Malware Analysis Report

2024-09-23 06:54

Sample ID 231018-pav93seb8t
Target 7129291FC3D97377200F8A24AD06930A.exe
SHA256 650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

650f0d694c0928d88aeeed649cf629fc8a7bec604563bca716b1688227e0cc7e

Threat Level: Known bad

The file 7129291FC3D97377200F8A24AD06930A.exe was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Renames multiple (1985) files with added filename extension

Renames multiple (1531) files with added filename extension

Reads user/profile data of web browsers

Adds Run key to start application

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2023-10-18 12:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-18 12:08

Reported

2023-10-18 12:13

Platform

win7-20230831-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (1985) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface_3.10.1.v20140813-1009.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Scoresbysund C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4 C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations_2.4.0.v20131119-0908.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\ExportStep.lock C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-text_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\fontconfig.bfc C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Tallinn C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-awt_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Saipan C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.security_8.1.14.v20131031.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Network

N/A

Files

memory/2364-0-0x0000000000020000-0x0000000000027000-memory.dmp

memory/2364-2-0x0000000000110000-0x0000000000115000-memory.dmp

memory/2364-4-0x0000000000110000-0x0000000000115000-memory.dmp

memory/2364-3-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/2364-400-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 d7df426a4cc83b8ba695ebc663dcb4fb
SHA1 90e6ec79eeca5947282daa4d64f9e400a6b9780e
SHA256 b642fc0d2a10f4e8fce6465d362c1a16f84ca1c95ea045dc700297ac11a3134e
SHA512 75af4f9ad492a6a362f8626d9d06ca673a90c8f203173dbc94a4473249f43ea2946e69c511fbb141f47081bc98e00a16206167262376dd0a451732ebfcdbac66

C:\Program Files\7-Zip\7z.exe

MD5 401c878a584b99e52e7e5e8cede262d0
SHA1 5de02bd500aea954192ec8db6eb41ff5b79f6043
SHA256 e9e2d6a3390abdb452e3712f9e25819ec0beb386eede42413715ce0c5e3a01dc
SHA512 d10dcf45714e4555cd00b8c3a21204c5bf81dc1369fc4ded55579b908db24e4c66febddd08567b746113d188f92a98237b4da47dfd406700b188ef58092c4df2

C:\Program Files\7-Zip\7zFM.exe

MD5 010121a2519e98ddeb012180fc233dee
SHA1 46b3498c7d7c543348b4e6e647d48865b2e97e31
SHA256 04d3d838896b4edc3e1c34af5d0f10273b03f2c0e0c12cebe9c367eb9575f64c
SHA512 e993ddb234b7e2438510cd150d909265d9516b6e29561cd316a4cadfc8c241329480f07c6fe5dc6c30af4170f94891b9553311ebd2ddcf7e74a4643ecdf68e95

C:\Program Files\7-Zip\7zG.exe

MD5 79d124ff989058fc80638dd010fc5000
SHA1 deb31070a7db6d4827ecda34b52acc4eda573ac6
SHA256 d51744aa9a21dbff28fcaa6f4b5d0252cc15e2a002ad3028f15c6044777d5c7e
SHA512 13c82ea543627ddfc97a0680fd6c1d774b6270243be10f156ba0e2256bd12e9fea4451a7228b09239291a746f429ea675c322dcca53fba0f7b84d80c213622a2

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 19e1d6da64b7f31ac7fe7625b2ca8f76
SHA1 133ea684ec6873028f1d75b3a2579617c5ea8310
SHA256 b815160d361e59391aebeea7faef8f783689e9c470f69edd2fa181d842c163f8
SHA512 d68bb6f9f24536ac13209b379f79d7f38f00e9ae035e37ea1400c5fd44a6cbfce698217fa3dfbc8425dbc92024fd32c7075242797b391bbe94b408482e71ab94

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 dc5eb45b486778e4d4574cf8955d47e0
SHA1 90e2e28111c2cbce21c08674fde891664e1cc1d8
SHA256 cf2c70fb6dfdb4e9e61285ac4466af69f7ee98540dc91b7e4e8a5c39af628469
SHA512 f9e5a51a933a384e812ee5e385962d9bf96e040a1b63e3ac0d475fca518a014935456baac58b20d0e844ca44d9610089b20393297bb92b64a51f3b53c3c9923e

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 2d1d462e3006a96c0a81c255ef600ee3
SHA1 10d2e3d0adc8d083f9979da7b3c080a942c895f8
SHA256 14972e07f0140a31a5f78ec3ef2c0c0438b81ff1bf363a23962a8fca44ddf3f8
SHA512 8c5321757ac24fe7277098de7ac0e01a1d810f81a45d3827aa92c1f5833ef9994c7f5cc231961bdbf84234511aa14f2454a20c10d608b594079a9dc7ff5387bb

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 474e215aaec54a9f61515dd0a14d3de2
SHA1 1ca1dcbf34cb24964fc103093db321d41aaa2d5b
SHA256 23e992957dbbfe1ac877dc4f598bc77a77a5a70367f8909d32ac5ca789c76eb6
SHA512 fb5bb08228520117cd2d1746fd6778d77f3ebad89a1fb17835bf18862911dcbced98f623156fbb0d95675ad1a680c41f02580ff470dffcfff142db1b3725b7a9

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 3a8c1b21066702150a16dfd008d55aa6
SHA1 4ef42c56c475fe811f30453caa8527f5a1a8dbb3
SHA256 109694848509895526fab414044d91da6992b4f06e50a936e8022766722ff499
SHA512 f47a9e0d9cb44b0cc4c47631025e53b657aa6f6ee4afd02d4f69552bbbe40ef35fcb32c5532cbdc23c644398e46a6184ffded372be157a6ade4b10716965e828

C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

MD5 4281948db1cc76df18211b84b34ffb52
SHA1 5eab90e50cf07074a12203db64a923659ebf5b94
SHA256 d5022acca9f22b33453c7d74ceacfaa2592868356a358cd4b33c45f2fa433f47
SHA512 1f2e7f29ba01fa4ea9700de39f3505752c6e96e2eb5103b6564837435ba522e7798c81d0a38bb55b662faa29e74f73ebc4e43762e4e77f12b1d16c59a371ee80

C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

MD5 d533cbd1f01e1b4673a1a2c6d3dfb5e1
SHA1 ef1c186e8f7b8495f082c265243b0d1cae675363
SHA256 948c8353fc9c5ffd7c59a3dc779d05be5ead98339421f61c66b48633ac455586
SHA512 dc3421a40e3fceea61c0211d953a134176d070d64fdfde22605712ae73e5115b8e61303eb6d25c10b9daff71c3caebcd231ad8ed3c0528a700cf29d085789435

C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

MD5 7a369dddb30f618ea9d60846179eaa44
SHA1 1a77497b356e2ef022cc50c60f55ae2c3fc84278
SHA256 ebbf06ab913c4d2aecce72cd3e32367a3e8fe3a5eb76f9452c9e6a09100e085b
SHA512 8171632ab2d594d48a3cfaa96190a3eafc19ba24b5206f5bc667adde2e1b4bb372e15344ae12decb84a34fdffbeeafc92a90ec1d9ceaf295de9417006f817caa

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

MD5 c3a86497062117a0e4c65f6b78494bce
SHA1 ef77e8e3eea33c8a11b299f6c4b5a188b6470bec
SHA256 b6892bfc97ff6571ba4e2d5ff59e55b353ecb578130d86f316b7d97a6ff94ccb
SHA512 bc7be2c0a9645195be8c2538c59031ec030bbd66b1d4b09f04bccc65e14043af1cca75b86bdfb89dd1c48eda166d2689faf2f6f93718bde39f1276e42006bae1

