Malware Analysis Report

2024-09-11 10:21

Sample ID 240529-zkjddahc8x
Target New-Client.exe
SHA256 4e60e44a1233df2b661a1cf31390c19ebfa75e18a692414a0d6a1be5e1d9a92e
Tags
limerat ransomware rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4e60e44a1233df2b661a1cf31390c19ebfa75e18a692414a0d6a1be5e1d9a92e

Threat Level: Known bad

The file New-Client.exe was found to be: Known bad.

Malicious Activity Summary

limerat ransomware rat

Limerat family

LimeRAT

Renames multiple (3699) files with added filename extension

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-29 20:46

Signatures

Limerat family

limerat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 20:46

Reported

2024-05-29 20:49

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\New-Client.exe"

Signatures

LimeRAT

rat limerat

Renames multiple (3699) files with added filename extension

ransomware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tools.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACETXT.DLL C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Security.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\mip_core.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\XLLEX.DLL C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\javafx\libffi.md C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN105.XML C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.Core.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Registry.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngdatatype.md C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.InteropServices.JavaScript.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Input.Manipulations.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\concrt140.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.FileVersionInfo.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.JavaScript.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\fontmanager.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Office 2007 - 2010.xml C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-util-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\DATES.XML C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\nashorn.jar C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.h C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.AppContext.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\DirectWriteForwarder.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\xlsrvintl.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Debug.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Primitives.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ADAL.DLL C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Forms.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Http.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.powerpointmui.msi.16.en-us.xml C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONWordAddin.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Picasso.Sampler.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\New-Client.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1152 wrote to memory of 3172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3172 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3548 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 5056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 5056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1152 wrote to memory of 3068 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\New-Client.exe

"C:\Users\Admin\AppData\Local\Temp\New-Client.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd5c1746f8,0x7ffd5c174708,0x7ffd5c174718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,9746279807902487099,5243884231800943223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 8.8.8.8:53 taking-headquarters.gl.at.ply.gg udp
US 147.185.221.20:3069 taking-headquarters.gl.at.ply.gg tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 147.185.221.20:3069 taking-headquarters.gl.at.ply.gg tcp
US 147.185.221.20:3069 taking-headquarters.gl.at.ply.gg tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 35.242.123.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp

Files

memory/1160-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

memory/1160-1-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

memory/1160-2-0x0000000002EB0000-0x0000000002F4C000-memory.dmp

memory/1160-3-0x0000000002E20000-0x0000000002E86000-memory.dmp

memory/1160-4-0x0000000074DC0000-0x0000000075570000-memory.dmp

memory/1160-5-0x0000000006150000-0x00000000066F4000-memory.dmp

memory/1160-6-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

memory/1160-7-0x0000000074DC0000-0x0000000075570000-memory.dmp

memory/1160-8-0x0000000007580000-0x0000000007612000-memory.dmp

memory/1160-9-0x00000000074F0000-0x000000000755C000-memory.dmp

memory/1160-10-0x0000000007B50000-0x000000000807C000-memory.dmp

memory/1160-1073-0x0000000000F00000-0x0000000000F0E000-memory.dmp

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

MD5 0eb6f0603596df519e1eb474a2688588
SHA1 cd21eec836876468e795374dc6a577c1398f1fd3
SHA256 e666ef0b68fe21f67f8da67bd1ef699417e9f7c9c14dd72a983354dbc0620a90
SHA512 30eeba0c5935af7c10ebc9e2391b2f13dada3d9a6e26604ab157e813d87a9dabba405340f278763e81dd886572d7bb46e88d2b102ba5c09547d362ac7d8bc7fa

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

MD5 7173de844299411b8b88218f867346b2
SHA1 b318f20d8feae886d5748759f14751644684742a
SHA256 a817fd3effb70c7d64c94d87a1108c85ace2e6f03541fa5b75a5845dec4a1cae
SHA512 d286ec14e62a1eb21f1feaf3fe5cfba8910aeca255517108327666798cba34f5fa8c56201a3d645ec0fa269f88153a5536f1c3ad413542b3fbb457f30aed3275

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

MD5 a358ddd2ca31eec496d858b3f34b7f00
SHA1 3c763f2bb8cb9877551464d3701da743a647453e
SHA256 0afb2e6b093a74f6b92a1679b45550ab67ec1095b39fad1755375609090118a1
SHA512 ecbce7c6942debfc7388c8204433c8d0bf78836b952e0d19e909153d3b8513da4068b3eace11047c9ed0564f4aa82240a5901d70598f4af9c165124c46a083f3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

\??\pipe\LOCAL\crashpad_1152_NCVEIFRQLILVOWIP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c69fead62c5a77421c47f73dc6487d74
SHA1 b31ae8bcf5153017758f18920c75c0ee2ad42ef2
SHA256 609c4e44a571891781a9cd41736d7fd0f8b54ae81731106cb80930cb1ddf999b
SHA512 a7b689dd0ce6989acf4d0a61993aab4e9a101cd8df279ac36ede345c109cd31a50574df0ec1ceb613d582ca428765f7f1236c61da5137b218706dac1cd190fab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

MD5 a81247ea85e9c00d1df7dc4ccb26e4b9
SHA1 b5a1ae8434a79478b2edf42e3afecbd4f31979c8
SHA256 f47120411438c4ac20030f00b1c8005df9d26b90d454e6aa6ca756e518322f3c
SHA512 5a6c636075c8c3158c93b977cf9b4d86ac9832b30bb90eb9750434ff9a6e6f2cca489de7554cf65614393bb66cc756469a39f0e9f09ebe6dd407656b6bec4ae2

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll

MD5 02d357c3c41710baa63a3b7c40ffcae5
SHA1 dc69146b5002a4d57b33fd3169013ea605c852ac
SHA256 46c4acdc9122d966aa59414f8b93cfb4a92017a6b68bfc6144737845f0ce51f9
SHA512 da1514fdf9b45e0743fdbae7d15de1c292863ef93c4f7224e3a653058264dd50a6e958a97664ad451b7a0da6d69a6696b7088a183fd46e2cf7042a0102895070

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll

MD5 64c921e4c1ceb66c279d629f9968b83a
SHA1 5916dd7ae93a699e4e9e29469b34ba913b1e4319
SHA256 a7a0d0d61166463a13d9dd779c7558cddb83c1ea14e90337a1c2f529c7208a03
SHA512 f0578c8e908fb7881e677bb08690f8ee027492dd812adc6b13650f531ba8b5adfa5ea5180ca45fecbee36c5896337c52521e544d5cb6c8f23eddfc90838f6f8a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 30abc84cef3743128b9721ece061bd04
SHA1 f4dfd76bef383ff2c5f0262cfcc5578125929767
SHA256 ff42e7433d4a3b9854ace646b5abedb0fda46c2d230082ff5249b8c394446057
SHA512 70b2e4762bc2c5f1c1bd9007c23ed3da42396f9f57591b1658f2a2023f1535a419d209098ddf1382c60d6daaf33e7fd7647b4482242f986038428c998bb6d69a

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 050acc44150ab46ec44a77cf0f939440
SHA1 e950f7845277cb5b026e121835dda8c24a927afd
SHA256 437b2ae73d12708b8a024128bf25c43af5f65b0d345be2e5c21d1603e51c382f
SHA512 8a9c7dd04b5d3737e004bed6deb799924417e5602ec55b5e23ea8b79b0d563df5a8f1aefb92a4975314ea3a029c67cd7c7f20e552c857a2636c83630f7a829f5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2abd5991ee8fce3fd3b6744b5b5ea024
SHA1 fd73e57f0c0d126faa607e46148f2f0cc1c24378
SHA256 2814e7b74196727348449517831e7313f6de72f32bd100c9f2c2af4a448150ec
SHA512 ac0ebce1c0e6fb597af32844767b8a776ec58de7acdf5bcb8a63edec53731f22ac02f11733b4e178b4e6bf3f5fd28e2002ba01fef9e3885d2b2e618196e2c8dc

