Malware Analysis Report

2024-10-23 19:27

Sample ID 240629-2gkhdayald
Target Borat.rar
SHA256 53cdc49c7fb83b419c07edb45c544b106aaa37db00e8a37211678af6350a82f1
Tags
asyncrat rat evasion execution persistence privilege_escalation ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

53cdc49c7fb83b419c07edb45c544b106aaa37db00e8a37211678af6350a82f1

Threat Level: Known bad

The file Borat.rar was found to be: Known bad.

Malicious Activity Summary

asyncrat rat evasion execution persistence privilege_escalation ransomware spyware stealer

AsyncRat

Asyncrat family

Renames multiple (6372) files with added filename extension

Grants admin privileges

Modifies Windows Firewall

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Enumerates connected drives

Command and Scripting Interpreter: PowerShell

Launches sc.exe

Drops file in Program Files directory

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Enumerates physical storage devices

Opens file in notepad (likely ransom note)

Gathers system information

Collects information from the system

Gathers network information

Runs net.exe

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates processes with tasklist

Delays execution with timeout.exe

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-29 22:33

Signatures

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 22:33

Reported

2024-06-29 22:36

Platform

win7-20231129-en

Max time kernel

122s

Max time network

124s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Borat.rar

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3048 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 3048 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 3048 wrote to memory of 2252 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\rundll32.exe
PID 2252 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2252 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2252 wrote to memory of 2644 N/A C:\Windows\system32\rundll32.exe C:\Program Files\VideoLAN\VLC\vlc.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Borat.rar

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Borat.rar

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Borat.rar"

Network

N/A

Files

memory/2644-30-0x000007FEFBA90000-0x000007FEFBAC4000-memory.dmp

memory/2644-29-0x000000013F260000-0x000000013F358000-memory.dmp

memory/2644-32-0x000007FEFBF10000-0x000007FEFBF28000-memory.dmp

memory/2644-33-0x000007FEFB810000-0x000007FEFB827000-memory.dmp

memory/2644-35-0x000007FEF8160000-0x000007FEF8177000-memory.dmp

memory/2644-34-0x000007FEFB770000-0x000007FEFB781000-memory.dmp

memory/2644-36-0x000007FEF8140000-0x000007FEF8151000-memory.dmp

memory/2644-38-0x000007FEF8100000-0x000007FEF8111000-memory.dmp

memory/2644-37-0x000007FEF8120000-0x000007FEF813D000-memory.dmp

memory/2644-31-0x000007FEF6A60000-0x000007FEF6D14000-memory.dmp

memory/2644-40-0x000007FEF55D0000-0x000007FEF57D0000-memory.dmp

memory/2644-48-0x000007FEF7EC0000-0x000007FEF7ED1000-memory.dmp

memory/2644-51-0x000007FEF5560000-0x000007FEF55C7000-memory.dmp

memory/2644-50-0x000007FEF7370000-0x000007FEF73A0000-memory.dmp

memory/2644-47-0x000007FEF7EE0000-0x000007FEF7EFB000-memory.dmp

memory/2644-46-0x000007FEF7F00000-0x000007FEF7F11000-memory.dmp

memory/2644-45-0x000007FEF7F20000-0x000007FEF7F31000-memory.dmp

memory/2644-60-0x000007FEF5450000-0x000007FEF5462000-memory.dmp

memory/2644-59-0x000007FEF5470000-0x000007FEF5481000-memory.dmp

memory/2644-58-0x000007FEF69C0000-0x000007FEF69E3000-memory.dmp

memory/2644-57-0x000007FEF6ED0000-0x000007FEF6EE7000-memory.dmp

memory/2644-56-0x000007FEF6A30000-0x000007FEF6A54000-memory.dmp

memory/2644-55-0x000007FEF7320000-0x000007FEF7348000-memory.dmp

memory/2644-54-0x000007FEF5490000-0x000007FEF54E6000-memory.dmp

memory/2644-53-0x000007FEF7350000-0x000007FEF7361000-memory.dmp

memory/2644-52-0x000007FEF54F0000-0x000007FEF555F000-memory.dmp

memory/2644-49-0x000007FEF7EA0000-0x000007FEF7EB8000-memory.dmp

memory/2644-39-0x000007FEF57D0000-0x000007FEF687B000-memory.dmp

memory/2644-44-0x000007FEF7F40000-0x000007FEF7F51000-memory.dmp

memory/2644-43-0x000007FEF8070000-0x000007FEF8088000-memory.dmp

memory/2644-42-0x000007FEF8090000-0x000007FEF80B1000-memory.dmp

memory/2644-41-0x000007FEF80C0000-0x000007FEF80FF000-memory.dmp

memory/2644-67-0x000007FEF2680000-0x000007FEF2696000-memory.dmp

memory/2644-66-0x000007FEF26A0000-0x000007FEF26B1000-memory.dmp

memory/2644-65-0x000007FEF26C0000-0x000007FEF26EF000-memory.dmp

memory/2644-64-0x000007FEFBB80000-0x000007FEFBB90000-memory.dmp

memory/2644-63-0x000007FEF2F30000-0x000007FEF2F47000-memory.dmp

memory/2644-62-0x000007FEF2F70000-0x000007FEF2F91000-memory.dmp

memory/2644-68-0x000007FEF25B0000-0x000007FEF2675000-memory.dmp

memory/2644-69-0x000007FEF2530000-0x000007FEF25A5000-memory.dmp

memory/2644-71-0x000007FEF1D10000-0x000007FEF1D7D000-memory.dmp

memory/2644-70-0x000007FEF2470000-0x000007FEF24D2000-memory.dmp

memory/2644-72-0x000007FEEFD90000-0x000007FEEFF08000-memory.dmp

memory/2644-61-0x000007FEF2FA0000-0x000007FEF4750000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-29 22:33

Reported

2024-06-29 22:36

Platform

win10v2004-20240508-en

Max time kernel

97s

Max time network

98s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\Borat.rar

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\Borat.rar

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-29 22:33

Reported

2024-06-29 22:36

Platform

win7-20240419-en

Max time kernel

122s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe"

Signatures

AsyncRat

rat asyncrat

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2288 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe C:\Windows\system32\WerFault.exe
PID 2288 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe C:\Windows\system32\WerFault.exe
PID 2288 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe

"C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2288 -s 1632

Network

N/A

Files

memory/2288-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

memory/2288-1-0x0000000001270000-0x000000000267A000-memory.dmp

memory/2288-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

memory/2288-3-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

memory/2288-6-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

memory/2288-9-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-29 22:33

Reported

2024-06-29 22:41

Platform

win10v2004-20240611-en

Max time kernel

426s

Max time network

428s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe"

Signatures

AsyncRat

rat asyncrat

Grants admin privileges

Renames multiple (6372) files with added filename extension

ransomware

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Client.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\D: C:\Users\Admin\Downloads\Client.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-36.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_NinjaCat.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\Microsoft.Services.Store.Engagement.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Utilities.v3.5.resources.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\vk_swiftshader.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SyncFusion.Grid.Base.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Protocol.xml C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-256.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteSmallTile.scale-125.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebClient.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-200_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ko-kr.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_as.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\Microsoft.Build.Engine.resources.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\adalrt.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vreg\excel.x-none.msi.16.x-none.vreg.dat C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7db.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-400.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\Common Files\System\msadc\msdaprsr.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72_altform-unplated.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso20win32client.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Paint_PDP.xml C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-200_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-200.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-64.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Input.Manipulations.resources.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerMedTile.contrast-white_scale-200.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-100.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PaySquare44x44Logo.targetsize-24_altform-unplated.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-60_altform-unplated_contrast-high.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-100.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\WebviewOffline.html C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-unplated.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-200_contrast-white.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SearchPlaceholder-light.png C:\Users\Admin\Downloads\Client.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png C:\Users\Admin\Downloads\Client.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MANIFEST.XML C:\Users\Admin\Downloads\Client.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000cb58c3941100557365727300640009000400efbe874f7748dd584eb42e000000c70500000000010000000000000000003a000000000014937a0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Documents" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 5000310000000000dd584eb41000426f726174003c0009000400efbedd584eb4dd584eb42e00000023340200000008000000000000000000000000000000a41c620042006f00720061007400000014000000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5000310000000000cb584ca0100041646d696e003c0009000400efbecb58c394dd584eb42e0000006ae10100000001000000000000000000000000000000294ed500410064006d0069006e00000014000000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0000000001000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Downloads" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "8" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Runs net.exe

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Users\Admin\Downloads\Client.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Client.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1776 wrote to memory of 516 N/A C:\Users\Admin\Downloads\Client.exe C:\Windows\SYSTEM32\cmd.exe
PID 1776 wrote to memory of 516 N/A C:\Users\Admin\Downloads\Client.exe C:\Windows\SYSTEM32\cmd.exe
PID 516 wrote to memory of 2084 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 516 wrote to memory of 2084 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 516 wrote to memory of 2824 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 516 wrote to memory of 2824 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 516 wrote to memory of 4404 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 516 wrote to memory of 4404 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 516 wrote to memory of 1500 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 516 wrote to memory of 1500 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 1500 wrote to memory of 1900 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1500 wrote to memory of 1900 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 516 wrote to memory of 2420 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\query.exe
PID 516 wrote to memory of 2420 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\query.exe
PID 2420 wrote to memory of 2000 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 2420 wrote to memory of 2000 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 516 wrote to memory of 644 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 516 wrote to memory of 644 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 644 wrote to memory of 3244 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 644 wrote to memory of 3244 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 516 wrote to memory of 4032 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 516 wrote to memory of 4032 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4032 wrote to memory of 3848 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4032 wrote to memory of 3848 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 516 wrote to memory of 2416 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 516 wrote to memory of 2416 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 2416 wrote to memory of 404 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2416 wrote to memory of 404 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 516 wrote to memory of 1908 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 516 wrote to memory of 1908 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 1908 wrote to memory of 2652 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 1908 wrote to memory of 2652 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 516 wrote to memory of 1608 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 516 wrote to memory of 1608 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 516 wrote to memory of 1292 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\tasklist.exe
PID 516 wrote to memory of 1292 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\tasklist.exe
PID 516 wrote to memory of 4948 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 516 wrote to memory of 4948 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 516 wrote to memory of 4852 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ROUTE.EXE
PID 516 wrote to memory of 4852 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ROUTE.EXE
PID 516 wrote to memory of 2952 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ARP.EXE
PID 516 wrote to memory of 2952 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ARP.EXE
PID 516 wrote to memory of 2188 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\NETSTAT.EXE
PID 516 wrote to memory of 2188 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\NETSTAT.EXE
PID 516 wrote to memory of 640 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\sc.exe
PID 516 wrote to memory of 640 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\sc.exe
PID 516 wrote to memory of 3532 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 516 wrote to memory of 3532 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 516 wrote to memory of 4036 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 516 wrote to memory of 4036 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 3564 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe C:\Windows\explorer.exe
PID 3564 wrote to memory of 2136 N/A C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe C:\Windows\explorer.exe
PID 2936 wrote to memory of 3944 N/A C:\Windows\explorer.exe C:\Windows\system32\NOTEPAD.EXE
PID 2936 wrote to memory of 3944 N/A C:\Windows\explorer.exe C:\Windows\system32\NOTEPAD.EXE
PID 1776 wrote to memory of 5044 N/A C:\Users\Admin\Downloads\Client.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 5044 N/A C:\Users\Admin\Downloads\Client.exe C:\Windows\System32\cmd.exe
PID 1776 wrote to memory of 1204 N/A C:\Users\Admin\Downloads\Client.exe C:\Windows\system32\cmd.exe
PID 1776 wrote to memory of 1204 N/A C:\Users\Admin\Downloads\Client.exe C:\Windows\system32\cmd.exe
PID 1204 wrote to memory of 3512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1204 wrote to memory of 3512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5044 wrote to memory of 1448 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5044 wrote to memory of 1448 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1448 wrote to memory of 4184 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Client.exe
PID 1448 wrote to memory of 4184 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\Client.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe

"C:\Users\Admin\AppData\Local\Temp\Borat\BoratRat.exe"

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\system32\wbem\WmiApSrv.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\Client.exe

"C:\Users\Admin\Downloads\Client.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\explorer.exe

"C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Temp\Borat\ClientsFolder\17C4B51780DE9816A7FC\Information\Information.txt

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Borat\ClientsFolder\17C4B51780DE9816A7FC\Information\Information.txt

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x244 0x50c

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\Client.exe"' & exit

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2127.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\Client.exe"'

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:8848 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
N/A 127.0.0.1:8848 tcp
N/A 127.0.0.1:8848 tcp
N/A 127.0.0.1:8848 tcp
N/A 127.0.0.1:8848 tcp
N/A 127.0.0.1:8848 tcp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
N/A 127.0.0.1:8848 tcp
US 8.8.8.8:53 www.website.com udp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 8.8.8.8:53 195.67.22.104.in-addr.arpa udp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
N/A 127.0.0.1:8848 tcp
N/A 127.0.0.1:8848 tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
N/A 127.0.0.1:8848 tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp
US 104.22.67.195:80 www.website.com tcp

Files

memory/3564-0-0x00007FFEC0D73000-0x00007FFEC0D75000-memory.dmp

memory/3564-1-0x000001A0E7020000-0x000001A0E842A000-memory.dmp

memory/3564-2-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-3-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-4-0x00007FFEC0D73000-0x00007FFEC0D75000-memory.dmp

memory/3564-5-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-6-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-9-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-12-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-13-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

memory/3564-21-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

C:\Users\Admin\AppData\Local\Server\BoratRat.exe_Url_gd1rwjpue5ky1rwo1qwl5mnr5ta35yo4\1.0.7.0\user.config

MD5 0c6e4f57ebaba0cc4acfc8bb65c589f8
SHA1 8c021c2371b87f2570d226b419c64c3102b8d434
SHA256 a9539ba4eae9035b2ff715f0e755aa772b499d72ccab23af2bf5a2dc2bcfa41c
SHA512 c6b877ff887d029e29bf35f53006b8c84704f73b74c616bf97696d06c6ef237dff85269bdf8dfb432457b031dd52410e2b883fd86c3f54b09f0a072a689a08c0