C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

MD5 9e6571ee9a8088814f6e8106333e685d
SHA1 d652b30646ab357a41d4378dab04cc011997468f
SHA256 7128fa92613feb68ccc6b88d52ef589b147272c771b855bc0d3ecb70f7eb72cb
SHA512 29d8b037113cb857ead8ed2675ab4d98adc6488557041e78ee0755cc041fd4caf3485803b90095d78ff0d6d654d1d61d984483120a15cb1e8daed4fb9e69a99d

C:\Program Files\Java\jre7\bin\java.exe

MD5 74687ad2333864c9b373df0113e3ff67
SHA1 94d5dd21aedeedc36d796f809a431331f35c10df
SHA256 eca53649e1197480fd3e04be48f1f5c60522d8e3c7dada0b2264e0b6bd252e13
SHA512 e404030bbfb9b7e2a6486226a0aa8e139d1478dbd49cb4000e54d27fcb3e9458a24f18961eabb9cb7445d8e2183d494735be2d0b0bfd6c65001615a92b74ffef

C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

MD5 fc949038b2681607f7bb776a266ad23c
SHA1 a83a7e5a4e45a3f1eff56f1f86f178173c283b47
SHA256 bb09db31d47c61ba144408ce6427c121e8bae8a31900f2b33df619110d59297f
SHA512 04da06e9f9cb1f5c5d69472b7594a1cd1ebc44f11cd9bec7755e3014dea1d9bca50ad11cac6a187af982a2083891926ca62b8da7d16fac3b8a75c0d62ad8778c

C:\Program Files\Java\jre7\bin\javaws.exe

MD5 173f62f9b6f0ac3de1b7c69076c578f8
SHA1 1be466a9d2affc65009cb4b8adad614bf24b24d6
SHA256 d89c130b129fbcf74a5e4d0c810b13831856d6b90148e38c82a78697db45d132
SHA512 9b2708fab53d5e6aeaad89aae1228d28d0db59c795c4f54e8fbd515a9e3cfb25f4f7dada0cbc44619a483f289d7961673825b6fc89df5eed9a44cad41aec78fe

C:\Program Files\Java\jre7\bin\unpack200.exe

MD5 96df6578b78d24b7f769cedde1b1d992
SHA1 3f39ecc3b9b278e603ce63352a3aa705613e3e4b
SHA256 5edb7243d583093a12db385cc8da86a3e7ebb4083e2419f69f996eafc9da9955
SHA512 ee07325b75d3aa9bda19f9479a6b4152d4f02d950ceddad3da9f5e6735c552ea78bb912177c5dbd62b91b1d7476c1205e15f4ee703607137af9c7fc5dd7bcae7

C:\Program Files\Microsoft Games\Chess\Chess.exe

MD5 93518c927d7cb8875b2d050d62de253f
SHA1 b02d12dfb7083e4a4baa99bb1cb23aeb14521df3
SHA256 621fcc8a001235bbe66a81a2d60b3f7b00b9a4b511934d925cae82ebff9fdf66
SHA512 c8e5600fe0bdbdf2bd7d0a798580efdfb16022efd0b72b0d27e3c5bd2de20a0632cda821656d371d3215dd52eac5f324eaf0ea8bc5af049e6bcad60bf6e22065

C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

MD5 d4eb2fe0a7aa9594f4efa6b4dd00b944
SHA1 98cf83df59ecbc58a1ff7a312c0abe454d165e27
SHA256 03d727aafc17f82a170e752e25b418c4122aaaccaec67b06f4f33b42289f832c
SHA512 f724b3a455ff1d904caa8180d5bde35b4bcd1526d328ece0e8f17f2a5cb81e63306e3e3f8aa23aecdf02f878d0988400078b3f52ae412ebca2261c1e4181c33b

C:\Program Files\Microsoft Games\Hearts\Hearts.exe

MD5 24f0d2c6bb61f09c855af237f61a28a8
SHA1 d988411b13fff46686a3edf658b6f104d90231bf
SHA256 54cb52147a255b898860abeb62d6b6f7edf9f77f43e58c0afb8bccf369c0e9eb
SHA512 d70cfde4e14b74c316af608247a24d53e7957543f69fb729676f3803940b8a007eafe535559c51b6ccc0e4f4eba6c1efb0d13a2cfdac7ed2af1283f0ce986bf2

C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

MD5 a9c2db43bbe82796c1bc9a8afe1e13b6
SHA1 6ebee586de46b313a99103f12203b50adcb90921
SHA256 96c92e81c51a2d172f2e96daf6d3f14f4533d6cf935cc934c7c149c9a58d5925
SHA512 1ed0d09fc6b28ae31f0ea5812afb0c74d6ddfdd3f5ed338b4bbfd8c7d9d1d2561f3adbe8c3c328c62d79f3aae6c89ba036c62b655adcafb3c3d674d59a90575f

C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

MD5 0e72a8b59edd891542aad5c888aee879
SHA1 2e991b54908a59019d2106fdd542af7bd8bb1834
SHA256 6d5771d1dd15b479a2ade95a3c7687245f2c532733599a2dbbf9e59357bda9a0
SHA512 a5629286149fa7b7c470ada4af8c2655021ecfb854446e3bf01b019c42e8904ce72530e40d7bdb00413f64979f6d90dd635d71c3c0d4201302098617134a96d4

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

MD5 fd4ddc611e27f598303d281f55f185a9
SHA1 75035e46b93474abd3317404921d83c2e3bea98f
SHA256 2547dd9cf66c0ac71f650ccf336056537d2327aa9436ac79cfe0748a2c3c476b
SHA512 6bc15fe00413981ffc6aabe177f42286ed086b0bc94d3898bcc98f277b8bc002b2157a33fa90dd4389e6fd4a76468c31195c3745d3748cc88a4bfed27da0a5bf

C:\Program Files\Java\jre7\bin\ssvagent.exe

MD5 7ad99e4b1207260a0778a6355d8a58a3
SHA1 4da744d3341faa36f88a1569d2385f1c06fc7cc8
SHA256 4c5b84383709f7a705c73e25d274eb06915f0e091119762e937910bc791ca8f3
SHA512 bc920b21039b8267d42507c148341fa7e1c154b4266a9a0b6fb5346b987afcba31c4d8557cb50692916ece5aaafed9e0e778081efb760b09080c2305f460d2b1

C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

MD5 edddbbf219a91cfa5dd63a79488fe6ba
SHA1 55d3f43164d33e8654fab6bf593b6ac6e5962228
SHA256 bbe7da33210327895939483a4d655f3a7b152eb2e901ca79a48f8ff60975b3b0
SHA512 9115ea1278a740d90ff704f16a175de1212b2cabff7a0c94b6a83c084bcd3b1a94bd7e5baa26661cd1e4b7059dadd43197279d8e408019bf47ebe5134a6e0c68

C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

MD5 91369668da47f65461526510c96e2939
SHA1 1bc2868d42049ca94b13ef33013c98410764a4df
SHA256 da2a68e50c543d8b209b5590609db77e1928913340dbd9e20e29d63de12c64df
SHA512 8a13fc61a50adcb362a951462911e63edcc3cc414a4df85a3d44101dcb97f9c99ca78580dabbaed02c945dfa082da96134991e447afa56ea801d0eb9482f2050

