60c0146d1719c888a5c465563a6d5
SHA1 84f75e684a18fa1a90a64e608149b29956a6e95e
SHA256 698db87f315743b04ecefdfb2034a56eaeee5c48a72d73fa61823580f7c105c7
SHA512 a7145dee15e5ee4113f33fc38b89d5bdb19226bf999685726dc6846f97bae6a0a4199ad1e225850bf44c4b1b87984a6bffea526b492386ba1a87d43dcd92792d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

MD5 32330f347516dde61db7956d75a79f01
SHA1 544729e4918afbe45431d7a5b75a5eacc23f4ac3
SHA256 afcd6aad81e1301e0172696371500b99c1ff7e5d9437f66d14dd4cee99e56ecb
SHA512 b10642bcb779e0adecbcf17a90c66a7b2be9f558dac5837996a191debe4aab0baa96e3d1bd904b9535d326662a905402c869b8f648209b897e2274f0d20a5ac2

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 9473f76c78b055c8da7b70ea37dd84ee
SHA1 938d405ec6dcd7a888ddc53e1f4e70a256f8c116
SHA256 f41bb53a84e98af1746bfdac950726b383ed1ca06ce64d04d66486932cd93fbc
SHA512 38ba921f94dd9c27940af6f111314531b717a3fdc29cdbd03f7f9464a330f687e5b351dac347a05f2398632e3616abccd63889a4583775a04987db8ed3d4f345

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 e37afe482f8f78ffd61d657c6348eeda
SHA1 fa45f7e056fb7b45432fd33bee69a0655d15109e
SHA256 59ad636aa975d4d59245fdcb4a8460dce12b224bf2d1cee7adf51feede7ec2d8
SHA512 6b3ee48a95a0d318bd8051a5a9f1123495ad1104fc1eb555293f975899d1357aad0c86df4e3879e8d25f27fa664f86093b95c1ece67d00a4d152de67c48950f1

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 1df5c0e93aa2003dd2892d1c11577602
SHA1 78a4acb4a98f5f61d8c472cb3f97ef896ff89c45
SHA256 617a4bfa33b0a0b38bcdef43e60fd8cb1c04caf86afb2b4f5a67510ea8921211
SHA512 c1cb3aba99230f6926e783b9b2913da43be5584239fee22f6ee55380ab9932dbffa0a01dfd889c6b24daf4ff1f672e533a8e9dd790f5e349f4dad4113a753c9b

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 1c39b4275ab45885832b39eba721377a
SHA1 2e9c5d0d8d99c1cceebe1edfbadabfc7c8796f39
SHA256 d801f153f21c36d02de45f11cdc3c1fef5ff589cba98d725ab398b22b98e02a1
SHA512 8216bd12569044905b1732fee7c7f4c49e68633539632bb402ff0ddbe68df537bb208ab17f7a2519cfabbf5ceb1d68703b36762df038b74e6492aef2e13159ff

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 d2cc3c78de08ba7164889b912b5b9895
SHA1 50c9234eae3a322fecf90a92b96b00da7459c5fc
SHA256 287aa5f2cc371f88757477e1248a2c6179b978398d2785076b6b55d7a7b99e8c
SHA512 614d87562cd724222c65d03f4501ee0e56f0184858b3c5d5277d6a1dd6a3a3c75ae9887a00baf0c735981cd215d20a9539bae0f6e1246898700322285d63a327

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 90f0471ce8cc55955a7ce0450135cc9b
SHA1 8c3efe94621e7c5369cd4393a962e434c0399574
SHA256 943f8f63ba208bb830f0b722c42b4eb719d84a9fa680581603f991aa906d73ee
SHA512 3edd3c106ddd75932663730c765f382f516b45333632ab600abeda70e6da3a278873d9b7a74623175e2dacce36c0bea52841f4c1a9a11670e428d0795d155b7e