C:\Users\Admin\AppData\Local\Server\BoratRat.exe_Url_gd1rwjpue5ky1rwo1qwl5mnr5ta35yo4\1.0.7.0\user.config

MD5 acb6df8bd0fe9236ea87ea6e3c28173f
SHA1 8b1d88bd749b58905c6db258e7224a67d1179938
SHA256 ec2b3fc4d011e9b8a04188d8f2ff280de854dde7d6ebf8e871e0642f789dfa5b
SHA512 a4222c0f5aeba58679c21361dcb6ab2c7ed1d9cae41d2839089fdb7bbaac3b8735afff8b302557f85389daa977b826cee77b944ba598e3fa6c2a16781453a832

memory/3564-34-0x00007FFEC0D70000-0x00007FFEC1831000-memory.dmp

C:\Users\Admin\Downloads\Client.exe

MD5 7d2a32931b72c193d701af0f7767973c
SHA1 44ab8e9374038d47aa19f13764e02d5fbc52f913
SHA256 b5365cf212489a451016d8825cf044b98b35ecc19a005e8fb811959fa7f6ce31
SHA512 7532fd0f3a2f651f2e0ccb609e2950f0a93e3c2d4f82b6f20faea03278086ee930184affad4a87de15cc13842939b3c2a71e3f34ff31e00592372b7fc7ddb610

memory/1776-48-0x0000000000A40000-0x0000000000A54000-memory.dmp

memory/1776-62-0x000000001CD20000-0x000000001CD96000-memory.dmp

memory/1776-63-0x0000000002B10000-0x0000000002B1C000-memory.dmp

memory/1776-64-0x000000001CCA0000-0x000000001CCBE000-memory.dmp

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\Borat\ClientsFolder\17C4B51780DE9816A7FC\Information\Information.txt

MD5 738cabf3085484975c61d0953dfec7ca
SHA1 a3471eb58a4bb51fa656f7e24d83fa3373b0b49a
SHA256 432cb68c2d5d18724c30954076134fb431007ad8abc6034bc5601de9d1ea5abe
SHA512 42e9b2a87ecef437745427320d88bc972108c6b0d673bf528e87b0ee9f23f122d66492ce52f0cfbb92f16cd8a5ed01734716c7aacd366a551ec9c319d3a804dd

memory/1776-69-0x0000000002B20000-0x0000000002B3E000-memory.dmp

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

MD5 fe9ec77541e712ac38256a3194fdc48b
SHA1 687264c78a1020001ba271e0fa0dbd890671430e
SHA256 e04eb6ef0f264df104ecfaeef8eafdb45a932e3a08e62ee3be34bdd7b3f992d7
SHA512 0269ce8729a73ed8896f9efe262fc1effab0e1bf0395dce736b39f3e34a59bbf071ba099123bb748a3b76f1a3b2805d46596abc89f50a4f324215b3ac3956235

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

MD5 a7f555e7a41940de7f7deaefe16f9832
SHA1 609a396e9dcbf9496b364dddcca175790a5bd3a8
SHA256 469cd6eb02f127a9cf6e2cadd7a2de881908955deba7c80b01c07e3b78ee3cb0
SHA512 f17708d6fe754bbf7a56114735a11601c1dbd4f950b84d75f1d93209e3e5cf7e84e756a2e41a4700a3cfacecdbefc28eabcdc81d2c1944243503fb7ae245f497

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

MD5 797b345012b3ac75e248678b4effd9d1
SHA1 e86816446d4e9f8c7997794adc72ac3d907248c0
SHA256 3f4a81e2087d82f5dcf39f99c282c8803805e9d682cb77a8d7437e4c82c2943c
SHA512 80c819d726708d743861c0e142ad0e9556e1fa2edb3b488f5d2e69b3477b54c8247ce52d7c84ab0b92c57f35bdfcb7729bb44f73ba639623c2df722ea08d81df

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

MD5 7833306d59d79114a04878cb2b0c70a8
SHA1 b4e8fa183ceeb579693758492d409eed8df9279a
SHA256 52a97181bbf15761dd6cff29b70d4ea67797c59f8246fcfbf077b6d08e118800
SHA512 956d3a917e90cc4d96257ca47e959604dc977652e64d5147576922cd9e9b5ef8d270adae6f46418b3e79770f367963846c043098e5d2c488b8e9dfbef3489793

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll

MD5 9a302bcc9541f05b38183170f15e1c95
SHA1 c666cad12cee1ad0a06f4be5a58958e50b20def6
SHA256 d4f8ff29c56c16acede30f015c5f7a9a5f609c4fdbddc376752426df570dc33b
SHA512 fa624343d9becb1cf5d28b8067db7aa9beadc269c425c4ee9724060c7c423040e7ad9daebdde7a04ec37b48a6fa50db53bfa7e4bed847a052a4f40e16d0f542c

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140_1.dll

MD5 4b059cb8672d4703d0b272cad2a20eea
SHA1 beb5b566fb407e206ecd091fa74d64223e58c759
SHA256 6fc7a0bc4ba8b40a50d1e77e1681ebe001e1718d26cd26c9810f6a7f7deb80bc
SHA512 da7b497d1d3414dd730ab3968f3f5b16cb62553a651a681166c3b38ea9390b26e9e28d96363002bc3abdb7c66ddd3bfc453e7e84d569916ce169845a2eae59cd

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 44bd2c1e93bec695ce850ecff61cbd1c
SHA1 54a3785ab0f8bd3d24e4e2fad843f6878bb4b930
SHA256 a19cdfb698d8597b7f205c51055f3e36785d82aa2c6fb49d08bb6cb826e14861
SHA512 e4997df27bb2485e0940afdc154759947793ceb1c3a09bcb98c0c0a75b2bfb82dc0d36786eea6d18449e800bbc16dca7ae9463043b9e4735a7d467c2c4810df5

C:\Program Files\Java\jre-1.8\LICENSE

MD5 599fbed6fb2aadd2af8bf030a7f78415
SHA1 3d33c82a92ee64a33de0e685739a801880b5fd3d
SHA256 672c112a25917a9f56afab81ef4159d7d088bf0332fce28f2b9f977c813c9805
SHA512 3f319ba7d3151f53f25d0836e5b23078126f755e3cf4b5ab821c57d621a45ecd531e0ce9ea66c7a00ae509aad4c30536c933f3fb77d3733f8fbcc818433e9d4e

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 c0c743a6252ef7b7ac0a55c5522c8dfd
SHA1 babbf5675c8baeeb9cac7a427a45f3197c7ca94e
SHA256 dbb955956c88433511e68d9b46ccab539b2793578ab1d45b76c6dc3f4cf8b007
SHA512 63ba81ca8546ed17e16b67aab25117692723c889b16d63a23bbc816090bb2a646ada09b9a4a7b7b00ef4bce03ad627633b885d678d082faa0fd1658292d836c7

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 dea382480b428772628f79e145558d25
SHA1 5cf0ac0cbd4dbb6eafa9d47f71215a429764bdce
SHA256 2d4211317e92a5ae6526c291e744093aa04b3e22d7bc6e16bcc51d1d4aa973f1
SHA512 e8375f1e998e7011e896442f545dda970eba4669473a8d8ac9263f1dff0f663ae87262db804ae2189072f6aadca2bf516e00077794cbdf6d72dd9aa6f1676be2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

MD5 70ad4be2f9de5c16e870e75308bbfb44
SHA1 a49bd5204a630bd4bcfaa1830045660328b92ffa
SHA256 371bcda630342c7b2f751c741a5909a1232bfb83d613b3a4a7d11fc76a1a3c69
SHA512 88f43e980b9f282430450c61d550a20e0bf4ea44a33bb0e5c7a775ab9e12a5fa25531f3d7a70e341ff80454a6307d818bd9ebea5ce47fa006d8a44e0eb61e5e1

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

MD5 a905b843c9605c2cd6408c9dd3c34cce
SHA1 10967eda30049df5fc211fe0826f5c6eb4f8b054
SHA256 10ce566fa7d169e3c08a0cfec80ab4df623aa15f672d80a9c200cf38f8aeee9f
SHA512 1dab90dfe71aaae46ebc8623165fe1605e1eddc675981946fbbdc84c5bc1c3babe9529d731cfce59b6f23ddb722483c62274982f99cba23a4087df3a8fea0f72

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

MD5 e4967b5d6dfc087008947e77e4eeaccc
SHA1 6234819c7f8e8d071231d50d6d1730563af3b226
SHA256 574e31c96fa0e3450f09c58802029fa569a8a94e6001b4801ddff584d3b71abc
SHA512 e6f97dfad55be736ca6134e7f94ce43869506762bc2df07d2c129e56dc57776270ca0491f3c245e024e0c4ba2ddac17ba755ba12ddd5b9e5c741757cb656395d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

MD5 3afdc8399837786e18b7070ff091873c
SHA1 81cd6691f5d3841b8191d17a2ae6aa2ef19e790e
SHA256 c45fd394ad479571bc1a1c160ebd1ecb4df93505d1fe898b5f4006afc368c30b
SHA512 b7018430609d5d62ed64d3c2560a07add8c87e7ba238c610d9f03ee8c286fc051a0a79d3fd5be282779346805a443039a5b1543cdcc6237eb2719a1efc2d5155

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 8a80e49732e522a1c2d59be8522fa019
SHA1 e3c0a3867e8c68f5e3239a83dfda736b508e1137
SHA256 4163220bbd24b455980e98ab9350b34d20a18b2a6b9ec376afd530e933b7e303
SHA512 7a93e2a2770d119f6eebfd68ca45255e232984f9e5fc270f3f18c335dba59b7dc7d2283d665c02fff20461f18ca2ab64b8b0fb74385f99e400a4e49b87c2abaa

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

MD5 23a7126294f1370f831a0733867c354c
SHA1 d5ec821959c3d7f680d70f73395106561ccc2d49
SHA256 2bd2bb68b57c4a386fc5884776e47154dec4396332e2dc86cb6d594b31170248
SHA512 1d910c54d105473832d38c0b7d8af4cba0eb8f1f44977d445b520983e80913c5b8c49198bf11ef1fd4d726a0aaad281624482d9b0b5b005b3359da0e4ea3377d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

MD5 e139491b6c403f06c0f344deee82d719
SHA1 fe7833585bdf28890df21ac356d05e7ced656214
SHA256 ee1955c31664fc96389908286c20d5de58cc6937a384c2f7e967a88e9e4fb8db
SHA512 bc84e6bdcdc37126803fdb66eb0dba64e150a69bfe5534e07bb715b65fb5f1897fac7e6bc463afb4954f1d465abd9305ed481fde0d0d85a39d4b6e7a8f8c8ce1

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

MD5 589d6e64c2b11da02c5f8a2f29f3aaf8
SHA1 43ef335019994c42c212334964fcb5c157767b95
SHA256 c60a3a79d1a13e75ce9430e0af5eda4398c0b5c8058341549e266a977474fdea
SHA512 389f2e2258deac0e75ccdedd60bbe00a579311b974f02d120fac78917416f2a27cc1f96d12d9f9b230d66eae2b188eceee8e1753ae7789766c093cda12af7803

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

MD5 c3a4ad4be31b8864ebf81bcec5c5389f
SHA1 e50a16a3b30bb85e418bd2df5c97289adb7786f3
SHA256 e9e0ba0ced181cb1ba8451ca8eb1bcbba3ec01538df4e4071769b04ca7dd20e9
SHA512 50cbc80f65bcbaf1c970f8d16863b84eab42c68504eba3efda95f4b4ac5976fac3751acec7bb2217f3c75c177f65ec409fd5fc3ec4e5cc356a5c81518b6eec1f

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

MD5 f97da8e06fe7fcacfec6a6ef043d6b10
SHA1 fae3c62c468dfcce103c9034dbcdfe19b2f5d87e
SHA256 d131ab0c0e5a9366b252d63475ac02c19d4cc6fd9dd61eb290bb7cc4e4c6a9c1
SHA512 3991a16b4748de14d35937f9aba03e091bd58d9480845909be31d03a21837bac2c7060841d5425a01bd9f6038412f2187e845ec18a635de3e21618f73d4c3c98

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

MD5 51fb2197e704d9eee14ff5447a85562a
SHA1 0eb60c7d00c0593eb099a947fd3846f79b150e0e
SHA256 f76b7d149aca02561b0114cc09d7a260bd6b0edc84435a5244ac21186759ea86
SHA512 4a18b335dbda32fc9ac485c6393904d66b2d131f01e5c9be9091569c9255198e5f488950780a227d7d06f87fdad2abe60e6a2c63b3b6efb6c9763a34e682fa1a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 a127236f7c9a993610822d99d47b5b76
SHA1 3ec722f7a7f63fe6fdcbfa049d0b58b8312ba17a
SHA256 b61d408c6e1a816d637aeb48598e98267370bd391cf84ad347da9957d02efb35
SHA512 44b9c899bc864502e8e8816e5cdc78b28e0c73191ec291e98eddb8fad6971944340138389351da948dde51f9cdc1a47190ae86c27008874b535c39774c97def4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

MD5 3c86245daa56f6863ce06cc66a76d03e
SHA1 5c6d7062975df9f6e3e4cccba75bec5c438c1d44
SHA256 a02ec5fff00a47ea2756b84cad30b5d7affd326fc2dfc60e740f03bee9b0e124
SHA512 7421ec2ef487f76c9ca947c66119a23f345794142fe30667ac9f0760e05426da194c46b68750c551be7c54a07cb8a70639f01bbff7692ff244cb2fe8207d4236