C:\Program Files\Java\jre7\bin\jp2launcher.exe

MD5 b594ebc40ca1adc7231295a5605f828c
SHA1 20b31595763f0fd9ab29b029c9cdfc7da96a666e
SHA256 efddf28211a0ec642cc08f95e7cfb184b3b60b6a3c210247a8955e722e8ddd03
SHA512 434c32c42cd2da6b91fd2850e3bdaf8d362b423a243f43982fe7f854aafccdf64ab4681406c3d7f408f9bd7e4285571c6bf8fe3dd58d3058fa11212f6740b06f

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 9df3b20b7d782a459791204ae92a294b
SHA1 3add917330a459a86fc48523b3d2b6fb8253e230
SHA256 cd230719e9c6c5375cc8c6ce21abd2f9593eb7f9c5ba5b3af9d75a4e85acd584
SHA512 00dca41035f043b4cd50a8ac3d11f34eb7a8ea56aed31845925e803573444095b97ef07aaca0d2858052ac118603266a973f0427b657802571f53394c56bc2fd

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 45e193b3f6707fd9ad6da94344ed94e9
SHA1 fd6dfa02cafdb5a2f38ff7a4a91c32baa1c53dcd
SHA256 5fa44e18fcdb4580470f32af8ab2099326ede7392f36e79e2742db074cffef7f
SHA512 06eb31e920ad5c2be54446816ef0fd74e0c028a714c270e67c72d1849a9044306f0f5c7e9eb65f8ac82f426c9ecdad6888fc172e850c824152f6632db68d7835

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 027d20e70090deaef8dc000ea8f081a1
SHA1 c91496ce0cbddef87b765ebec10b4fc60120e995
SHA256 eabbd9ca075af9e8db9830e1eca25682bdb590ed73f165ef3fd49660d917a091
SHA512 e55ae9cf531d8d43ed64be46abd54470f80dfac15db544a68c7152bf60dbcd212ae66b523c114db952e0bfdd412797d30c8aaf291254b4f928cc03046cbd6d04

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 e9baf6e1756cb3893862292b71b91e74
SHA1 6014683211f0dce9c52cf4587b8a9493b81cb8a2
SHA256 8b38bb0fbd1abed4be0d882e57ebc89c6742e72da635a47cb03275d59beaaf22
SHA512 a61c423500e44e4f652e9921f3f2947236e1a37401675bca0d598db76f06893f2d858af7f68d02fe31070f9439b740ebdf981f938f32604e694c65a4f9543afa

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 72fcab71da7ca3426ee0ae5a51b70876
SHA1 8efcf9eb6952686e4e4ddf2ba0749c3c570074a5
SHA256 7065c7cad62fb70822076070a94baeaa504d9fa51e9b4a5fbcaa917ed79f6403
SHA512 8d2b7737b0c4617e1d50d19c868c62d5e89438aea9d9514c98e43fb70ea26b118b0b673dee0cab601ba9e973b79f009d69a43692ced3aa7ce9aa2e188d4db723

C:\Program Files\Mozilla Firefox\updater.exe

MD5 2c25a1b3757eb3c736bd2fcf09bab615
SHA1 9292730115c9085635c965587839c08ba9dbced8
SHA256 61679b8183185b22d99ce55dd46c3f805d1e3dfe70f42a5198811058c0088931
SHA512 c08f2d8c55635b2ab356ddedf7d78bff3f41b8dcda041c6ee0d3c8de752f7a6552b53e6f4cb3e70082123eca35b4ff8801804807be6c4bdc02f82495f15bee72

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 91fb77575767a008b8e31f9ae47c79c0
SHA1 b0dc6248ba2e91f0617d6df0670963f6da687732
SHA256 2f1e43ed9de6ab87b80ff9dce182c40c2f95f7263718739320fc8292ba3b6e76
SHA512 19b41ef20ddd6ef3ff9a8c123d9bb211ea90101b2a13456e83cfce044b5e01755ff3c111ac996fad37ad808d79e5191987255b4a48f2cc3766dff32d9b43f9c6

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 aa206e75bf559366a5ed03759a5713fd
SHA1 9c8396adc0e7959329380a6d7cce1898d816f3d7
SHA256 0505163c91786546020378741660249d673336a18e3dd8bb969fac7ad896f509
SHA512 af15b9645c9d29e398e7a40fc017dc9f3e6142bff02c6016b09d808e7a9cfccb8278498830e6a6bafa5a59a7f72f8403e3c60165d8c2ef63490cbc662b4802e2

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 40140f4b9742b61c7fb7693813da67bc
SHA1 be709d9e22f84b7928cb11bf97b5f1e5451a664b
SHA256 ec151cae4327f2b561bcba4f2c3a31fbf49afdd4505890ad8bdd177134afc595
SHA512 bdb0bbc1b63cacea7c86116cd82bf4191560cf7a64243e34359e3bd786757448bdd47a3e9e0548659e4127d1fa7543729c7dab9652e818df766027450bba0281

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 0ccf8ec47789199aa0111c8979274085
SHA1 25ddffbb077bf0e313a95c7a416255f22b8b8959
SHA256 7cda939949595a61aaab65785a7f70912ef220abdcadbd9c7178b1205293eedc
SHA512 bb3d6249358a67304579e9f793b14e9d1c4fc5578c957f9f452e8090735cf3614c598e99ac21baeb5ea71fef5349b22a8781ba33fdc8a471fbc0b715c4546da7

C:\Program Files\Java\jre7\bin\javaw.exe

MD5 31f7aaa1a8ee01564b8c5c2bf7f35843
SHA1 927ed13ac511d3cdbc4aff0f94de0748eff3371e
SHA256 f47c5f0fa483ccc5ad3567d1a0ea4e598f4a31f81ba379e5d5eb7814d4257b1e
SHA512 17183550e929dfd58a0cd95df2dfba1735913833b2907ef8fba1051206a5dd2e67b8c18eb6c32d8b53b76bb3b4262a7addb590555a95aff0977b5ab0ad4aa335

C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

MD5 28836f268fe5ffd7de3316120c4f5a86
SHA1 6576e9ca01d1539c63d03135245bebc8788f5a6b
SHA256 4def38ebd3e64fbd343b4e13f921160dd57f2b6026add4b9dd8c7df3d6bdef5d
SHA512 1b4698cff60e0467a2c3f1f1e7625636ee928f003e0b5a5d8d861c334942eded95d4500f2ff1d936267e5125b7dbc21b36428a736d8b68a5f01484cb9736dd4b

C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

MD5 d5fdf4d2af0906047182d732e52a954c
SHA1 e76c0a24040529aeed71925f553afef608a4a5ec
SHA256 dc00ebb6ab3feb1f69dbca8921b50277b22771f4da8ba9afd32ac32ce6143caa
SHA512 64b2b40989af6d8290b62734553541350e5dbaea2d87dba9634f524ac63406b3550b54666aebd2feeb73fb484e456ec356ba676df3d4335208e75867a4096569

C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

MD5 1b13ce6b2c4fc692b82add67aa3fff66
SHA1 8697a78eee314d6d52a6794f0df8dbed4ee693b3
SHA256 3214e5c9529e8812c7cd516b1c5e79c1fe60b0335fa181319593891b5cfa5f14
SHA512 ea26229171e2323cf652bea6800c6ceae6351e276e95383b361cc47188e936dfeb96827178df001503e28eca34051d0c1c7c529a00168380151e0764e89f9462

