Malware Analysis Report

2024-08-06 18:38

Sample ID 240530-pny8wshh46
Target Rat Testing.zip
SHA256 7d0608d6ae56de15aa0acc4942e7f2aebd232bba4e48d867bad9ce46776b3fd3
Tags
limerat xenorat ransomware rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7d0608d6ae56de15aa0acc4942e7f2aebd232bba4e48d867bad9ce46776b3fd3

Threat Level: Known bad

The file Rat Testing.zip was found to be: Known bad.

Malicious Activity Summary

limerat xenorat ransomware rat trojan

Limerat family

LimeRAT

XenorRat

Xenorat family

Renames multiple (3426) files with added filename extension

Checks computer location settings

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Creates scheduled task(s)

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-05-30 12:29

Signatures

Limerat family

limerat

Xenorat family

xenorat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 12:29

Reported

2024-05-30 12:32

Platform

win10v2004-20240426-en

Max time kernel

166s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe"

Signatures

LimeRAT

rat limerat

Renames multiple (3426) files with added filename extension

ransomware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\PresentationCore.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File created C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OARTODF.DLL C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-checkmark.png C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationProvider.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\eula.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\sqmapi_x64.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-heap-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-140.png C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Windows.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.StackTrace.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\WindowsFormsIntegration.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN120.XML C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.Primitives.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\IpsPlugin.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\WindowsBase.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.AccessControl.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\wpfgfx_cor3.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ca.txt C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN121.XML C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-file-l1-2-0.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.UnmanagedMemoryStream.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msspell7.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Input.Manipulations.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Excel.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Private.Xml.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\Microsoft.VisualBasic.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\OSFROAMINGPROXY.DLL C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\ThirdPartyNotices.txt C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipsar.xml C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsFormsIntegration.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\msvcp120.dll C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1476 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 4228 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1376 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 3676 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1476 wrote to memory of 1424 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe

"C:\Users\Admin\AppData\Local\Temp\Rat Testing\Lime Rat.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x100,0x128,0x7ffc74ed46f8,0x7ffc74ed4708,0x7ffc74ed4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3688 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17104452372438490972,18222152333612931180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 3.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.4.235:443 pastebin.com tcp
US 147.185.221.20:3069 tcp
US 8.8.8.8:53 235.4.20.104.in-addr.arpa udp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 147.185.221.20:3069 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 147.185.221.20:3069 tcp
N/A 224.0.0.251:5353 udp
BE 88.221.83.184:443 www.bing.com tcp
US 8.8.8.8:53 184.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

memory/3996-0-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

memory/3996-1-0x0000000000D40000-0x0000000000D4C000-memory.dmp

memory/3996-2-0x0000000005730000-0x00000000057CC000-memory.dmp

memory/3996-3-0x00000000057D0000-0x0000000005836000-memory.dmp

memory/3996-4-0x0000000074FC0000-0x0000000075770000-memory.dmp

memory/3996-5-0x0000000006500000-0x0000000006AA4000-memory.dmp

memory/3996-6-0x0000000007730000-0x00000000077C2000-memory.dmp

memory/3996-7-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

memory/3996-8-0x0000000074FC0000-0x0000000075770000-memory.dmp

memory/3996-9-0x0000000001680000-0x00000000016EC000-memory.dmp

memory/3996-10-0x0000000007F00000-0x000000000842C000-memory.dmp

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

MD5 07c5d2f7f9419c6855a44cf8e78ba0c2
SHA1 7c55a1021777164afdb330b8969c2cba7f54a1b5
SHA256 5161a6e7a07bd54cab5bc0c488bbc80e8b36dade240cdcad70efc5c965194d29
SHA512 982b031317a66b7afa14b624e1499f8939f76afedb40e05109b11b842a3e99605a38f7f5862bfd7c0be3a425434b02ab31085ea20533aaeb6d868c309a9acca7

memory/3996-1439-0x00000000012C0000-0x00000000012CE000-memory.dmp

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

MD5 24aa0e44647abb911198a0244b3a2e54
SHA1 860eafcb0c3b131e80a9f34b15da0bda124c98e6
SHA256 e01877f8ee218f0c2f5a1dac143e317c84b3e2d012e7370b056fb8682b97f228
SHA512 0c31d959f5944347b9b841ab8055697a3aacc98c6c4879d84301e1b95bfa3f2d1e77e855278545d2ccab86b60ce158cd729570649f30aabc9f4be7aa89924ecf

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

MD5 e060653ed54e367fa374954302ffc8fa
SHA1 0e8e3b5c9addc951bb83682ec9d015773e800a32
SHA256 8b186e239b4ab970e8accde0af6cbc64e1e7589272b30af6232e9b680ff9313e
SHA512 294ce3d39d18a7acce54e471aac6e8117cc215a3faca04cc5382b79d79fac70b810fde9f9b48df7a406810c9bc889eecc09943edf68dcc0f4f6f071c0c9cc67c

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

MD5 b4858fe103f9b0bbf2d41dbc61d24aaa
SHA1 55d1cda12c6b0bc7dcfeb81b51fe579d10b1eb96
SHA256 bb0ebee9295844d6ca444803a9e09a7cf7242710fa722e6166bc129634d58286
SHA512 e8878ad15669af20d99bab4331daa2e269d62dbf5a987f203809282f0c17f51b619d61c570008480141e90dd1ab8883c94bc2e8fe1b1962b5894e05704a7b7a2

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll

MD5 d36b303dc4af6b68cc4ea6dd0137c367
SHA1 0d38f8e44d9473f31301b9b848ab90766cefa123
SHA256 b2cd494543efc3523358b21d5a651c25f577e5ff38c9ff3b241b0f1cfeb979bc
SHA512 1aa1f0dd48418cdac31e179431d2c992210d1028c3a8a2aaf88ac4dd5078387d134aee973eaf5e97406237014b3706268ced69643a03576cd2b54cc809f6c761

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll

MD5 b4ca7305a243faa920b19701a027c37d
SHA1 222b715af0d6b2c20102dd92ca309dbd244e8e11
SHA256 340fea0b8920e986136f452589ef75dba9c984209fe543a63a04a27dd561cc4e
SHA512 e0f3da029765d037a999dd9929b9c0c783c1160c8701ae8ba52eca053a2f0235f55389bdf20dfd2e08734c3e102e44f905c25f41f2b29c37a132da9e6b76ef60

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 7abf6a57fef637b8227850b77e1e6f41
SHA1 4a88a864c54ad9ffb1d50528912d61d17728dd95
SHA256 9560100d38052226615934945a93fa3cdbaa70464971d4140954ae0bdddd9e5f
SHA512 4264bfef89d8ff3749fafdd2d2e2a6e0765869d6c5d5a1cf78f56599cbb356cf327738935ee3c74b4e1f86b60492e5bd4ad3f894c77fcf85460d5a219ef5c9a0

C:\Program Files\Java\jre-1.8\LICENSE

MD5 9062823290e9bc31ef05505bac4fd378
SHA1 b2dce8c82ad5ecd9df6a59250529acc272538414
SHA256 6e737a09e80b6cd505301f94f50855e082eb0a1a0a20b6731c024022d1226ce3
SHA512 e3c54c021c6a0198e6af7f0b8cfaa84c36a17dac5ff801984af3bde6b59144e1313c52df028e6572d6841621c716554839613ee787a20000d670073761e8678d

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 46f3b8f83d1b2d24e8585da7de24d11e
SHA1 81a6d813907c34709bcf950ba8548f92da3dd0df
SHA256 0e8b4d0788ad8530535d23f23232c537146174bf36693ff6a69122ce9c2da7f3
SHA512 7d402c6dfdd193abdd6d143f97145298418bb3f0b03f05f0932fed12a28ed984d90e7783fe94f65b74683924a8bee59a982dab918e2807e44eb7c952ea32442f

