azov | b102ed1018de0b7faea37ca86f27ba3025c0c70f28417ac3e9ef09d32617f801

Analysis

max time kernel
140s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88779979788.exe
Size

32KB
MD5

6468ee100d88c71d55dfdcf4e30f991e
SHA1

5c520d2d7dc4c9e5d536d3aff998185657d40ac8
SHA256

b102ed1018de0b7faea37ca86f27ba3025c0c70f28417ac3e9ef09d32617f801
SHA512

41913eb5adaab42c7ebff547421c0faedede5a3356cb2aa8b92ab20320f73766101056853f450435281cf31e7f32603c62fbd88fa3a680b19abda5d8cc9a98ae
SSDEEP

768:QzG3EG0IUJrd6dQar/MjfW33AMar6q3Fu:QKEG4Jx6Ky/Mjo3AMa13U

Score

10^/10

azov ransomware spyware stealer wiper

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

Family

azov

Ransom Note

Hello, all your files have been damaged without any possible way to recover. Feel free to commit suicide. [Why did you do this to my files?] They asked me to do this... The hatred is that what makes me feel alive. That's what you secretly have fallen in love with. The hatred is the force that drives the life forward. The hell is my paradise. The suffer is the bliss. Others say the hate is what destroys yourself. I say that the hatred is eternal cure. If you feel desperate you lost the files. Use this despair to create the pain for others. Make them hate you, it is the source of your power. Do you think why the people go to schools and kill others? Why do people make terrorist ideologies? Why do governments covertly makes you suffer? It's the essence of the future life. All we are immortal beings. When spiritual is not a way, the antispiritual is your victory point. In the manifested life you have a choice to be with us either be against. Sow the evil, reap the power is what I say to you. Saw the good, reap the weakness is what spiritual says to you. When you hate, you feel the power. You feel the flight. That fly is the antispirit touch. Use this to multiply the suffer. [How can I use this power?] Find inside the source of bliss. If this bliss goes stronger when you see the suffer. That is what I call the source. Check that by looking through the news how people kill others. How the people dies. How children are being tortured. How animals are executed. The death is your key. [How can I give you my power?] When you read this concentrate on the intent to give the energy of your source to the meta-source of this text. Am vizu der strotum la fictus om spiritus.

Signatures

Azov
A wiper seeking only damage, first seen in 2022.
ransomware wiper azov
Drops startup file 1 IoCs

Processes:

88779979788.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt 88779979788.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt	88779979788.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

88779979788.exe

description	ioc	process
File opened (read-only)	\??\G:	88779979788.exe
File opened (read-only)	\??\H:	88779979788.exe
File opened (read-only)	\??\N:	88779979788.exe
File opened (read-only)	\??\U:	88779979788.exe
File opened (read-only)	\??\W:	88779979788.exe
File opened (read-only)	\??\X:	88779979788.exe
File opened (read-only)	\??\T:	88779979788.exe
File opened (read-only)	\??\Y:	88779979788.exe
File opened (read-only)	\??\A:	88779979788.exe
File opened (read-only)	\??\B:	88779979788.exe
File opened (read-only)	\??\J:	88779979788.exe
File opened (read-only)	\??\M:	88779979788.exe
File opened (read-only)	\??\R:	88779979788.exe
File opened (read-only)	\??\S:	88779979788.exe
File opened (read-only)	\??\O:	88779979788.exe
File opened (read-only)	\??\P:	88779979788.exe
File opened (read-only)	\??\V:	88779979788.exe
File opened (read-only)	\??\Z:	88779979788.exe
File opened (read-only)	\??\E:	88779979788.exe
File opened (read-only)	\??\I:	88779979788.exe
File opened (read-only)	\??\K:	88779979788.exe
File opened (read-only)	\??\L:	88779979788.exe
File opened (read-only)	\??\Q:	88779979788.exe

Drops file in Program Files directory 64 IoCs

Processes:

88779979788.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml	88779979788.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\RESTORE_FILES.txt	88779979788.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\RESTORE_FILES.txt	88779979788.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Cape_Verde	88779979788.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01239K.JPG	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hong_Kong	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198016.WMF	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml	88779979788.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\LICENSE	88779979788.exe
File opened for modification	C:\Program Files\Java\jre7\COPYRIGHT	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01035U.BMP	88779979788.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat	88779979788.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099185.JPG	88779979788.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Tashkent	88779979788.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103058.WMF	88779979788.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18249_.WMF	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00333_.WMF	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL111.XML	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF	88779979788.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html	88779979788.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297727.WMF	88779979788.exe
File opened for modification	C:\Program Files\Internet Explorer\images\bing.ico	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\jni.h	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\mailapi.jar	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00095_.WMF	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Ceuta	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\init.js	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00642_.WMF	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02296_.WMF	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding_1.6.200.v20140528-1422.jar	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01058_.WMF	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0217698.WMF	88779979788.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\localizedStrings.js	88779979788.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\RESTORE_FILES.txt	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml	88779979788.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml	88779979788.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png	88779979788.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml	88779979788.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\Notebook03.onepkg	88779979788.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\RESTORE_FILES.txt	88779979788.exe

C:\Users\Admin\AppData\Local\Temp\88779979788.exe
"C:\Users\Admin\AppData\Local\Temp\88779979788.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe

Filesize
453KB

MD5
26e4452661b0c6457a274415bd3f7655

SHA1
2651b3688edc08430472926a1500cd9dff33e7c2

SHA256
705a39a483238196d107cff67cba1f3a71fc4768716ebe7f57e13f549f1dc643

SHA512
0d95feda9a86c07cb4ad32b2b67cf64d88dcc55fae8264da8004cb6f5f03317ef1cbc903a02651159ad75bc1a13a06d83ffec51e39956b11266996feeeb7fcc0

Download Submit
C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01849_.WMF

Filesize
666B

MD5
7cf0aec719cf403791d5c261b84dd5f3

SHA1
ca47043bba29fd0550cbe2bb2d5f4c5838238c8b

SHA256
3740d61cb72c731e8a9d74f6014bfea9ff1241a5d65c6591f0ec5818c7dd9da8

SHA512
95ee92b7225f3438da699f0ea1390e518e35faf668d395677820f9471d81bfeaad760f4e11b7690a61c21c4ffd435e4e3804c554558d6696ebcdb5b8b6983257

Download Submit
C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10266_.GIF

Filesize
666B

MD5
02b4cbaebaa480c42bd74602e0250da7

SHA1
0739c7132a6a95cd1e2b80b2e4d387ece027727e

SHA256
e4736a7fe58fed6c0772319ee3c1767727ff709510f6e5b70eb250207b3f744c

SHA512
b4bd9c463284815262948739ca0e46712ad8af63e6a90baf9dabd2ec8542a0c08ebfce000e76530e43744a4f553bf8d7f89385dea7553392142b98dcfdb6530d

Download Submit
C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF

Filesize
666B

MD5
8e5f0efe9789e2170aad915ca042a0f7

SHA1
f6a36f9d5ec906c19c4dcdc9d76d8777bb0771e7

SHA256
2e581aa393bd5ceb701a64b920d60dce2c76b1fe4a960258306466061a6e2cc8

SHA512
604715ef09a766b9ef3eb0e4dffa58199fee07a5f031362ff56a584d44cfb8489f094777ae3e7bffb5d30656b7596a765747d195f9502c6567fbfe00558bf8f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB_F_COL.HXK

Filesize
666B

MD5
48522bf973a02dd04a00bebd28f3672a

SHA1
6d1533c6d3be457ed31a1de539e90dccf02558dc

SHA256
4f2e109831d010de9118d2bbabfc15502ce431b9583777fc0a93fa2c19c1c3bc

SHA512
89800e43c5aad44266abc6bb40fbad87f64c3b6335a7872c2f3336f73a4a9184b3c648e359a222a96d62d2926b5833d2392379b8ded79c2f110cb5d66a75ec9d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\SETLANG_F_COL.HXK

Filesize
666B

MD5
8cd02e7cb901a9066c1336416050abc8

SHA1
e5b3dda70080995c3eb0ceef0f36c9d74843c5f2

SHA256
4778c19511b1e2d71041ee6cb6001d49fd2a6ff0cce116f4e2cd32e2cfb6f1f6

SHA512
be23e71021a6ce10eb4a538d549337378e5bfc6fad8829360be370883362e0bfb46dc23bc9d0bf8617398e9f4d93f28d6707e7872ef3190c094dd86f82700ba1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.PH.XML