C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

MD5 03ebd97296e7d234ea303a08786ee84b
SHA1 560a2b1d113afce0fb6aa490c304138d4c642f92
SHA256 57727f1c8de0d076f6c90d8bb7409c1acec5c79049e81ffbd0c31b32ae9bb5a4
SHA512 c8b0df3b67757d1b613ea0e324abff7ce2f264b41ee927728a456a52200679a5e86d58d54e416449f59964bcb86a08e8eecb786e537b8c3f0f68753817905cdf

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-18 12:08

Reported

2023-10-18 12:13

Platform

win10v2004-20230915-en

Max time kernel

165s

Max time network

177s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (1531) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Internet Explorer\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_basestyle.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\7zCon.sfx C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-loaders.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\uarrow.gif C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\ConvertToSkip.lnk C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ja_JP.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pl.pak C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerEvaluators.exsd C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adojavas.inc C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hu.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookbig.gif C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\include\win32\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File created C:\Program Files\Common Files\System\msadc\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.io_8.1.14.v20131031.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\COPYRIGHT C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kab.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunpkcs11.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-core-kit.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fi.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\LINEAR_RGB.pf C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer.httpclient4_1.0.800.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_mru_on_win7.css C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-api-visual.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pl.txt C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe

"C:\Users\Admin\AppData\Local\Temp\7129291FC3D97377200F8A24AD06930A.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 126.211.247.8.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 126.20.238.8.in-addr.arpa udp

Files

memory/4336-0-0x0000000000020000-0x0000000000027000-memory.dmp

memory/4336-3-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4336-4-0x00000000001A0000-0x00000000001A5000-memory.dmp

C:\Program Files\7-Zip\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

memory/4336-2-0x00000000001A0000-0x00000000001A5000-memory.dmp

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

MD5 5a4bcb8f300db048048ed1ab113a8afd
SHA1 d65537705f591f67160ea3b5f80984239550a2b5
SHA256 d142b21433aa76349f9ee03e7cc7c83b0efae6b8cea8437e539c63d3a80c3cfe
SHA512 211a9476ff845ca869271d87413d29dbf0169807ea8a107dc657b6f77280cbbb1a5b5a4ba16e587981e3815840373391e05c6f9428a99e6a2bafa43eca422ab1

C:\Program Files\7-Zip\7zG.exe

MD5 ff88760c7ce1138ebdb646a0697c6b08
SHA1 04c0c4be503e3d576c08fd8fda795dfd16808798
SHA256 e7b389181cb04fb843c4422019c852dce9aeb7f3a92c9aa47120caa4a07735a5
SHA512 623528eaebf916c6b1d666a8dc98392b41bea9faefcb9f71a7b564459fb0fa6e543d946f19b167f45906105fd3b1f9f8a633b4229363e901ba526c54490c92af

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 e00c2e340f54463d01f7f26e4df90b07
SHA1 2b3911617838b254b108d9de1f28fe7f610ed2ba
SHA256 032ea185afd624ecc2f67cac2c8dc6832912d36da7afb2d1c119992ade6aac75
SHA512 3b6396322459c2e87fe5dd1748a351be91a66a1ab1d091146a0c1a91ddbe3e44e76c9a8b610743130c8b1dfd08275ce68b1343c3b734b424f89cc18c243fa048

C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

MD5 ba67900939e6ef194d52e6bef03021d8
SHA1 5aef8e70d04530296848aa856ca5fd2b0c33dbe0
SHA256 2821545b4d739f1c84f064de3a30982db12ed1a92ed37a8a2b71f93b717e17ca
SHA512 803158b2acdf5fccde727336f37e3c05dea289c6b12b6c99a5209efc6ec4153377529afa0b39641c978198e8a5a32c320924c36a86a7aa5d46317384f027213b

C:\Program Files\Java\jdk1.8.0_66\jre\bin\unpack200.exe

MD5 8cbb1cada8b13b4a1bcbe14a1e35850f
SHA1 561885f91f97ce312b417e26760e5765b9cf5feb
SHA256 111d718e8381f55766726e9bfebdbdb7ebda04af3d923d12f306429d05b4983e
SHA512 5f9e7f30cd2a01659a9e9cf3d2ed105f17f681d35b25554702ce49a25a47964009dce7e342d741e16ef5753593cbcf220a252e8e445833236636711194fc0858

C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe

MD5 df949384963cb540f1d8bda015b18362
SHA1 0fa08eb723966882831b7830e692b7e3a351d4a9
SHA256 30dd727af517c43a4a28f55fbf45c5ca974891d3e63bbcebc4ffc002494a3e2c
SHA512 f00a863a780ce27fab665489387a526b65efc9972b49bd821bb656360d12efe10ff5e690f4ce494508296fb47197a4b886ae47c801135956b1a2618839a8db55

C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2launcher.exe

MD5 a5acbc642e2b9d521b3990d90a8b34ea
SHA1 2d5484c2be9b619e9a203ae43b70af4a69891087
SHA256 44732382d1e2ecaf12ef360a686a36672ba31b753b94070a164144e257827c4a
SHA512 67127df45b27aacab76e7d4c4969add5b0b1e3d0f5e062d07c5420c913c25d2552d2f1d2229767fef4bef5498f028991dba69dfaeac6ebadc64ac3f7bc319ff8

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe

MD5 f5deb74b36bd1ad6f1592badd90e6a43
SHA1 97ec7808296b268b8e47f9f02eca71240eec1f4a
SHA256 e71152a6054c7e7fc4deaa2ad45f922f490fb31b61788ba7b8e821e8f337014b
SHA512 b1a8aff46c8fcf87e0f8652731512bcb4964685c0bb53061addea051b40364546899af1fb35ee4d4534bda7c2246c51cf1a20d4c5bcd0df7fdbc1d17b11b21a1

C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe

MD5 ac330586b6196fe3c9addf49e6025611
SHA1 add8b3f56cd094e1ed32a8af4f24149d997f56d8
SHA256 b83036d434b3b3e2b770083f2bd9ab0e147fc792a77201a992fc7121afc99380
SHA512 4d178488703494e28854f4a85b772f3cb0b0dd6090f403a43067157eb80f89fb01f91a939856a6971dbce13bf2b79faee20ba851cd95a7d3a62a4235d3b96515

C:\Program Files\Java\jdk1.8.0_66\jre\bin\java.exe

MD5 d3994958c50e4b20028b260e4c0a1c7e
SHA1 d3ce4639a4e57f3dab5605fed6402c8f3dee63f9
SHA256 ac7bc685cce85d55c3de314538a9f4a05ed2ad83a77911d5b351a15929963656
SHA512 2b84186d19da8377ac2d24b02da8956d4ab6f5a0d9e02e261bc6798125f862f1d02050178c6532ceacf0c0d7e8b171098df6f428f42710e44bbd01e0ed052ffc

C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe

MD5 7ec2812aa60e2d777e29fdb7e8c83fa8
SHA1 82d0b0f50f6b7ba9e4cf91d1442030aea921d1e8
SHA256 c9289876c3cc6ea6a31c24b04b1a908c1f2f8feb445f3b6d2a4505ffa566dbff
SHA512 d45976522beef579136075f4c42dfeea16732c2ee5e97dbd49c2e12ef19abea182c9a041411d6b34af3dde605485c4f89a71839478ce89b105bb7175ec430ec1