C:\Program Files\Java\jre-1.8\LICENSE

MD5 77c094b51da1b566080a2c32de53d33f
SHA1 e9be32b3bf49fc977bd110cf234302577317087e
SHA256 606743c471c5f3e37161b96cd9a166052832ed08d44f02337693d7a4a11ccc24
SHA512 57599d0d9e8e2420420cf85650a76f1ff129698c768c3661c0dca1db4d5a51612b8519c5e8498ec0b77dc64ebdaf7f9fa9220727da74a4d8f4f84f79bd262555

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 1e99f85f19b1d9506c611a4567ccc1a7
SHA1 8543be6529009d3406b5ca1754d1f34566b016b0
SHA256 c5a679a56df45f509b489f10da7ac7d7da8c86dd37467b7ccd5896856d00bad1
SHA512 8f8a07306b9d2fb5eca9d0f9bb2a1ccc4687b8568de920970e3d0a1bbdeab08550eb63a191f51b678d72e7a75af2d8a78dcef77d39d0b2027afb60366c7af9c6

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 e0cfdd44db51b2d638bd32a5fd1bfb0f
SHA1 5806f7932b6a51d8c9e78256fc5612b90fc392ff
SHA256 f60fad7b8d52635f9bbb7b9e6d4e74271f2f06a2e07d4fefd7371c84acfc9b31
SHA512 7ec3182943cbd2626337ad07a902966634e91ca25acbbf5fc8756d80e16d96b5c50f7c8696f68230e6d4d98a014a5b3098ddd99e97b9256a00d32c044306ca8d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

MD5 19ab45d100482fab0b504fd279c5bbbc
SHA1 b1d9abeeebec45a9fb6a055df0b733fb7bff18f8
SHA256 0d4c7340304a655f98be43ecafdedf6c06504f04b219710ac628e247e8c8e595
SHA512 ebd45585a2a91cb1db5cd8e1aae04f77c1a4d750a5cd23959c4b5fa79c3f2e1b6d29254ca6cdfe2b737be90fd1547885204ad2c6da0a6e18a452e976ac4e4e51

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

MD5 82f1cf049243fd68ea7bdf0544e0514d
SHA1 d70a8f2106f619a74c3894bb97e2770eb1342851
SHA256 730b2d03b9a73e8c33d299ce543287c19e64c69a0696beca7e8e97fcc3fbf235
SHA512 18c744e2f28c2e418b23b3bb2378900a04412a44f5d3ce5c1f4e221824a7deec8abc839d669ea3015ad899b16fa7f3f21d1beda0f877c8dc93973e023208ad54

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

MD5 1fbf328f33104bdaa33d3f22e94b665d
SHA1 7e4cdb89aa1084c25733e69aadd21937eb86e6da
SHA256 c0111c59cad81741f1b4f1062687afbf9adff996ecaafdd79618ef5cc62c3e5b
SHA512 4c38ad60e5fb8afa12d43f3dfaa05d5570e8a5b5504fd32eae0b06a034f20fd91a77e77c364ed9806b5f8678ddf435c2c42dfcccef8a1eae8cba2d30a7860738

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

MD5 56e446d966830843bbb7b7533ce36692
SHA1 7d8d3006fe8fd171ce6f8490cc3fd383e19763b3
SHA256 a834e0ed05f0fb42d935cd5aeb66fcb6c3b3044bcdc258ca608eb68965214868
SHA512 14b909654e10c45000484a1ec9bc5fc428cd21274cc4a8728b8c6c6d2ea4ef372ee668bd58472fe6b99e9ffd1f284c141159139d37af100a9569ae25fadf7c8c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 8800f29762609d3d68dc782109fdb429
SHA1 013bf85433c9adc61e7814b6296c09d151a96943
SHA256 8c449d9bed08264e2afedfa9f9134b1101c7eddf0476e4029da02d0039727016
SHA512 b1c262dab3d9799a22f3c05d4a467dc16141d11e7ee45b7b9e59f4183f00aa1461adad2e2416986447ee177ddbb9a1171c1018f3a3d0b1e5c702ed6a8cb31e6b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

MD5 56dfb8da8dcff4ed122f7a0be86c251c
SHA1 32953cdceff19220ef4a047cce419023d69b4497
SHA256 509d7989b2793f7ea85e23d8f8adeed342af53af228802069d518637f8655646
SHA512 3a60d8cb0fd5742da1a4239a5a10d4a7a7d19f9d96fcddfc9943d0b851aad0b5d2d4f525f12fcf091994ead44ccd61ece388e05869fe7dfa4b97ed781b5ca95b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

MD5 aeabf3f2e43c9bd2fc7683a06344bee6
SHA1 42ed335ea789093579d7a57766474d9338e8da19
SHA256 0c68fddf16670cdc6b1ac004b3068e56d342cdc8da63d132ca7062cab197ab23
SHA512 f9e8641f612f6cdfbb46fd730cb9f8e8869ce51fd49d59a0b54c331c2c942b25a146383fefc6441979ebf8ec151b215e685ebc1e82ffb4dbc55e648b2408bdc7

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

MD5 d581e51ab2315137b15699cc4a023068
SHA1 a83d6ee0a253504bd67ae8739996822e4f40bdf8
SHA256 04b66e064d853b77e07275679fa6af6ac72b7a033d8869bd3de3e6e29f8601b7
SHA512 32fd139e5eaea697722dc3ac3f713b1045a7210282a93a405058e896482e1ec904475c277470d2b5d056d1d4fbb4bbb64accf0cfba82f9ed3bafa2ddb7ea5afb

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

MD5 f475e67fce3daadf69fe119fd2f5f532
SHA1 492f0d9b0c90717e278409eee2aa0867da29e167
SHA256 8a4344e9851fb8b134cded879f78b478ca71720d78befad8099467e724823b17
SHA512 d6458956396362648b50bb3f68da50b1e753da5eb79940b85d4bad2cacce45fb14ff5a789ce527d8eb106db810604ef82f066797501b759ceb45b2f0e04d7aa9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

MD5 bc383641b50648a2249869e8d18ec2d1
SHA1 79222bcd5ab7a619ab928f1a384fd6a37194405c
SHA256 afffb6b947359eafd97c946e8c7de6c3d19850076c6da42408adaa0fb6613fea
SHA512 023f9cdcf031f371b7a15589f60239f1b8a534251068532016bd3ae3b319c67fb74c4fbb745f24aa869f367549b002652c1cfd4026d5d51027f156e60ea851f5

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 f2239e260304e50925dc791dc19301c6
SHA1 a2a0ae406f9c209e250a955193efbe1e91838cc7
SHA256 c358c1caa832d62a8cf3c0eebe14005ae90a6d7b30fecb7797c295b9d0341e7b
SHA512 1d6b505bf33ae0259e092725df81f7c20f5ede3a47959d6ba7945e8dc3f7baabde96550595a03250b9b00543cb466de006f8c491cce75ed1b64f672d42c4f9c0

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

MD5 f532709a5775276b1b6d197949087631
SHA1 4efa45111f9ebdea480919789584f32a67214699
SHA256 361f5094cefe28ff876a19f94fc7a3f31492f18688d050191204f9e57ef3968d
SHA512 779ec9579d7b73e0d706b2d91fbe9061f3f24ff3c1085eb15fd1612747512b4833d9c904913fd15f5de10feecd13f9560cbc6f8409e7469c0d4e092683db526c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

MD5 e5c5ceaf508607c5791f7fca829dd0d1
SHA1 1666cda802f2e6fd245c1ca9383cd779ae7fc0e7
SHA256 42cbe4eae3936db0ae5de33b51053bad4e5ff667c8beb19711051e1cc89b32a7
SHA512 17cdea8ab41cc4c1db39c638d21bfb65f8ae436b5f8dcffec18d3604dc7988bcc67818abbc3fa773c1169f4e80687c6a555091f99eeaac9f6fc3f0b817b8c417