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

MD5 170d8945fe3e4d88d593b82c5be6b400
SHA1 dc57a12933169573bd3fbe1618baba9addbdcd86
SHA256 9ab3494abc87e817a2adaf1edf775cebc13eefc92d37c5d831e31dfcc3024952
SHA512 bd2c58321b2e430c86220c2823d077ef51453be02be83097c2fe03352e5cce7865929cd658cbf9da0be2476a1077df1621369e95750dd7235122d962920007f4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 fa26ac757db91e5f9c6407a610cb4881
SHA1 d1d0a10604811481be34ec8add02fd5da02ed527
SHA256 6d1ee1cc547889ba38980dc984780c400a06d6f42cc5cc84c3093f9922391e05
SHA512 8c320b9ca6e4f2f7624c1602b939ef472817db42ef29729d65505104cbc665e0d3f464c5cb484c25c1887fe2c678541caa24d5f3bf3ba7d203784d01918eda14

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 689f885fbf5b8bf6322d824dfef54b97
SHA1 b31e38d942bb82b15b9c32fe250906012e0f2d8a
SHA256 ff1e67b52964fb807c04c416de994fe155cec51ff1ac9abc39d92a30fab036c2
SHA512 8e21b268d89f92b431a8f835c8d75064f423001dbcfcbe4c5cbf8f588000d6083051fdd6b8bdbe37edf8ee36468b4ef1358f2950fe0beebff45b22d53af4204f

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

MD5 0a4add18e3077a0c2ba5ee06b2b82f29
SHA1 57bbe96d1f8f710cd2346f2529f33db86b1074c8
SHA256 ee7a0a7309d364ca006ad635cad7497da75fa1f2ccb993a22a9508ac098c335a
SHA512 bd607f49f0330d386d183e59fc3b72ee7b51e3dca58e234b63cc3db09092e90bb9442f0f7b9ad953fca5f16bedab58f935277beb96e30d864234e43759c1c25a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

MD5 3c75eecc7d9e07f7fcfb4ef74a8b95be
SHA1 85b95638128b15f3609a906e3a6c7cb8002b7172
SHA256 eb6902b721ef5b11e83bcce896d1f511794b65a546a7192e7f041d6d296f3588
SHA512 238a8fa71b76e90a6e52e4f290f4d84316ccdd7179c89befe8ec49149f214f34b5415886b5fc2efee649ee9970bba33742d9171d45711c66aa2c286c60c7bf37

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

MD5 754159e1b819b419949915c35265e93b
SHA1 7973a3341338212a80ea6d5c975b31a0d44b3877
SHA256 4d1cdaa1c27d8db52c9e11cab21fcaf97fcfb010eced5071c8b6ef1d90ce0ac1
SHA512 b8ef8f047085ef7cef9c9316527c3c5b1eeaee508798421934074c47c2ecb5a7904798a0d46351f448b0ebb4bc5cdf7a73583de83040866b93d8dcc06f10878b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 5a5843078aa9b5be357559e23570c99d
SHA1 e74aec4dcfcc2e269895940786c536288e145d39
SHA256 ae9b737fbaae274a9a5d770a7cdd9299bbc1925a0536c6192e1568a642b2ddaf
SHA512 693c37e2732288c81c336a188986423d87adb76657fa05294ac4a53835ef17865e6b0b89459ffd33fd0fa65e10b5cd2f0802168a1b23a20b23cba57924239fb8

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

MD5 cc260bb21dc948f859f5f9e315ad2630
SHA1 9433e1db5c7314ee659a21f7786d11da0d5fa4ea
SHA256 8892f427223c44792c777d4b5425b2673bbaeeec590e6d553ea3752de161415f
SHA512 40a3dce0835ab1f2b84b9b6dd1a3395437e063e37f911e3bfae41edd713f8f718d0208ebd29798847cd126a089c86d30b65e5d64f3f3a9c669ea49d7e6a11701

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

MD5 30a5a461c16704ea2274b80005bcd078
SHA1 9d6e4ba91e216a4b793340b13b2e74c348400242
SHA256 23d7e72ea276609cf1ce93e08f68bc30ee11a6ec987aaf10733a6e9248d53a54
SHA512 c395e60b812d29d4a22413dfd0a9c809e3fb4251df559dc119825aaee6e8843ef59426a5b51e305d699b16b1006fdbb7b8644688eedf9eebdaab09ec17e45d4e

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

MD5 d1e42fa31aa0583d54867d1648ef4802
SHA1 b9723dc84a3fc1ab48308538c09c917251540e9e
SHA256 f4deb560f11cd3b4a802dd7525149ae93dec8e294e1d6a70b6c86f12dc6d9297
SHA512 7865e393f9ed7c18fd23800432f52fc1928a52e0f0b7e2c2dee3ce8fecc970728b6be732c742d5c373be283b1409a573841b1a19457432bbc9f63ecb09dedc22

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 d311b68db72b49744f83cdea4bc52230
SHA1 361d52686b6e83ec716f9d31dde5222fb921a1e3
SHA256 f96d289ba6e4a60b356061391141694ec1ec47980d3cb61ed2b75df2242b64b0
SHA512 2adc3b1b2db56d957f7478c7320cd2df68b6f403db1d11379843ed3cb6ca1f2386b0c1210b7cd46454205b9045572a6704b99fff63abb23157968aa0d9267451

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

MD5 136bda9c3b06a954d8b83beb7592b055
SHA1 7486408ff60c1d926611f3eef057d4a997626176
SHA256 4d75c09375cf69a6db7924cb5a404fb53e74ca2c36e3e3f70ab12e0a69ac5a5d
SHA512 fea7f188d4487a37d2d885e40ee4af24a0d2f4693aec9f9e440d651651c09a4873e8b73528345c4f9c5b64ff003ae367355153c49ca4e37fd8b3bcdc516359bf

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

MD5 f2c874bb352786ee860c4db9c81a881a
SHA1 cdad8e325e3ecd571d33a1416e8d4dcbc258ee33
SHA256 aef14e773aafbb8abc5b3edc5939c690d78d883489aaf4a867bde0cf88214862
SHA512 c932db857e96f496b16c29ae31c4cf8bcebde5736a008c59d77ad9bb12edcc08e1e5a4c71d739841685916a71c0952e5a93c2a32ba4069c11d6d57ffb1eb0526

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

MD5 8953a00357fd39a6fd5991fb60e2bf44
SHA1 60e866dde899138942edd74e5278db0c67f2baa4
SHA256 d98923c4c4b14baafec1727da2b1324307c0c85947498f01e33bcafcf03c366e
SHA512 b7b2a9bd5dc00494ecd40a4584c0700ebbab0ac9d6ec773580b4c6ca9a3f51f9a4ea49a7d3ce06c6de77eec842c20593bdd898d273dd176a4194796a8993bb5e

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

MD5 4a632b4d7dd783a40c7bcef66f08e68b
SHA1 f094f47045e066e50c800b98f7dd0ba20e1a2b55
SHA256 7fb56f22b407711d5b9a6dd2a2d1bcacb003c8d5850fc5bf02eb655fb9ce70e5
SHA512 5ff119f9a04f0ef287ab86859dfaf77f54aab87a3de7b7daf95582afeacaae85a57937d45ef728b17d64cf50cac9f6ad13bed0372de4b16833e2b10822e9414d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

MD5 a7a41080cd8cf116752bc06f002863c5
SHA1 f917d2a34d68e7252903237f3b0bba0ae124ef46
SHA256 d1a54c7d0e0909e94db78f07562853eb3acccf787c84acff1e03a24db045dfc2
SHA512 7feb05be4e0b33d996c035f193370bd475ff87f310cb1337a68984fbb230d55ad3ab64172cb6f5dabe22bda8493f53b26c9b2db62ccd339f395394c4291c5c85

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 a07141e7355d6af365d02218846afdf2
SHA1 5d473a206b401605deb08c80657d2711066d0fb9
SHA256 cdc0adf32d00d06239ba98d6cdd462c19314c2df4cda1ee8cd24c9c1d40fe44a
SHA512 da825db9c8ee37d36179dbed64633b78fdbb1ec989b9f25cbfa8fe41b935260ac74bbcb34996725a42fd14796560038d9f936ddc98c97cd57cb0003935742c0a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

MD5 830454f2711e1bf8bad601b91895b132
SHA1 426b8a330fb92f04e9293735d14335bb2791eacc
SHA256 37132e3f9634f8df715c382525deb3883c167fc39ec3575ae2c04105a1411d48
SHA512 14888452b08d1b0c4621b9d443578620525f4cda8fd57d935a7c8411005ce66995257addc41e056664bf6f4863c4d95fe146ef7b38be8e445a86f9967bd96544

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

MD5 1afd1004452dc38a90f5c0308d2fd199
SHA1 4b98f14ec9daf4cde50e46d6a81d637148988484
SHA256 da45696ddb6af468b16d1f881cbdaac1dee310aef10b48cd2ea35ae8b8298f76
SHA512 a550b18dff63bf31c20e193d1215357b69753b2b950accb84a9edaef4cb334e5b3abe002a1b3f20129747087ddca988e11de6ab765e0c9d1cb0e44cc9ff7a5b7

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

MD5 fdeeab475b9160961bd434e2fb144c6d
SHA1 1273b0b7bb01bcf6950477307e43e573fe7acf7d
SHA256 74604f00e7e04f834a6292c3bb4db70c71a9d87591307ad076c9cb45e19aa5ee
SHA512 3b3a1d8aed59618511e16d08110ad7478eee1f8789a6d6d5fbd16b3a24e1ad5df3f75e213700a2aeb58dfb52d4c984623ffd9f41b60b623a04d084389a1c97cf

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 e8d665a0005d26ca83cf16c2bba30bf7
SHA1 71107984d7d16c25e496270886594dfdea052122
SHA256 8fecacf11f8289e5df27a51d043863e281eebcf83b5951660d296933a326930d
SHA512 fef21c276fc1eb15a60f9f89c87e4aeae78330c02147545232fda128b1127d48e1830b4c0ba342d4aa5f33af68e7c0c680c9176af22995c981fe48387281ead6

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

MD5 151019f6821b9453b5963f6a00d2e105
SHA1 54d79202b864a3fb5a04b2b6329a60921ecfb0b7
SHA256 c02ea83d6fcb43f5845d869919f05f560e0e005e433ed6fc53ba2932ad2bb98a
SHA512 f3a2a90bd9be24a1f7e1df05b49757ee1fd98023926671ccb0066797785ddcfcfca5d2ff457b8effe652371c9bbd066b5634456e458c7ad989451e819cabb3c3

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

MD5 306b3b87f20fbaf912ed80189361532d
SHA1 fdcc5b37d7c126348a3c3ed263dda6afe47d98ae
SHA256 571f5becefa6120c68f45c05c46649891a7c5d9f6ed2f15a2b6226f2ebe412c6
SHA512 e9004ba8c813252612a3487c7b4e5d704fb201d46032debbc554356e2d7c83f7aed128934cfa7b2e0b2273c8177307da268c3816f5c2003398b8bb359599360c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

MD5 d50ffe6ae36373bca7b8b3e4e8c14b68
SHA1 6bd411c9b7019c248e167119019af19e048f24dc
SHA256 c61803488db9f75517a93b29f1f9cba4e13cd11cee7a654846df23e99efa3428
SHA512 09fc311f29c065ab493f50c01c3bba75c7bf1ad08ce207b7f37068de4a8e71f0c0020349aa81360f65154642819669c75b1954677ccd4227c91b60c46f1a32e6

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

MD5 0dd721f40c07216af8fd21230972e6eb
SHA1 78b652acd340864f086863236d009c4223b47047
SHA256 ccaa061e7c2e36c2f89eb369b0f97f4706b6e0942badcb7891ac7aa7b898c20b
SHA512 d348b889caa05a117097a2947c1b6efd1ca5f6d924dd38744ce0b7f2d1dd2613729d4b2e5a53d018c4bfefb08f23dce1bd0190c2de794940347bce648cc9cba2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

MD5 ee56eabb429d004b40df10d31d74d05f
SHA1 e6629d6aaa3a8aa6a1cfecff4748ac8f2b709279
SHA256 46f0128b7ce358d4cf322aa2a87d263b814bea0103ac1d427f3d3eedab9cb080
SHA512 48213e8a04710b72c5ec7444055d0a484ff96fb9537f8cf189f7f5a5da45c9be038d643a05f5dde2241f1cbd8ddfaee141fa2259ee515821d49249c2873b007f

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

MD5 4044685397c83a88777b1f8721d275db
SHA1 ca74b42e252ec54f3699d9e73a0285711e6eeb4e
SHA256 9a1a4f36416b0907fe326f5a7e8a388159b0aa5ed0e990835ea7d409d830711c
SHA512 e128401efb32aaf08f3487da847437adaffb4859a3053a450b912389e976dbe21ab2df3a8096a7c372f24adf29e36d6f89015480ab35dbcca5a6775417c0124c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

MD5 3399d55c842b80dbe4704be4bbde6216
SHA1 f3a2c971dd8cd1880863fa1571054988418a0ba7
SHA256 d0d6745861c9a2405ca3c06af58ad521704086d65150aaad29c4e7063eab7882
SHA512 cf4ec5559946120c4118553909de58b6ec939fb282eb809178e48d688f29ed69bb8a853fc9424609db1cb3e0e5848b639565bbafa9a4f30b753bce47ed4459e0

C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

MD5 3948aa8539e5b626294940f8fb28fe20
SHA1 eb5db8824f6683e6c0b0abe3370047475f8bef74
SHA256 cedfe6417ec1aa2cd1f9b69a3de536f93da76e90b0908e636afe29a21589c895
SHA512 75632b772e7e5fa7cafdb10e07933e059db4147c535604d7af8cecf980955c4e5a2bd60a039a55bed6c8cdae90dd71b2ea44e5c813d46ed0ff7ce3bafcb6c91b

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 c08ffc332cce550c8c8cce9acd9b8e56
SHA1 210dca643b76435997407b351d8c33f301f7ce80
SHA256 1da5c2956936887da04cb7dc08fb9acde9ce3636f150b137c46fde1da7c779e7
SHA512 1ebd61acfd4e815296490cf24ebda123d4622a0e9f525ce3fa5b522acc7b2c8cbd1ad1fecc5908979f2d4a505197317e0a2aa4f7caeaabb8eba8726107181887