C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe

MD5 887a01c43a0c0cd0e81c8a1e9f8c12fc
SHA1 c0ac2f4dcb1dfa4368a754ba3c31815cb598b6ce
SHA256 df5579e4af25b983c5fcb7feaafb6eb6806321dcca9172986c75d61624bc7f02
SHA512 8814fb17d13dec18a02d82d64848283bb2f20a454085d49e5a0a374abd78342d1db41a626b4f89dc675861d03f2382add16263bb271c242f572fbf07c8c25e97

C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe

MD5 2ac2f1f2e1e3d398c73711d81a67b88a
SHA1 44600dd962487577689106adcee898726f1440f1
SHA256 0c18ab9de94bdc37023e0bfb61d11558cec60f582864050bf611b934545e23c7
SHA512 feaa8467bfb966fee88daa26ef065bdf95ff48d63a92d05125b3e835dcf2a388200c05a0a0199b663a7697cf661538f1e662c514914572b1c5696b83237c5fa3

C:\Program Files\Java\jdk1.8.0_66\bin\java.exe

MD5 6ebc4a2d25826830018d8e88b3ff16b0
SHA1 f9d54158194bdfc5e8bcb2e242c247fca5dfaced
SHA256 00e3a5742ad21de9793dc75d19edf364688bfe667b32c1ad160ddf2da42987a4
SHA512 a3ba9e45dfeefa2f23b21988d4d67db77e8da07f5c934b647f3b6a214e87bc80cb59c01e616ce0c8db990551e049b1038778e65fd9d7b18cbad745799d9374d2

C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

MD5 89e7cc9ae2d31e185cb5deccdf70f9b7
SHA1 f736a2d3c8f4621839fa2650224ee93530993d62
SHA256 05d6122f35ef33e79b90ab32256cc9c6d8ae55d899c2a70e3df10ba0892771e5
SHA512 873d175fcda297a26841498cb6cf28f441885b3b49ed4852b98fb773330c0235504971980f6286c4254488d8d4591d7cc592f7d1090ff4eb5e9e5f3eb81afb43

C:\Program Files\Google\Chrome\Application\chrome.exe

MD5 01d559ce1a2f9ab6df9756ebb5d917e7
SHA1 f91f972c8fff4884c0ed6eb3c735f56891cb6175
SHA256 22aea4bad7b2df86f89990e1549120190ba90fa5f742c9877ebf8a34f1c8c5e8
SHA512 acd3270faa56ecbd20a006cef188f04535fbb941a412bfa02df2f7f67cac7d7d1901eb8f7b81cc40f802380e39eb43fa34a390925421e7de97761157846777ae

C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

MD5 d022123e6769367436963a51259fabe5
SHA1 facd2de91998a81536ffc2a45f14ea52097ad07a
SHA256 eaa25f67f5b2196da5b9c1a0562e8ccbf5fb61e591daac0d423df79dff252de4
SHA512 6542678bfd56abfc6d29dfbf39a976c3515e0d1be52a4a9e1d87df20143fcd649112073af4fcb4e71a4142429602b4481397c8d9a6082e27566a12e0d33025c6

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

MD5 dafca675022c398b017b1c545a7b73c7
SHA1 3fff86006556a00c4c0e93f06943e7a5c0bc0736
SHA256 c4d0e5a576f7d5885acbb5216beaf2bef3cf8c10c27d072a93258617a3cd7f48
SHA512 0b2b6c14f0fb994ff157795559696b656b71be46fca887a77ff01c52f0acfc1f2b233bc56dd89dd4e8f5e2dcd4dc9289425535b083f38396762df16266773a7c

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 24cab39ee4bc7fc4dcf2dd5e7b7da0e8
SHA1 33af4900d6b292e8017da24228bb1a6ccb80f228
SHA256 d31a657145b2715920bd7906896eb01cb22e7f8a5ee687169a71ce5c1468f11f
SHA512 518aa838818b97b6226c6797725b0fa5647aefee850155dc71f48617a762b9f32d8a4b28d7a0eb2dd4ed21003e28ad203cc78a9d0987b20331a933b030e2872f

C:\Program Files\7-Zip\7zFM.exe

MD5 c99a1ce7ed94c2a91b02ffc4461dee67
SHA1 055adb2b759abb4843f50754ebcb782c0e04b40b
SHA256 ca03755452678778506418c0903ca22afe487661262280218d7d5f804b08408e
SHA512 99f2fb3bcd90ff330e787f89c8ac98fa71ad10d2b18b43c8daf7a0b3fd6f937362915fcbbd728f0cd1fafa8f4173e2fe618a0d8888da9555ea04ab65a03c454d

C:\Program Files\7-Zip\7z.exe

MD5 454420465da6e91b7e52d8938efc95b3
SHA1 5dd15da3ad40b309083643713ee6e6f592d24999
SHA256 6d3771f4068ebc438ef92c8463c83cccbbf1baa120865d24aab9119a44d7a38d
SHA512 fe2d616236211ed25410ef89d2e49266db616c4b40254505c24b31d5e5e6b6ce1120ebde0b60928fc9c80dcd16e774b46ffc1d6413502ad4e8a0f456edbbd67c

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 921185acda4e7de5e883e8d5413942a6
SHA1 a0a6be9990bf20ac91c8a49e86de0e6f77e668ec
SHA256 9e8080eb83568bbb65b181a543a69978ed08b896bd0042750f06bd303e2db093
SHA512 f1d4ad0295704ba4e7c2ab8305ad08ce9d176a0e9d87738ba8654b1a71a6ceea21d528851f610f0fad454f47dfe8fca658e486b19faa30232fe130c98971efc7

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

MD5 08a7c4502ccfca203f0992b73bc98117
SHA1 21aa4b00502687f6c74ca20d359270eca49e5244
SHA256 0981484c31a2803206969bc35bf71f5e87c457b167160101c5cef9453a15155d
SHA512 bf48ddfe9f56eafe19adf6239eb845de37c53335b7ca43b94c80bd4000ba638c305b637c325a00763e1e268900692aa167d736a7d015145d3ab48b4f2caa8fb9

C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe

MD5 912383812d11743c4534b8a0d1bb87a4
SHA1 e5082a5907a98863c184d98d6220a47ff95345ac
SHA256 20d32de5618aa2004457647fc76ca3eff90e3f5d2661d7640eda4e77325a505a
SHA512 e74cad650664798d8e77f60a1f6cb05ceaa3488df6fd8f38f0978a64f10311270040063285485c943f9dd3d17e4e2d142fa5d3eaed39f005e39855fd483ba911

C:\Program Files\Java\jre1.8.0_66\bin\javaws.exe

MD5 8cd1a472628cc5800e41ed498e78970f
SHA1 4b8389326774991867f00110850832427b73fabe
SHA256 ba89e2c0604bf4c7e3b60884b9bdb01dc5b9a0bd3b76fd5a6d07bff0191119bf
SHA512 63aa130b2b0b2192f17b7b8563004fb25a59425acdbac7707cd60e7eba3ce7fc91f35aa80ff2e40fb84b1dedd422d2a420765731b9e8f9d2506ac6b73e87b6ab

C:\Program Files\Java\jre1.8.0_66\bin\jp2launcher.exe

MD5 71e0675cc42c6bce99eb27ea7b229fae
SHA1 1db87d9d67195435650725afe79c80b815fd5b58
SHA256 6eb6fe31cda2e5088bc33da948d881024a2904737140cd8076dbad6dacad670a
SHA512 d69bc86bf434415362596e9edfdfb3efb892d0c2f40297838a83b1f61e9ee7169a9131eabe9e7ab026d4db4f60f9e3bc894b3be653790e55d2991405d3b0fa73