Filesize
812B

MD5
5dc5bd2b7e01c9b5ad0b045f78d67c67

SHA1
c19c48a09a87ad4fa64161d1fd888349b79e9361

SHA256
b2ccd63714bd9df4b07c1e93496ba5f51662abdbe8d6f84ffd713a3f813288fc

SHA512
1cc59849da57c54ee3704fa5b377150d550ae366b1b5bbd20c36f5de63649c39e7d9c6631c02c2b7a2b1ac8e6ee9a601f503d7ee7498fbd6220ecc0cb423883e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.PL.XML

Filesize
806B

MD5
b4a8b7ada7bba358fbce8ce06ecd827e

SHA1
208dfc479c4767ff8389f527d6c0136bbf7adfda

SHA256
bab98545c471525f4f663c0ca1bc37ca77ebe5351b91264e149e91f1d31691ab

SHA512
ea6eaa5e839830c5de6e7db5cb1b7a35f3dcb9c5e18123864b2d76cc7f1d415ae8c35006d341b8321dab01e29cb46650ad03305a2d0a5bbb8b27eed64c5e0190

Download Submit
C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM

Filesize
666B

MD5
a5337e071714735140ae25ae3f9b6d37

SHA1
c45662ef9f3b19c9b2d72649a02b8713a9488eb6

SHA256
f5edc34e94314d542e7faf2bd23e7a418219eb64ef31c7cb84465e7730d5faa7

SHA512
965846c6e826ae623b9d9f3d75477dd476a761907a15b2e6508bca0b118d3c23ee3e100acaebd3b9d5b3d3255addd910bd9242d8afc941b6992906bc18a8aef0

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
284KB

MD5
af6b0eff8d19da7903489ee48301dda8

SHA1
acf2cb114db85cba93f205d4ae229b4c20280b61

SHA256
07f5aab366749937ced4cb8644dc41f71fa4cf12bef24fa5537120f428adec72

SHA512
f8f310b274cac217c79381159da296a64e72fbd16911575b9745b20868075effe960ff4728214258365f8b1adc9f0f79b6496c003deac23aa66c42a3d915a250

Download Submit
C:\Program Files\7-Zip\7z.exe

Filesize
666KB

MD5
e595235773c9c6733ea7c40cc9c82f17

SHA1
9be6a40959082cd283d25f4a6e20a24b7033d1de

SHA256
02663a01f2a8b7d8b678675d9d1fbe47724a18feee77a34227a6dc5041f688ad

SHA512
eb832254ac3d74cd8e62fa7c7c0d9ee24d8ee62b1849808ce38d70878426f5b0c0b6a441ae70ca6e7a0319b469534e6262c7ed72fec64182a2fae598f31c30bc

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
1.1MB

MD5
b5a118a9408b2df142e36bbac103babf

SHA1
92550b46b93ad98bf9bb44839e37ff99a1b4cd7b

SHA256
2017da5354d8991059dd82bc11c0d92c4530c97955cc03dc8457c5820c2458b8

SHA512
08ff83c04480332e54eb2589565d6e83e885334f1bade72baddd5956da7449fd8be0ed21ef6291eadc9139aa0baecb05a4319639b6e9be593de138bb87f0d03b

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
832KB

MD5
f6353d5255a7c9d68beef18cff31cd2d

SHA1
5a380b8518ed8e2e8d959d9d73027095400f5af2

SHA256
b654e8af00c7bae27a08fc4660864e7bcd4ffddf91b106dadc194995415df57f

SHA512
6562a31e0846d4a95768b9a2d861a88eb759779e66c1ae07891744eae3dfea4e829ac6e459649bf4e38fde7147683f526d1628d8d73ee08e1e7481c0c2e04c3b

Download Submit
C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

Filesize
3KB

MD5
4f3332a48d767cc5bdfdab755d84a450

SHA1
d7d583c08e82f39637d8209447c2c9cad1478f01

SHA256
a04e8cc0ea5f7e143eba012c2bc470161f1faf9c904eb233f777ced8e6e706ad

SHA512
0f60de7622aa69ae0b209a1ed54ec7ba0f6b81b597565e64d41845bec8c471a768ca8622964260c448530f637492aac31a4fc5ec95de147ef2c0d89149c2a66f