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

MD5 58d61bd68311022c59a952b87e6e5c8c
SHA1 a9df9c24505af3e51634ed3187627e7a13e179fe
SHA256 0ab924b5234cc777a244e8aa821161b4e7ebaf152184d716b59cbcc4230b47c1
SHA512 c8843acda0c5d084668e19681e8178c57d9155aad16c2f23178de44119b4d149f787a349374dcca3921a7ad379b8f4190a1efecb3539f469419d7c0a15f974bd

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

MD5 7e3b4934eedf87bc46a14e87f5221622
SHA1 52bcf1cea31db4f2b00e5990205255bd48c2f5c6
SHA256 9836d9e5c11d9db703d6aeff2d4f92d772c3c932cc9933f8086e56df62acc88a
SHA512 2dfa28d9485a2921b1dfc30732b1034a2821d601efdaad15acc0ca6a55e356aaf5a56e68e091418e61a8a50a7d68a5fbd23030b2247cfed70810a8d10dc67424

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

MD5 16e6404e204ae2b4b5049b40734895ca
SHA1 d097c031d4ca1cda53550568c5cdb448f109c4a4
SHA256 9b31f1c17f13b8d8979e15ff45aa11158e67d602a8dd83af56d35dde8fb932e8
SHA512 331405a4e8d5a0f534314127f7156f9894e97f34124e76fd772cf2775700f24d72b8d19521cba0bc81e61d27ce83d285c31c4032cc4f14d2ce2b910dbcea424f

C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

MD5 9990d2e485ba5e5b076ce32b5bb6bfae
SHA1 6d6568af19944c73032d5e21ae614f6e417a4e1b
SHA256 26fd7660a2a67ba0a977bbdc01e7be182def6185e3a5a0174b4b836c7c417fe4
SHA512 178393f3d523c9f08605b44be3df53502d596c1689f16337e200de6780b5a0e5a63761d76248a2e297703fe33339fec3f415e26508662026553b131934964296

C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe

MD5 fa72d0fd8379411518f63bb6e6f25c92
SHA1 bd509541633f4792771419999234208ef31221d9
SHA256 a17a51f1f32d4bd0d35514aa3a558fbc838efd4ab0a6da00112f51e01b8d0917
SHA512 1f02c5e82e0ee33fcddf89ee91954c58abaf2413aee5b7b21046eba6cf05a41868b7837456f4c12a4727b40e3d94fd5bf3e39c465f565cf464879b0795fb1a16

C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe

MD5 75b035859e34ed9dea9e0248f8597d8c
SHA1 b63b0754209440c246faed9921aaa9684ca4febb
SHA256 dad0a8db489af3d8dd487715f1ac9389539884dceb1a36f9b83a1df9b085d949
SHA512 ff883033786c83cd6edfc487fef67563ced0a94d5f6bdc60e1a0b381a27b5e087d0748e0ad791e04889183d60b8e49a480a2c48f9febc8f9c63ce02342e06fa6

C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe

MD5 c9c6c6fa40d7b654bf80c971f657f010
SHA1 846502872a943ee6bf2c4ae596f9e4a40fcf638b
SHA256 8f83252d6e5a7040205a84914f93ce4d6e60fab4d3ad34f1ed1271cb7763be9d
SHA512 d0d6a49c274bf435660329446209b3893c12e26116d90b8672579fa392cd4ce14ddc33fa5c05a732a0fa0c73c243b2a29851ddb60cc3369886b40909c2b072a9

C:\Program Files\Microsoft Office\root\Office16\msoia.exe

MD5 e9d7cb9d18ae0f57291c63c4d8de1b90
SHA1 be814c1395cb3bf4ee0505bf3985fb3776724d5f
SHA256 537c2dd6d8b985d1482c394fa413f10a76993659382b6709409b8e2f84bdf976
SHA512 c707169bb19945918e0aa5fca104826aa98631b3a0030ca98224bcc877c299a0e05975d8d873cd0792f458d4a749c140a44413c3aacf81e2567412a4015d574c