C:\Program Files\Java\jre1.8.0_66\bin\ssvagent.exe

MD5 028a77b6a7780644c2844cedde18b66a
SHA1 2b3f9e7d809b74d3b616550a05f15c68d034d923
SHA256 ccb85cd0a2501bdf4ca6fb682cbe3c1577d93ce2dafedbe860c34640d740ab67
SHA512 8baa31e8767b061258914a566ecb44dcfea6c6e3d4cb6fa59c69b778c2473181179a0d06444bc70df2313ac18902322a0850cb7ddec43c54fbea838ef665af25

C:\Program Files\Java\jre1.8.0_66\bin\unpack200.exe

MD5 9b3588c5f524dc70dc3e250c5650adf9
SHA1 e2a8d2c26e0cd45d60be261950d53e44d663a91a
SHA256 cec5349983c37ef3bc0220209e747c660e3b7488adc401e00ae435cdba3c3896
SHA512 a13ef63f3fc236f47737ddb20e481e5c7960a8602352092a1ffdeacc6140eabff80bb6a62ec9218ec37a44430d1beb6e14a6216da648888c18b51cb5aca811d5

C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe

MD5 f6844baebfd35366bc011bcc23869302
SHA1 8455ffb5caf89b38c7ab749aed00339a784b1c23
SHA256 b5ad9b18acd55cc5d6fa81ba867dcf5f69b873ddae798a165336772151231a0e
SHA512 d08eea4fd262a0235d8625bdf888a5dca3cf81639e0b8c47bf89eab3c2ec95233d42d944512acfc3bf1c59d0f1d28076a66c202918db67364af818aa44a6661f

C:\Program Files\Microsoft Office\root\Client\AppVLP.exe

MD5 14d4091493b22ff8e40a6e21ddfc29d3
SHA1 463c365da9ef81da6e5c9716c30ecb52263443ef
SHA256 5c62d327e9aabc472672d8978565172637c7dbad58954edeffe39d0d9ebad416
SHA512 79da680fbbd96fefc3d4b86673299710e0c6351ecf5659a21ff647bd0b059212dd981089d63f0423430f37990fa6d27721d8b3db7a53f19013ca2df9c02d0cae

C:\Program Files\Microsoft Office\root\Integration\Integrator.exe

MD5 1305b9d22ecbf3d795a17b80eae28312
SHA1 cddb80f27e1defb8a2f9dd806fdc78819e0aa99d
SHA256 c867db928cb996cff8c6fbaaf04fd5d7bd253e25cd9dbaafec51176958f83784
SHA512 363d799bd261cbfa0fb98b90574dc5e3e9647863bc9539432d7107287079731e92a98a2747055742f55b3c223484738f6e7c3c3d572a3f89ed91dc8cdf576c53

C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe

MD5 4441c2edb14acd255cdb03d7d474eddf
SHA1 a7813a76bf4deb346833dfd7a88a5c9cb4072b46
SHA256 3fd89e7bd6fca35c8a390e34f76b68174d9ec9400771a7148d3604ff97c8e9b5
SHA512 b4b096a72d3aa8ce0bf1df316cb4a39c9f726d447db4179f9c84ffb41825ff55406b1543ecc6d9a9ee356d28b96a976363bfb389d7d1d6e1d6c86f325faad4f2

C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe

MD5 893e564fa48404b2157f0345b43970d6
SHA1 29c69ceeff94405973a5507e717a387396e84ba6
SHA256 761446e2e395b18a874f460abe943b0189cf6cc33a7389d1e7137080205105e6
SHA512 11f63d5fde7481d852ee68b1d57c3f6935097d302c13e6418c903f6a1d145a231c476c4b078c195fad5356b023a0c017e8f27a6e709fdc935d23279d49043c89

C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe

MD5 ff86666959a8ae3895e3a466fcbc6773
SHA1 a9fc73d19aecb78147a152c6013b2608109857e2
SHA256 d2268c370a35931ee95a121738f0dc1b832b8b4b601bf7341fb5265833a320d4
SHA512 196df27314d7a920fcd458823179f1b7ac7115c888f07311e4795d9e83da9f8b6806856518a95b8dd92cbabd81a243c002c94f7d8a8889e1315da819b2ab071e

C:\Program Files\Mozilla Firefox\updater.exe

MD5 5b4fff5243a8a1a25961e38c5465a3b3
SHA1 57d4be98b883f051aeecb963bca16710b3f27084
SHA256 d048cce203f43927caeeb8252902a64690c950c8229a4084ff3683e62ae142a7
SHA512 683561912fdab062f7ae9c6630c8ad7720c7edb91ab10fe843d426ae6b3685404622086a57cb10cf3bd0b28f311f042a8127ce20679f558e1dde84ef307728f3

C:\Program Files\Mozilla Firefox\plugin-container.exe

MD5 df194a52866899745ff1d56b32315d74
SHA1 72733823713dc175002aada571d5863e88d02d2f
SHA256 edae68178d4cf26e9d5e9e6659b322858e0ac9ebe814945a4614702473107549
SHA512 bd866625556b9b57c0774ab75f51711c0b44d1c4d0bc811aefa999eb164f16df7323a81320c7a41677a811e3341bef0f25564c2e14830dcc9be3908fdc0f0009

C:\Program Files\Mozilla Firefox\pingsender.exe

MD5 4f0f0e0d6a7d2f133d8a2b163dcef944
SHA1 9d34b527dfb5081b96f7236e9243ee6c581a3d78
SHA256 13c7f5fa73d1b7d50e1de466ecab644eea5b6aa07f097d45329acfea66ebd56a
SHA512 85073cf1a9160d3d2e4611d96dbf339d2cbeada6226556a76eae606529fdf6340dd8c177aebebfb25c9708d042f91074f5cc6b971c6b4a2d330a6c338a8267af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe

MD5 5dd4889f93de3b1eb86d6f08e1130f77
SHA1 825b108052c5826bfb2e51f580a66b64f8f0ae6f
SHA256 62c940f7d601dd9ee60931b2a63925918ab1858c4ea1e637d6c6f54174e6128c
SHA512 a669ecc204b18621e7973a13b5431e94aa9e0113a4caee8df344140ce3948dfb644a613730bba58ab79a6f98d06497c1ab1194b8003f3029c1d9dbb94e7ee13b

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe

MD5 b022d720ee926eb0bbccfe8087421c05
SHA1 4857ab7803174a54479a8eab6880b0bb8c240400
SHA256 e9fab058bb802ae8f6229fa729b292238ba0fafd07affc7b90035ab77f3d1f5e
SHA512 01b2d9118b9df1b14525a346a6d550e9df96efb6dab39db1cb1a7a735eebec6c038e3e4cd7e461173a5d092286c0fc607ac0f11b70f6659c103033726d2dcafd

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 43af5513cccf82e0914b159fb4569762
SHA1 341c51fc8a928f3e8d87e40e8380641f19b48ace
SHA256 fa1b39b7f8845ca8bd352faa762a8c05fb49a60ad28f6a95d72459e815dc7f40
SHA512 6857e96abd444dc86fd8fc22ad27433e5507943de42e78501235b5c2d3df6ab1d00db2c19defc8ea8a5b38dd5c33630ff54804aea49cb6f793e3d06c1153f32a