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 37d11983a568f7a70674a75497ef6be0
SHA1 34f43fbf97719aed3749384f54d9f7b846f28537
SHA256 793964a8ab3d972a0c0280f1f0d97bdfbce78d6bf9ff3b4cc14c2593a8a57993
SHA512 b2e221a76468e8ed44343ff65ae735b83a6cccb4245cb2e06531bf4d1086e0e0e2fcefaf98e39471de9a447424ca2bb6ca24c17b80c17033b636fc7e9180bafb

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

MD5 19e1de9d76847bd830e142a58fa439df
SHA1 93f0fec335a2b82adab0862f3a12d52a3503c6b3
SHA256 5d03f1a5eaa46a689e739387eab1cc2166d2b66cbe17bb1814e687989d962298
SHA512 20e02796eb6a3a58c1e95528a8993b28764b409ffe80b07ed6fe0b8a66892eba1aa8708ccca0badccc934bbc6d1e17a067414753eca4b6648d7ac1977b80d4fa

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

MD5 dcc2bfbb58e578ea4a4fd62c56448116
SHA1 e1ccf875452143ccbf8c16becbcd970e6d4dab0e
SHA256 f2842a5fbcd5c25d9ca3369ad3132b562267d3f6d31c4d149bef960ebad59912
SHA512 fdc1bd9b7d314acf5aff071ca7b3c3e97e38a79039710a97985171e7d363ff53f1a51d313e6b4a9fbd4540969b121769d81ff58e23741146dbf880c46383f823

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

MD5 f7835aee1609ae718e277f83f89e6daa
SHA1 497b74e6977ca402133b9bc905827482cfd583f6
SHA256 bcaafa50d2c3b4201b09b831ebdb60a8abc0103cfb8c4def2ba4e380b846a44a
SHA512 e8d66a077d7d862e5928f45602359bcd4c3f8e1bb76541e8d327d95368399000fe7a17bc376880bcdfd9112b50f4f76c6885c89375fc228d4c4bd556a67c2757

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

MD5 6f636f5548ad1e244e2c513f2774f5fd
SHA1 93b117f05339ab8d7e0988a553d8fad6df63b861
SHA256 d18175eab96d0ce645c39686744271e67f42e5d156c511a672ff9bb0173f34a7
SHA512 39ea852fd9a2b1446a2eed83a18a9d8e01259bef57d78b57542b3fb3cf92c45e23e6d77e716b4ac600d825af553e0f769c57249fcb2b349ee59e2f6895b52947

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 c4ab090ea0b84782b82a74ce84f16ed2
SHA1 9c6186a023bc9f49ae734de118ce372d565a0be3
SHA256 bf01a4894ab07aecedafee69f7a9fedd8a1b7efb0f36696d49164d6ee4033a35
SHA512 feca4ba3752e7a8994d4873e506014b6a52443d94502569ee8e48774c826fc5edfe44e6b0e6829a80f21f279224719d0a1e9df675d5995b0d24ef79afb5e0b93

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

MD5 bf8ee0678f92a076b0fb782118c76bbf
SHA1 818c77fd9e6c339e847d1ba8bf2b1766a19dd16e
SHA256 4dc0c36c0364fa01f6550ea8a3b1cfbdd66bd3636ed329b70f1a8c03fc2f64a3
SHA512 93af491cf40f116ba52381dcf8335b75850daf2dae4b543d45964e831d179e0a1f5a6a4423ee93d51a57f408b607fdf4826f9b4d951d6d3d056e78f9914d686d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

MD5 0c02764c386cc5e2d131a3222a0d601c
SHA1 a7ffd93fb39a1480b71f271d801f07a43d1540cf
SHA256 a3436dd6f4dbfa682a26263435ae8eb1f2b055ca9bf308ca5625c596e4269b3a
SHA512 ba66a941350833111d36e59cb5e48b302330abd74a545eb3cccc0c12ad25531334516bc25262ef16e8396db0f809507cbc92c2357663a01f9c12dd72db3068a4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

MD5 ad80780de406dfc61a3587802ba92613
SHA1 1e524b1a75ce1de3619ca94cd4db196574f76c99
SHA256 fbbd23379ee1cc717da7cea274de6ebb9facea8bd27c4b8516b90b4d3bb0b217
SHA512 5ed97706bdf8cb76e503909128fcc87fa5f30bd026e7bd85385d3ae706ffc5fa02d278ce80880fea529cd0b78e4bd41e6896b97f6b19a8350db8bddba07e15ac

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

MD5 656684604cbde711d344dc720650eb91
SHA1 0e95e3bfcb5b83271d59fa945a7008311b09a680
SHA256 b115051bd6a6bbacda1204ea217fb6ca099f2a2060731bad212a16455eeef22c
SHA512 0b6dd975970d174c03f97277f96048ab5969e9a82a611b6a2d671dfee55e2bf446163031224b126da73eb102a095460a46ed819eaf23f48f5361b3c27aebca48

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

MD5 1e48c8a0e7b492332a2b4b5c0ce0941d
SHA1 bdf6994fdaa24a96619208c3faeb151893808817
SHA256 f5b2816ad2be765624dccb57f7d2b1f883beadf04b87f597025f161706d933a9
SHA512 7613cd334b08b3b632bdd8f455d16f696fee4103cdeeb8008fe28bd66655722c077c7f44cb9e75b6c875fbe5178f23f97a0f1698db39113ee7c5647fb473f5d5

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

MD5 b91052a2285c855f44028850c1dce7d9
SHA1 d35019b06ab05883feab69f2eb886d3126ff3085
SHA256 24cd69007158702ad38138cce6de3fc9f3b8e7fc6516526b3643d06b427c9b98
SHA512 d272984a13074c92e9ba8f35c5e259674f7c21a6ddf354e794a196a06c663cf8a08a96c77e5cf85c5927a89169acdc360e1ebfa7b39b8478fe372a943f03c82e

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 926892c5c0dcfe0ee45be0055695ffdd
SHA1 080bc05016d31c1f0a8b9988b2db825190f395e4
SHA256 804f8c7f888321e5822d54e68d6d477587b72b4f0d54dc2de4ed05cd690fafc7
SHA512 6398c7a0020916bbd167a0d9c39e8c2afb8a1754d22e9a216376af0ddc649463fe69dbbcf130ddff8ba64a3361dc6b1fedcf113c4fa28d990c70587da1664cdc

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

MD5 31ac0e2c79b0651b29f79ab05fc2d68f
SHA1 82cc24529a89ebf09a3f0bf7de46965fff8e4e72
SHA256 bd17b787829a61075f4d331bbadde9c21a95344489bd879cf58152c6ea1e8a89
SHA512 9127fe8216ab83dcf996a782367c34e7c1a44dcf3ee59128ec34d91c5fe3006d5fade19fefb03b7bbe5bfe16c2ed0ef03b55303408df2ceb0e72f741c94d4227

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

MD5 179560dc100db43e0f26944e8139d1d5
SHA1 2a68cdf54f5c95d460a91221ad1becf06f6b0d1c
SHA256 1eed2784b88ef46b79a09a5164bca356fd5f7d1cb3dc8f248d0f8f0dce36944e
SHA512 f8aa4a32d19720a324f585de2a850b277bf66cd0fe8540962f633de0001b699de787c633ad9d7454c455a616e0f2f4be90d802a0798d332585b1105357a5b1d7

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 ffcf145288e8f5c72a7f0efe65b5e07f
SHA1 45327e4e71332ff0b1e7be7eae4d361584c41ccd
SHA256 9053f945579396da764ae1c44a5ad46e534be34162deb1f394923690fa4fc39f
SHA512 926d6fbecbe24ea669665313cd995d7810bf1cc961159d3b7d97f838f9bd67ac015c73072aa35b1c758654d35d40e2eb6a2f92afa99b0846b211ce7708ad6629