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 fe671403b987ab5accef3fbfe2047f07
SHA1 bc99e407b65164395246a2bed471ec0da992cd62
SHA256 48244fa13e0c259ecf78bd6a3c18d505c00c37ab2c2dc2b8d57e861ea79a044d
SHA512 68c47be7fd9bbfd2313e54eb43e9684b4fb7745f251a48c80a62f8a8505b40f97a47ad8111a3314f357f08bffd6359958383a626dd908fdf56d11d599b9ebccb

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 0e9515858e011ced2cb980c742ce765e
SHA1 5f5f919778a7a31f0349702449e2b8d4d34ee187
SHA256 cd799019f3470bdab4007744f6e63b6f6dde92a4570580db3415a7a44c4f139b
SHA512 ab737df303fd93e0d6e3b9fc3866042770eb33ddc8083e134459814fd34df6f7b50dfc6e38f8e7be5e2e50787c2ff241a81a90507f596b109affdd1d3fec3409

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 2fbdace2cab12d9a33603b90f443143a
SHA1 2520694a31f3fb07bbebb6e8d4dac463cc082256
SHA256 64c342b95acea5371109fc7bd7d5cef8f5f4a3831322ed6b15d703d213ce6b89
SHA512 d5f21315c3f686b5e3ec21151e92a6365da0d1bd48d0571f557af5d8bf3e6621748867ccdbf72100f0daeee8b6538e5ccc9d24cc7294bfd3449af1b47271c87c

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 876074938c1749e3a21cb449bf2a74b2
SHA1 e3025b4b55ae337d61c666dcb68db42f459dd4b7
SHA256 99c58aad8cb70ccf71f2383f9c5ab036904cbcc7b45c8c6c57e7f30e47df7e54
SHA512 e04c9427777230bc9316516a85f3be693c614ad0508d27da54b81075821edeace179895dc9af3201f1d5508a6ee2dad26ab8c3907d1fb1be55ffe891a5301613

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 8a3320fdaffa2a45a129c6693d62605f
SHA1 b8e3783e1afc12568c7f6ea2614d5512515f6dfc
SHA256 38278c4c6914fef3cbf852c1b69b8fee9529c29975061ee81a709e55e33c7ed9
SHA512 8036d34890c534358fe72425f9514a6cb41bed2e4e5da6c1766ae34d3960fd96144c15f0d45380f7940b55edff780bd26bd4994deb89ba20e92135fc1513a410

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 91a4d6c6636af984146b5c7d3bb8e656
SHA1 4cc1b1d6718d026e593308cd6b428fe5d8f9a785
SHA256 fe341db5ac529759068a6db8ac08baf53307e8e5070c412eec2377f67fd7ab06
SHA512 1ba737b7dee0fc7d24420a389213380b373507a074a563daea587d477256906cf243abf8648aa0012404dd4d5d474a67b1545e60fe70814a4b924ba113147d46

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 d4092f0a1fbe2b8b5cf2e857f013fe1b
SHA1 244af27b1ff642425673ceac6e89a1a56ae813db
SHA256 77a1ded56bd6310c2ecb0aab3c9d1c0517b84910ea15b687862b6ce889da4204
SHA512 35b855383a1276a4a56cfe964b07ccb38e2114bdd3a207721bed32eb76a1a63921417a3fc3346c8b1c3a04796b191161e36f281fb4c35cd53fbd19560eba377a

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 49a82669da63cb19a11790ad1e2107f5
SHA1 aadda7f348cf2c3a312cc23c7270a57f5b671a74
SHA256 8027b0ad6fe314afc9a6c650fb8fa89d07da225bf584b144fba42ac1e95009a1
SHA512 8c25d4172650d82251458d34d4f3f6a7510703bb5d04c3e64c9a763ec065fa7e12f1741638a485f88f23e19ac7fdb6c941155f906c3250bec396c135a2d47b4f

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 f3d81b3693cc2475cddc048d16b8187d
SHA1 db31409a0532847f56290bc636d01405b5d8700a
SHA256 d7c889f0c416ecc6296e2cf571a60dadd8f8ee0ddad5937464f58eb952187400
SHA512 0df8d89e04649524e37e1d841971858fc17ca382185300908cc3f8092b5ff9414eab1e55727b7ef59354b5ee537ff0bcd6cd028542a944dc85c6bb81ea5ed204

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 2ff0ed382e2d6125d54ce13103dcb2fc
SHA1 215a2dee24be38b6d5265955ca9e6e814af7330c
SHA256 1be433fbe5627947e3272e84af629075180e526d8e1f15caa34133def8e8fc0d
SHA512 a334358698b21c2bb6a79ae71c95ea7fbe4667f12845597b9a2215d5195144d8c1e0fc42b79476c7976fc9c9e600f41caa7c42f787726dd11d2216f4bf15d55d

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 c0f3bb4ce95ec6ae5d7e25e245387583
SHA1 6acbbc8a3a97adb49a74fc4809796a1c3951daaa
SHA256 15a29f73ec4c8868a4beddd6b593cca47fb964a29fe74784445dc33a5d0d7f5d
SHA512 2c59cdae962a2da910bd15214982fe092a27d7feaa12097c76d7f80517447fe23305ed2527c041ac1f20e8a1fe7bf18ad60e79cd502612d4348d06b593fe88d8

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 427a97a4ee0dc00b83e42a7978ebb53a
SHA1 880f1d6e05dcdc51fa907a4c4dc3984f68616388
SHA256 b37e4208074bcb2c53cc2f295f0126490c9cebc43cdb7b7f41645b1eb8ecffe9
SHA512 9f29d4dfb55012c62e54194aeb3a600b50678eb830d5349fc5f9740ce22b2188fd4d8592d5400a48f3b3d514d1c53c3879228ad147b4d5b9f0c7fbf2d6416e1d

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 975b2ab7b36719912216db22988b39fb
SHA1 c6e618419aac40d1aee1deb861ee74323ab044e8
SHA256 676a4e557fdddc89a2baed19ff1471a7bcef3cfaa887dd7d993eba1e039e3a77
SHA512 ed5f7136ae783b653f58d279520e3f7e26fe44fd483b8c2d4ce5f3de1c10985ee23e9ff6102188395d6163bdd64c30119abee3d48b1a4171b2cd4458b2a6b7b6

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 017d03de551f852f5e8e510fa588c720
SHA1 3acda5cf2449e510d5832070da41850051baf00d
SHA256 6ba7bcbe80ae6f1477b3717bc77d005fcf3962a270e38f23bbcf9a6f5c2d3b7f
SHA512 37d1dc0256c4db4f9cbbe107abdf9b059a3c86a880fbcee90e70c535a3a9201a44f98f6fb4be229a4d380b600668e8afbd01bae63a80c02f97499351d68aea46

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 709b0e2cdf01a9ae72bdaca833def9c4
SHA1 8f447b420b63182ed3a9572b3d3de4002789d3b9
SHA256 0b508883736b2fe130911761e9ea23e7e3e99ed64e693d63cf0b46b9178448cd
SHA512 a838d60773f6ae07b2a593518e5298f878872ec7118041c8d125e4aa427d12d766f42ce799e78c0ac9f327010d4ed5e640c2c5afa7557d75a80d1b5fa78c8dff

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 323a0cb3f99919ce1f23ff8b229c94f0
SHA1 a835fdd31fc08d0f313be900596c22b0c2386ed0
SHA256 c9fcd30498af06322ac96d693d7277f0f120e0350864e2f0a152363452fc5f2a
SHA512 7e3afa17fe4535fc368e53d6185ce52eaa99ed4e827722a33f5872288e0a7b044cda84e5902a5f51ea7eca9d1aa2f24d4ad61e33ad20c145b839cb6c891e46c8

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 3d5857ff5f13b2422338c7926f01b932
SHA1 51122a5b63d0537f161d23d71e41aebb54f0b900
SHA256 232e1360677f461d625fc7aedeabeced07b17ed522d211613e3bc42fd0ed94bf
SHA512 7e56e061a0a67968bd1df80524e31878a95e59a081d3025a53eba8ec00c28a575caa21eafe6bf5295a381435a522cae914dace12416046803441f4bb2906cc3f

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 e77c4cc535aa13f3f426b0b2b0d932d5
SHA1 ddf7caccc636aadeadaba075a7f0bdfd8fef0366
SHA256 e9bee75d4a2d83bb52c1a41d46450663164432e9bf733c544167871a41a67fc6
SHA512 d1a5f5d05b32d0b784e5375d78ff14a4d1da632482b08ab90543db1d0db8098ae969320d80724df45082d8328ad4134eb5097fb105011a51d2bab6560470af34

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 8aacfbe365be2324385740810ce4fd3b
SHA1 3b67ecc3512a0df063e118246a9f2b75456f8e46
SHA256 fdca25c710c2350d191f21418fee48ce347175140ea33085dfd61bda538845b9
SHA512 43976d64467686ae561d6d756dc6f550ed2d4115f9df8502eaecf4f15e62692c80e04c824b33ab6fc3af1ea5eb24d475e2e9ad1235e15a2714eca3c1e3710a98

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 51a7446c4e69eea99d7b437922b4a0ea
SHA1 2f497a9eef85c76d91a2dbe8c50762da3696cf63
SHA256 56d38360a8618302c6bb691da3ca4435677e75ccf0b8c8f31bf501c474a1abbd
SHA512 fa4675cfa71ee79a5902c9041fa8a81060e672fe36e5ff5ebe824038d1d33cf4736bd34d946efbe6208a7d48c1a3666c963425e6db509ab560dfb4e3c24c9e8c

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 4547cd2f76b4a09d875700d84a64b02d
SHA1 38d7ae4d83aadefd6fbd50c801c6069cc538419c
SHA256 806408f8aaccef5d7b8496f6d8bb910f2eeab26f426cb80b210aedaaceafb968
SHA512 3c6354f63b6a637d139bd045f3e4ab118f35c35e3a372bcc1836a701f41cb13f9f76764ece1f567e3cc9f2fccb9e144e8b3cbdecc0585fbba909f97dcb5cbefe

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 22fa5dd124859322be234c6ba1a8005d
SHA1 a73f6efb3f1f08824fa31f8545e969c0e4ca44ab
SHA256 4be60986dc56062efa2a8b4b5f62452311f889b4a3ab237bc2661326a878c658
SHA512 8f2c4119944e5354b47967bb3678ed8f65a82b415a886d5c90705023bc64b8f3c0656aa92de35f4e718e112ce6889e6b0c428aa7e48a9753f75300da2b677e4e

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 d3fcf524b5350398d9f3388f048d0841
SHA1 2fdea4e23080fbef3fd1cd56d7412ae986cb09f8
SHA256 b578e2a47de2add6b455b884835b1f10568d5737c3be23d960955818efa46307
SHA512 545dea236d24f8563ac40c563813f5c425e8a6c68271251276a7de52e4fc14defd3cd814d530e123d6fb319f01dbadeb2d04f776159869e8ee6e33da8c6c9dcb

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 6c1c736ff7c7d27b8842002a897eb407
SHA1 679bd1aca9071a0a5c897ae0de853baff7311616
SHA256 f28816e393ccacde61038fb971b5291c27ea55867d2b17e60ad98b9559a94d39
SHA512 b016d2e9508cf0640a2b1604d0d743cdb61e5287b545d1dc7c051e48ab5e967314abf1fed2f45c7f91e9afbeca08f50da20977ee06795e7133c535e3ddcbbb77

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 f5292b9c402118981f232203022a2cd6
SHA1 8186cbe42807664958bfaaeda6fdd5750f4b57da
SHA256 6566f7cf830a2fda0bed2b2cddbbe217a75bd5dd00f16e4009775051da48d326
SHA512 80633156b1b052fa5d539d12dc4b0aebacf58ee7303b76e6c0ff024a58615f3b628e981b04cb932a6b3e191db73137cc9a32778c67a355edec9098e68ff343a7

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 f3cfea1b52e8bf7c0491180e096ce194
SHA1 e64abee30024f3d52b60dd94c26a785ae7534ea9
SHA256 43961d482c63afde49b4591646b9b27bc11503f99b73c4160cc98569948295a3
SHA512 deff04148e1e38f88126ad4d29689417a3e68be676510eec31385a5c778851e72a961933c28fa8e76de479826139e025664a47960522dfbc6ca48318615a092a

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 4dbb8bde7f51fe0721e428803d6988e6
SHA1 03358fe242d2ce6521d257ea679235aed37ebfa4
SHA256 1723eba38b64c77d45ef679bb3bb8600a541502a519221d0f26bb747aeac1177
SHA512 a8024b465618958207130fedc30eb41ac11088048e006b6fa39fdbf9fdd62f3b7bdc163c6e8b88a185d943b0dfe6dae1ce7a85c86ffbdc778e11a8af88cfe88a

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 5abd1b10a79a27a51dceed32e97851be
SHA1 a604811dcb4456e20e895d3899bd7c3f650c7da4
SHA256 ee94d2a5f2769fa756150b4444591efbe87d7c440458899a604b8879de300ba0
SHA512 d489cf14e7e981e39261177a075f7666fd4df8faa1d9ab0911666bd4293ebbfbe2707e449b465286fb9cf87f712be53c8d541d267ed650637f3ccb33f2c45c59

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 3a7d8b830d5af8ae10309a0ea126f388
SHA1 4a61f4ec63db6ece46b7b21c0193436e469ebd4a
SHA256 acd3af03e8dd79b72cbd16ddc8e1d4fc18d5ee2f7d559f332777be9638d4a9f2
SHA512 f2e2ca89baa150bc9afe3dfa51a3b72150f93d4344d9024f01a3cc369aedac3ca78e7f1b6ded23efe21e35b830d371663a08e878f9612e05f4a1eb6b11bd1982