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe

Filesize
4.5MB

MD5
66f3cd809020d7b20c663e0f8d3a9c10

SHA1
88dab48bf49ddd3f65d5bbae7d21252e5532e1c9

SHA256
043a12eb700e662aa553054d243ce02545e47c3af777bdf6108931b627a7a7a2

SHA512
6320ba98aff0adfad120e8cebfd2ceff1a477b41cba569af3495fead5d64fc1e5ba47f73a888ddfee0eddfb75c5764590e357c945383b068f03197435f99a22e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe

Filesize
1.8MB

MD5
0eb79e1703a0af5df468cd630d5d9a33

SHA1
4713ed26762b15c32bc749f0834418f16e083b9a

SHA256
37b7f45566d691d768c0ce450bde79779ffee3aaeba81f1b7c7dfc87901e1b5a

SHA512
0824ecba1b82f32bfae326d4873dfe925dd156f9a0283e7d78f28412b73beaf6e78a20626f61a14949db93333659b3233fa0aef2898553abc170b7b818ba7b3d

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
1.8MB

MD5
459e18e303916fabd663bbd713007955

SHA1
36138b8b61f95ecfdb45a543b9d2d7d5058d9ed1

SHA256
e715255e07dbc75e831c65768266498d50af98744e5bdff74d51f88668fcaa29

SHA512
79be450e4b560c66e70d7954c86a688d184a2491353a99d00229d240702a24e29b30374b769ce2455718a9d7a40cff7ad6dd3742e69cb3bd443075545388f1fc

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe

Filesize
1.4MB

MD5
8dadfd9588afa7c88e56c9a5f7e2935f

SHA1
aa355d6018e482b2cecf87adcb6158559c3ece66

SHA256
ddd91430b422897e6d216cdd1889f0f470561fa33a3bc8146c4c69b127d5bfdc

SHA512
c8baf146692d1205cc5a79e70980382cf48cbad1d3fe0e717cd2536188875ee8e0dfe75b0372ee3094a1a2ac9e67c1b6202c5a6cdd4762037bc4af276829e532

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.9MB

MD5
21bd84717885d17c84c44c3dd184a822

SHA1
4848612873c9e12f4a1058df445d4dd75a072bb8

SHA256
9b1843168d08705c78802909babe7ba39143a0d1443e7f9472b5dba2802f9501

SHA512
26a932c5513fcb15cb52d54f59fe7dc5d0cd829095e0daeac295880b453ea69eb12c2da2b8c9ad94d965da95817b8074313d19ebc7d774c11b3664532fded034

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe

Filesize
1.2MB

MD5
774bba33d7dddb2c16c27a39dc9b4dda

SHA1
516ae6dc448863d18bcce4dd1735f12152774c92

SHA256
13790dd9572f441605dd15a17b0a2cb453bc434a343822e5d8185b9d2a6da4ed

SHA512
30df8b696c55fce16b727253234b5782d43ad87dc819620bbd2df701a9bf2d7a7ca55d2e42a80d18e0f45abd5c8d2b0cd054932f6fe23d740a9740ed347e5e5d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\java.exe

Filesize
226KB

MD5
5583479460695c213f6a2393b40dcb3c

SHA1
a9796860962fe376ffbacf8e4c075f00755d4040

SHA256
1bee75a1ce7d9e3bef215f412a6cac5f0260734891d7d05388616d3b79ee10c7

SHA512
22e941a920c3ec892af2df029f771fa859e0910a1d0f6a0507f5f22fc7aa963d4f9357daa16f20cee356cc314cfb509d21205f1da157c0222c168f169db52057

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe

Filesize
226KB

MD5
26c2ffaae5158a0aa366de98562748f9

SHA1
e6062c69f4f857c4546ca49c34a751a8675d40d7

SHA256
14e4675439e9cf1b5758820b0f1453485bf557d3655d43d48c7056064e639777

SHA512
1a49dc98b7047a9e6e14f26c4b36394c71d6c4bebcd4620da465f26566c3e49c841f87fe77a563bb6b69509ec5ac71184658cd2a47a87c87f9b3d25154335732

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe

Filesize
390KB

MD5
2c5567d476e466e2ef1a412958856855

SHA1
a04fa9e2f97cb7d49ca4450c89ad8326aebb7991

SHA256
6de0ba1c2aa1bcdb2183a699353cd976620dda693b3114092b9948840ab97db5

SHA512
dd376d7e75bc1bdaa76f631a8f495a3d3461bba5e10eb2ca42d8628a30bd85e3192deeff665d4607f60033c24b2ae9118981cf3da58d0dab13f1c25a341154d3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe

Filesize
338KB

MD5
96aa052e6d1110f2aab962258d02f13f

SHA1
079a6dd590246a2410dd7f31af5cd28981f21a61

SHA256
e156793631a5cade0ecbd9890a9aece0144eead9a7436b4944f34e6e013ff690

SHA512
a9d4fd7f124254d7d98809ceaca8f765cf760aca8c13ab7e0b799c65465fb47385f400d09725b005e9cbe13ec379f62a800b50eccdf8364f42d16ea5b0c5d025

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe

Filesize
226KB

MD5
98a4d266ec6229ed1fe6a3471c891a3d

SHA1
bc3017a444b6992faac39d6d2b7531b663842ae2

SHA256
17f11f12859b5dd9e5bc0ea6dc3f968b7664ec301f3ec1a0376bdf0fd7f24ca9

SHA512
c396d19b688db879a25a23a9cefb21e53522b95a1efae7a6b285eb6fc19fc7ee3248fc37116275ddf0387b989e91d2655e0f6ff8b374efadbca64693b4508982

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe

Filesize
226KB

MD5
adffa03566a8a18a3257df5429fa6c21

SHA1
99a9b827f7aa4f8d4f1a6f15705824c865be994c

SHA256
7daaff2c4dc9b603fa53fe1c583a6b1bf76193aa242bcb955e7fee187e79b6c9

SHA512
f3a191a6b6dd111ff63dc3bba0c9634107120e1170570a9501b856dd1a2f6ff080d88717300cb832a84c205382d87f284cfc2140ddb92c773329fd9846f8aa64

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe

Filesize
390KB

MD5
1982a2edccc5be298d03ce0a3caf521d

SHA1
6f69625658152ae5da8069be8ba864c1fb5acf98

SHA256
abc484e81b126dca5ac64a724b559046d6e98b4c2f8752aa5184a4408ef816b2

SHA512
ca81f48c1f859e0bb12c9ddb7e61e559935bac451b7ee3fda2f60883c2197b699e72760c16fff2a79295ac9bd5cdf966f5026691ad0f1852801001811fb2176e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe

Filesize
147KB

MD5
eb331679d50618563001aa0ce8a39efc

SHA1
35381ded977d01b8965d85e672e52277688c0758

SHA256
4bc1528c3f19a8dbf0a8d415f724e88a64945bcdaced015b30816fc4b6a51942

SHA512
841c9050dcd39e7c33aa1e7e6f27b93e202da7ba77456e59cfbbceaf0549f9ede79b9a4527caa25322ae3ffd42e9afd524ef2fdb52526a992501335ca7a2e204

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe

Filesize
104KB

MD5
0321ce68185fa70a0765755f0bee2813

SHA1
cf1e9a02e40368546477f4327694171fc05de620

SHA256
12e0ed76dde111701ab2627608a26db85f81cab44989a6238976aca1f0c97ad6

SHA512
0e88fa7e14f4f5ec37bccd189cb4316b660007601fa3ec703bd0395d9b0cfc48f052b92cc007bd64fba4ba73a7d081cc3c0bddc79cfca7a59145731200c1a2f2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe

Filesize
338KB

MD5
2bdcf7375ca3be551f92a4af6ba707b8

SHA1
d32840567d9c29bf5380211c50f005c29dc5860f

SHA256
0a3b4359758c59f0c3814812ae81f63fd8699e14de6648e07d08bd62e317ec72

SHA512
fa0cc2d7b6e5a802f68c44a6028486f6b66910e471cb1e7d98548db3d9d2203b1711c7a8d09443f158df0ab577297a23a8505dddb310c781b0975ab05f582a9b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml

Filesize
666B

MD5
99c825da1676c9fe71a8ff04b30a225b

SHA1
eb1d0ec26ef9c8ec43865d6a73d2114ec8a5cc9c

SHA256
23cccfd10313431bc1259e548221226f45209e5b89124d63a4f5d99e245df85b

SHA512
48b4bd04f23a76ae24e45c5cc03d7da9a674c21153e0168545823cf91356f6770c768f09013a68a318f00173dbe31a59274429616412d8013aa5e3357282b272