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 e002b69feeb962db9e71ecba731b3c56
SHA1 bdd22e8c3786496077536001149f7477b20817a5
SHA256 c7dd91199a5d3b455f77b968b4c1d6829a3b7c1e415e6d305d0e1a2bdd832504
SHA512 7335dd90e84a9c6b62f6f9b5f2945c211a4de38ffedde8e0018f998cf962ee8dd02eb87b1ac8579fe6a084a483c671796c1156f2c80385d60ab5c1e58f2c4fea

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

MD5 cb773a4ddf930a892cff9dbc4a7f8208
SHA1 c0d1e001c2d2f449a861877204baddd1695f396e
SHA256 6982503f6fd552f9398387f6de99805b31725e951f7d40af6775f882585faf29
SHA512 39bb553c85b29a807b55238ffc94f6cc3834bbf655173e3cc419e996c0abfa9c79d1c676536e168cc873beef87f518842b23a49103cef223daf6d6c7ac590bdf

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

MD5 964b1ee838a87077d0865bfaf210b9a2
SHA1 d4b759f425d7f7c8f6d46135dc53d9896dca053b
SHA256 8ff755dd5193e37fd7486e6f037623123a8208d8a11a6347dff3124af7b5c126
SHA512 47febf3594d18fbae1b7a719bb3027e0a3c590290996a4c7b18f59b20d2c4d6cbf778e4bf059e70f2aa4979efb260defa38bb2776d56baf8e4453201c4d9208d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

MD5 5775a8ef9fb0870baffb4dcda8fc5efa
SHA1 d4a590ca7b21c0555d8d6d44a38dfd717a82a8a6
SHA256 36b92fce7eb749e6042bd63d94e372e2e496c89aea90c9f9f4540c50b38811ea
SHA512 61d348ab1b6901eb38ceba8cecf6e0bf0e885aa123198a22ab9f487ae6c51080a1dad7b27a6fe1948773580d7d4bbef6cdd50a1c9a9b6da4c0abf7cd0ee56239

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 252d1b2ccb43e3c01c4b48dd63f1c4ac
SHA1 31c30f871f18b53e74c505450512091c475a9261
SHA256 6fcaed215b115ccb0604c070eac2d2f4615f560c01a54b77759ae61db8fc41e4
SHA512 d2659f0464bdbbe170127e175056a2ac975f150685fd1f3650ca7f1b69f465d97632ae00e2f053bd9ec16097110df3069f5313df395201193172877e2a38b694

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

MD5 edfbee84b30bbd23799f61217a301646
SHA1 6a7414752f046777e7adf8fcf57b6e98f40a24fb
SHA256 5a7c33647a4739e32c7f633f0e331d72017c2fa3e491568603c20e2e63d96803
SHA512 a911428875b464b79154133c0ab53ac40f99275fc5340a8615bf6f444bc040dba24e5eb2467c526d0c780103d93d487a4846ff65fb105c548836f72e60e935b2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

MD5 d7cde22dc3c6d6fd580ab3c3522d2895
SHA1 d15f56c6b760e78ab0379a72d4d59e31ad7c31d4
SHA256 e517295f0688f06659b5fd8d40ea457209a7332d5e7930128ac27eb45758eb09
SHA512 5e501dca3b27fe184871961aeb930a60da8712f55f2174daa37fc52d22b064dbe4d4a2bcbfd0bbe4ab5ff35ae0f49c5cd49d129596fc3d0f9b1b090c9417a08d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 d77fffc9e23ae76069a2362a968c3bb9
SHA1 0098a4488386f68e1be0a292bb6f07888af76ef2
SHA256 b960087953395e45e06782908a85cf7c4c987042620b8a7ddbdaafd53d9eda3b
SHA512 998f9f3df9eca0363def3f5b31dccc3ccad59204f3e71a37412ea6bde76eca2e3e37b6aa302db91b4aaf38074ddeee6e75c1785e2ef83a737f4d74ae32756f96

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

MD5 d185df263ff9b14bafe964f955f211f6
SHA1 a941769e6cafd17e24521e3b1a59b5fb9b67e28b
SHA256 2b11cbaa4510f714c6cbbd70e50d4d9ba44d44317b6f4012782184c3b279b05f
SHA512 dcd878fa46c2deaa364667bd671102e2a10cdb203037d608d237d8c939792c121a2d655cd6a73891c39818d2eaca5051ece27a244c1d86d018d4d09809ddf8a3

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

MD5 a44d25bed75f515a1211bc750d7f9a2d
SHA1 b02446ebd3999fc8cc9ee2504556865fe5c1bfa6
SHA256 d8eab44568910546476033fc9dbeb9f768bfd946873cd98a99e99d9bdae5e14d
SHA512 2beed84d3b85a9cea94ce0ea6cc3c543989b54fa54f6b74a2acc21199cacfce4e93ab443d9b6dc379141fa638f74858889b204ed02a236948b4a8c70420e9263

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

MD5 e076bf964176419a935cab589f6fde98
SHA1 46cf4fb41f63dbb26f93db1e0d463fd11ee90c74
SHA256 9b6a629a40da9014dc69f4decc286287639da392112f87ab5fa43426a9c5886f
SHA512 701ae13071dfbd9d2884786931abde5eec95807edb370865f3a1a0a6be36c06498c206675f20b9dd57aa7a12ec78af0c45c5636694bf72bb1682ec306ad57b4a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

MD5 47c8eee0aab8e58845897d97539b7aee
SHA1 62ebfa71bc3829b5c47860393b314c46f00fc646
SHA256 f051c26c53ed8c951bdaf96eb320b586283f7e9c4ea3ebd8f7fdd880093284fa
SHA512 5c9e51b32402406da7d7a1d7a002093bdb8e185970fbcd2f0b934eac56bf1b9e12ee737557b6b6f588f9e7c9c2ec7d6c3d894315694bc195c4b369bcab76d58c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

MD5 0116d18ceea57ee9deae10cad82f67b5
SHA1 8a5341db0bfb84002ab50b201100baf763b30542
SHA256 ae90b8522d8fbab72c81a52e40142eda8fc3384aceaac53b8e6b2c93245c3c63
SHA512 47f56b4484315f7675d778504384f0ac5f517f109eb959546ffb4dcad41dd4b07d498f10b28b38e13ffbd7662bb7c68c0f9022b14981750de0ed11e1598c1f52

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

MD5 10910ac48f23c5b159dfdc8600a6f008
SHA1 a71aacbbb78e69780ccc27057957fd9947f10faf
SHA256 96e91d199f73d6bec71b58c1bd81e9abf32de6905425d3d236cc94d1b799f5f1
SHA512 7615b0fe6e9bba4705a0ef98cab659bd0de280c71a4be578a609c2e39866cf553bf0fb9a90e24a18617388cf102b0d9a6fc2bd6b4ce0cb03a728f66aa7c87bcc

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 991a98898cf4df4e8ff050a10ba553c0
SHA1 800b4e5bf803ede649f196dc96e11c880d46fd70
SHA256 699b5c1240004775ed4351025a4c85f4ea8de146797b7a0a024a1fc868ae5269
SHA512 369e2fd6539a1b0f2ec6009e86c4c426ecae74b2a065b969490378b6f1356a7de447a74ee6504bd4a7c4d552349ce606227edfd24ff084a42d7a1129c736171b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

MD5 21148d89c86dc1be368620e84ec9e512
SHA1 3172916dbde8e629916e617e9ca795cd54eaa0db
SHA256 4cb2603bca7abda4de6965697d0f9ac253fc038cbaffa139c544f7ceb3509895
SHA512 69a8ac48e56e9931e202717273379213200b9cdcaeb6d5066cbede1ef49043d7839d44f35b81f9dae68caa472f424aad76433a7d522149e9c55a916cf784fdee

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

MD5 ba3e40704a8d023b6bbb1ea1a66efb84
SHA1 3c843242a81d7a6094ce1ed3aa7776a49b9523c1
SHA256 0760b3609f4745e88745c3cd41059858db851c4ad80446a706dafafc15cdf090
SHA512 5838c9d6451b25429311ba41ccdef9398e693c99c0a386a24cdcba8ad266c4daec2dc7ae293fc5b9895d12c890634b3910cd9372a1cb4faa61c69391587cc024