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 12e3a6ccf0203c3d223e87d62e881971
SHA1 7d0d3bcde172f6e00bc28745a1eb70cdf87bda7e
SHA256 9295365479c92422b1dfa70b7b9a37ed601a63bf62032f86eb2a50efe27019a1
SHA512 d868a51467027582289dcc54dcb3887cc62373215b60611011bc0ce8647b42ddde753802fe37d0c1f24d4722aee178b64a4830c7e99fff688bc108ca5f4b2768

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 f4315ed7a1dc6054f370a9ea37292e97
SHA1 42582856208e1865e254f267efdcdae3683ab23b
SHA256 542f4cdfba71726b232896f8cf8cb0f6650579cda057fab3888e60668cc275f1
SHA512 944c34846c6144a98c6fd3c134ace31ea2705b71cf150024de5be407313236b77fb0c55103556d4b3c88220bb0cbeeffeb0240ddc4c07f94673d7e40ddb97fb4

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 94f884e05b37e73c0e26812d02ed5ab1
SHA1 fe5c931cfefcb8f54cf6486d560ee365f0c52ba9
SHA256 3e6315d5082df033abe574bb0601f28c699931b8785d49a355ef8133612c98d3
SHA512 a2d2f34fc5ad98c9e46b8bd9fc91dadb939b5d1ab2825ccc5e61b3e41cf62a71b55a6a881322de603b57f36810a683d679a2ec4b4df985b76f2f6c6ce0442b9c

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 187ffa395012c38309259e6557768d38
SHA1 10f2f1368549aea8c1d11110194efe7299c7bd9f
SHA256 6d3187c89c54e76f47f2477e86013d50dc0275e1aae7a6bb5f7d7be1d2bea2c1
SHA512 94bf808a658876ff9701fb185977fc255f7e96ceca1fca4a7e829a63c1f52b09bb04aed3927438f57b08b9c598adc655088d9c62427e5bd83821017526acfd3c

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 a533b74baa60960c8b526e46ee471dd5
SHA1 ef4475bf5e73ebb7b7c136c785c880068924b104
SHA256 ad9994a75d61b388c9c29861ceb19adb89a88703f6ff6b3eb48ebb976e974105
SHA512 594d13e95382027f9eae0b496c72b410a7de68940ce957bac3c5174d3ff9d26612421122f1bd776307290fd43e5003b5a0f46bb473739f1d7fa6d752743fc52d

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 fd081a36377c6c27da7406bcd22378c6
SHA1 ba31892b8c8d0800147aceba02988e15aa34157e
SHA256 2d2921adb407e9d43f544bfb9047415ced297dcb6fcca4755b6e35ef402363ad
SHA512 173493eacb5df72f21deba05764e255369f0faf7c86015b0458baa0f945e318200d9bb12d280ee46e1ec4e0de0533945383cf18a8f12056038d3407eb4ff3aa7

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 a1da8066d3ca7964ac1f85c0b0ae953a
SHA1 b079281a98e354a55f0fce14fbbed29ebf9e279b
SHA256 c621c78a2b612796661b5ec67988a7079ab1c9737447619123cf5333975e0183
SHA512 16dd992cfaf4533fd23437049abe4bd96681631f3ca20d6564770954f02f47c99d39108c1e2f929ebe7942d492f19f6c02a0a81b81e111ce7633da24eefe2b16

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 859794824b21ae7cf863ab548bbb4283
SHA1 81cd9ba5a1e344889f4a52071e68ee6b9a81d3da
SHA256 23bfb308d8b1a66fd15d8268cb48f0ebad36542d66c65bac0948120f4ce97d21
SHA512 3bb393279da56e0302c5c36eee2947b379430f48def3164ac83bc2c0434d21c0ca16c6b08cfd1c71245d5d5300e374c668f89cb03a5ad18496e856ad891ea0ba

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 70d11a54c539c055edde20ae26746801
SHA1 0aff951e6b3b5fdd99a3b0f0238ebe7c698855e3
SHA256 36775f58c55c023f30244889408dc46a25d3ef7182eb72eac6c4847f295e9d7b
SHA512 ce506a7cb5b8b98c31ad7e30b81fe015a7d5965e939921a6b4d3a04b8fbfefbc908eddfcab74fea28bf81c2ca03112f1128aeecb19d7ccd76d282b7c1eb8ff53

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 e28889d2b0b74f6edb93d9ee4ae4b995
SHA1 c807c56c729b3f8b14af32464881158d90e38d5a
SHA256 a834e21ed20e61ae6b8b3fdd1e177179ef93edb3c99b0e6d728379851b066ba7
SHA512 07eae0f79a5f0d7a025dec5687964b7e3d551dcc10078f85ece27125ceae1d337bffa90551ec7a1759c3b34e5ea28b44f48b8655fb309a53258fa512f981a437

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 737a8a94c4f20f01376522fd88dd3b78
SHA1 205a74de2a59483ffe82fcadd68d0828b66b5208
SHA256 0a70ae85116343c56fbe6b12049ff4f91103b2615ba0a3a5c35bac50f64d4f62
SHA512 95ffd86d61e3869a0e11fc55b141eb5d994551aa763e02b2949f78014172241e4566178964a45ede3c0740ed5eeb5f9798764fcd977119f266935b41e6e1e1c4

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 4502c87ce9d60ca60aead6ce897c7d4c
SHA1 f81c0aba42afb49c32499de4fdcd60c6ebd33530
SHA256 324b3e3d79d96520f356d03cdcfa3cf3ab9f52ac79985affc625a52d32983b49
SHA512 ef71cb186cf46b7d2c926d8820d6484dff06103eb5152058c8571c847db3b90d6d8af8dfd6fdba3bb587729b1db1dea97e3248ab3c015f8ccef1e1aed104965d

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 be81878826ac26e7cc04b5de6b355f5f
SHA1 4db174b7c360d338cd8f41ed7bd4cfcace8985ca
SHA256 a78074a11f5ac520541c0f683dcf643eaf6f7e97aace4cb4bbb07136fde1fd68
SHA512 23f273640e3f4eb5521bbc787515700ecbb06ecba20d0080d81a1e936ae86158d6078813e2a0c52ef8e3d6ba9e08801af5bedc81c0ffb90e1dccac8aeeecb773

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 f6eea71a121f9d4514c5e6d2db0434cc
SHA1 b6ff70a9470c04261ec1a421f169909e9dfff539
SHA256 173bd44b04c71dd9c306d61cf2863ea466ee56262c3da0e9422c865636c80abe
SHA512 512b3f460ae5176d367aa70571f136426fac12c0d1ceeee577a24925ad42337f884ce70f770694c5e936f7d171299ad232426fade6841ad23ea53fcb3c3bfd13

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 4a5e4df7a1e23e317e09163a2cb93b7f
SHA1 a7e3b22d5b9fcaf82dad07b25ab435ac28e85315
SHA256 6f6c69af5c8c863ffc27c735f53b2a64f736266a95219a2a6f8b84e29f22749f
SHA512 34d50c11faa622da73ea3c7f5e618beca1acc62e4b38b439075cd48b01624f0215b75fa8e3a7fc8658526d74e0ece92c399c4bf9bf6821c499dba9ed2f4da041

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 f305bc3ee71759d083e2b971258a8fe9
SHA1 c2b505cf4c15a63f9934cb15bcdf1169bd77d7d2
SHA256 360f3d7e874c8da98beedf18c5d964535b5dfdbd04135ac753c2f7f71c494347
SHA512 c62b1da2e98e7c4747adbdc8c6e6c9d0a52f57e19a4373b76d588b146dbc8690ecebb6648e269a8dc994f3c7823c147c257f8323bca5bb6a28afb60ae9e8516e

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 7362cc14cd710420c8b8103e8c2277ff
SHA1 da39b8deaa43778f4b0d8a47125e281555a38306
SHA256 ed69ff0235dd1f09761243dd808d599871e33e09f3397bcdd36bd347409dc71a
SHA512 58b702751506d03fc50ed25fe38d0735a85b2c880318b35d18da85ab59560a5ef090976c2464c2a867a0c4d9a27d34bec19a763989058af97750a6f7ce2bb887

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 85b7779a4e563079f1a019d227a8ebdf
SHA1 f05194feeffc9f2d12767569e544c119d2af5569
SHA256 bab3f54eb8ccd2f1e927ad0ef97ad7a910cc77923708dc703159e56bf863b8a6
SHA512 ad90dce3d1e0c6c107f6b879bea250a0d59bf665809fc2866588ff900678acbc86437254579c8116c221de423c48e760091ef5bd53a417c4929abf5fa5c01cfe

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 18f331c0722bc0f3955e4df4ac0b9f49
SHA1 0c994cec820e65ffa1694477c76e41a46dcc9013
SHA256 ad51f3d5449e8470c0203cd60b5d760b7f948d613205d58f836d374fe9639bc3
SHA512 ff4aefd8b70a6d9c99ec7f9ce342640ab08c38084248596ece278250ec80cd3b0aa54ddaccf2217ad99b61635c8df750dbd320773da69701c1fb82d64d29587a

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 6f6233d842eca98751d7f4e376a8a5f0
SHA1 3f8f7f1f3886127f91838c9eba76c6defdeadf30
SHA256 ab7ac7e2113ef3c2656edcd8d456b9c478f01b020e0628d964f7dab25cd7331c
SHA512 c8974f4edceecac26b53b0cf1d35160f0d11c0163631e001d19f1befc3f08cff39aa01f223cb919931c43736a55ea87d9c10f1db55d487314ccc97569145d872

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 2487d4444b9594bb3e02e6c231e8596e
SHA1 e600e2320d2138089e500351aa68cd4708eae1b3
SHA256 4255626a44d4615e12d5830a89e908ee727df0cb44cc8bf67a116a462d87559a
SHA512 f91248c11cf325cea70e49a997e81eb487198225274ae1faaf75d794dc5d20a2c74fb232c5e631a4f82b6c95fdc78702bc2eda75c372467aab6229fbab1c609a

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 6554589a899cbbbe1c7aca08b44b16a0
SHA1 29b7e88a5192762686f123e7748a4c171d6f0c0f
SHA256 df3d58a644d285f7d1c66be1899573d1397504ca2e60d10679ee1deaa2f0c135
SHA512 504f5c6ceed9e5e2d5cad70ab64545b05b51e1fcb1555615ba92fca0fc8cbc889f999a93c1942af857b89e08785f08f89d63d9b0ce7f1e8f0c0b9a891548c5a8

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 c5b3a02eac2106fd21661175789e8f65
SHA1 55580261e40d40a24c7b79bf016a8e76312e8988
SHA256 560e01e72c974d4759b1786947395e7aca3d26ec2219b2a7d09e5e1b94416723
SHA512 dfee8d7f1f8b5927f790f4ed76b8ab4a91fb62d83910aa677030030ccd14ae85f25a1c09969e6317cbaac073547a7e795d0f0f3436fbd1793b720d5add2c0bf1

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 91d355d04731ffc1a1ad50f7c2cb2f3f
SHA1 b974934c818b3ba9adb5272e81160f36640cd3dd
SHA256 2aa47a0b931e84a7a51f9b660796658918e38b5892ba8f882403755a0560b082
SHA512 c62ab66ff9fdd22cd39686868ea3767fef60a712c5c914fafcb0b328a27c9e35b46f41fb91268ac9bd4ef9633613bd2a36de7f2d0af15e3307c4802daf80a6be

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 7cda06a7b7d6da5c32146e189a5d24f9
SHA1 35b15c1edb3a8c10139098c9445f3f3fcfd0e747
SHA256 b07b9a307ffe44abccd56cf57ae53583a6389fbd24c92baf8b7b405fd71d549f
SHA512 0880cf023019fc469dd9820e7aa44d2265e22e8cc244db8c321764ad2f47713382ecf25c11c2fb8c69500daf19ef7c986d61adfb79b1b92cf9d9e526cef368ab

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 d4452c41ea2580fbce3e114c36873692
SHA1 fc74457b48c6b9c421f94f000f162439ae6ae3f7
SHA256 f2720b4b31e9ab0c9c33fd42131bad09752f1db25cc3e391a262bb6cb57fba88
SHA512 965e3bc4933c194f2f984810656640b72ac8a6ede32eab78d3b4442d91a8b38cee1f0f30a932c5c217606d34e054cb0518c9bdf81f87febc9cf2a13075761bc2

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 130c69abdca86bffbc34d7a6789ed202
SHA1 6151db1279a9a3c1b0f9b3991108a146159914ab
SHA256 f8c477b1ead9b5d9d24f4c1ea017c11f98913cecf21f52b2174cd88cfb17e77e
SHA512 82e3016dec491c41c446ea70b70c669ef7f757e191697f7a5be219be090aaac831466a23231e87e92c3cff01b3475186aa3bf63c7c8fd66a123add5c29d61731

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 90d8e778dde8f2cbcd229ed98fdfb111
SHA1 1d4215db31ba89cd2b5f42de2af8886d516d32ea
SHA256 9407906f2a08a2f1fa78df8bad1d2a0abcc5a2c442645da8751b0155aacb0ae6
SHA512 cdaaacf8c0b8d3963e5372f0c0cc6f8dfd4624b7a7d23c6a884db455a5fa92046a399de2d330a2647af6d44353580aa33505ecc8ec8ae16d9e76dceb2a7aed95

C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

MD5 ccf71e0549adf49923a41b39efc9ad7f
SHA1 e448afd8bad94a82c1fcb3c0bff8ad8ced8e02a4
SHA256 b1e579651ddd134b830e88e523fe14405893308f4a0360c3d4204ef8c5cc1d6c
SHA512 bf14292a76dc17239a97c02c4d5a94ddefdc06601486485aa6c743881e9678802eb6b5bb605046aca7ce41181ea7e79ac664c9c6cd8fbb440bce545793ef5c1e