C:\Program Files\Microsoft Office\root\Office16\msoasb.exe

MD5 66545bb20aa6ff343f39591493ad0c05
SHA1 3ed15447be766da96c3cfe3f874843822f098e3f
SHA256 1018e875d12f22a82e2e913c833f960b84f267f97057eaa680f5630c55c1ec34
SHA512 1d38f5c25a8139892c30bfbb3a4edb63bd23879320f2a3593b21324369948ebea3bee323cac86065856f51eccca889400819e2849869eb49d619713497049a3f

C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe

MD5 14f8e8f44e7530381687cb24dbd12539
SHA1 66fff1aa6939c144864f2b36f657ee76096fd50f
SHA256 b266b8cc9fb70b6d4ab9303d2dd80584f24b3d1aa9dfbe657780bd5b5146bb1f
SHA512 80dbefe139fd2dff2690780199ff9890bf2fc9d02b0f6bbd7719518d83092276040ed16169be638127443b6b26e95b8efedb70d9cc4d6defba48d65a50a3861f

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

MD5 dc5caf26eeb6a58d16352fadf87045c1
SHA1 73e9272de339d594e97da787f54cc659de3cce32
SHA256 6da53bcc62a20c8a1e2513f6c18f10218d7fa350062ef2e60afbb5acdfa98d2b
SHA512 696ee794a70924b39803a425ff649fb2a5a0a40e9607da4f409e068eccad4f2a74da950a4b997381ccc248b3ffaea16b1fe7269b2fe73d4f0ec0acd051874761

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

MD5 f5f87dca26fa412c44b9a5ea9db3ec5f
SHA1 4e198f86bf9a9c05d62b41925fe00351eed501fb
SHA256 03516cf2860460065124b21390ef3d0837d4f40b288d7e89adf7b6509cd3b99c
SHA512 073f7d3381d6bc730ce531e57d29c609899ce8689cb83fa231daec08f690c7b1b597f8a5e86c1eb2268f770af17687eb9ee54495fd452c600e02ac20ce066747

C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

MD5 a89a3b89d2b3aef1b6222fd0842889c2
SHA1 5824b135149e9deb1d1e99ab53d910a9cb59cc9e
SHA256 d147522722b95f356cf8f655ce93c8dcdd5f037e353296b42b41dd567e364dd3
SHA512 72d3159f7dae4ace551cc5447a37cc92c21c832a0baf1746f6f31452aca877b6a2b24a7eef065dea890abd7a23dc27615bdf4fca5fc27dd110122cb238011698

C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe

MD5 3fc63ad7ef8bb3958b8a9ff9599ab099
SHA1 71b7349319d931276d7177faf6b069ec4f3e7456
SHA256 2a0d562559c2f98b8eb60de033a9fe119b5bae2cb61ad244e0654d4068f1590c
SHA512 7e0db7513f8692c08d3a7f766a71358a236d496dabcd7dfeeef964581abc75675b59508efdfb0619866b40ce767af4bfee3fe5de4f412eec2a3849eb13361529

C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe

MD5 337dd7c49bea6ef3589b00ecd8ee8c31
SHA1 b7a77c185e21cd7d5b00f73352a51396527620d9
SHA256 e5405f30896681708ae743904f12a32db886f89f5d05a720df22cd3e96f7c0f7
SHA512 bc28b233de105890f7f169459d9a28a24b29cac87b981cbe45a2e6ef0baa7417bef060ddcf1bf7706a34782e0525658f6c98cd7c3c2c3dc12e73dd6bdade0649

C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe

MD5 50c3823bf4cb055b4a9f4a093fdabaaf
SHA1 523ab721279d09b2af1e000ef983be59ef25aa38
SHA256 d2f83b810c26cae60874838ddd0f659ccb2af481fab34b313b481b31b00be8a6
SHA512 4fec661922d0fb89f3eed1967120263c1744547d4c2bbd3a9580e4eae2301e829b376a7f7abcc218eaea7f2a3bf6b8399955754a9d901040a6b37c8923f776e6