C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe

MD5 904c3ffc691f82fd4da630714f56b930
SHA1 38eb39db35e0aaafe394150511417cb098b72507
SHA256 fc6edae2420594b5fbfc11d587d32d664dd9b2abb747ad972e343d228219ab74
SHA512 d5514fe45951534ccd9dfcf8056a6952a4feecbaed3a55bed032344cec82c52c2cccc6cb88a053a7972c3cd4a83c01670a049e25671b8955b9c4b0a6328dc397

C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe

MD5 095a57b5b1879041d7641bf1edcb3778
SHA1 8f60836ebb63256b6831021942660f6226e4e83a
SHA256 88bb55f1f8fee648f06f1e367557f37d04f8090800598d8d7eac4be944d684d4
SHA512 15a397a163c2ac841d1aa36fd3be883d1da98d96f5606867f43460c74a1ca4415dd68026fe4cf6bf0d7ed558613511ec8217a42d9cd6ccc1af1aec4d7ab94d42

C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe

MD5 8adaad487c2459659f69ab4a94af0f57
SHA1 339b1fa56510f874df58bb672bd7db8bb2c86105
SHA256 eb90f7324f0d54aa89c8dc87bfacb435127049ec57f92052c75c289e6fb32685
SHA512 a62ff0a4bfe3fe293e209c62a4c1688fd3ab47ebaac3107567e3eaa989ae32a83038c499d03c4170fb8fb03aa2be34f04a79bcd007f1194ea127bb58d545eeca

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

MD5 1b57be7a3f27e32e8724306fb4ddec72
SHA1 11b4dacacb052229ced981b73373f4986b2abeb1
SHA256 cf581c50ca081bb773eab510b3f0b4a47b3689ab2894b814dc44bfaf9905ea7e
SHA512 b4c1328da4cd2000cc40a51f0f37614d85a6c9072c33595fe9e7f985245eb25f58310ed9a82a105f4869375963e51c39c582ba927a991bddd2cbd81276e37877

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\pwahelper.exe

MD5 ee2fef07b1838fa72051f45be6ccc949
SHA1 496ef315386d2afbe9002efc3f53a55248ebb657
SHA256 a4e1d4f4e49563a5339ae4acc7c9e3348e96af830574d4782fe270eb0e695cbf
SHA512 773ae5ec64013e86a7ca2f73fc5fad3db4828b889747a0743c7728bb3f550fdc66b7fc62df5c9ea173b1ea800a909ccce885bd320ec4ccf138c6a82ecf15910d

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe

MD5 417d44513794690ce12155346418d797
SHA1 9308fc49fe167488f019c7c6dee27b52d6c08898
SHA256 aa5f3b02f8f5f65ea8ff8d3940d3ebc40db61872729dd554017e619d53dc17d1
SHA512 b014e9f18bf7d1bf33dd075135bf4af64c48f1bbe1d8d0f2c7d818fcdddce1c0e65cc1d911c0c5304fbb9cdf54b649a22f75b213570d0147a54d108605ef2df6

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe

MD5 afc573323723b384ea9da16ecc8cc7e4
SHA1 c3a80fed227126040c4ccc33bd6602a46fe7e07a
SHA256 15ce824aeecf8dc61c4f275278837ac2bb65eb3e84cd0ccd5fe38c68e1210b7f
SHA512 6a025ec5a5e2733300dcf06ff398d88cfd6051099d9af6987377bd6524096ec5173b45967609207cb4b5e40a4caa76a1f6f727e396ef41b3dedc63c6687e1567

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_proxy.exe

MD5 8437b22d195bdce7c529214ee72bf1c1
SHA1 fa7f39d74951b872f88dff0cc326dcd3201a52f8
SHA256 50b2c8ae00ac3580bf40c4bd3ae2207eb9473123e2e6686b8cc475df3d3da7e2
SHA512 60047f7ece596718a53171ab1bd7a2dddc54e8a7950cfde6afb001c124b11bc00dd5c63b21c8b33838d9ee2188579b618461652f04a335565597738aea5918a0

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe

MD5 cda906e223bc5810d67cddf7321b66df
SHA1 bf79438185d59b0b7a341c1ad99ef5a428e461e3
SHA256 9c677cda0c97c83ee9bd01fec97ef8e7e9d7b5316da6c14e255f50756102f5b1
SHA512 916cd2844577f48a60d8502bdcd282dfb5fe3a2b0ad3d26619a89ec327016eddecee7c821b09cc02b66c8ba976ddae8ca047855491971d71c74b62e720a073b5

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe

MD5 4a9d43b19b83749d07423c1c6ae036b6
SHA1 a09aa5cb28145b0343fbf08fb119a98eb6739efb
SHA256 f07939d354ca8cfdbeee0eb38136883cda1558701e879ae0174f97c50dd04ee1
SHA512 23b03f766aa43a2afd5140656b425557211f7accdc1fd1ec65279971b75cdbfe74eec296f40ad4b606574c0b9afdc8e84ebfa5320fa35f39103392e7c071ead6

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

MD5 c30d6932360f9663d292523ea2dfdaa3
SHA1 0ccd1c2f894b2eaa4fea40a6e9cbce1bb6e717b6
SHA256 674308ccfef03f4fd17a78c46df5472beb4845bb95f75f5202464aab0bca4303
SHA512 7bd9e9262806c14e9fb966689bd6b82246c1ce332d1f79e8559963e1f40b17322c5d2fdb1cd481bccbaec6d666b2ad115a009a08f260a164e86a6bd89ffc9421

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 f186ac1c61bde6b4f9d203c1a5d27d0b
SHA1 614d26d4b327ca418472dbf0c70edef556c24bfa
SHA256 c865268bcd6b47cca40ebcd7b645a42f3d41a4568362b6cdf59f7d965310d58d
SHA512 a33150270fe395b3c95a8d0947474632c8149afa47c001622e13156d75171d0a0385d7b70688ab8d27c4b753971674b295e6a7f3e891544e34c9b42996994439

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe

MD5 4b4e6fd304e41c0023a2ed7dd7d5616d
SHA1 26b41a4fe5cfaac0bf1b6435ee7eef19bbabe818
SHA256 00c91e98b4d7efc686e2df23ae7be3301249f2a54d9a57869daa89ccc9152b5b
SHA512 df326a2b4495c8e4bb8bdd0beb631c5af63a5a4d134ff180635d9751ddd584b5df386b19359e0d351d2261f4f9c71ef88419fd2c9618d09573db5c0e15249d84

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

MD5 3c1c02de7d3ccff4c5c1b6362d1b5e9a
SHA1 1934af803560b94f6609b02fc08272816c71779b
SHA256 e7114682740ddce5007bf698f6ae69578d48ebd9f45e2739e67a55dae093d716
SHA512 9c8963a2513fbe03a10be93b138b3edf3d56b7a3551bdce95a15421cfdfe3e4d25f72269cd0e109ffac9211822f39abcfa516424aa13fc21af24f3519f6f25d8

C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

MD5 c6d4892b5c18c77f53f95805f4f135de
SHA1 267a3223268d96dd0d00cb4cda2fdeb1ebd91ec5
SHA256 69259fd9626ef05a2288d22894a6405cee65bab4078afdadc81bf02a74720af1
SHA512 035bdc146837f49d7dce08a3f29309ef7c6e130dba1efdda30bd4f7ec91b0e89f9ce7c27ccda92618f97d57bd5c9822870b57b628554eaec94cb9d08b308c973