C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

MD5 50493668dec11ae59c6687cc44383e9a
SHA1 dcd54d1d1a3188380de05edbd236cdd07336564b
SHA256 917a8b46c74a684be9383322efd64bbce405dc9608a3a08779a3dee2fa3ccad2
SHA512 a56d1df0db439ae8b26a219f13a1b9fe19ca45b84e7f60fb782d7eb5f4d443d4af08bd8cfe63e16ef832188a2266c6bf2760d12aacdd6e96287dc39ec5860eea

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 8984953278b5863bcd14a78c2d9b93e6
SHA1 66d10500e915b93e67a8f1277374834482ef39b4
SHA256 9fbcba20074eb34c7ef52b6b66c8046405d781fcf817e8d54a7fe43f807ce60f
SHA512 03458275e938ddbfbf4a63e4e555f22c842a57a4760c8a242d9c02d91c726a76cf36c8d2e83e51cfdd4de375b9833be648fe3efd9a48412f3e8d84c1992c0ff1

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll

MD5 21b739f3c3bf859d049eb26c9a65769d
SHA1 2fe833815d19ac3cd106ad9e7801142a867fb9bb
SHA256 8ccddc406aa9cac7a7289034e449e30f7dc0a70b0f5cf6585bdf15a38fc735c4
SHA512 3e7d1e045f9ad95aa17af68ca832efee40d60752e08b5084ddcbe3ed067bf69407899f7c2e455a4bcb46a2c5b55a056c90ef57474c0d65bef240e073ebdcb73b

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll

MD5 3afe42cba9a8775a641314b8b96520fd
SHA1 dff93b19a3d0c9653bac43f2cfd9ca14556345df
SHA256 63a0973a54ce2fda21a3e01a687e6dfed5146dfc718d9fd964eeed86a5206e63
SHA512 4f114a9bde6dee762d6e75676665601d442f10b2fcbb417b9b960c5dc537a6e984eddac0566baa02ae735179758c831bf93082640c003ef5d557dd476c43e35e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

MD5 a9a4324037dadb655932ea50f98213bd
SHA1 c9623ccfe3b0764fda3b0da89fe743ff8af8a124
SHA256 0f5bb7f89409adddfcf7527e97d0997957a1bfbfda1293246a457b2e5f61fd5f
SHA512 d1d2615a82d8593859ba21c5c611c84d439d1929c90a2be251c3da42f30cea1128c2765f70feab910005cad467e56b073bff5c48dd84f5bc9472c10cadf79cff

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll

MD5 a931cc533cf0b53f7cc9d3511ca6e8d1
SHA1 62ca2a7bbadde71155c30ed8e385004c96d60c6d
SHA256 499a86e3d249a1343110338382bc35ffc651f46b6b83c2a9e69336e109456408
SHA512 91f6e5669463dba086dbb6ff5d19b6841d2c2949e896e8ecac60c0971986a1553e65a3d41d11d2072667fc4b11fafab812ca51cd847646651bc46a172d9375c7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

MD5 93d16e398e84d14f7951b75c0fe0e816
SHA1 d81a82d3daaf37192e87c276f117b731e073b9ae
SHA256 fd1438433ea1b425a658694f102dfee2a52683c48c57b888d4baacd07184ebae
SHA512 391112a513caad1d8c720df3e3e52630168b02dad3c882e458e5d1a8b781703e1c7899a68f268081cdc9a531d108d4b40c25a98705d53a8d6395631136acc49a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll

MD5 d036e93f7a1cd1c92a458bc1eabc90af
SHA1 689ae19b20304813e2e418f5683827f7b1f1b3b2
SHA256 273927432bb3bb1f64e641ae70c886d1d503ef2010f88eb4e9e9244f6d97d55e
SHA512 eb5fc935b8391e3f1e4424b0fcf4beeb7027806817018d472ad8f9c526a21cc8a415eb95e0fabe4c22176acc5e26e3688c5c2e4bf5f31c15d1bde1eb53486bf8

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ucrtbase.dll

MD5 508545524a044a5950cdc9b8ac6651d1
SHA1 760e955e8ca2f833653a5edc41cbf39b74241d2c
SHA256 e2c8006fea1b03a1a2c8bfeacc068d513871db2d539727854e89de2b757d099e
SHA512 d26306225c4bb46d54b5a38c2799eddd1d4039a3a7757eba5baea72413965f3c094371ad8818eaf8a38bb631738d3477124bcebe6e782127c4fde7d9f50b44e4

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 1867a13a62cced3b83584dd630c7f984
SHA1 f4a9852920246e0f34bd9d712d81e6a5f0d670ef
SHA256 0250ac0c1121a074e85d805dcd1b24c2f7bb50fe307b002764fd2c94883bc0f0
SHA512 fb76a6ab8e376c3fe852abc875d7aa83b36fcdc0a47c7b7b82286f054bc0fd184e18223235b5df3526bb1abb44ae69a6c91c1c138feaa3c8cadfc1db7ba639a0

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 64bbfd9eef696471d4818a33d00f0e08
SHA1 0626d4e75e4f0872cad0cb92ecc3927796171ec7
SHA256 4cfee72948872d05d640735cbaf6a72ac9bf42ea54d66373b5147d1f1c54f302
SHA512 10af72e4a2a05f5d921b50aef471b84d41aa11489552f46801e28f450db05ad2dad3e1f0445d7e7ce15bc5dcb248de074c1573d837c4dd7a34f482d602f145b1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 fb81d895cb6f5975a129a4f3bc465cf6
SHA1 f99daac9335c1565a378a87241866ec9c60295da
SHA256 dd7c712e9b82ae57b4f58ab8162bd4d4ec78108885c55c9aba712db7f7891f90
SHA512 c786e23ae8d66e17efb4c4e49885aeb05fb8f7f47f9e784bc87063b73a89e4b4b671614d37358e1b9dfad5059cb211d0e6e80cf3ba5c44172e5a88410e90457e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 fb8fe9c6cecad360070a69bbfa82352e
SHA1 228906ea077a2eff61988a1b39f6108bfcacbfd9
SHA256 068cd05a7197c8b6a370eb06b5e573db4dcea249952567410b33a759343a0955
SHA512 a9c1283553bfb282a5f2891a4778eebbe95eaf8ec030628d5399c7a49f17f1601194977835e4e158f1b3931f990a931480cbce485d6512f9ba00ffe14e9a2e9d

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 f3ece0f44dc8379e511f76aa7ed2757c
SHA1 bc53552964158d4a54f821982596551b4e6ab2ff
SHA256 da1fbd7549feee79ef345ba3b86e3215dd7eb3f5a3576a7d098b339271bf44be
SHA512 4bf712dc8dc5c7d3cd07a4d65183694d4be4eb216fc247741a3137faa598b0bbc0deee8b286165bdfd97b2eac4e3a237b01a851e1bfad90013dea1e1e25389ef

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 cf820200e46781186edeba0215504396
SHA1 29080a9b2dfcafce6e0d269753247b850e5b47b1
SHA256 0439644ce3461f315c78ee1eb4475b6d95f9ad77d6485d4e47f623c47de2e5d2
SHA512 1f6574a95ae83abd8c7c100bf48b9443d5448edec5b6a2b3daaa37885e97992ecc8c13107ab182c9f93a0f43430a37850d6d36422a8de9e8df7e88e01ba0650d

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 8798efe521d609e185b05f9a4e8c873b
SHA1 d874121ae1dd0ea147813eac7636b47008646ce4
SHA256 551ca1e89304d562cf9d9fd342883f7da421ae104760edc9079b078cf089d80f
SHA512 2a7b9e1b33de3dc935ef23719a2384c8f923f4efa7b4369f1069cdcad9cd8fd26b32773aacfd3620c16e6ea667a0bb29dabe5aa097e8a5fbe5a692e521b590ac

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 fe72ee9fd881dc0bd846cf82e0efad9b
SHA1 f7f76f3d3c3d29c2412dc91c111c763f7e8c9b12
SHA256 509c76703cc36ba88504ef3f91e8dd6f6c5c7b56b5c2723f07f79da79fa20682
SHA512 a85f0a422dc659acd2ab3575c94a18d79db1082dad854c6c0fe5dcc13a13f97103b1f5e1e08e64f408551434753136cf6ceb39c8ad0871bb955c7cb871597b98

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 a352c47c980fecd06e61e29ba23bc643
SHA1 57d3334e9c0c02dfb5dbc20a95295897d24e9c5e
SHA256 33e7527fb465bef8eb6e92cbe53989784938ac5420529eacff3cc397e1980df5
SHA512 a0f6ce1fea809004b2a4af1fe05892c07785088db56bbda0aa94685532dcc09117757d1e245f6491f3540d740b4f1a8c8acafb98b7c2f3a8ce80aa297e78a9c6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 462f4e844ab57d824b42146611bf2a6f
SHA1 032e586ae30500b1b802880f7540f5e0377128da
SHA256 a68815185630bc9b3597addfcdfa30d227c2fabdb9e21aeb1aebcf7f0f085897
SHA512 a13b6d8a35b3f0c2c633805cf52a159bea50472ec6dddb64f6a3e012c323ef3f574f4a73260722677dbe58f845ff993aa29641f57d93a5bb59642b53216398a6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 a3005583fe1172daeb308be1826c6e65
SHA1 94ac473b15f3ce618aeec8ff3b92d499b64b8ee0
SHA256 4734e8deec1d71dd29093d2d1f5a2a3d6072ff3b15e3518d05d916e0f406cb10
SHA512 e8e8fcc260b41235c005a0ec6f691c609f09e7747dc93b6a156fc84d4e3a6de1d0e985e7d07de058683dc0939aa352b674ae10f421eec773ad62992293d6302f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 b5dca8547c540410006696be59ce3bb9
SHA1 4365aea2ff9b3e797722f85c469a5b11e0232f58
SHA256 ad869b42b0348adb8ad89d97f608774e2f9b112335ab8a2c6c355c9ecc6c72e5
SHA512 3a68ea56d1db63a01a80956d7872fc612f22548440f62bbf82fdf3cc7752d3f66740eef059f24f159b034469c8711089117234f22cce8f0517b76e06759687d4

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 c61cf076fb745cc0b0337c9cc5875772
SHA1 7e445625616d3e8779970a9ebcb97347883e19ba
SHA256 5ef176a8a41822a580a978789f56ad0800cc356e4144827fb5a8d355267f8f44
SHA512 918d317a13f25a02dada0d753ce52c673e2b8a6ae0b9b9d706e10325ae73971ff8441b6a3ccea4deb9ddd90b08fd84a355dabd59b7d8299befdc7418744af943

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 dc99ccb027e7f2ba6d98558cb4612289
SHA1 f5331a00301033f2f6d14b31317dd2e447d9fd40
SHA256 75f8301573ccc19e94aead3d05dbc4c2d99ef0d13bcd6d9339134101e80b9c4d
SHA512 cd9eebc81e3044108a6c14331e5936b6dfc395b74a58ab40fb283c946cfc6545f34ae99b9d253a0a58d27a9c3e4a30053f153086df7c9599100ebd3c4f7ed71a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 48e768bab6405cd35abc321113a52f84
SHA1 6985fb64489f502b36b5a886b470539b6d676415
SHA256 b28a663b4fbe25ca04e3498712f89b56f9c25499f68c2f5d5aa3b8ac5de5573f
SHA512 1bccebbf8a0bb3e0853c195b8238def5b39472c7f3130db282ba01720ba5bae32166fb44a98551682dcce411f9a1281375ef3230a1b81240d8627ed3e2838388

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 9fe5748a093d8cf96fb3b159a9ff4fad
SHA1 9b65cdd95327cbaeb5e124123c39692376b44f9b
SHA256 3b3bbbf239c3066629cdd279c945ea356898f581605baf5f13d45ba50f3d638a
SHA512 a2333ce8f9a9bea2d643c6868b6bab8bb12c2998f929a166cc30107437eb710ba238a227b5b4d763b5307d484e38a242343a0fde140d7c0b67209acb14f89d9f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 c8be4f272e2bc408e0febedd7d188d8d
SHA1 056f0ad2961f669faf06730a0f85ad081c6206bf
SHA256 1638ac1717ad229a3647804598955c2120e5e3f7f8b3e0b01acd43f64a30024b
SHA512 2283acf585ac5b4ae601f48e74a5d03ed95bf050c83e51b5815c88e045fd6d6d36c5ec190fa739a11a9ab48b77c57fd48e71f1f5169553ae3086a4a9a37d8e7c

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 e5ad3681335319da7132c363efd4875b
SHA1 2df38eb2da76ef1399fb255767f845a958dc3920
SHA256 d474d7069f32c22b81fc527480b0271a51e833815d8aaad003b450fc0b95d1f7
SHA512 825eb0bcf82bfd1281bbe3a12a37fa546d6835c782c3419123f4b10a0ae1397b7ec3a724c58e5ae2694bda7c0f7bba2da999948bb8c35941bba3333843b9b226

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 d69343d2898efe2e97d14771ff01c8bf
SHA1 efcd6c27ec1db4590f279c2ed4512b864366a57e
SHA256 a0d78650bdcd24e0c610c05c4ff9054e76a36acba1034a094d9dec80008e2325
SHA512 61e31495f11e353b794a7f844871f5072cc762b2620d5da7af2c4c35a1d39ac353940542a2c68ebd03d8a62f692872a4077e91b70ac37ed7679a3b71c6be6055

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 99a4405dab0676133b3667683d802454
SHA1 e4242b90935fb510a396bfc4fa90e6d524378291
SHA256 2d80644ab77ae0743e9ad46d7bffdf54bd7ca1f1879c17e9f13744be5c7c8451
SHA512 fd215db2b71062aac6fc491581d43e50954281136de4248512cce847b7b7a9f3658eaa90a0b336c30af973245df7dd0ad548c86a47aaff7c5107b76f3022332b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 6aed3d55e6cb7a78320956803572fd63
SHA1 d89ab3ebebf61212deff411ee7075c9524cf8ab9
SHA256 448023768a9d76d198e0e05cbb9d50ba91b16c4bd2b04cb00407789e5e473447
SHA512 3703eedcbbcb413e8c9b8d90ff6840ca7595b3e4397f02f338492a2d2224dcd06251e8d20bd35965ca082efffd3d0eb48da8885f516ff1600292f537572217c9