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

MD5 3431e77ccaeea5fc60499d1d1f1c7714
SHA1 72c349c478fbe2d65f1461b115a2715d5aa7f5d2
SHA256 05a26ebcaa79cc3a5ca9e0e3efc3d25a6d14dda1bd37a4e6a78fda5b9e8099a9
SHA512 c2013e6e3bc134e2587ec24a8144a8dacbd34d0c1b2feecd63d024f85d97db0e682650913438ff039292e83a109aa3ba337a1aac54d6237b8494115c3856b2c0

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 b957db2a4e5489a8341143c5b39dcc78
SHA1 7904f4689745901c7ba829164810f0ce9e2976fd
SHA256 e5906187597aa5379b8f91a865129edba7f84179f3420c401cbed766c027fa3d
SHA512 c76b36e5992774a85501fc7b422775f59b9b2e3d4d0f7b59e066e7e828d23820b727f43480237bb86848c853a01aa79342b574a8d0c4c741a5939ba09b8bac88

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 7af7c08b0b73677c5c42abc5fb09f40e
SHA1 6f9b496a49dcba40c5743d86a541f6b31ffb5e5f
SHA256 6dfe56c53c4699c89c0710b59da7e093e757e11f216fb9fb393ddd5a38696cb5
SHA512 fb51ea46b6f5d0c7557ca93262e96ded205f3b50d87b265fd9f416202527c6e1633d21106797c84d1d22e38f3bdf831a8b6156a7c86d3376299b3884399a86ed

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

MD5 5c2ff1d34491db60410d3ed9de8d0523
SHA1 53e48efd3af0e030bf7414735dfea60bd82a9332
SHA256 e0145635bdbf08eacbf7f5882353c1c378076844602b2e89b989b924c9be7281
SHA512 738383194a5963bca07faae8bb9fa1a52d32a6b23bf5b34a83f93422e44983a4b6359cedfb413a324f36fb0883d983c32e5c1bb3960ead2c778bf060962c0266

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

MD5 147ff519234753386d9ed7f90ea2c884
SHA1 164f6d0fb2c687dcf09781ae0961d96eb1024368
SHA256 ed1ca2ea66a359a94674194597b13fd657d72eddb4140ecfd57549bc6fb33e7a
SHA512 e87a82384f987695665510f79d57e82251ecb510b09227ebcd9972a130d5de3724e83ac4cd1d767d543bdbe041b7e10373e0c34f6ea15d74b2f7037345db5dd2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

MD5 8dc1d021b0641905aa1b43d8cb6a1f08
SHA1 5e3b9dbff04283b087ca9fc14a677cd26c53e98b
SHA256 ded9c22dcb327a42f2191a426d1eb0e410df71e16aa178ea014fb0e2d3d0fba2
SHA512 259bd9e9f5f330ba4a0ae5a61ccc7e376960bd0ec5b3766fc31c0c2efccef5c47e133b6a706ba43daead5b0816420c5ba81362ae0eb1f445e320c82eb0fda621

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 d1c629cd3dbc3c36e1a591736b89a78a
SHA1 86ca87ecfc7b7ead7f08eb80ba45ff5e2cc40e59
SHA256 cf69491b9f6bc24580543e23cae7ad8812e0af7dfbf11728f86630ff5bac1ae7
SHA512 787facbbc919220a365544ba442d0853eccfcb5591eac7f5db4cb847cf8bc9ed6886fe1d60ea9b79782917b05acee1362fe332c48c160f30a780f634edf0c72d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

MD5 3822664fb6cd268fe82fdb1cd2091b19
SHA1 72268ffb80b5161435a5716e2d38040b61b31f2b
SHA256 c659442d964a765d94bd1986e7a7275df70608d64084862cc3d6f5c21cf19eaa
SHA512 9b6d8940cf5674c59c73a1b3e5e1751b730965deb32da9ffd92b2c1fec20bbf55e09484ea462fcd7dce278cd690c8371a9304d2caf86d4f57f4221ac607617ae

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

MD5 5d6441c92a1526e5281c69264d135a7c
SHA1 a2ef846b5c72aec64df048d96daa94696746aeb9
SHA256 9bc26a5379ed654f76ca915afbd034701452f77c05a97b5c017d17dea045bb3b
SHA512 8671e60da4887a5047ace653e449874baf22a6ebff298a0a48878a91565da69c6b66bcbfac59352b5c4c7616cf51157ce5e73944010ea7b2f1ecde32ac29a9c9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

MD5 ce338c87ce98f4382a7d1ffa4be96ab3
SHA1 44f92c2dc0c69d7cae3dab96b1e0b40dad21361b
SHA256 d73d95de846c826ed4e4aa8e3e06f2a65fd28f2d305eaf6d6eeadc8677a1d73f
SHA512 7d40940f478739cbd6002e3248d7636411b5255f88ca2bb799b1e47d4579808f389d82666cb0c6782deb217ca19715f86d08bfee6920500a88eb6803040d98a2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 1ee5e6d5c90d3429e993727226aaf986
SHA1 a8cb2ec364c870214775ca596a46f9f92d7d7b1b
SHA256 22ace8473764d6ee76e240765e15b7e996edc446caf8970c57c6813d1bbd5704
SHA512 b90789a6ed4aca4da25205acfc60f3f49becfa141e8dccb09b2fc3d87c6a975d1ceaec7d7c9a6271378f3d8b909f1443ed783f9e42a99095edbfa79200b83d75

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

MD5 112315cb59c73822b442e7f4ad2394d8
SHA1 2ed0a52ae378c5f3f8d03b329b6590ec39c363c0
SHA256 131f586df884fcf7065c0f93d2212a2ab8a4efd0a3b1be650d8e93b92672e72b
SHA512 72ef186da22e324adc0a6d438ed8d51358fdccb1af5d82946e254d577588209ff77df7d8096b811fc7431f6ff4bcbf9588e881c7f5f267fe7106bc1633e6c2ff

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

MD5 da6d94a35fb6b580c59dd6d633b83cf9
SHA1 d3cbefc1617991a39eacd2d2d647d7ed51e9ef34
SHA256 aedf414c160fbbb83290722089a324510484490c6dbf280877f47e0f95088dce
SHA512 6bc4f30cebb6c7255dfde9ec1ede8085dafa0078fe9f4fe5e27e2fe4d5f9bfe6e448b88f99bd97684c302f0b0bfc653649eefce737034f40011e11937ad528aa

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

MD5 7e90b7a0d723fb0bd6bce64cfd68eab7
SHA1 c49e4956feb0229b623ccff874c31cb362f101bf
SHA256 287875879fac91a88936226f6717caf6ed616a0d1d007ff1ec0086334b71973c
SHA512 5199a38742244ef270a5c8eea7accf01c8ba389e2d4defee14f25c55b11259e8af5474f37f1d559a83ba23591f4e54c67d0d4ecb74e83483d7bbbded8a8bc2c2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

MD5 ad1aff0af433f354d5b948348f96bf2e
SHA1 a2b20d10eec77c8185e61f7e2ca0568441a9bc22
SHA256 c8050ff4b0dd4c20dcb1083967f0302bf4ed6245e02d60533f1b1172c0cb0955
SHA512 e0b25bdfb07fc8fc1acd44b96d8fd3d2816fa6fa8cbd82e99fa256c2d14d1b258366146bd73288adb7772a5cce7c950f14ce2a12a3bdf39a1a68dae7afa7203b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

MD5 cea43edd1e61de75188f15d4c53a3e04
SHA1 bc2173ee62b44da644e96bd54542a167f731bb0b
SHA256 a23b631aac3c2073bae3f2df2a6d4c462caefe1cf6c37f3d007209464b41df59
SHA512 f7869b4f21bcd00a6d1692650f5fdb532a4b43fe45438621b088fefde87ea0054567904b7332dd3f34a56da733372ddc737e2a8d1e03bb40697c5ce2080af156