C:\Program Files\Mozilla Firefox\maintenanceservice.exe

MD5 c728e4539eedccf474232c08e5a9d031
SHA1 6e1f24370f0bd805a1ffcecb4d022688c6f9175a
SHA256 fdc021db8ab3687ce102a0b0721b2f09098c939d6491a3fa31346304c7ded026
SHA512 613f771bf5ed8076239828b51ac48fb698e92835e89dd291db695d2a22e36c67194d84faf3d27d75978a0ce8a14ba088b1b7c1e1c222230988b63bff2e81bb85

C:\Program Files\Mozilla Firefox\firefox.exe

MD5 8ead15af63074ab17d5bb9ec0d2e58e7
SHA1 19669921d529830262faace858542abcfc43a63e
SHA256 b659822135d22dc5b27e9d20884aec33831049da90e70e57c95ce8dd1d929697
SHA512 032884a2d489879471253d70b0f0256479242a691d6bc445b6def55bace70608d422f0c01e14f96c91d2fb24ad62375efc5948267995f4e9513703ebd70c8fb2

C:\Program Files\Mozilla Firefox\default-browser-agent.exe

MD5 3ce74db1eabaa81d02d47667649ca5af
SHA1 0941dab24fe913927f7d388e0d13c84632e27cea
SHA256 49ac1279a87919e894f17f3dd674d6c0fd00996a96932ef6cbd97ddc4b48d665
SHA512 adab08592250201c1d4c6e1cc1ceaed2cbc3bddd8fa8ed5df8aa78544a54c65086c328f6e4667e493ad0a78c6e2a4e21b5741e1ef5d268d051f16e11902b9466

C:\Program Files\Mozilla Firefox\crashreporter.exe

MD5 6918b59abec5f6ee822c88b2a63784c1
SHA1 986f764e1ecd937e6fcc925bfbd4dc9d642ff518
SHA256 be645b693d81c9e1b342dbc32ee8c6c6704e606ff8d87be3dbc9d772f952be7e
SHA512 3bcaeb08b95eae96a7c12f117335756a60c15666d6b1130b9ba820bf24033b6800fbb6ba1e9de224877bd47b1f70584868eed78679c51d2caa8ed23860494069

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 87df99467d2b373f32ddd136fc3a077e
SHA1 8b6d863937b733b8a319cf5bd39b8aa5fc10b1a1
SHA256 c4e4f999ae7a1fe75d2d8f7fff55f55d6517085e11fec0c68169907cbe7b197c
SHA512 b15dd135183c60728e036d33d380cee5f3f5f6a7b138b932238c3431958f0cc4779ba965d90003fbac31363edd907540f835eae6dfcc447123cc2ec96a21dade

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe

MD5 e246ec2691b9e15de580f4d51ae57108
SHA1 99e903a9844afa504b17ece7df1cda29e81a16f6
SHA256 2a369a813201cb8591e809fc9e4e29713619638a66bbcc7bcf9429a81557929c
SHA512 b86ce420b2978bdc9ea8047087d3b517157827b8f375549f1f6995fbf69d33bba408cdec6deae0b12b7d5c596e0c0adee1b2d489b40530c53d923edbeff7e683

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe

MD5 6db2b46f7e1f6408d59f79b8a368af37
SHA1 ae0b05a2ecb40dd23172171329de29c29a094349
SHA256 a19f2f3f3602e306467809bf1ced11224eb25f550e519d246ee0869e8a43f376
SHA512 4cd3a4ed36410b27cc38c0761c0ac53ee123ec8fcf2e0718dd5a4343e61fcd81f6eb2afbb1ec6a74114d759d449d4d4addaa357ac19259f1c2439e48d69e37ce

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe

MD5 64126fbc9739a3da84774f28b220bfe8
SHA1 b9c765c7092a105770af60728c0a99710586ab48
SHA256 da599e9421f2593e5a9febb0f10a72caf9ba8efc201344660210568039af4203
SHA512 f1c48a9d8e31a1ab45770d34ae1908ed4d9cd9d54f5b4159aacf2ff254b38ef88d2a3df1a5412f7ef3e031fcdf8b38a98a9368914c8225a4191aaf2a6bb21da8

C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe

MD5 712332976d1cc797426885a56accb8b4
SHA1 fbd26f2fda078c8208a615cda59ff0a255fe712d
SHA256 3bc11d368451f0c7f21d383dba75971df94254ac3691906aa1961146221ad9af
SHA512 e1ebf0ac7e3eb3dfc9f4cc375651eadf4fdcdd062c2c752e4891db7b71c6e54b43704b69aa1b41c5da540c8bdbf7cb9c2216f5299564916405b8ec6b5a9a3a39

C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe

MD5 1fd97f25ff9dc30cce1d812fa19c776c
SHA1 7854a197660d925fd410c5ff483a6005e47e43bf
SHA256 edcbe04d6f96fb9ab17f51ef59936fd50a319afca9bfc550360bfe3cede05189
SHA512 21b9989b6055c8d781a4500ede37b2bd505366951c0e220c5f7cf5aed4e40c158508d50ed9157a73e445331a8cc57ca70f8f3b0606b59e79b69e472e30fbde14

C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe

MD5 9b82947db5fe2bc97aafeba8d8d94543
SHA1 ce8cbd6b487cf26dcc8b8a7ef168cec0c55274b7
SHA256 3079a1d7086ef5450e504faccac260d7870c67d639cef7299a243ae78b3bcae8
SHA512 e0156cb328acf7ded1abfbd9189741fd453bcc95e22c364fecdbb9a4ba011d980c399e6e239da9a27feda7497f01456fe548f4e7ec683b36b4f368f645e571f2

C:\Program Files\Microsoft Office\root\Office16\msoia.exe

MD5 5bde67ccd35b8ac106292cf8ca0f20b2
SHA1 77435fe453f2bb7de6e2f3b279179827ce320a16
SHA256 49f073327e9ed80f687a604b295c85b1c4c589e28994d974e8c7b584bca05e70
SHA512 b18c70588fe0bca0cf160e605417e0294cb90708c2b4a621758fdd93970326df8c42ff779eda472896e543bba4953de32510ce47a736f03e010c61aa639fa989

C:\Program Files\Microsoft Office\root\Office16\msoasb.exe

MD5 6fe48aa081cda77dddd059ece43dc0f6
SHA1 208955365054981dad06b9a04f4df2e882771982
SHA256 5461db31fb2346d1f119548823d0c03c6c6adaec1adb0b6f360d0ee1b4ba8d5e
SHA512 880c984a64c15022ac00bd3858f4f52aeac8c1eec24becdad3759ab47f3383c751d9eaf3922074d2f584e950ecb62e80528c9efbaba184940c218b0153d5bc16

C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe

MD5 61fa9044a08b05a2aed614fcb64ce3d6
SHA1 e89ca949cf92c8a34403e725eb49ae872a9b8665
SHA256 0a804a0a09fd4a940cbcba66320c3590e951506b76ef9602facfd5501726f1da
SHA512 7a61de176b806f53e8dd46b8230be2053c21ce9a76a11af1efcf208b8a528546769ecd0708d3a068cd67918a562658b212b2bc5c62bb99e542638d2ba64906b4

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe

MD5 963074fa552551e82770e0cacc7e4944
SHA1 a5ccd0602c6bc8c7e8809201f4e948da7cdcd9a3
SHA256 61f6b4360c9d3c7ebc8bf266c84e233bdaf8cfc02006f14de1cbc9ba7bd7f4b9
SHA512 5b6749f897143e94bbf52cccc47fbd919ffc7b15ef73467079c64a3e7d8cc6f42ace22fb36cd815ff580e8ff483b3c9b08cb764128d2fb7b7cdbf6b28876fe7d