Download Submit
C:\Program Files\Java\jre7\bin\java.exe

Filesize
226KB

MD5
ecb90cc4832bf0886b817667b1a707d1

SHA1
667b52500fcd25fa696d3fa13b9baaedbc5ded51

SHA256
436ea9c5e8315cfd5e3b8ee7f857f75cdf76ae0980dc7941047748351be2cf6c

SHA512
213dd5f8944e7c7bd19cab9d3fd4080a018d1a6239d1944d3f72f3b232e8a4217bfbe85d3977e9397939843e1f02cb4031ecdfe83887c565e362be7c3418e522

Download Submit
C:\Program Files\Java\jre7\bin\javaw.exe

Filesize
226KB

MD5
566faf353df4fbb3ff256e2b489e2abd

SHA1
00a6f8ae381a17b99a1aaf3f39a74a17c54fd569

SHA256
71f5200298b5a653957c5035c5bb9daf8c59ccb892922fc5ce95ec6df95d37c8

SHA512
9c112fe08f31279ec6c3cafb695781ae52b20e774fc2077c197b17a35fac8ab670ccfa6cc505b9c562892823ab784d267bda8cf288d96c829ec7570e5ac517a5

Download Submit
C:\Program Files\Java\jre7\bin\javaws.exe

Filesize
390KB

MD5
ccbe563b813e88ff7b509f783c4516f9

SHA1
4357adee9874370bbc58900ac91c53c6bab8518d

SHA256
3301ff758a972a17927b2ce7ed3c6990fa394c31f26de17c4cf54125f7dc8485

SHA512
ad2ad1e979d6fe714f06e09820bc40621cd3c847517592e9fb27d28b78591ef89fba8e030550e126aff92f01aa0643e85e0391f11947b80359331ab914765d4b

Download Submit
C:\Program Files\Java\jre7\bin\jp2launcher.exe

Filesize
147KB

MD5
1d61c03195dc65db5656962659b3afcd

SHA1
93a61246e7cf5b0a2fb6da688b01fd55b1e38677

SHA256
9800c4d885d392610751de31f48913295a23c646984a9a5f454515511d1e673a

SHA512
7a545f222f4457bdc7e0d06d1c275e768754c5e6daa92c53df155d555365e37ece49b05301aff4591978c03ff4bccf305434b92132e58f15b683df636acfd45d

Download Submit
C:\Program Files\Java\jre7\bin\ssvagent.exe

Filesize
104KB

MD5
29678de35f3f89b1539f335a88515bd5

SHA1
4c169630e817d3da3377663cc06640c3487c675e

SHA256
b0cf8f13c6aa1b71b66ee6486201cf575a9507c61d89ceeea02bb14e55e16d2d

SHA512
8f35408332f49f16c6567c539a3ba348f3f3276a7cce4d787bea6904bf5448b90fadcdd199d571d16aaaf2904ae1b5afd9249517a85ea20f49f5ad20e1b1c0c0

Download Submit
C:\Program Files\Java\jre7\bin\unpack200.exe

Filesize
338KB

MD5
136c37501de98a5d0155488e428c8462

SHA1
17c2927262d7a24e464dc37ab5831b2214209f6f

SHA256
bdd056f762e60de1d663a9a13b356a2009e328ad7104cacf33f01eba4e043267

SHA512
e18f07e60dd8015a7524c4c37d72749f6a3514f849911ae734014530602e1fa8e954f8ab0514443cd581435d33175b632d7713a8707c2f073fabb29dc3362104

Download Submit
C:\Program Files\Microsoft Games\Chess\Chess.exe

Filesize
3.2MB

MD5
1b9a1165364d9b7083e62da973c6967b

SHA1
0e5870b1451620d0d1a512a680e9bb050fb65c07

SHA256
1a6c1faf19455635ea80fde5f2dc5d2e74987971689abb171871043faae9ba2e

SHA512
9921f66f5af97d82671cbd5343cdee00201681006ecdd4f66747ab0d6c2f30f3da5bd780276c6b4eb8385d5f3ab8cb632ff2f37d65c59d40280ed4cfdcf91082

Download Submit
C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe

Filesize
968KB

MD5
d94170270cd1c5946481a24fd3c4d911

SHA1
3ae4a808761066331bbd59f1efb7d811ced7549a

SHA256
25355f5ec352f82f9974d29be88e25c18b2ff62a84971139e2797e57e672ead1

SHA512
e4dce66aecaee6df48d21d11baf57e3fe748c6610f1973e2b3599580b5e86bad23a2ec037e652150a0fc961c5c49193f1ecd232af6c3db255f2c1cc141a114d4