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 df4a1c7215d69a5739823eb620ff5c7b
SHA1 4490417deb36bb864ed93aa6d179f62136d10693
SHA256 5964d79bf72350bcc16f75f197b62dae825297ea2541e50ec810c5f99d6fc093
SHA512 e5f971350c3016c663f2da024e7858f7ce6e0b69dfdd2a01d52bc9e008dff9ea1efbf2d7c6c44be9e707d803ecca971e2b6d3720a251d7b2ce63fc59ae62f513

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

MD5 3c2f0bc646389a4688d4aecd4b17674d
SHA1 c879d0ea697d9c1feabba5c10a97d54f05b459c1
SHA256 92213c712527986f4991ef965ed4f656f873f6ae0c490d87ccdc572fed15de0a
SHA512 8f29c0515953f764495b757cb23a7aa31918709c91b902497f26fb84e914aabe223db7e170ffb4f8a21578efc2ab795ccc6fdd627ea39799063079f7ea3f0fc0

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

MD5 84919a0cc62fd71c9656c99823166673
SHA1 7ba393b96b758203c6b19ed7a90e5c5f2fd2c50b
SHA256 cde4d17e859ac38fafeba4e8bbf88a01d3629cf41909db3d2ca6cdcd4ff05c60
SHA512 5a4e2940105211ebce8dfdccd03bd0d45fc758395a3eb0bab386c3658f956141379524d238fa56a1d5087890964b712a98e36d6176142f59f48e2e5289678246

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

MD5 7fd55101f449dba9885644db2b503084
SHA1 d8583db4c3eb4b5b15e8f0b2a05b13682375f21d
SHA256 8e8b7b5dccde7558108a690b978ab3d01cfbdc6c7f8fd260ede10b4f8e678d28
SHA512 50da3dcb7e5788d2f8923fd5ce0910a0a47aeacd796328a9baaf4dac9b0c459f209dbd6906b94ea59d7681b609a222219bc4c93542725f84e6d4953cfece9e55

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

MD5 49e1d5ced990078cee2946292ee28ad7
SHA1 557feb90102ae87c6572e8a6738a2a9dd2c3146e
SHA256 7907130e3b819f9509819d45e4be41591cf579b0ddf058ad09fffc1b4c1e6d73
SHA512 61ad2beac03977c41afeb02c704e47c1d764f11aca33a3483210fa881fb75016ffbb0eda3c8d56f6942aecbd2afcbb2b6ae834864af6dbe882b36ddcfb80abcd

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 98a15fedfc836c40bf40713572f7001f
SHA1 5342630d970819b2ad4e6d57f3d3cf14fe160f4c
SHA256 fbdb7f2632c24fe7acb21f89618b7fd2256757fd05c17b7b26e9ca431be1f520
SHA512 b7e8cf86dca1960612ebe14e562fa04525ecbf897805b130c465edc300a9cb6bbc07b7ea1844da43e2791ebdb0a596630ff3edd776dac624a09c3c19f5f4dc37

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

MD5 784cb67ccb37fd0aed3a83b9bb9763cf
SHA1 c819af6489e32d74c44bdb47c852fbba86e8d537
SHA256 d7fa8d05fa591a09efd4b35f03b49a64b2d86bfdf94bf04b16be4f1f07059d9d
SHA512 e57fe40097227e644b1bcb1136b668ed7f9834473efc5139114f1b18bac0c10f7ebeb4576709937bfd17d18ab7ac96ab201cd33041a617ba53b9c858eb93cf77

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

MD5 5fed414c2a3baa33223a72c76e5b17f8
SHA1 8ffce8d757df3f4b277b76776cd47996fe508f80
SHA256 7b56eedf0723e9cd94e74f58d59f7668248d9bd30444e195010f6468f871ca24
SHA512 66ace545d71c5c7cde76bef4d7f8a370367cd05e6668e366ef3f4cd704209213c65df3a1365e3bd53621ad475d7e81d3eb2b99ccadc6ff0b5fd303f1db30c4ca

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

MD5 ca62ddfd123d2d0cf00d30a98f280e15
SHA1 a408adf217d05936ada55c47710465400dc2d6ae
SHA256 d2f6c7367ae54fb44c836fff69f4744c7b9c3f40f4dbdc5b04951f3ad63c8e42
SHA512 dab1a804e6bee84f282e9e0823f7e967d0f62cd8f7af2217ea93fc4686506aaed640321e5a595052201127d4261240a7d944dbf4cc9341166b0bfd2df67baa09

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

MD5 025e0355810e8e1402ae486594798c4e
SHA1 38e9548065b765432d656f99759536b01c31c45d
SHA256 ce15f10ee1c44b4360d3f4e6a3382632dd4d7f609ee211108231e3810282335b
SHA512 e42dd8966fadfb2e1c38e83e8c2deeffcf380596ea69c67d384a8bbde1ae614d18481b3b7afaf97304db5a913781648e2e7ba36b04d26b2229398d2c7ef9a15c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

MD5 7bf9662f5bcb4a497d09006c330556cd
SHA1 8f6567b37c305ea7b14c94aaf723cee042c0d77c
SHA256 68b69e945b8b559e89e75f6f10da7df980207dc0ead2e2ae889b3b69d0201b5b
SHA512 911e4841c723a764f2275d848a7ec2706d724b536a97a8ab49b3b28f758a62a48910681cf8659e785d8d694e12d2c15cc9b17ea50cbe46b73ac574e1aa7c1e80

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

MD5 364fa4bda93ba2c8cdf8f64b6b3b9846
SHA1 78fd7e19b382fe9cfc80a97829ca0a19c2595c18
SHA256 74ba6a49cb7225d088560f40d1fc9043996953bcfab07bfe62bc65b133fef303
SHA512 3fbcc8c3373132020d1d19a15de9d3ac0e2431b3a37948e5a6d9b8b985652c42f63711330d98267d11dd8f9d5baba2de968be06c699ee2ab2e0511b6815dc550

C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

MD5 90b21e9f82f5a8fb0dea225383980fb0
SHA1 38ebec763f4e84f6231a20e92442874cf0f01222
SHA256 de21becfd574f7917f70fa25dcb733cfefde3d621dd0baf1c71fa4b3af808431
SHA512 d976fc739b1be1504f0654e12605941bb665b584000aa7dd287b9fa5c7609d44a2dca790b99857755e30757d4d841b9933b189e74f671fff2493985f4388f4d7

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 96814e5c2cf2a83138d4ca46efc245a9
SHA1 3fabfbf748a91d3366a19e8804df67d948fa4b32
SHA256 61950a1f9e8e9264fc8fee729d185eaac7e2200ba9ac611f96f8c241d14b9068
SHA512 d07df302c0605b06e114720f8a2c913e0d9093b1e4992385224a028441cca36addf985c46a2984965460f277ae4b9bb921b9f0a55619224da0fa0c0aa96cbe7c

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 97c125ef3d42a20445b75f01eae57342
SHA1 f2dccfe0427eba76a098e933fc9ea6ecd7e72fe1
SHA256 f0b586879bedb925752a053eb8b329ec0d0b1091dc563f2224d2355b3fcf89ff
SHA512 e0de2c026612e503b2995665530689e2e27b75a4f208431758d06e2b0fbf31fbb3dd93ad9adc95a5750ed7098a1c33b287a467c9a919529333ffc1742c0c7579

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 548350ac4e91eb4fc1cb82b9c9e338a5
SHA1 f36a4b14c7b7d75fcbff842cbfbcf30d6b111e78
SHA256 67c3b29127d7ddb39e05394ea0749e1ac516b1c531c14a341d0d57f8257b7b3c
SHA512 fc74940a8a889193069855af20e36dce4e0743456f9e0fe62777b4e36a193ceda222df7d1f5333d36fc8ccf19f77768408f7fdeef02b95f473d915ed64c74ead