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

MD5 e8e695e24b84af516da8c3909d322c7f
SHA1 594431459cf26db6f68a254cb598966ae74ed342
SHA256 aac1f00ffe7b5bd7f24f1b0bf0fbd4e1a402c732f3a9a0f0da6092e48e55f2a3
SHA512 b517835017fe5307cd298aea46576e11aa4ccaa6200bc3dfc2a08fc2cd46fe7297e05d4db56134e5ff9ffff9d6c82ccf0c63aecfac01d3b23dbde77a91456238

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 3ffb4a546e1e5aad2f3d0d99dc96d48a
SHA1 c3f21a59b3c18fcbe10752f915d5cc1a48691388
SHA256 565667bde9e6d1b90c2bb5c453446204683210c933c8cde6768353609f372fe2
SHA512 90e6ef93c714ed26825cde7e2348bccb4e20e19f347c81f84bd089060f86b69656b2b6e915ecd5698120cb2c3ac8b8ff02cb9166c9494022cbb1fbdba31cc7a7

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

MD5 d33ada42195447d93cbaa719e39a0dbb
SHA1 9beb31212feceb0c1a3c5499c9bdd49bbdef6cdf
SHA256 a5fc4825dc762a71a02c4d650e7a88cf9cffca87733d10b2eb2221baf70cd9c7
SHA512 5b05a762064338eb5054fac60de53b7483eb935897d712d0971e22784a8acffe61135c7548acb8704c16472d10ea9506d7e4fd65d761cbf9f6dd75bc11336aed

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

MD5 36291305a855f5d8a00a576ee23c93c7
SHA1 af4f8a06d1e5de2716884864bd5861c3c306b868
SHA256 b563fd3a7e11744907b970f268a54619f0edd9518f458945aff355778467fdad
SHA512 322c6791d39f3ba918552d7a6a6cf59cd245c58fe904970dc4cf8ec299b45dfc71630a60e4039492ed01e1ee031de6bc0cf543a0e10e573b6b9c168ecfe3e805

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

MD5 a61e0d97590f7655851d0f39e92ac341
SHA1 0c6a2e46ece890f46d432c99aa981ecd876c6a0f
SHA256 cca2ad3a47b45377b600baf27335da06dc5ae9d71ec283265d1cdcc129909d3f
SHA512 035b21477fb3274e3255e7f3db5ac95668ca2cfe5e2bd29860559825f29dd0122b01dd330f258a04bc8c9be1aa3d6282848aef98a8de44cc1104f3a021bc4a5c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

MD5 dca227d445c139e81cdd699d7f0d1b8e
SHA1 eaba344d475715325ab129dbfa6a975248047361
SHA256 212038b3fe43e04fb1fcc776a0bffcb18542605f27b2cc4a7a1a18f5d2953d7a
SHA512 34737b4f42938076b2cf0ebc343d6184de86215d4a6c39b73fc8843b9d18e96749ba76010943f7512a35fd5e964fe37fa4964607a355a52a48387160a50b9a4c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

MD5 2e118d26462fc7135914613f4cf4f980
SHA1 4f9e9e6c85898adcb5eff26f22d8d4bcce304651
SHA256 4da8bbbf399e6a0733324ad8297d9eb63d670aed1d0d8ae0b932fa4e314a4750
SHA512 6c58bcc3dcabc92004d50850ba60b921ce5fbfa02f1bfb80c249253cd1c8d39deb2dc9918d4202862ffba0fd87bfd4ea32ecd70a991f96717e63b9f53679c31f

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

MD5 10b3fd605dd523d54b6a5a7bfe5b3cfe
SHA1 7f0bb165f91934addd50f024783320c4a037fe68
SHA256 5df6263f37a4b6415a881a4facaad72ce0eed2014e5cb42f5aefc494f9561d49
SHA512 d056c8fed7f1023d26caa3a5b83e398040fc386f6341f9a08aabcca7fa2a201b2411d10eee8a31f78e94b428540074b9e6a900a2fd4899ef36ef08b3188ba67e

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

MD5 fb52403eb6ddf3e9f37e16fcf064b536
SHA1 3bc5daf54a3b72fe4d1fe1c34f32a0beb74b1f2f
SHA256 b5cd89c2b8523d5aacbbef7b50d4bdb799de5833ed8c4efe64c93ffdfd010f21
SHA512 50d1102c9a67539f4bfba7906b5bfebf8184bae80c248fe0cb962fdfb8d228129b518639899605cb73477877da1170f97c7e6278859c663d80646358c1732a04

C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

MD5 5dd8ffb5880dfb7cf5aaa7220972aca0
SHA1 7bd4a4818deaffd387f3551682862c65e911525f
SHA256 2efa1d95e5048728cd4e2e5d268f956420f186bcd849f7deb375acf623e9fedb
SHA512 c3e04885385766aa54281248d601e91733e1e89c282d70e99b1c93b68d0f9dd5843ea5425a304c8c0a20067e8d9bd1a7f1a65f2dbc720fe97d4f0708127a814c

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 98662fc2f848b51554202e48ccb92895
SHA1 d3398730e2c2509cf5daf5e2d1d645319906dfef
SHA256 1fdfb88eeb61cebab3ec5fddbad7d36c591cc12eef0eddf31d31cff948c66515
SHA512 fb300d407e8e1d37a8c9c6dfc2d9806bd8ad5ed54586e53cdc7ab9a6e103274037b68785e5b75c6be6bfe4eba18a059dd41c6b382669bb246a33f081ad6a8169

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 bd56c58264e046498e2a8d13e3311287
SHA1 bf429bfc39d25886b8f27eb8a9eb31d7653c66f4
SHA256 d19914d8e0fe01c270054bc2adb9a6ae3d5888e7f4dc86013e3408bcc28b4c10
SHA512 f6a39475a1279cb9dafad116e9c7e4da114dd87e14aabf8fe24f03af8b1e9afc4619302dfed04936e24bc73fefed015a295eef73f634cbcab1be5d81badacf6e

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 6731efd9781dd5951a06568aef458938
SHA1 af9186836e3e6a30bd85fc95b9db2fa78b068364
SHA256 5086e00c5b220cda45a4d753a90c164a6256853895e90b7d1ab21231911aeaca
SHA512 be25bcdbb19cdf036795e1a22bb56c4b215ca074ffa7d8d4e2faf1e7b976b8d95217ae68ad374856d5aafea056dfbf492d5234f2c1000c9daae93700cd10bf39

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 ebed9636a40a2e9cceac8cc2b1ff5136
SHA1 785fd1ac73e9e979caa349fd503eb082ba474c7b
SHA256 7b36bfdb893b5aae1ba6bba4f83a24ace8aa9eb267e18fba626eb5e2b144a68b
SHA512 98d2046aa0778001eee11bc9f7791a51b6d4e15c6251fd6028c57b99abac76d136c225786978690fb45f73310340502aa6399d6478f04324d952b814b7ab9857

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 0b4ce8b465985e25650d61c228db4d7d
SHA1 e7d653a6d8954f765d2f488cc38cf0c3c515285a
SHA256 4dc10b43254816512a950b0c446fc229bda640b2b2f888e846ac641617e449dd
SHA512 a46b18484d46097faef3ef3b10b94fe5c22071f0975e6a660844f64fd6a3122193b27ed619d5fedf27afe0bcbed97e3915f7368ab41e1c8ab8024b5f5457f637

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 a5dec396a740ee0c42beb68f2758cb6f
SHA1 bd7a799a90bc7d98d8521eb6233e3034ea4bb202
SHA256 eecff046a33d73dae3197282f6afa5b816c1d4a8d50c66f8c34d4c43c9303a5c
SHA512 f2372347db69b0452f01e114d98bc8dd2fb7b952588f092b070828806fdc7e965b1686d20f81cf1a9da10e711893e5e5ad1bd32eae69fc7c7d27cf4385876bfd