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 ed91c060b2df23bfa7006f702fe2ff5c
SHA1 847f3a4fa52ea3a2faaaab953b702aac1251fac4
SHA256 dcfbb10c41400645c0a42928d522d888bd05bb000cf8887a98ce43c2d70579a7
SHA512 49167370ab8b08859786284d996ba15ef82e6bc80ec93fc053da87f8b1cede5ff60d6288d01e2162b14fc07d291eb065b333259ecec5769b7946629dbe0ec831

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll

MD5 beb89acfcc802b766640425f1acc947b
SHA1 2c442dab0c40e08b9989157c7d567771fa0b40fb
SHA256 301e780eaa165a7b5ac0fcdc37857cbcb1f0205b44f24a76177efbcd2eda256b
SHA512 c906ebe2d3100bbad72832faa569df53bfe7956389d781156fe9a063b8aa60b7e90a8dcb79115fc57a18db1956e3c2f390ad76d641a2f23700f54f25ecc6c3c1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll

MD5 7c160be0bdc787ae3b74ec0978ca0d66
SHA1 ac34d593d8b454823f448322e605735de156999b
SHA256 55ff77fceb336924a66e5d72503e50697a815a6e6601a5cefaa3eeb1a1772bab
SHA512 bd5ee745ce298267100c8ae239ec135c0e40b667c5f21a83ad53eb7b96b2464edde2316286a0af837656c983c00c906491d0c7bc0e79837c86763e6ed42209d8

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll

MD5 2be4a9eae90f72894f4f5a9099a8430e
SHA1 e70594e5f25b57f4b58ce1d29a55aa362e030503
SHA256 2681cfc7e9256cac9e7cfe6fa0ae40f665e73e2351626ea1d4ebcb2c2b763a83
SHA512 ef75fcedb63f796b0cc6bbe8a614596c3ee824eb60f39685decbab5a19af8f54c2c8200675d8fb1a6133c1980d5f4ea19835e327811cbbfd9abe40fc7179f058

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll

MD5 897d622877119e249ab152c7ac3d4c9e
SHA1 43b86dcb0bc129c439ad17f0854db91b63aff642
SHA256 21c78f6d211495697faa0328c2fac7e7af3fc932d16af0f473d2799361441b1b
SHA512 4dff5d45c972b2ce6ec8b7cda5ff5d3f5708305fafa75e6369bff95a9917a17fc3d4dc0c064f075ae867e048d4dcb3d81f847afdfd4ccda25858805aa7d13fd5

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll

MD5 ee513c35807c93469868caefd3a7e2d5
SHA1 60d1bf3dbf85f7c0838f3dd6f7d730579344a710
SHA256 b547efeab55ec074b67b1201d8237cca6b2bd91e25a05c8c517f01ccbd5f3c0e
SHA512 1cf5386b2908bcbe205371325961035d1f29bc1b3bfd748105e4299f8dc2d96fb57ee3dc37763abedb343ea1d8b3e647fc7ed87244f647ccff12ece522662953

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll

MD5 a1d399af6926c00b6d73d7c0604189d8
SHA1 1d61df418b997a14d94a858aad23d14d6cdd092f
SHA256 cd0ce8cc907269ad753925f05aa9949c1e87db4cce869a14dc2c730a9bd71b44
SHA512 2f2a61bd987a408592e0572d48d5fcf920118e40666bc29f1861251e5302ab4213b19226a3006d2ff42bed6487321cbb7d488652238dfe37f60e793a4fcc7c70

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll

MD5 57b9ec2e8a4baf3a3d058b00fef627ab
SHA1 1779d5d52ed313f6ef24908de14d8f0c8fe1e6f7
SHA256 657e1e04a96aa86b9cb96a1b290f499828876e15ebc28bee3f4c952932a0318b
SHA512 2b14406a1a1e6f1ecdc336723fcff198bea547a7d23db15083f046030ce3130756ef29cc10634c6f0a8dd2c294941d5aeaf70034fe59612633e5efabebd08d9e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll

MD5 a9558c416903975d22ecf57f4f7d55ad
SHA1 962ac635694fc1e4cc0832298371becbc878a29a
SHA256 2f39a06bd2c84776a2c7974077201c50ae460686587912f875c280b38d24126d
SHA512 643156f2180dc810b6a9067c2c206a0b2578adad625fe9790cc589ec2a4ecaac8d5bfd37120cbfa0bd5a95c89d85a161bf617224b02d2082c479f681e941ec32

C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll

MD5 aecc5d5bd1fcb7d12086da744906aa31
SHA1 2504a84974e08b83d1e57d3844f583169fc47f29
SHA256 d26a71353cbb611320d0b0c40424ee500377434201ee86a6c93e825342548d84
SHA512 8d11d8ba86b4d202afde90b30ba103d1290b9f20044e2b9f29881413ed0da68c3952f987950cbed5980ee7ca8534b1bf3d21d024c1dbc010ece0e3c2ed84c208

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

MD5 7264295f0c7a05c2a673633f3f6b85ec
SHA1 310d001ea5f6a7782ca09816ac99fad1919d5513
SHA256 cfa31bac9acb4a8681dd55e6adb155a447486a697bbdcf350d7c7a3ab6e8e716
SHA512 4f3201e8f3b08c5d673985666344916dbdffa6ec90fe7f9917e2ff5e367e0267c4df7b9851a0578097fda51ba60383a7326535b288e876acfa1398fc3ab9d9d0

C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

MD5 f89e69474b2bdf7cf2c0ef6398f7c4da
SHA1 c7084b290fc11ffd81b7e8044fdc37fb30724860
SHA256 5df1ec5227ccb0aa6cff5e815978d440087ecc51def44d0c0226e8e42569ffb9
SHA512 b7f491c6c478e5db070cc88ad11389e7b197f09a5fff94ed5807bf3863104785a55150a875d4b0d4e6a6eaa083a7c23b2f1968331885e1047d74caa6b9a959d4

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 4ac6f01392c86f089efe883a2c63ed23
SHA1 ce1264a6a0c0acea558b7e3a666adb51115fa88f
SHA256 e3694f0e43f4fcf107a0c2eefe23d3022735954352c7ea3e4ba7b45d3626d25a
SHA512 809101ad3608e2c70b29f3804f66628cb0596c6ad5d85241f59d0a0eb095d2b119a161579708e0fd48cfd9997a7c6f59caa80d581e19683780f52e1a355eb9b5

memory/1776-9079-0x0000000002B00000-0x0000000002B0C000-memory.dmp

memory/1776-9080-0x000000001C660000-0x000000001C670000-memory.dmp

memory/1776-9081-0x000000001AFA0000-0x000000001AFAE000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 c6ca79facfd24728212b192875946669
SHA1 e1c6cde196b74f59b1f98381985c55dfed14a6f9
SHA256 78ebc12978a6caece4b2afb0ef5fd4ac47415f501132d3e4ab3424406c9f7eb3
SHA512 6c08b856f6fecdfc5627422c373600dd5b44d93bf59b2acdca79677a9bdaa17cedce0fc823622df0899652589df950fc5556cde02f85c5fd1f962f30e3393a64

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

MD5 824f3336b21102c1df38d0ffbd384d8f
SHA1 a21d02ceeb6c6906c2637b51cfdda03f69b4e52c
SHA256 339d6a9518af09a5c94c1fe9be84d428950a99c9c7c7e7003efd75c8024f7107
SHA512 9600183344d9a87e67113caf0a59f1d348644b45f5c70254ab044a8954213d37f417e044c0fa715330c3a5d2348b4416fb972df2e6923e5af54208f766d3ac6a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions2x.png

MD5 ad6ce4d5cad2fcaf0e30c6180e93ac23
SHA1 5a8c98e0f341a8da6496593a7de194c384184bb0
SHA256 963c3f725dc0ae33112420b6cc89fe14addcee9253b3c204e78caa59fcc0a669
SHA512 fb0e5be6a81da791a4dbb5c095163e05f990dce0505af63d92c449591fe0e2cbb074319af5db8872acdb981865fd3ac61e60f90923919cc2deb29db7ce7afae4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 f1e085f06b3dead28963cee4bd9240c2
SHA1 f05fb12d49072633f8439eb25f8b6b149d80b070
SHA256 9123b1e697dd1a486f31a4dd5386a9be551941daf96accd064082f6338c3ff76
SHA512 bd33c89d33d33ab9772e2061907c5cee1afa7c05c821312246d82abfc183629b0af90be15b515931854cdac95f2e1b5b9ccfc90fc939d68f5b97d0e0505cdad3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 7c6a8850c2785e05a39bfd9029c6ea2c
SHA1 0e6a1757f8564a71d2cde7306484c0a76caa5488
SHA256 3d6ac1ace08ecd9898c4e6a75c97ae2138b93d137969d9219dff29a922061b7c
SHA512 ee4c172f65c14372b84c4cf60b538b1d9e5b2060a153f63b986137198f6a9147e2d40573081c0077b811f018a4931bb3739deeb5cc26e1a15be225eee393cd8f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 32dc1210e5371a46dcb035e5305d9020
SHA1 1d278b9e6c896f48990353dd7107b1f4599390dd
SHA256 b9bd73cfd56a196833c058381a473bafdfdfba6f2ea39c687abaaeacea2a37ba
SHA512 302b3f87825be41bac6ac7f20f3390702960942f388740ae13079a66ce83d054edb1ae5f7dc2de3db544094ca29bc5090a64f628f66f45dc24348ae455e9bf38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 6a2d3891a4baa7e59bf32806992d8565
SHA1 2610cf96904a5208fd4b6f0bc52aabbaddbf3866
SHA256 bf717964669b700751b013f87e57306986da5eafed9e795e9afc4b3bd358dc21
SHA512 eaabf2d2434e9b03f727b2c184d308e4db62f98c1f4b4ba5d46def26baf9808d4edee400c53a1d1f2b841fda2f8ae2eb3d1da9c0a5a02e193cd2333d1106df74

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 f2feb85c3e033ac26c809eeac2f13d37
SHA1 c29ecf21bdbc72e20fdcb06b337a922ac0dbdb68
SHA256 db235fffebdb45e2b28a746f1405954299d17ae9d1175a1f2cdd0007cd871700
SHA512 42a0c41d3d02e02cfa410ca9c96b6c08b249b4b067690bf473c5fe5f1eab595a848f1e2f7a2f1cd7e348a540d48ab10137fc90178397443fc782e9e9de79c187

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 d7bcb4bbb628a5e6bd241e5921996c25
SHA1 c5a5b5d6d0db363d652eee2fe965ad558db4b87e
SHA256 7fb5881e946788f4ae43699046dfb31d6dc9476777ebdd2f00c5474fd5619762
SHA512 8a78812e5e15323096634be93eeb78153e9b96d80994d11bb2da8872c245b05090dfb8ceff2b196b1fb4e1a4206abf1195099c8a66b9902623d3cd708570e30f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 f7e77a19b0e43c0f3ba1f5f21644dae3
SHA1 426e1efdfc2164b463c21616b9c2814be56d8c7c
SHA256 f79dc90b72675ec32f33b64d75b2ed9e5f75e540274e91753eb87d8b3f531d41
SHA512 17924138e4a147f6427f77e4f58acad75900c9bbb8557c66c84ccfd006158bd22cd5c8ba2d611ae471ccb6423bf99fe1647a964e03eda1baced60f19bd5c37dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 ddf93fb7d1423161c372d5ae43a1ba6e
SHA1 06ac172a20a7d8af3f58a7dbe4559af3c6a46532
SHA256 3a6f3d44bde9b31d44b76ea788c2d53cda630de3261f0641b3a5075ded21adbd
SHA512 9c7cdf4c50225e7d1dba14ad36fd665b38e4dcadf881d06dd225c7e569481f9ea0d3e676e98da0235a0616c6677022b4b0e5e7216b99d6d184d14860f76f7b9e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 ffb58f802667413f7e4c39c2b2e6ab80
SHA1 f53868f363638e2220e589ea9e271ce044599002
SHA256 6f700db0d59fa766a21099ec63313ca88273465c86de7231e72afa97a971a47f
SHA512 3433711a8745cb7f37209aeeb4d1e483bee33436878a0e3468ee2bd563de41800de917bbfe1e5ee5fbfcb829c189e52c2cf7ed00b5f61384275dfa118caa01eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 591a516b29ce3200a7c22a7af635813b
SHA1 3a656fcfab7c7feab29570a6f13d9acb7a1cdd38
SHA256 cea17e0f12ed73e197329f8a580e0b31008ffc91bbc600edbef696b6670865cc
SHA512 274c8a21d30b30d0257ee56b86c245b024b5653c42d8c95e8b242371142ed36555d5a791559c33b09ac1ffbf8716a22f21bd6b80b54e82a4196a3f3b90226080

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 7bf4a6e814d7981d3add00e13c6331e3
SHA1 d58eb1d0b8bac3b9b13256c3ba80147a3f59c464
SHA256 8f0c59e33aa88af9c7cfc4f7ca31015e745ab41a7aeac8d8ed64fe0b73e86b62
SHA512 8c58d128a285e1c0c727e04f1af6ab4df070a3fda0cef5ee1dcdb5b09153016838a1c3ec49e9b32eb878755d79575519b9cd4e95ee07c1c5994c686235c4532f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 c7d4428a8a8a5471b76e8dc8055bc39b
SHA1 488286189207fefd532277ee981181aa5374f144
SHA256 6fa4e246d7f046a806e23e3ccdb262d6b75c2c273e695e69fb15720b4e1ac8b0
SHA512 2efa8498da3a276ac4f317c7526ffb0221c1a98f2a7ff378163d4136da7f8b22f707359c2e99f2e22de781850f0673474cf6b155216f130f66d818c5bbf42d7c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 585e854a89229a3abf7483ed6b78d061
SHA1 f1e0974c4e1d50f19805c99f688183bf07cd6255
SHA256 dca6e780d4e3385b8662628894aa9344f8463eff4be84ed2c9e0b693b574cb9a
SHA512 7f0602232db282858791945687d3b8f3561aa32e76dbb5fda7d065c44926045bb0c93b3cdb43361b145f393697b7873041187992799fa53dd0f020eae0e53056