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 5b613eea8feda67a28f29d71aa976de1
SHA1 705f118b931c75ddbd1b2e4a7f10770051c524d2
SHA256 0c610671ae88babe426a9bb05562c63098550f8c71ff545d7b7849c7178e16bf
SHA512 ee3a387b197740fe8db344820d328b5923e11f566619c40050c7e6d90e435eafe2111647ce126b6c78cda44523adf454b00b8c3b5134552535df1dc4a882d9a6

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 6e587f83f8013f9ccda88b9880d328e1
SHA1 db1ed48d3ec48113592e535cb13b7da80098e4b2
SHA256 1270be927e86c84526836d4d3f3d5d81124e6b56668d571b77eb6f4b2b12f7dd
SHA512 d8b438464bb662841f7ec3a030f951d495e74ffcbb1da3cb4f7b24a12a4f99b4da7f529574f4e040f532d577a6580aeaa3a8b218d1ff28ac99acf6cf75794a79

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 780ab14102e26c76b5107376e01adae8
SHA1 5bb166d032d3a96d4aae464dd8515f1991843c65
SHA256 d0d211ac3c52b0faf43110cc580a8a2ea37dee43886aadea1440a11d66c58d07
SHA512 3b902a3baa2cf79580455316811a381a68e99ddd5bdc24ea13c342b9105489e3bab64b5fdb01c04cc0209e23a3d5e7457c2ee9301a0a6355a186df25b84cb7fb

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 cc953d53b9c83872727719afedcb83d4
SHA1 9f27a4a83b0d76edeb2256c94d10321d7954483b
SHA256 5b0d1c95db9a29d15bfb280fc209dfe00bc616ab47d89fe3923d37d810870128
SHA512 b20a701860c196c5384d522a90bfe4603f2d4164e7cecac5ccd7d9b0631e99e3c98c2a8adc1908163ce66ae456b8f6546e6057f3d57c454910a40ca1c79c9227

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 d11b985fa994dd4de63c557f1b1f8b60
SHA1 44b84dbb6281b635f80ce92f37f4ff6e243f90d1
SHA256 2cbeae5f1fdee93732207480632defcbc6a82b2bb4b6998273e430ee7f3a1007
SHA512 6e999f51d4f9f1337ba74807a93c575f0502cba1ca4abfde79e26e37084674c75b1ed3f7589113c1e3b0416504c76167d85a1f7c4e7305d68f0c58a700d50b4d

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 977d12f79db0ba58192433a6a730ad78
SHA1 0d5a1d9735a5f1fea1974bfdcf6fdece331a9108
SHA256 52d29c30d3352bae68a8b1e1841151200fce7991998c3a031cc99181e315ba15
SHA512 65f6b9516aa395a2a62089c3f8a99ad8059ebb6a4f48b87b67177a508c202f33f93ba51bee2e21d620f8a5fb7da46a08c25b39c58ce18107bef4749b370fc391

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 e5492e0d092367082d647d2e82dc4893
SHA1 b09f65d216960c7ad47d6e44f9a986111d95a785
SHA256 47b6d86031a8a0112b5b2dc1c47efdba306d191bc4fe7f440dab5f11dbc54d74
SHA512 4fccf685049867a1a7f863d91bb940ef4cda52ab1d14a5d1ef4dd378278b214c468588863bd869f0b0bd7e2394bc044d24bf1b6596afffd6887e7145561fa97b

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 38d487b5142aca1bf955ad4073caae3a
SHA1 66f92af986d834747271b1f96e6948d1cec1b029
SHA256 58790887e3c9206caa2dc61ed16b7d7ad7f83c8215b19c0a37dc5bbac45c2de8
SHA512 fe964eb1f5d5c3d3465a524afffdff7520d3479dff430879b5c81340dcb7cb8863b0df093baaf838ffaaee6619b6c588c4c4179c562fd79eb6722f111d7336e5

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 45d571af3f3cb2ce772c118159790bea
SHA1 08d1f04a45b74acb09024e38fbb040410efedc71
SHA256 e0bc2e98e5800142bbed7d0c20a594fb77f2bd32f6022b6244b96dc1da9330cd
SHA512 6889b59728eae11e4a26476634c76c1276a116f88ce29af14231ce12420b9e8b5390b28d6810cc798f35813a2660d7de470161deae9c024473228357765a4711

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 79cfd6cbf3df3e0c2d16eb8e4f36365c
SHA1 ce12b30b3a8f6c34d2dda94530c8630958f56591
SHA256 d599840cccfcc02c7155021a067e04bda6c6aefa3192a8befe105bf228fd4c86
SHA512 fa8a4a3a1e5722808acfe545372684787661b968d6e82e3ca0397f96a38776deb1ba101e95f47a8406d329916820188278c83fa8e4df54168f0be3901ab9d211

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 d48b9ee4fc21dd1fe83550e7b6015e30
SHA1 786df9e1332185c185feb8ddc10d0af272c32c3a
SHA256 33b60cdcf5bdb5d88f7cbc414cbd3bb7b26487e097414cb5200aa0212fc23e74
SHA512 bdc69e17aec89530c5be82b5be2b954efb51fbcdd9c8750eab0e7d094105881c9a1808f3645bd46b9c2446c600869a1c749a900bdaf6999dca97cf556155a887

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 864796a2eee445663f090d81e7f7ce1d
SHA1 e92e5af3e16661ae186ab409c75bcde6625c9f34
SHA256 efb830ddf31d656f9c14e77ee93341b85d3ec5e0ae4df61d13e483a14f898a9f
SHA512 eb7557bba89bdfb3c7b9a283c2fa14b5aa787475eb2bd17cb8e8dd27163a0c884e0fb9e915d7a6834506f05d864aaa7d1a60826fabd6cc0c32075ef7ff030e79

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 11cb5f236439ac6c35d375d107cef026
SHA1 d4ba1351d0643aa94831694dc85f721dc4b483b4
SHA256 ca62bab94401bbcd70e096044b64c46b84f59f03acf858f92d1c386e48bd2e66
SHA512 778dae9b43e3c62c5c2a7f33918e92b564d48432c3a6bfd42cc606d76072f9b100a79c6d3b765950e0bb2b7ebe28313b38e63707e701dd94e74c6bb628fc2e6f

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 4ddb3183b7bf956dbcd983578565a39a
SHA1 5e5d962290057941ad1afb5d9fa077c15345c653
SHA256 f5d0c0a8dc7c8eb57cb17cfa7b0106c128dc3762d6e12f14bd196763d8a5f4e3
SHA512 b4e7362dbf280c8bddcff9faf6abae5b182db91299921de78e9e916e8e89b347c02333ac618447c0542378a53d752a4484d6b213a990fe667e5bb4155371fba8

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 e77bf47420e5a5befab53db938dc38cf
SHA1 7e730349c0f7e82103835f7c3d1684d619421046
SHA256 1987634c83032b976ae3e526ab5c0f7ad607b8b9db2d379793f1bafd1c7bead3
SHA512 a2cdd68a32ba05a092e42202b24871f73c400458f60c93d967f134c430921e053268c9ac047d8a9513ac263ce6e13318071ad434473d3ed25b26154246c7dcfe

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 b53d70395010067d00c20de6fdf13250
SHA1 f2eaa7abf60a1f743fcd63aa3f23a28db5eab335
SHA256 bda228e6310e0bbd1662d5000de39557bde03d5504298063f7c5e48d25043440
SHA512 6af6af8b68555c66c628a48cb3ae903f29d440189b918b3949d6001b74aa616dd29ee4c46e82903a7a53b63abc7ac00fb57f5f03437f98f6e266d46837f71a0b

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 9b745e5295b4c3db1b65be6fa55be330
SHA1 4d0c7fac6914f6b46b42d441ff3ffe4197035055
SHA256 5ad7f7857aad6599b530c08edb542a38fab35923f26e9b5928e05c30adc4bf92
SHA512 360d08ac1923f45bb32abfb6158c4378f042f79b330ba69da2b285ab9c8318b91a01164f3c11a800946b89134bc65932024ef5740cf16f78f73607ced960e973