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 ffb536979c3fae5afaa5af38610af01f
SHA1 cfe5dc37082580967b834aa91f27b957b31f5877
SHA256 69664cbf5311e192a3028acb281e917bf344c17ce3a89dbf9fcdee42806ef068
SHA512 4228e1358e0b3c0b40c89b505c1212059c46bc4890c669469383189a35088cc166c71b99e53f18ef88e8ba5dfc0b8a3ae512f37031a6a7dd441c428da8ca876b

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 69f189998e048f30594b952be119f12d
SHA1 5bdad78a225bf17428a055037882b193fce2aa19
SHA256 00806e3a11a9a848c9229c017eaee3bb059283e81940c1c66c1edfeba1f55148
SHA512 02193e40a0d852715df7510f73a7b64bd7e9da692d60d791ee2c4b1488fb9e81d318192badd3833549e18528cab2afbd4a7a4c3d3f7d8cfcbef9b664bb3bdb15

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 b300ca0e59213220caf76720fea7ddfc
SHA1 fbabdfd26fcd9ff516fbffeaf5014790b940a308
SHA256 634a8d90bf371861ffd315f57fe59acd85c9249a9314e653427620fb523c7dca
SHA512 935508011b664aa803e9b9b2289dc3df2f61bc70b8ce27b840f73f8a35ecf11de0e1cd9c3925bc94538b9f963af11bf83929de9a7f7a71b1a8e95b761ccb1d48

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 4c568a1b434a0aebbe6441429246e35d
SHA1 953c4fe55729c6f1730fc531e207b2b50ca6947a
SHA256 f08b95a716d864c91482e4f4588fc90f70aaf8470c92664039d640d3cf93971a
SHA512 ebd448100a08cf4e9156523d170eb33588e254c2601892d54e0142c12cd380c0a2625f97964854fb6455ee86a1e490fe3001b221f584f9f6fc99023897d22ff6

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 889b8fcdefabe717216c53d40c2239ca
SHA1 7f6b865fc7bf2cba838c2df84628be29a74d3255
SHA256 051cbca63b2af3c740375957ea4b6b810b592b5464df6c3bde64f6b122936a06
SHA512 8618f3564c9cd8d4b02c4009bd491563ca2db14f42ba8154cea16d7eb20706a6adc293167150de5dea7236e801bb85970aa83e91dc66bca3049deda54df60486

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 423fdaa17a20447133394a581380a17a
SHA1 f85502f7a6c531cdc83105bab9605c7a4f533a57
SHA256 86871b0f33b812582ce259dc416c2470cbf660bb728f4ec535de85a1b8c33b60
SHA512 132844ea4882125c49119682193fc521b6c0b7f81c85a4a9ce94f954bf7f42472c7a212ba0f2a406b7b33d9cd0082cb14fc69a6a2eacb75977d8cffb3319e3ab

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 a87b91dc5ae9f0dcfd8eff5f7c64c211
SHA1 69e842fa7388aaad8dc1f45afdaf45d777ad162f
SHA256 b384151f1ba4ff6531e74ff08714733a00d7377277483b180b3ffa2598693267
SHA512 849560a49a5eafcfcb1b9baece107a422c69f0c4766d87611f319f2c631668b086e770909a9e84f63215757f631a4302ed15be0d959ce20cfe14e1f3678e3e0c

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 2d3f9b8d1a6723973804aeea7b9758bb
SHA1 f38e51434cbe53172e8c6f2e288ec24edb7fd9e3
SHA256 c44effc13a572d00555a1b1af23dd82d06d97c5c5b07c510b502aa7fa99dcd1f
SHA512 2a11cc63019f011a20f2d631ff609ddf60f1575708faa9f1fc4c17077380e0973fce1bd61aa4ba09ce8f09a536e753549f14ba3ea13e0b4e87359e5aa44536ba

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 269bd4ef1dcd7961ca550ee8887dd267
SHA1 6bb99ab3a9f2eeed67bb9b50f9d90fe88a4b394e
SHA256 21edf7c0382d053d69469c7398ebabbed07e97af57afbf582a3fabb0fa645d1c
SHA512 f660264c9452902267c781f8430969c794062e1c89de1486ec1d77de3036e2a1c92b55dff35d5f77d2e31a12dc71aed5396b0856989c737eb7b0e69f1d274cee

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 5c6a1c0789c82c6cba50d1781d8276f8
SHA1 a7fb64769b1d6e4295b2d2045e4ebb98576ac191
SHA256 ce7e13f382390903d892e619bbee752e55f19d5242c79e6069c7591abb20abf8
SHA512 0a0bfd68bfdce3f4ebb81ba635e3ee485e3e63de0b18b4acebf2ea371317814fdb894a3dc595422b2a61ae57ca7995dc9af7f779c68be5db362ceeb719d2f2cd

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 cc30fb85357fe731bf1c8cfe291e2ff8
SHA1 7a39515d3dde4f95e9d6973eaf8604b2aac53b71
SHA256 765aa70fcb67fbf7a737092b3b2c1aaf4f37bce7391c2346907e8ca5930cc71c
SHA512 5633f9b81dadff1350e1989335826905bdabe2d641952e47134c579a88fdaea45e98c4699179c1d0fabd793ab3afb6ed76954307115b27cf0b1ec0f68badd4b9

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 7f306c024b40646918ca074a2633e7e4
SHA1 4df316adb6e3140f8e11bca5bb21fdc665af8748
SHA256 40f2e06a7960d83e898df6bc67823d067a3c559b428d46416a475187a52a9d7c
SHA512 42eab17f17c97af3edd252fb2092dad83e3fd793b65b510acc75fa0a3d0d93d8242237f42246600ae51609876fe38254a88ed9ec0efcc4ee052e8873e507d377

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 eeb064c71fe4f7d107cb6e1637bd79e4
SHA1 846174687c2fa0cb637c2aacd79a5901e768605e
SHA256 fbea11f141ad211ef5fc47c56a6da16c0a391a08d7dd0c13a5454c4df882be3b
SHA512 61ac15d3be46cb00bd4a27f5995d8d50cef0190437c96b78f906a25dd256e420dfbc74212b8c8540379df493601827e5cfb1b235e1b176e2f82037e70b45378f

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 f2130c04c27ce4cc68894f5ca6daffb6
SHA1 260a2a467e2ce1b74a8283b8b0bdd831093306bf
SHA256 c6daabd1cfe7f53235b773f5fa4550a4fdbbf2b4877caee305799ef982e80eed
SHA512 87537e651698e2e074857edce5302d8c7d3ba8ca65abb0500a7e8f043289ec1d9af2fae1b941bbed91c020b56031f999af08a0cb75cf33599c631adf6b6f825d

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 53755b8f47b3a995269f508143773ff9
SHA1 075f3b27ac9fec6f20a3087a776a6574867466df
SHA256 b3cb08d54ba59a89d724d25d0807a41b8b937120eb490678fc91a304d0b8f1c5
SHA512 1107bee9c132516a454a60137e594271fc62fa78e166bcbee86ce2242c13516bec6f14c481e0690737e3bf3265ac9ce872231501ef0603bbf4d770410e718669

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 a01b8326355e727139215ee30ac89c01
SHA1 873242a56a95c0951414f8a5f6ea83c77849a570
SHA256 ca03b9c23943b06e195a9df72c1c67c251762da4a7d5b3b3ede4356054588e74
SHA512 288e05a9d960ace218ccee18b0002a05bce0b228fb887e77c7418d64420e273396badd11397dea655cd4e76ec9ecf20339962f20dbd1da3bd050454a93add56c

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 7245e88b8f19e0c53ce9337588a2fdde
SHA1 4bd90a00c412061f47c0de97cfafd955ea25aede
SHA256 62211997d1bf9fbc4d5ff4bfde396b30fe67b78c261071e5915ff25cfc21d8d5
SHA512 e4f2aeacf080967ee6ac8ab5cbd73569ec1fedddc11495b22fa87af8063c6d56ee97bdfb186d94a7fc16a2d197dc9155bbaab47e2a43cccd7fa31d69f03e130b