Download Submit
C:\Program Files\Microsoft Games\Hearts\Hearts.exe

Filesize
788KB

MD5
d04b8fef0aebf8b3fcd918320509fd32

SHA1
f352b8270663683429bc3b124b2a9e3addc5aa52

SHA256
62217cd51aee4f4580394bb3ec7a1246edd20427a46e9fb83c84ba5314067a96

SHA512
f84f953f26a9f6b293154cf21f4f5dc9b0e3b71cfa94f9259f7f634b0f4f3a53b20be06406692a28546997101ac5ba4b91f238158a9736e72a4139380ce5c859

Download Submit
C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe

Filesize
950KB

MD5
66c660a1476ef067f14142581198076f

SHA1
0762986929f647c9aff3d03d11db6709bf6b488e

SHA256
f7f75ceb7e7143e0efd1dbf8ecf37a9c6fdbdefbc2cd91331f9ed5a7d1279138

SHA512
9ee97dceaf729b554b1e617a1e89097f50819b15a6d3382a296aee257808e6abd52f6dd1467650d72f976fa4cff68287a8e6ab841fce12467b0b82886d097ca8

Download Submit
C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe

Filesize
999KB

MD5
a1d168bb6b14dc8b33b3af7f3c882143

SHA1
393f6203506c1269d9a845c1f782e10e16b306b8

SHA256
1d0972bd1560b017d836fce1b335385419bf0966ab5243d98784249e6248a449

SHA512
e535b58f28770704183cb59274305f7e85c59e44aaaf008e6ed028abbb365dd669ad6663c35336e08ab07e42256e35576ff2a42aa8c7d1abf9dc69bd1076fd0d

Download Submit
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe

Filesize
1.4MB

MD5
63571b44f3be55c3389eb346d4da7abe

SHA1
65b3052d5fd7a019b427e6a50e78b615802de1ca

SHA256
10fdc0f9b0384c6adf4184411fe31c39ef2e951a12866c44c63c953b38bcbc25

SHA512
8487904a42aca7748c68a9cc8a8f120f599f0234d217e13fbbe8ad4f8b0e9c3fed1356fbc6f9fd41ada63227c10e94a7690edeed5da510435e5bb57459ec2582

Download Submit
C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe

Filesize
990KB

MD5
7160a753b7cda9b5acfced7aeb82214d

SHA1
625abbba5769790d5b5ffe316aea8756228d995c

SHA256
c6c1b67fe246920941cb0258f8b61f91ecab118f97860601a4ac3849f37a5684

SHA512
2d6120a90608ed7b40eee4c9410350d53bae5f443b4cbb77950cf5a47ca9f2099416ce274d975fe7d3d37b147ef92e9f5e7813f9d6d77ab97ff391f8e1c59c21

Download Submit
C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

Filesize
990KB

MD5
538f33c2986c1a6329ee256a0ea7ff34

SHA1
2e1a4693517ecba073c29f7ce2d4387e324fe19e

SHA256
4e7755452fd50ccbed63b08d2db2b0b5cdcd186c4f9125bb06418e0d2aa61bb4

SHA512
669a53a21e23165ddfa3029a2d2a7815d727767f8fd82976fda4012d1167ffeb2697149c9e02316a97b3075b41ea29043288fa5ab5d280d2972733bd978246fd

Download Submit
C:\Program Files\Mozilla Firefox\crashreporter.exe

Filesize
328KB

MD5
1cd2703491f5f92f76e50c185c3a7cf3

SHA1
25198096794aa587200b5325143986dfb2e2e42a

SHA256
d7d13185512cad172c97d6c055a8da005d6d8f11bc6b13def2a64a5407ecc0b7

SHA512
8063cbbb9cb4e675da82942e39eab9364e4cdfe2d8fdc8daa0419311d3176a7d544c95ab144209f1a9ed4eda1f3b3afca53c27f9bee866d6290ac91d33e19fc0