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 578759ca3c7d85844011effb1e30e4ec
SHA1 76a04af75e8ac5685e600ce920e750ee849e9141
SHA256 6dba90789ba1f1bab14ad681594975d338058ab78b18e79e2ed897487358cb47
SHA512 d07c87a2283d5e9d272412c781aa1cbc6fcd9d6aa122226a595fae8319aec078c5464b65f0ad2804269a54bbb50861ff77f600580d4a4b68f620c371b1824be6

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 e9afdec4abe561a4d484c178bccb89e1
SHA1 c0aad81b6abffdf21e17cfe2cb182a37b40131b1
SHA256 89fdddb6556669c9d0da621a9ca3e4af052a4bd6a2a64ff0795baff8797a6048
SHA512 d2d9ac1136565a13ce811a699e045fd3ab95d95bce2c1c3e762eefca9e7cf6c2b9aab45a972810eee3d6d342559c976f3204507139ab96c634a68661c5d96b2a

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.Lime

MD5 f5d5d95b9295b1e654b3c72c0337e4b5
SHA1 c621dd88d26327159aef84aa9e9d7279ac1ec5ff
SHA256 33ead1ab739d7584cad60219fd26e501b641467c981c075dc20360031ccf7335
SHA512 f9f2a782528c22a8b771e01aa5a787becdd0e864b4a2a619574607ebc0fb8596c0e402f81bb7c37e958b88ed2340c16caa9e1f1179dd5e02560150afd909741f

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 25cbc5470f56d9dc6b7b46752ab0c888
SHA1 cd17da7afe6bb3cef67b561d4a310e2fd61103e0
SHA256 04b7fb2a4c07a07821065638143bbe9df424edc9e2b8d2acd68d09023e4e94b8
SHA512 fbc5aba8a5f084d8583b83c9315b369aa91f8f80054b00589cab1d78cfec20fe2cf2a2ae813e87f47f7d4581e5bb9e11e908989605864bf9a813739f1355b66d

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 218284644ba6b7a507e11a35c1c633c9
SHA1 75874c71da910e9ede12c2084c53bc84df8f7bb7
SHA256 b62e2abd0e39809a1eef5c6ec8e1a11d9aa97a5934960d046bf03da030fe9e83
SHA512 79463fcc6c9f958db511774632960e7c00b828de6c5758d0a7803743c4197b58459c192e9f9e08f05d021daecd36aeb92802245eafc24d0a19aaef0fee109259

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 627aeec91a4e30f83301658bef16efbc
SHA1 fa0b9fd66a9c23f356ec2c6ccc828f3a7273fe0c
SHA256 77efd70208a132887af7b7110f8ea6c3a04024fdd603ff7ed1c2d10ff046cbdd
SHA512 a660d6f1a991d592bf0e8825b73526c3a2b9ec2eab6304fba607468be7787c19fda4e39da65e6061ce02203111e99d71bfa74c9a1f4eb5731e6d31e5cfefaa5a

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 e97a87a611935daa878b13f2500aff95
SHA1 61b9e0f851648808f1fd6871b862f8c3dc64501d
SHA256 c080fbd88e4361e4ad2a09e237e09233aa4aff8657e23a550ee39f40dc218fe1
SHA512 44779fe35f3cee0f3e8f14b927d7043d35b11d979382f471be44d39dc1dfe085add8a41fc32730c30bd0930c839a7f7ae76ecaa8c973f5858659ef4a0d2f1c24

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 e899d19f1dc90088b6920a064ceba4f1
SHA1 52f81ea0316fd6b54a4e3e780d1fe85a3c8d623f
SHA256 98c455ffeef3335bf06abe427a7e05b2d9b4583f9cebf43a1474202b5f0b229d
SHA512 b417d5edc97bf0dd8547e972e79b06750d28f5a8f72c66f8a0b34f42e5fdfdcd76b3f0600319efc131ef2c2304233f11db7903a33cdda6e078bd34926a7ce217

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 a0547cc1c0d4aeb0fec293954c979ccb
SHA1 08438e72601fe865d8000153b1e404bf1f0637cf
SHA256 26a775b2e12c8a18b8fdb07c099f179061cd56df0dacebb9e9a82a6641999073
SHA512 d1302f9ce252601e6342d079df94ae130d32c51e3d99f14724bfad232a52dbb1b843d0d85c0447f38473989aec4e2a11a76f1c2e7db24ef271706b0cf2c0deaf

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 e0a8b5c5689e032090ca04ed7afa12b0
SHA1 8350f77aca5a6abf32ba225b221a24d910bcd830
SHA256 b98e753008b2e973f4e463b9272b297afc950688eabcc9159fc0c72ca39a182e
SHA512 2332eb204527ea5575d54ce8df58729c27874c2ef311623852c4dae8b192403e3d5da1d5c53b4c16905b03f780aa243339b69f877f15d38663eb5041dbce6977

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 1bec5beeaa7b8d83dc54656342ae4a75
SHA1 2162fe2293ac2de2192a697ac9586f385d4ba62d
SHA256 d62236a87e3730352b446c7e7de82a7fdcad4e4126dac6825b500aa42b192e78
SHA512 bdd6fd2ce25016337f2609e700575ebc8a17264a52d4f3a04ef327ae75170f210e69a4c8400588c1ca3a9804ff5018889b219a786466912538e33ead07ac3cc6

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 079afc50e43e482a68878e92065eae87
SHA1 be48455980b96e4dc77a98015ded2b808de5102e
SHA256 4defbd2c74128500042d74cd3b379f2f15ed6a487149b7e423c97d814e8e6139
SHA512 fc92178c88810bcd95c0c91b44c92aae9e7ce1583cb1ba136e0ca2d180ba751df4cb32f9d53808f5a7b1fe2723c1ff80040f52e7eeae418627366c2f5b8e0015

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 bb859dd10b5b8fd12b1b79d899ba39e7
SHA1 cf6d78ca0d0c7a98bc24f8251d8b780212d56fbf
SHA256 9513eba001b7c4e9b115ccf597a48fc52d80edf692618762e5081dfbac66ffd4
SHA512 1120ab9ef9155bcbc09eeac38e3c07620f067f059db87a0d6eb5bd3df5fc5690fba38b6638d57a86969d478fdf8c093b24e45ea828845fbd64a3352cfcc3a745

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 60edebf9e9d4bda70ea082c8d781a170
SHA1 158a189cbac2ecbe951a5953f840f93d59471b13
SHA256 6fbf47dca76bc9c6bd969c043f166f92e9f1f0d71bcbfbe3510af26db596a549
SHA512 91ef0fb8d088a89964033eed30a2d03f0e6500d261a632d4d7ce618f77b61095e569c176acb4e971c98ad4d23f7b30e848ff9da0ad540dbeccb1ec0705949ae6

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 73d5107f66c195590173395de80ddd69
SHA1 48c91af4bb634b348494f4c1426203b5e68cf8ec
SHA256 a2dfd1c7cea4442ca7a6a32acbd66ed14b2032a0aa6f5175be3e5f7d00f86961
SHA512 0416775d1d7b396045858a5f398b9e055a857afb61665b1584637c56fb0747d51c2a4a2b069b08152f0e8258c1c581fd270fe8648a9f26cac4fb20289a38e7c4

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 2b64aa308a0bdbdb5c8e85a02328c285
SHA1 91766aa1545e5c552393373b5b82e5c856171773
SHA256 5be85982952dd3bcffa67d60ce7f02ae476f6188df7570ae2392e16d23872475
SHA512 bd2a0c2da825f0e739023673e586dcd1b6dd1ba95bcb137d43fa2abfd14601eb9ced37c3de4f1aff4586f051734f8ee02eab0163487defe24228894ab7dcd5b3