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 553b985ef4c7f728d235986caf6d022c
SHA1 51fd60996c2a740670d367f78d1fb1489ba035f1
SHA256 e6fc3434ae19eaba0f210c9a1140aa276962b666b4e83f455c5ad7b4e3734856
SHA512 61681d8bb13dc774c662f7dc8307c97f6a7fd0fff181266bc7ec6d58ff894cb8b774367c1c1e77e99ec10ca66f6aaac368ddf089b77c6ac34dbfedfb16a82821

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 a343a61e5697a412c6c7f3eb809f63a0
SHA1 ce1f23c66f8b5e43a940ae43ba886a2b542f8f8b
SHA256 a2317dc1d5ebd6f1d34f7529d7094c1482ac9037514ec2c203879dc620146e6f
SHA512 a22ce257b7a42260c968ccd3b4186d562654bc1f5c61fd1e05a4a27ae243589fe3284371eca8189ed71bb29fcefc5734ec6db7acb0ad878226f00046b940f346

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 d4a342b00d1ab17cfa96ea61604eefab
SHA1 283a19a33299d0848bc9f6346221cd2a4e26bae5
SHA256 e5208446775138883e7a83dbba97129c5527974e41f28ad894b1d2dcac5d799f
SHA512 ef01340ce0e504a62da9912bb45ae6d93987bf00d19be23a8116f239145c48c8101d9db9a0dc9b180be897cb94cbaf56d7c5adda20c65051aa95e7d8e6879aec

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 1205a7dcd88ee7c122e2f052ba168925
SHA1 e9fa4beda25313c45ff6e6ecc4e822e7506279da
SHA256 6b02f189da8400899c386d36eb3f36123e0ddec6af206a39b816f30f16c298af
SHA512 630cc5606d09ae08b90575f4177397dd4354872c9ca6080cbb3b16cafedd40996437e9f985aa1cd688e959c610febc9f12053fd0a8367ce5ba292c9169ea3e51

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 6bde922cde1bcb4cd018facdbfc5b7ca
SHA1 dd63443ff21445158582ae13162cf9d9837e95ec
SHA256 10b1ba032d4d25d956a6eedde5bacfd29d3b9f3ea2ba3dbe634862e2043e3df0
SHA512 d968fd0e7072207b741b9e987d630431b323bf8f497bde26d80f0089e4ff06d0914fda3679028e6773bdfbb44cb0709ef70158f9b946826239f7a35a3e02dc47

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 51138cde1c7f24fb2f9516ca7224bc69
SHA1 65047bc1b201af9634b6368ff198b2821722abde
SHA256 16860767f31ff83ee8c471d8037a875687760522be417f5383b131cbcca6af63
SHA512 850de99b8d7d32bb7d70ceb8a7ff5fd009a077c0eb4d0fa75a2f777f122017e4235b4934335017f599b84a5c4519ef5396c5d064041bac9bdd4a6347d8ba57e3

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 e8abc9d46446c50f7f7d002b84e36c1e
SHA1 1d57bc8bccb8cd0f0e4b038f939b1fc1e6adc2e2
SHA256 b2072823242fa5753a7a8392c231f901e74983d1ac12399f8560eab189fbec42
SHA512 f19550d872e2aa5726698aed91a9914ce66f9df3e94d169d25b8a682a513a640b9ff0428fd9709efbcf336a35e0c6566938af0c937dd57dc15856d0bbc17a0bf

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 63f6528414e4782c955c6a350defe966
SHA1 939ab463fe10ada4b39a9ec11c5e1f577f0d1288
SHA256 0d1164f956b82500ecca7eacbe155211903cc2333480507078711091d76d5448
SHA512 6bb5bea50ae14a428990bd6f81db2c1e192ae03d846712eac2a5c52ceecbe8862ba4bb5bf0f3ae259c3446ad2ac702ebe3ebceb133c512e371a8d1a13405fe50

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 225a4cdb845550f997fcf4fa5fc240df
SHA1 9f73a1408e0b7f3a073195e524cb711e3ec64cf2
SHA256 6349cce7e56035cab22ae20269ae24ebe510d381fda41ec017b76d17cd54a821
SHA512 0a3b3ede9cbd73470939926b64f585daa8a6a149490ca8bae3b3279ebe3b80a5f8b53a668eb194fcb2f2fb85078ac319c654e9a58f6ca6263675346358996805

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 5b3f8b0f43db9ef0738b400359f9c312
SHA1 0b3e11f43c575ce3fc1454df4a5e175b74fb46dd
SHA256 f155e36d70727e49f4d062b8f7714ae3360bdf30abe7807caeaf656c5c8a9611
SHA512 6b3e3eeca74b3468a4579dab5e698a40d34d9c8ae1a6a665f60b194e0712ad7918af3ef2b72d2c44c5b4e82566607a5ef8c35da5d23c7f1abe8fdd2ccffb7f81

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 c4d405819d009d6a495667e415dedaf6
SHA1 2c85f1eafd5d3b39b1379f58155a510f69fc7686
SHA256 da477e15fea331354655ca5cfe0b39f6ef2a32039ff875fbc78ae6ea5ef8733f
SHA512 a9a533f08650e2c872b542d1663c806bc1dca09790e8891fd6173e87e2b716ab209add15a4af4cefbc0f5cb44ff245d52bdfca6663631bdcac0d1ccaab1898ef

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 df5214c1be096cf1005d212078942f72
SHA1 41fd8a1aa44d9df86ef5275c24e3198a968d018f
SHA256 045f354a78f7d0eb5ce664d7a62add62e70bad2f5eae9e8ca61b1ba5eaa93550
SHA512 0babb5e3f22aa286f415fe7eb8e815ce0dad6a233797df0d6534e75df6a5b7f3b8aa2538cd4632c699cde909d581c72979e11b0690d4030b76f9f9c647bbbd37

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 b350b0b5acee047e236368ab9da920ea
SHA1 f5bc5b116b11c205c23e5ae824d31e9daba456d6
SHA256 58cd85e8fd4881ffa4f5f9964df5cf28aa5cd92251480e5b4b1dc4cbbe14775d
SHA512 5b7f32b91543befbca838c7c162594e568cb0c1b43720ac53c886784e582658a86a5e8dd8a05440cd4242ad62ba93c56c568086089993d6fc6efcb1745ff3209

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 e89e4db82c4f9b44692f4017dc62362e
SHA1 7e6aa06b2b17248e944936f1a5ac315ab0d6ef09
SHA256 7dca9dc505d1ababfb862366bf999a02ea60fd4fae556718e39d8bdf80da03a1
SHA512 22b98c8a693020288252bee625b446eaed08b95daa97bd9d7f9b467cb24c8a0f26d09aea90b428674b0db92d6b1ac4c193b271af9363152c417f8593e61b627e

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 3b2c4b94720f01c4a401abea21d48dcc
SHA1 a9a329d113732dc8eaa03b6151eec6c4263733ce
SHA256 17945d334255450954ac89a4548fe512b3c02f0cd2362fb2df2cd66c4d40fa57
SHA512 f8f45f207926fa238b92d9b4d4f397fb47dcdb63559ded25873d951b712c3c771a5184b3fd05dd021f160e6f80fe721202f9475fe6a75df0820a3ad16d06fcfb

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 a784e1a99fbd80fc80ae49f51b396d1c
SHA1 f8d73d03cb8ab3b4491e6896560f1b4ab00199ab
SHA256 fe1b3eee3ac2d5f132a907c41532b585ec0c194036ef6ba2d829047eb5b7b94f
SHA512 897b7eca0034bcd60a1b44a79c7b762320b95c3f9ff172d61b2a4a6a2d49092d2b967ac6d5b846bb9b84ff299cf295e88db393bb3f429f12a9939a41f34f8446