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

MD5 b7a19db98850fcaac7dedc1fa174e940
SHA1 48c96c64aaf2e05f3747f090ef38f539b4809344
SHA256 6e1c312743845292b810befc15fb79a4d6dcb17157caf10678a310779d9ad29d
SHA512 af367ba844ec7c74f4f00ff01c57054470cacf0cc2ed186ba8ede2d0b84458cc75b366fcc2983f5fe56a9a400b7050b4fa4c0a4914523754f9e26e915cd3f115

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

MD5 21d9ae5956954155cd64db49a7f1e119
SHA1 ad283d43ec2be52820f93d990e3f947b6fa6b686
SHA256 8fadff1337caced7169ede43b2f1e3867fa5dbdf1376a4939d3405a45bd20141
SHA512 4b434737425841825b3b52fdbceb421cf9dfc8fbe97fa28323fb84cbe246e553265f0144867f4564362227e3671e9d626afc19f0238b84a12afcd9902d4489ef

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

MD5 b27c0b4d13a78959ba889e0d97912071
SHA1 86ac74669f610527cb0ffcfdc5e8a52abce2209c
SHA256 319cec3ec95121680a5b3cd25bda916e8c4cc203b67635430cb6656a40d107cb
SHA512 c57c1ee00b9bb5e46ba8b2fca5a0654dd42f5532209d4fab30c3da78b1b6cb8c454918d3baf405904ba71acc45af552f0f1276e7fe42b9dacd0c67c4f70f6caa

C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe

MD5 4205be5aaeda4a1aba33564f76feec97
SHA1 9cccf5375c6b902eb3b7fc313635ec1b887e41e0
SHA256 b1087af2f041d4b0f81f98a268acc19f26240ff6a27141427d70f5d55ffcb971
SHA512 e8e98fcb2f94766bf527a0552f4348690d191d26505784e8db530ac531e36cecc2d20beedda5e1cfe4e70e901cc8cfe35d932c6c197aed3120c79e80072cf73b

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe

MD5 1696b33594785f24a3ecc321637d9269
SHA1 f8cf6da13cb03bfca61ae4940838af3d730746cb
SHA256 35c79908ca0f55edd30e7e7cc3ca4c986b5f0659b454346951bb31a0f2718b0a
SHA512 1d1e23afc16587a1a456ccb6aaff29b10a071cfb03382eb8de8b234f5a1ed4569cc584d1b31213f11a293240a6f0d8b8c367524de0f6f117272cf8d0966bbedd

C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe

MD5 f98b388447d185c3152b676cd3e7c56c
SHA1 c2ef1dc9b34a7d424238d87b2653e13fc6210f78
SHA256 43ad68c6e8290b5da73a901d80ef7360bc855a602b3eeeca2973b6cd0728900b
SHA512 6f87d2c5bc9c33264cf6f55479e063d093c17fad8355e3143a846f092270ee9fd000578a0bfa20e74b5fff8cecb22db1baabba0c1d6d16d0ab3bf27c6be9205f

C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe

MD5 3d00c4246902804443ae81b185f52c46
SHA1 7f711fa5ad065e0a72c7326f475b59c0f0408981
SHA256 77e8a1f1fd29892688ac7ad1e58e4f15a668f71068cce7fed6d9b997b18c836e
SHA512 f135f32b45acc0c94df037f3a38df7a934feea3f4a7c7aeedaa39d643ee156df15aff06c29ea3dc8cd222c6298f3ba190873ec170a135d1cc1ff657cae973fc5

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 2e47ec96acb904303e669a454f0bead2
SHA1 4144cd7bdaab461159aa6a7d9bfcbdf4fc531fdc
SHA256 ad583b2bac54dfca4e62b30499e2e629029e746ab3998695a812dbfd8aee3e3a
SHA512 0bce8b414f5f2166eba7530bdf47e5f05d9b882d5643073d1bad7c977adc73325d67a5b9894e808bdb92f6cf00bc46fb8cf294e72596ec8eeb8feca58290d651