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 0b7607a1ea7c2d67711313b413890e31
SHA1 3faf7421a1affa426db983c88412eeaa96ee5c9d
SHA256 bd74e73f725749d840ef7ba8e4c1bc9e018cbfd01bd38f7f570def7bc707acd6
SHA512 f6c281228154e922436da9a808e7e087bb33e1d92c70ec707e94809aae6f21d09cb16cc1419c4d3b3d7a506b835aa56c24a8308d4783ec28de0c4b69611c7046

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 277af377eae03334961989d93cb4fc71
SHA1 f28ffeaa4abc88e8ad1d44a0f359895a479f9670
SHA256 b23847b7a93a43a46a69aaead784888dd924a9cee6fb3d1eb32cefa065828443
SHA512 d86072b646ddf15f36c27c208c3b126fbb35d8ddfe671caa31574322cb171aa0b9764e63efc9d423a35fd1fa3be32c978f75e34bb0de3a570ebcd7621ba54806

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 7fdd57fcf26c78e39e3e5c13c54a8656
SHA1 8c2a0e61ce1870517d3aafaf6dcb4ee63a31688f
SHA256 26a8d707c452b27d4732e28abae6bfb05133e0abcb10327911bfe8c219d6ffe5
SHA512 ceed03dd1ee04c3be96350aa9e4be22b37aae2562b776031d78d7ce6cc29aae5bfc8e250125ed6d3249faecb671f4f64bf70d31906ee9830eabd27650b69e038

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 54817a35821e596fe3faf2736455a681
SHA1 959ee02749c2af811ce81f4bc84e265308b4b411
SHA256 d3287c5e4a32f05ae6681b40ca599ee956bc22d4444d50fe32666082924a23e7
SHA512 5b1ac3dcea32e62492726610e8ef03214013cd6d8953eb0e92faaac42b62e2fdc140201e50e4a5511b94ab3b5edbf309248821c26577e879f14ad35313445e50

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 1efe7ac7451683b66a5f187ed0824874
SHA1 1c5efaecd39a53585311ee102fd82de41d3ad969
SHA256 33fbb2ec505059900f8f3cb1782d4d04140d4c2bbc3e05b61208d14aa152956d
SHA512 e1adb256cefa421e24c93920799a6096a2411c2fb1399250e4629ec6acc772e92d99d2be74c0b8ce5d75d4278d1e0bd3c72493e0389b49e5d8c2b61e24c62bff

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 122dfbfbf386134b542dabf78a649d63
SHA1 bc0721d1ab7f7e6b23f5f99836d40b860002d0d9
SHA256 9e89a44c0cbff697f8e5219482dcde92f3d0d3aee1cd5051d07ce482a5272257
SHA512 b767b228a610091f2d18dd98ab3d83b92550b8e4c0c9f300a944d8af587c3126dae4a9c29eea3381f9a8b8b4272da911ef11ab179febc5b2079f510c4cfe7b92

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 df42111a1834c76fcfff5671f328c704
SHA1 45af4161fdc7ee7a0340bea5a661327d654c3a0f
SHA256 bec5fe2c8153742372087347a6609d01ba2a2f8fffc5932d262a8362d67d02ff
SHA512 26191d34ee368652ce72211d37816c1cc4081ef23d77d3c2cb407ce2e0944a836a15ce62393cda181317f3a849bbaf7b27c87019b1e931cbd533cfbe9e5edefd

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 a7fbd41c131e86467286462f850b348d
SHA1 b60ec8c3ffd4b7cf0f1ad9a380d53904f9139877
SHA256 c57f02b6a54dad379694c682357acb95a8063bc3a6abc612bcd68f3130aca5d2
SHA512 ad4667f31f27d1048ee6078e5e2d96d9801e8d115b8559f5847bf2e69a353c95a0089be937069b92aa81204ee4ff665aae0a6b3e83afcab7a2871c4528262a2e

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 d90ad93ff55789fd07927c066299ccba
SHA1 053441e628967478b247f535f50b522a231e97c4
SHA256 93e48bcfb0081082020f5efa962b5c97abb2230d3c2b9cc6e9e18e1023756f79
SHA512 f111363c4143f20f8333d0908dd7f1a49a6eac2962facf59be3c94e5d52d289677b54fc8d3643723f6b80de05be42138ae94cbfd07709eb962b0095d9c0f7705

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 ca5e2ef3a5d725a4c10b9523c400610e
SHA1 9fa81bdbe72dc8be30dcea718e8d7df8cc1bcdbc
SHA256 6bf697878504a89047a6508fb8dec3c41c6c4a52471cd432100e9c349ba19e50
SHA512 de8c39e1e89d13f814ae34b83cca5e1414c46415d5f1275b459d6f652e89b19da707159ede2d3a720ce517ca93fa5c547c5035b98891e80af0eb61d572c44d01

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 e249810f2ab673f5b4e59b46c8f513bd
SHA1 8a702736a95fbbc732d3f5fdb9e67fdadf9b85da
SHA256 fb50aae9562b8c3bc5d2380f89c7399b1d91e413d130a59bb0b8977d4fc6b380
SHA512 d15ce4cf61baaf0fc7971b320247d3cfc143a9dc76a93d53ce84969e10582d72fb0efbe8aa67c7515029db18fd9c463640196c2280eb8e9addf9be5f980ab3a5

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 47ddcc44646384a68edb9d2fa7cd30d9
SHA1 6afe12ba39488c40a6c8fc08f2b6ce81ef2ec7bd
SHA256 66212cb7713e8bdd234120082c7360b3d46114fa97e473d0d3c6a3e226eacf52
SHA512 a280552d445d7e5f383dffc0cda3bc230cc94980f5e3e0b31008eab6304bf720323eb8847fd7c36d7cc4e059e07aa8e7ee290f97a5f93e55eb67cfaed7a88aef

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 a6d9d8ed2a9fba8fd129fe5b561a54d8
SHA1 9b384ccb5b4271d8e406c00c488bb4b3a4411ec7
SHA256 86fc7236497e94cc2c01252ac83df747b1b66cde19d4571a7412f9b872aa7ca0
SHA512 cdfd9fccd964fef02e0bdfca8efc13968e6d80b2d012ee9d9c7d13bb4068fd03eb45af4a0a4a50789250a6031fc17a8a05d1e142c372d1b720fce90a76033d83

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 5b637222c6ec2fe36101de41979abfe7
SHA1 b0392047bdd0baf8bf1208572e0ed6134c0bedaf
SHA256 8b1c6e5ee76aa2e4708a9a5206fea8390e386f5e7f415130b0a145d13f0a5609
SHA512 21ff729be3eb2ddf7dc071b53ceba557168428fc47250a48159f03b0b93d20a82a02c1c67a9a60dc00b604d0e2e7c7217c73f1c34b9af44cbf69f684a4cdcb7c

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 53bf15ced7bf9915fd885edfb46bb019
SHA1 0b792f92afa3f64ebde06a4323641d2e9289e6c7
SHA256 c7eebe024ab08c3b74a78ec0db9e09ce8f48818ad313e56713b9bd48eaeb39aa
SHA512 c1aa115627f7ba6be45e06c47f75032f8ac205e40922374dc12a06472a5b796c57f6ff1abf6559dcf893e2280d2a448fafe6faeac58d320f6b4fa704d34078ef

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 2600fbad488c14f32d11a2418bbd8ac5
SHA1 3f7c6ff1791ab052089e3ca7bd8bcbd6a275173f
SHA256 1d40b0c1d26f2d4a93a0a091babaa0f26f64c8167e6d00968a47d8e35f2d957d
SHA512 1a012a733747a698b9935cb0e418aa4a506cf40e84aeed4dffb26858b8250c7f08af9bd6960b4403f501276cf12b3d2989d65e52204269d4fb8265769b69c6ac

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 bd81e0c60a7f23854d861f660a0d47f7
SHA1 83343966733bb71b3b517e52314d18b04e048d64
SHA256 7e02410707d407ff667eb544afa23fbaec9d55130493dfe872643949a0a0b3d4
SHA512 39940a59cac5484e947fb467fad88ead6ab881433c90b34028e80c9dc9b3b134b60a566ad18de9f893a0e510ee0a67c7bee9297d275088b739c3c64816e86bbd