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 c46170c0fb28cb112409d88ace5587b2
SHA1 119fccf9ef7391161f2fefb9e991890b0638e8b1
SHA256 3a15dc4ef5a7c4fe1474d78870dabcd3b7aa608f022c193fdc3289fd7e7aa294
SHA512 85d6a7b2a133df7a9c43fc5b551e9d48b4ce79e0652ebe23e6b0878279ea3ea1bcef1784fbc4167e1612a0305e2ac9c407ac1339e431f4daa42b381bca0eae87

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 933f7da6ee33e7316ecd84f4093b4c40
SHA1 5ff29bded2ecfdc3aefe4045ef527b851fdbd827
SHA256 49c8e20193d631ece140edc03898cd6100cfa700cf78db33b00d6db73752d93a
SHA512 694ee6cbbc6362079c4e358dfb463567cc7c85b7782db6ce711b2bd1c23c79b9e50dc68bf346c4168175b71cb2ab8e22b6890f2347dac97d708738d3f5654132

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 dfdc23d6c13c68648566d43ccef97807
SHA1 a7b88ac87c91507d5a5b8895ec92ecc0c6f49679
SHA256 0fa7b82f7f861ce5c2be3dc0f6b71dca1cd507ee3df5f824b18964ef7051bb38
SHA512 06b9792143738f9af6debfe83f91d3c1632904ca920939965a4175b319110440ea14fdd8cba85f32eadb0f1c19deb3fddfe50fbd1004d92ce022b71d4979bb92

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 9f622080570073e7d3023139aafc307c
SHA1 6fb98140a51f278e3a25332eda2786188c264eb0
SHA256 3d9e14a5dea1996d79984a43c7fd472b016be90ff0cc96283ddfd57669d4964a
SHA512 964844287678f39b8038bc3dfee34c89ff967a0ed8c8dc4623f5b3111508442bdc2926c7a3e16be875b3ea933057b10e12dbf474541aae6aa714a4a09691e93e

\??\pipe\LOCAL\crashpad_1476_FKPBGMEIKPODSTJT

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 d346332a57c10db15b9dcdef73dfbb87
SHA1 ed2a5f163b196f1dbd45f0767e1aabb85a80ee68
SHA256 844ef57bb91600cf2b3c4ce559163a162b0650d67476ce538918454f2f1ff363
SHA512 92244eea81e62758582f72029d6193637b8206a39147b8faf501dda243f782d3ea8b68fe05cac91465a62459766fb7722a85124e58c1fb97df156bdc4e82a508

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 a0f29c6cd98f6f88088d717da746ca05
SHA1 762cdd12d251f67c49fe1b1f2e5ac717df9d4840
SHA256 c010039ac9117b7aacdf2f51daa1046bda6d1f4fa89341943531cedb21c42f06
SHA512 fc2b5911907f90cf902f7b5bb946d3566d3559193c9ebd730039f903c230e79c733953affcc5557b94df93bc7672513bcc2d412b658e04fbd5f2e0f1f71cbd33

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 c02c80fea8f732ff9a3e05a12beeb172
SHA1 404104153e4c9f173bae02f27697285c34c5697f
SHA256 e2066b29b7c2ab33932cbaa082e680f76bed9a3029e05c81c6d6df35fa4814a6
SHA512 d34e31a5e4d95d0e9faa0edcdbc0175bcde787d50c756a75c6555b6e86fe5eb228f158df9d06691feb7dd476b2003942a2731fc7899fcb38132e86a88e2885de

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 c6f745f466207d2bc34176ac5116a3ad
SHA1 ec28c00937b2bd29a0dc7115525ed842b470a824
SHA256 bae4d401bc4293c4767d0745e2644f13a67bda90875c36ef4a482b2677f7f9ec
SHA512 3d01168ac8589ed703b1c01139c8588d3645389063c47a8ee9713324acda505a74736b325bb73f537b1b64111e7ae065dca51cd52c4df7d062f6b91f80a18e1b

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 71dac7391e619911f316551a9fa9f83f
SHA1 bb49d407b3c320ab8819bc217dc8995fb57d362b
SHA256 cb99d09ad9a37d7079317ce8db53cc33c516a9d62600576d960290275ae34187
SHA512 cbc063ea1adfd5125ae61fc9204352f92a504d5da1f66bae9ae4802bf1a8048b52a6b3ec0ef6802f157462e84195b36d1c3d650209fedba21b860a3e36f634e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 ec9378939a52bf9964a88552c7b98e51
SHA1 5c756895c0a6187938f0f59d10cffb09165e5bae
SHA256 b1cae0e73ceaed985be199de2d54ff4f656102407a9e297450ad3487fa8e718c
SHA512 7b610358f743b7084a7b27a13a7f82865165dfbf1435c90fece7b3739837962f7f5a84641be30fbd3c3c1e3f79989af55db102c153e05fe404e775e3d51a09e5

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 7ecccc632256980002de83055af31350
SHA1 49503b6c85f3784132ac48331366205dc5245846
SHA256 775d9fe45616eafa0e7d91736ee6ecbda5de81cf4d063727fec7dff37ac49a7d
SHA512 5c83c634c9f980412f1c588264324532dedb69062b259d333d27beecfbe3cfe7095816976717577c4333e061fcdfd36b2e3d8b624f8fa3e05cbac406e5d7253f

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll.Lime

MD5 ca443500d0a576be6d55eb4c06a057e5
SHA1 8d73c8ba649c6627b5b6c4258575db6266ce3bea
SHA256 0881755014144b28b8a622fcd7418b71f2c982d5e678158c8fc33481247d225e
SHA512 c636e18678646e9a9eaacd2efae9dde3c7d5fae26cec542e46f1dc4eaf32d1499976a3a5efadb37677ab368507c3999dc4622fe061530d38be27293e358ee76b

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 6a7e173c707aaca3a255019210465d35
SHA1 c23f9978cdd3d69fca37321e4cf303f329921bb1
SHA256 8a8acf90a6fd8d6429e881d0ba70a9dc11231b4cc7e3c1de583f4df7fa504943
SHA512 2d89efad71ce541aaf33994057c60714f2aeed1c5f1ac2c11506c7d8bc9f05665805263b98bb85ebba9548e80c2fe6f535b7db965128251d742c35f9eaf7100d

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 66bbe0db34ff291b91f895d4fa04df47
SHA1 36582093544efd7bbcadc58276d607181013eb92
SHA256 a120f18ce2ed1cb11b98050326ad3768e48115218ae23c00f65798c0e6902ade
SHA512 fdaad447938327b7c26aab274ede0544fa8a2d0e2cdea152570f3be4e230f30e9b556dc769838d15185efe12f6b9495b31888d47baafecb82983053c38ba09ab

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 89892dbb079d9306bdedc98b2e046f44
SHA1 b14149b10d8d199423fa670cce684cf5daf8b7bd
SHA256 40ff47713328bdaaf2a7e90e15a6b8e4e10bf9b557a7baa3d108d98a21eadfe6
SHA512 25ed92ab261c5648577448e107b0abf715da7980981d0a446d51a289cb9beddadec46f972b83f9e69564cbf1aab055ecf4b1e64ae317f20905445ce294671538

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 5c1bef53fba4f6ecf26ff90a8bb37997
SHA1 c736f8f6f0206157dae1390723c633d463d66893
SHA256 4709ba9f768df8cb632544bae0f1755cd0401f2c4e01b05a71f59c653811d109
SHA512 84952608a810c0a0f2e1cce0862f533ba4ba5953782245e08c4682eddaed5a3c8774dd448358b4f82017f162c5e3b80f3fa703072559072e1cbc6bb9e7502dab

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 86722c962a799e002258daac35be8c18
SHA1 95f99af830040f44dcad6087289699bcf2715d6d
SHA256 419874f55b7f37d1966d763564fb12d3a0913952c1407ce08ce95b1bfa462048
SHA512 ce867b088a0bbaf70627ab366cbcc2630582739312a2ddc7add7e448241e3a2d9c0dc58ed7a892fcc4fd93e117335fa296ce225466e117b4391df37a8a742399