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 4fd4d031192b51eb74a91fc6f82c9d16
SHA1 19eee2e004960d011bbf4f257f1ff67636f14754
SHA256 426f83bb9c66b4bb37a8a0db2634454c522cf63e24e0c94330e540fa66a548f2
SHA512 21d1050408f1c0074f79d59dd16ca9a08eca232f9b8bdef23c03fbcf51d3a2b63d1c55d016d919d087ac8c936df990a6025f17a0bcffdeb3d7d6f8ec7623c5e7

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 1b03e6dcd4c4751581ccbc8114808e96
SHA1 398190358f97acfb7f22b20045276441ba37c245
SHA256 0526f13fd45cafa3ad231a051aa0f1f4404326f2fb9cd5abcbe22ef76166fb20
SHA512 977a0f5e78c63f9725581ed0511398922d61e7d1600e14b101ec53627d6bf479c11cce2567a64f3f43cf4952c834d2dcbd5b51fc73c16acde18f9bdd3da17a91

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 dcaf1e918c82b71a47ee14d0d57e41ca
SHA1 6097a73bb739f9850e928f1be0262f09d3f33e6b
SHA256 19544c8c0ab44493da1f79e0e0f97a6973a815fd7ba62acf2269c4acfdd8ab77
SHA512 418f891174f7943d900d5df6a4b66d53f1e1b7b9728c6008c0ba72b20478c73fc7831ab5e53e53c92f141abd91921f80a957e6eed3c19a3911bc85505d1cc34f

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 ed03e0708154c89a0a5390302edda42d
SHA1 0a7600f455d5f634333bbdaca986d9288745b2a3
SHA256 cd911cfa17aa51134c863417d55383e4952460d3c3a5280cc323977dd271e752
SHA512 a4e4f5793a54da0bd0d07afc799e3c7594ac9be094f13ad7d31d5055d4f7360b8022c61ac1f3436700e7aeb2552f2ba5ba39b11862da2678415094c1b51075ee

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 30bd4191bf59a8a99e668c07d8c293fd
SHA1 5318e8da86d196f68a1838556ede03a2fc3c4708
SHA256 0511d60d114ef463338d6649db4cbec8abeb7a16326e05ed248df7b3c67877b6
SHA512 836ef3c56742af2385ec5636af580ea804b7b734b31f91c35c7e69bbe4071c6f4a1acedb618d2c4f629be4ab72ef01c7225656a6a84afffb49d65376d39f9dd8

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 a694c01c79cd8e7bb9f45b8732659a72
SHA1 f9d53c5b6ff42dffef254b26cea9d1349a2e518e
SHA256 c39f5138f2ceb3a61476556d711956a0014502c9d7b646d56cb488b382716160
SHA512 9a2a5282c2f4fb3bee9e65b166b1b979ad4d1ca75ebef38e3ec0a8282b982ab36e7b5471c99f8cb1ade1c8e404f8f3bd6113dfca0090a6ea2a68b939939c461c

C:\Program Files\7-Zip\7zG.exe

MD5 d2c53dd52f413087ede504d67112acdb
SHA1 cc4d7c6ead4ee073f031fa81f2e6fd5013dd2939
SHA256 92e083d79f7a424d4b7aef15d4a53ba114c080a36a3369deebdf63fd6149cdd1
SHA512 e21b483751206097eebcc2a3b08ca958d4ec9299167d1a4335740a3366bc8e94ba9c67c0d1c85281b6465455fde378b6b02fc0cf4ac4b44fad0114ea0ba45068

C:\Program Files\7-Zip\7zFM.exe

MD5 63acc5998c3b7c056bc087e349fbc48c
SHA1 d262ca623f3d81e16e3e8dce352423cdfa54e3e2
SHA256 1f938deea820ee69da2d3e13654fee69db2882685e3e299870b1e22c235b9401
SHA512 dc54f624776dc6977d8fd76560aab4a3f32494cd815dbad32ddff9b88df50f41aa35d760b22b4cf9d2de4832100408f455e80318bd16db2d103cbf4daeaaa24b