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 2ccafc82dd41dd1a38a2abcac7008261
SHA1 6a9a8f9644a4bad5778c7a5c278a0d51104ca2fe
SHA256 3e73adf66b1960f561e0f4321c0aefb832279fb2ab72acf51a108d794201191d
SHA512 6e4802932703ce10dfb787a3f129d421e01420e08cb295a4a6134c0d9bcf5cf9a0bca9f105f596b42a94525c187f5f7ff92dafb89f5a4d297595bdd58fd4fd01

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 8a2227252e99069fca13fb04bf4259fe
SHA1 eadeaa088b66c68de472890dfa437e954b25f928
SHA256 214bddd4845a84c47e00daf65deb9c6d0f6099f0dbc3b7ba6bf52bfeaffacc58
SHA512 67a8cd407e05024188609c751f21cfbc383e2da9f18a477dcf2a06fb5f7b4103f8c85406207add090d0b9a0cec52ce8d3c0d1b7ba35274fe8b7f5e404f60f12b

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 d8360e2b9c8030fd5e42fe952a6d682b
SHA1 442d72bfbd10b76702565bc7a916576637318d04
SHA256 f98640ffe511259dd4e34eddf17edfd58c913f533ae101ef26c03484b084bb36
SHA512 5fe4993212fdf23090432f9edb21f2ac05b4a45445aeaaf25e56ea9b471bf3712af26549d1679b36b9982cd14086fddf376b7783d1ceb4c3d727559d687e1518

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 0bfd8bad4df664b60e9c3cab68a4d70c
SHA1 96ac5e2f49cb3cb6cd562a49044900a9a2873798
SHA256 cec060f0fca3a4b4bcdd9f9c518f07d69e3bdbd5b2605ff6228c628961f12b09
SHA512 808d791525bb05b715b21d78bd42d4d30e2d18c18db7f20682bab8949c80d600917fb67cf3edbd20351b6e74d507d7fc9964ed7c7a6e35d5ea5a645f1f9b3bee

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 788d3a40345535042c4258c6d10be8a8
SHA1 16b0bb6c4c53847459d4a8db4306fdbdd5279919
SHA256 f255e62476cb50b79fbaa19c7bbc4e146035dc22191123a467554c0eb5c88e7a
SHA512 b7f949d1baa5fd327f8c64918afb0a3a9b6c3b2dc32f77366261379210fc80e74d525431d0f96b1fe580883177a73a5de63fa859829d2987c3f27b115c44c96a

C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

MD5 4fe7a07677f8aeebfe9ae04b078ef042
SHA1 80b1e82e88537d9bd3b76354c859b6521771d4cb
SHA256 8a83af26486640336d4837f1bb2bcaf290fae6fa9fec40087c7e77861db3cffe
SHA512 e66d7e190002894b13cfaec34922cfb3f7d405246aceb8998dbf73f9f891ae5341724fc3a80a48e9ababd8055d8ecfe37f0661d52e7d737b537c370b6a90207b

C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

MD5 8f37cd3e8c22599a31aa4546e95884f8
SHA1 3cb59af3ebd03f662a46a1f90541054693f6a14b
SHA256 dd686948cc1e07c74f4251f289982e325b30e2cfc039f32ed34c2927e46466e4
SHA512 86333f6848cfaf2bfab6b9705fa3c860ca7e363ffc7071fca163434347e27c16cffbf198a7bdb5639ea6b2a2fb158259a75024a0ce319eafd23e66d6ec00c253

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 1e021fc374380def02f8749bfc105a85
SHA1 bd1e80060164535d9b8975ca524f4f92384d3fd0
SHA256 8e4f517a82dc6728b6ea64c21c97e95cdaed5b59f65bc0642e3b6cb9a829c5c3
SHA512 ad1e0f8cab16061dbe59c0b5e2ffe2791884eda9c223bed9777b5b74b5d461ffedb6f8ccfc3850cc43a457db8e257fb5dfc17f06d17cd5bc761fc5ff407a61f2

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll

MD5 7c23b09ebbfa3e3b1677840f255a982a
SHA1 edd7c3a3aacdf74c1e4f9931391670ca91436c4f
SHA256 7cb94f718b639fdbff0d78a8d87e00714add8b8c9bfebf27d09b4b9689984493
SHA512 ba0749bf71e684094e2c108839c16ccd795f42233cfaf875aadf91084b690a1e758cb117e8a8bfb8fc155ba36b0217ed6011147aa1eee062cfd3e5979d0d99c6

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll

MD5 6310793f6096d85de4ce47ec07a0260b
SHA1 50436613e0f14ac3f6db7a9719342314f675a213
SHA256 9608038082af05911c408d001574346b67288f381b8bd44381799acd1d0c0cc4
SHA512 4a409793e31e1e6d41ee8613cc9f1426a79ef7218dc57fd403cb65818adb4439b4f43af64faf2cac46932a81f2d7596541c2c8240fbf802942061dcce74ecc81

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

MD5 8a2f35593c134d284a8904416748fe2a
SHA1 b82eb90866a6487ab36c0bc4192770e34fea5204
SHA256 b90e64faf8f7070ed7654aa38b67fb92e4901d0c5c208d6693e617a05ea50cdd
SHA512 2b883b56c447c89729866a06782cf9cf7a106ad1e3995e4fb527cb3f77eced06b24278cfb872f1c0970f4065e7eeb7b510fafb1e4fd61dc7870466d19ea7077b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll

MD5 9535b43609bdb50b7dcd2992b4dbcd4c
SHA1 23ab8b91b13161e004a2648101d6c140d5022907
SHA256 6bf08acecfce06b0abe81bee7697288b82a752d639389a103343038da1ddcde6
SHA512 2ecf56c4a9ae26de652207502ac2bdd18e472d486fa7571d282ed29fa9b6bc99ac55a3bcdfbc4091edd3e4e082691c0ff7a2ef1132608a3cef7352dbbcf37a9c

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

MD5 162dbb8f9e8094974386ce32d5945ae4
SHA1 0240d71edcd988e72ec9f8992ba223a6eab4a8cf
SHA256 00b907f0d2b78c55723f9e2d65361d1d8492448e0a38959324f3296b4535f738
SHA512 64d4b6903e262bde044578ebc9a11e0b8111e8007a394c7f6606a15bfcca1200505d9d3f41ac150c23be603b115da3019cb16602f7d0e08308cc3bdab10735c5

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll

MD5 e217ed110430a90e03e4e8fb907ee363
SHA1 3cc4922015e4db0b42661c9207826e91b5798e41
SHA256 a385caa3636f837b1bc00402ee7a75943ace4f241ca9d566cab9937c228c302f
SHA512 d70a479a9b585ca35efa101a52bfb7e42b5e13bee982a50dca87ac374699d8e2ed13af8a8ef2ed2452a4fb0feea6ea810b75ce923ceea396a9e6b9337ae9b20a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ucrtbase.dll

MD5 7a0c5477005e35574b57021eee6c65aa
SHA1 a8be47cb95a5de7da68ebc52068b0bd539803348
SHA256 5c7c8542fd0a0a59bf31763c4d6197d8bfeb79c5a2fcafdf2d909c018de066c9
SHA512 69e9760ed00eabac95c094ff3617e7d667d5ff3f98d441469e36fd07f3f04ed9c6a81b4e0a79350760c1c8d1f8b5243e209b0e1b163a35a06172a0f42d463c2b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll

MD5 dd79da26012dca21b990aa341b377dad
SHA1 7d214f712ebb98ab6fe0564772882fc68cdc05ac
SHA256 0b56723a19caba8cf201d714707a17d0449edd10d528eca7757025a5fe9927c1
SHA512 5d705f133fb344e7d31a25347baf426a9977fbe7c0aee317aae1c1b5d3d362dce318cd498c3b896b3d7097b2813885c962aa01eb591371112dba827c84983dcb