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 cac74b598821d4982db54faca254840a
SHA1 3a11d1e9990977a2da067d48a435b91e4b1a1a05
SHA256 4fb42e646d76e894b1cab37f68f2372beb76e9e84f4b61985bac54c4f34c2168
SHA512 82868be0b50c1a3b076a450c9f28e63e202e0d8a739028ac1c3a9629a84e61d96ab9a34ee65b496db0de3b75999e07d131f8dc4e4492bd0a07db9cc866d95ec5

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 92e4f693a75ae0609ffe63c48acc82b2
SHA1 6fca2ef3636f124f2fc4fd471bd7a013a5b3d0ac
SHA256 348764defcbc35a4cd8963049c411ebdbcc2660fe88a44040374f1c06e30f2e4
SHA512 4f38d8ff6c26d3effea55ce8dc850f0449198296c1a38b94b8c643a1be178febfeed9ada3968236d0563bb9e8a9a4bf0dc7a7f82e7ff408fbb6ed1f4aa9faf2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cabd79744585f15f1add139e20a97953
SHA1 298d1ecc0a8853aee648fad3fa606384441b61b4
SHA256 31857975e787e034d3592805bcf418d1f4dbb3d271dece8ce4725184f31b125d
SHA512 9c4f9988a92befc7efbf7f5a61d995f19195fd3e8d516f856cc386abbc9c09a4d8abe8802db50a5a3884c96f77554084eeeae0ea080ec2258f583479e2df8dc2

C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

MD5 6395a2b798d010ef4d800e8c3d3e71c7
SHA1 32b66d431b512e10660b29753821bb25d7b85ef5
SHA256 59757f0ef5d7138b357674fcc4f8b7750e45108de20d3fc98eae7cf5cb4c3a16
SHA512 2d6975b7f84ff106fe9a0c468a205395e7c2ab892ea789a745cc7806dd20c2c2e231690ddb3a21cbe75dd22ac878314b90dca4849c6b4350190ffcce2999ae0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 03680dedf01cd0cfaf6e099293a9a6bb
SHA1 dae825dd0edeedbb701015d1b07dbd8c76c451df
SHA256 ac1491364e630d1dc1a44e4ba1e9e2a7739167b221bd7f4ecaa29e033d275e7b
SHA512 689ab24cac29fa9e635dc870863f6454e647cb917d3fa5ff65278d1f68dd8a112106e2106a1346a64f1b1780624ca65ec11e7e5e75ab04e6404f027775f3ba7f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 f9af97884713321f8a99d1a88dbe5ce4
SHA1 ebb329e1fe82678dd84c4798394490cb4757fa21
SHA256 9e513825dcbd9f677a74466f71c51df20e403c85180a3c8a83e0b5763879c62a
SHA512 c69851a35e4a636c524af75f42ae8a58907e87dac7b327c4b1abe5b3aa9ed570401e709b49c93c7fbab5bdd4b80f1a547879146dc3a016b2a0428adb568305d2

C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

MD5 16935daa87c931fa1443ccf282aab296
SHA1 de9be573b5d6873e3293fdd02c9720f92d4b0aed
SHA256 2c0a981b5fcdaff1dc59370a923f4a64df0ad69368a6bccde125d7e194ce72bb
SHA512 20bac6bde05048784c141f250eb8f444f0f55ec134ac00db092ca9271283e8db9a533258ef23cfbb49f0cecf579111b3cb36950bce942679e7b58d22c12d3c1f

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 44e651ccd3a5ce1e213509acadf8bb75
SHA1 6f8849ad4725ac750e131ce108c0ce7a2b4a7803
SHA256 cc965dec1a5738029229d7186d540d2c37a8923d4bfb5a947f937dc321d7bc62
SHA512 54cbe401e7334b04e1d157665a090f254660734682bddee54bc91b45633ff9472590e7b65deb53e18c123411c1cbface33214a7ee4aae3bb2a6c0113f5dff11d

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll

MD5 8cb488240c90aa907726e021477d6717
SHA1 febdd80a9715d76ec0039b6a16e05c1765b70093
SHA256 3a578c3cb53a662d2478da11c649b8b5df317e4d5102f73cc1bba0a292ca42c3
SHA512 fd8f3ebad8ee899133ed9ae76f297b3ddc16a3e6c3a212d2d4b07dbe3e4879e3ecc057fd96d3f216c2272d041ae5b3fbf5d0b3162deee301487dde6872de54da

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll

MD5 ba0a348d92fefcd6d658746540b0b41e
SHA1 df77dc5ca769157c4f9d36bc760cea2c2a9376bb
SHA256 ab9d4f4941f8384f1f59454546964fba6f13d68e62189be0ea0920590ea761d3
SHA512 685ca9d385aa0f0eff23206b7f1ead4f3994665eff387144bbadcbd57610eecc3768314b8f026ed3964f4534f3f99163c218b6a33a9b2980ff337dc54566dd58

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

MD5 8c4706881925f797ff4569afe7d0717f
SHA1 bf488dc70a0aed8407d04b4d730ca40f9facdc50
SHA256 ab3a3df3676de5950a6149e6e3a4e25f19cffc5555ced73ed979499d3b250672
SHA512 f0d05fed89ba8c16a0a17bc6d0109702c776b1af8f40a6da24575b73733b613f1a6216b356f320054070a63bf6d831c12dd0a7a8c4747a7e4ec9b66235680a83

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 12:29

Reported

2024-05-30 12:31

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe"

Signatures

XenorRat

trojan rat xenorat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe
PID 4520 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe
PID 4520 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe
PID 2468 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe C:\Windows\SysWOW64\schtasks.exe
PID 2468 wrote to memory of 3220 N/A C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe

"C:\Users\Admin\AppData\Local\Temp\Rat Testing\Xeno Rat.exe"

C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe

"C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks.exe" /Create /TN "Console" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A67.tmp" /F

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.128:443 www.bing.com tcp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
NL 23.62.61.128:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 128.61.62.23.in-addr.arpa udp
US 147.185.221.20:3403 tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 20.221.185.147.in-addr.arpa udp
US 147.185.221.20:3403 tcp
US 147.185.221.20:3403 tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4520-0-0x000000007495E000-0x000000007495F000-memory.dmp

memory/4520-1-0x00000000004F0000-0x0000000000502000-memory.dmp

C:\Users\Admin\AppData\Roaming\XenoManager\Xeno Rat.exe

MD5 5bf8a2aeedfb1123eb10af5e0f0e3302
SHA1 cdb9c4090f4ff8b9a5d94eaae30c15f4916e177a
SHA256 bf0927a0af35c23071466397ab21b38951d5847a4c7dda419d83a1a98183b12f
SHA512 3fa42409cea75c32b6323567fd7f03f10fd220fd73a93e4ba4d6bf998b228377e404d1a050f32e952b742c8d89a7e2384c14129608814711e285bfad33024983

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Xeno Rat.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

memory/2468-16-0x0000000074950000-0x0000000075100000-memory.dmp

memory/2468-17-0x0000000074950000-0x0000000075100000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4A67.tmp

MD5 0e29fbc9d75d451bb7b67f39780c4a90
SHA1 e1029b49a55d95816055da478445478d019b8683
SHA256 34268bc2fe7b655c624dfba5e5740aa5d8c816d13e917a46211c746ae4ab8bf9
SHA512 817216c5022e6faee6ef3f35f57d6e7d1238333c461c6dffc2c77f332a670ea0e772f2f910e45ef76c36427bec36f16c55e2fb9ce11f11e0a465c3980e6f1a1c

memory/2468-19-0x00000000052E0000-0x0000000005346000-memory.dmp

memory/2468-20-0x0000000074950000-0x0000000075100000-memory.dmp

memory/2468-21-0x0000000074950000-0x0000000075100000-memory.dmp