Download Submit
C:\Program Files\Mozilla Firefox\default-browser-agent.exe

Filesize
804KB

MD5
3e091e01577694720a8bf8fb85188297

SHA1
0e685662ac6a8b4dde54bdf3240a7b7cbeb25514

SHA256
4b7387d0cf4ce5facdff1d8acab81dcfa94b0521beb5ffbfecc70dd8347d0a30

SHA512
e143122592e31a667275a24a24a470a590acc88a909a80a18c6e0733223abf4dfd3077cf3f94ac15bcaeb1176a24e3730d6458345084ceddff7efc425b8ca4c6

Download Submit
C:\Program Files\Mozilla Firefox\firefox.exe

Filesize
774KB

MD5
dc01ce210b979edd2bcc7a78131193b9

SHA1
30e7c780a7e1c505c750296abe79c3f84ab903f5

SHA256
1905ebbd07a7f78aa4ea5b9f11d8111b1411b50f7dbf491e6991df83c23f23cf

SHA512
2c538ab92dc2aeb2ef7467c47eb5e53ecf1657116b47f75ca1cd4c07e75b68ccc394a1d7a15f3df397d63f648cf8d746cc1ec1451bd5da5f914827d7b44a6cf1

Download Submit
C:\Program Files\Mozilla Firefox\maintenanceservice.exe

Filesize
284KB

MD5
3e402e7c6b2b92c2a3fcaccacfab7370

SHA1
0c122dfe0ce4a12ff8a901bcdcd7ade9db04aa02

SHA256
906b180eb96135e5c154b8199d8ccd769e33842580947699f3eb74f87871e9c3

SHA512
88be33710cd29976625f030233f7cb6eb69e1afabbcfd0dbf93c44512713d7c9f6f9850183d9acb8a9795472ca6676227c20defa45bea4ca4e3b66cf2c4b6428

Download Submit
C:\Program Files\Mozilla Firefox\minidump-analyzer.exe

Filesize
839KB

MD5
e474744dc08e1b89051af7d128f6885a

SHA1
a748daa74b37b34d7d3c660252d8859405d0f788

SHA256
dbd00db69862ab1248e28abca842e8ece2653c7f007f75da7634c227305de90d

SHA512
0fb6724c8fc59d5c28f5fa2b7727b45d3d9a21abdf4c991d430d6bafd4ce679ff0e90c0b22087dd276c03282573925321faabc3a69b978236e61df70604d23ea

Download Submit
C:\Program Files\Mozilla Firefox\pingsender.exe

Filesize
123KB

MD5
42184542d5699fb7e7624395f0a7731f

SHA1
437511f8601032c19861fdc78c2fcb4219ba8477

SHA256
719a01203bd71ee4d81750e69748bdaca3a5852161c084adc41ee9cb153836e1

SHA512
e5428a6e70f96a4d060e4e489ca35c3685d151572e96f5161ac3d83e16b75e2421bc559a8bec685bdac6a6839aa0b4e90ceda8e8d1349b46f1a29c0437a39adf

Download Submit
C:\Program Files\Mozilla Firefox\plugin-container.exe

Filesize
401KB

MD5
918debfe72d3a9f38d3f70f77e50a4c4

SHA1
4b46ed054712f78f638ffd821cfa7496517e0cde

SHA256
4d606e5e8c02d6d1ad22bd3192a607d6d5ba827f5727cccfefe038e15f9c1bc4

SHA512
88ab0d31ac29f633174eae83e76069fc1f7443c154fd5963e5db177d81a27c44b868c88a8f80dbd6e7c601e78a51363ceec8db6a42eec23ba1344fe4d36825b5

Download Submit
C:\Program Files\Mozilla Firefox\updater.exe

Filesize
454KB

MD5
8d312f1c72466a29ab433dbade3bee5d

SHA1
515939f605b5c296314d48357e5f8c984a94d11e

SHA256
fc0984890f6f62d4e1d4698029712e4ed1d91fcad0f78d8fa04eb627b8665c7a

SHA512
cc252110acfef9f11290b8ddb96902fab0b8ee9c889c6b678976cb634e5fc027c44d699c02f7301d60e83b3bf693264211d5cbeb1a8b1f747cb49c3546fd9e06

Download Submit
memory/2604-0-0x0000000000020000-0x0000000000026000-memory.dmp

Filesize
24KB

Download
memory/2604-2-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download
memory/2604-4-0x0000000000405000-0x0000000000409000-memory.dmp

Filesize
16KB

Download
memory/2604-3-0x0000000000110000-0x0000000000115000-memory.dmp

Filesize
20KB

Download