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 edfe9776b2a2a1b2f633aa1e170d5098
SHA1 34bcd277ad4dd8f1451c7fecb900c119ce56317e
SHA256 cfb9aa148308ac171eb3b218bfcb11b9d554df1bafb345360b2c8c928083d2cd
SHA512 6ec7169bf878362e8e305d84513b09f587f82fe02c5604002e965ed1268ad0d1a61f7da6668fa05b7b042eca40455c0f6c4044cb05a05f438f63f3e283418bd9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 1525b70e358ecaff0f760a654e08f9e7
SHA1 83fb5d9fb3f92c03520949511174b65b248294a4
SHA256 f1117c1c743c7b1e0601e772afb3703c6e5342b65334a74b09c7de173b4e748b
SHA512 70012d7333ce084ad39555ae7bb648334fd944f80777ddb58e55bc6856b023400b63262d72b866b16ffe4853686f09bd8fb004c8cb141b8fc5734bfceaba4c46

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 2ea13e878646b282206f9b26c97691f5
SHA1 0f6393ca54f83dd9aa32d11b5b84190e9cadc3e9
SHA256 3d3de9507cf6028fbf753726be680a6bb4217c0d5f12f477e7125eef01aed646
SHA512 ea58d66b7cd844e0007d75ab84989075282338b19f95c36150f33e6c9150661474451264994dd7e35c6f5c5b0b11852c8b08a46390ac8a793765b07ae0476e3d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 67f6d95dafb23265dfb318306025a5eb
SHA1 347a623c1f74bf88053b00fb9cea35ce627c998e
SHA256 06e8ceeb05d03b2618c16710601d5a5a83c08a2e18078a8653f33db1215a5dff
SHA512 e14edb2a0db0e2946e9341672cf4ee6e3d249ca5696a90f67df61b73aebc9baba4020d4caded2e87ff9a632b4012cd8b0cea272f87588f5b35ea27b781015c1b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 298fc1fa8a4cc84884188a9dbf829340
SHA1 c0bdbf975cb10886de9b942275c517a49ee3b6a8
SHA256 01ddbae0fc76ccaec86f7e8c4c206d469aa3b62a8a133f0e768d6571f0d1ee2b
SHA512 32f233bc3fe3a05ce72ee91709a3c9941594270469fb7982c64bc00e9c8803b3af3651d7738ba51bdcf2659da705ee7b38f6b30b6845af9239c50533487c6e1f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 1db317754d41560ad31ac1dc03ff8e2a
SHA1 ea0d3b67a82e27f56e5f57f0f118ef61439d8f88
SHA256 ed79174becb484766c0c8a04a333170fa0b7595a12b11237636995733d82767e
SHA512 a39e27e73b1e55ad08a156b75d0a2b3ce1e997b03714bd8c49b65120a98d9341b2b6efd168f138051bc2ed076c3fda1d5c34ebc0cdd4dbb82b69c6614871519a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

MD5 0dcfbe50ff9c0e4057b38bfd17d7caa1
SHA1 8fd38665f6f3e906e024afa9252e5d223d62ea45
SHA256 ec8e47697d13516abc65721245a9abee9117f5961c6f0688e64d45eac79e71fa
SHA512 407c12d8c673d2f8ad413c7f0e166cab511c47ffc2bf04cd15205a9e68ce92d17e72edf5a15e2eacaa1e8993155c25e67818032e684ca974dbd8b9ba6ec874fb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 e6177a56ae520055b7af4145c4f5bf31
SHA1 3b3386b1a30579bbbcf46405f63ab96e0df5a784
SHA256 a43ce657b05525b550b6ed02205d1015b8cb9dafdc8048af47054a7e569d8db0
SHA512 0de99aa9bf606708ed38941b8f75f150640db96d315007b15c824ff382d64faf2cda8db3074d2dc9b96fa17d1ce09ae21cd9dc1634bb033c80171b589779b7e7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 ca03fc5aaafd6153cc7ab4e38d5a168b
SHA1 67b3c319272800e275fd7c464f8c3e259b29a5c1
SHA256 7489d451ca07e275d81ba8ed82333b7e5420e72eef70afd6233d3c0731e5dc74
SHA512 2d3c5f0ee7581eb9f2e3c6e243dab2ef3422351691afef56655843d6046ff96eb584d00ff17bc5ec6154019d2c3b05e540a06fe785eefe9d82f283c231d8d4af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 49ead18465aa927665cb3c83b3f957a7
SHA1 8724068bfc1e28d371d93cb32d29076637992974
SHA256 d717c192f4eed5a18e08c0143457061a8ed3a028b91d60bd48cc61fc6f89d983
SHA512 bcf56e8f33b1841d4a8ca088bfb11faded85e6703c0bc56bc7efadff8df6a50a9be4ce40d971d130e4573c885e36d3a7af33446fa09c950ece5631f35a19755e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 b14164819b5bbd4a5204b3b2d18a431f
SHA1 c6bc62679b0ac0c20c7c1183b9148c8797d7671c
SHA256 340b0f0124ae77339899be8b42ad75da3dd0ed75aa09613f31e1bfca892df3c8
SHA512 86cf9e604af9b014ae10343e559c321b3d43c4363cbe17fd1ce8928a2ced76135a0b9475ec4a93352101cc8a973905338e8d96e9d5684871e8a0b447e6dda2b7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 181255e7d8aa47376f3a498af92e376b
SHA1 844f2d0570e3c6a886d469eb011949a70b10fc16
SHA256 8384b9e523642935ac1ba5d7bd4e91785ec92a65f74404c069e3cf1b7b7a5e5d
SHA512 f0c3689b7afbc06430df8cd888f40db2387c86028ca7550a41366e9532a460b395b19590e522d9bfea45d44a13f65e28511c52eaa38f846373d457de7d370bc0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 5eea184c97afa7978cb4c5501d9a4f74
SHA1 f9b6a91e9c200f047f3933b9adf3550ca03204c3
SHA256 057d1b26c10606e04c102b2389505b91bd559fafccb254895b9aeaf4c0243fa8
SHA512 ce2eeee404e46ef52fdd8ce4984f1703743469024062e3b40f846b769c66b34675289831987c5fcce4d28a577b67194590e0a07acd5a4bdb1d5ead666b95b4ff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 f02bc4073309c62ca0da19037b65dee9
SHA1 53ad8ac90a20003b83235ca0400fa8922a90aa80
SHA256 168349e251dea290c9b52bbc4bade6ef5c5a97a6a1c1c2cbdce4c53ea445e3d8
SHA512 27d7674476a4335c637d64e8e464bc1f931ab70a918fadab752880e6f356eabac879896ae19a141d52fae8d821d5c8a9840c964575fbe947588f7208ec02385a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 fd83ddfa3d919bad63dd0949a772ffbb
SHA1 4317be8b91e3a6ff4713b1c06de2ea6570bd4250
SHA256 dab9c28f71771789d2acc1957b8f52deb85cf5a57f2a3c171756cac9a73ee1e0
SHA512 e8b4e0f65f607b052b8f94b614e51087ffab6a9c75a35d11f005cc3103adcfefaa06e8f54b763d8734dca124b225b6f1fa42c24b95dcee46a04ee75a6c68bc0d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 29535f8877ad7f2686a56a20d1ef9873
SHA1 7a74dd12e2284fac02d35282ec06005ccf3cb583
SHA256 97deb3364aad2a1be788c5d937a7bb43886dd3adbec70145be9fb0c32d03b010
SHA512 14d6991688e13dae0f0a9bc164bdac6d66126e72e801ec084e579f686472699f177c34bcb6f946939840a83c55380688578573076a77c0473527901556669afb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 da9e190ebc7601132ee8819a47e5162f
SHA1 a197e3a6aa39cd1aeba1c9e097d43f255a4be505
SHA256 c06d7d7fadd918900936e8b78b3692345fa7676f61cef5f54ef55389a33f0379
SHA512 81bade49d77654914b2a4a18787e5e35a469359c0683355b00b8cf642c06d7c784867db000c5752f1617ce1df25052817f6f0b18da16e834a3c070cc42fa838a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 1c529657f29516813014eccb9f7f902c
SHA1 ced906e6f7621dae2418d6410e2a28ec6eec15f1
SHA256 5abb943b70efa7bc222b72505f5c672fdd65b18d44284e9984776ed356878736
SHA512 15fbd97b7460c51550d461f906cf68253d421c488147d44075c47029ab6a354041b199ac60dde144bb91cd6a5e6de4bc570a0f11f19efb1d3a6280eb713dc7ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 749cee3a50db29acffaa9f1d01ef7725
SHA1 9d46497c0e4619076da1edfe774944a95b869fa9
SHA256 a6099a90f05d6a90dd69c41f05ec5e929c73e3f2cfa757b647d22876671bd9e7
SHA512 d6658b469d860c0eca2aa21cee00e7c7a0fe9f6c361c6f58f95d6a5149a53a481249e14c7a763052d0d55f1f2514f17360021ec1b02ae355fc86b9e8abbb8a11

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 32222522b0ab2c47b7ad98eca839addc
SHA1 69d8af0a2c770cca07d5eaebd5cda2669371b1d6
SHA256 f64381b0e5dbae3183ee7a6cb48f4eff32cec5721b237f7690703427a0d30942
SHA512 cbb471491af4e4beb145c9810d5fba073b951422ed101570111ace17a1da56522799a90c7447196be714784a8ba788ad41d6258f145cfc6645568fc81633d2ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 2a4e30b4f977c0fa8a94c119cdedcb61
SHA1 5aff7ae159739e85a34aae27b562d56b1533c480
SHA256 63dc0a1866418302a09b3fb22c2f9170d1580bc4a9d0bcaa561ec3a603690038
SHA512 9fa0c909f978b10b8051458be1a21496bdd838633ef463afa81bea22c2bf26c37bafccfe8178480c1ad5ee3ba65803dc594d3717fdd8c3cc520d986c9bfc047a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 f60d5cfc169f756e2c734a8372b3b6d6
SHA1 c4cd749359f3eba38c0af04a78b33efc85137956
SHA256 79af92fd0a63e1e57fa2e61d423d28568aab274d3a8b5b1d7fd4c1a64bf99e9c
SHA512 c0e7ea12a7d6a505f680535317fb6826aa010ee0d1b4d140ae8ad9f7690c7088711bcab6f761573b27e9daef2efee664ca48e8f633e4eede8336b61f49a17ef0

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 7326a07afc0607769991efcd6ba5a99e
SHA1 781bc9dc4cebed4266ab0a311b7ba61910355831
SHA256 0b52ce564d162c7b281bf0a1c96e4a6d2266a9ed9984280e4120e812cb35313e
SHA512 a93d1182a5bff84416ebdb966372d80802aebe034f68571b09e32934817b48e46197fc27655440d6de4c3c6b8a4a4605016bb3ed52311978a731888eb3e33ded

memory/1776-11293-0x000000001C700000-0x000000001C71C000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT

MD5 6626b8e7ceb007a7f541f5d77c3e9b15
SHA1 3e76ff7e0033121be705230f5135ce4f4bcceae6
SHA256 49f649e524971fb9bbdcc790e0943a8df1dc6f65b4cf71b4add79ac5a5664a50
SHA512 def919c5518bff2a946e00b8a7b49783ab7033a33a66617bee499fc57d7445bfb6f11b707176b69d6fc94bb6e6dd5d4baa6d1634b67939779a9ceace156f3b89

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001

MD5 78107747b672eb679b3f094a3ed2c36b
SHA1 e7bc92e2a393c27bebd84d7fe760ca4d2349131b
SHA256 85712e93f7203af0afafc132138001d4fd1b2e203a4e994b65d9ffb9cb9c517e
SHA512 ee8d1ac53795aaa55220de6c64ec1025026770fbbc76c9c2b4a45aed1bc89b709cc019ce364c351587021bfa4baa4ceecc4b825c0a94c00f98a4f4548da7b452

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index

MD5 c5c6f4ecaf8d935d5b7fd06b6ef199d1
SHA1 1de5819b05d652b51dac88ec967fe2afb961647a
SHA256 95c1ba393f5c5da0074a14d2c9b9ce9417b059c59de119bcc985a1ae23b4368b
SHA512 a7d6834823a29030dd30dc7b46dbec038aba157dac93041257b7b27f7196cfbffc96ac883e3c53181026989a1ff7e224745c076c8040e423af38f0c6ab126c45

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0

MD5 08e10dcd1ca347dd62280405c262fd39
SHA1 37d40dfeb6126f3f5cfb5fabaa04771814221bef
SHA256 b32cec07105166fb66d0bb53677357eadeb36754fa60b4cabfe6b0daf9d4cf3a
SHA512 269c3468f2e371f8631bb5672fd157b629708d8ecbb75687e197c7ede4b7423bbd93447a43d499cf44a51c7404ae959d2beff2729eaeedb6ca6c08dc2719ee6d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1

MD5 57b26e51d4bf41090e253e44276f5708
SHA1 b2c9dbb03a93352d0112830f0e0ed8d8a7c7c10a
SHA256 42f7ab64b049a3c02d1c0295e937f9ccf47950d52d7c6f3b5dfdcf10112d19a9
SHA512 b5196a5b45dc912c1f8329bd87c86ecea2db754c2279e5bb3ac3c8fe46a74213444b514f6cbf437acfa3438d2904672ec201e4d9f16a2ba89c09ff636344536d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2

MD5 98358d88b337f8da252c7116089d8244
SHA1 d9e39c2bb7129c02b29919201f15c26984a7a800
SHA256 3f3b0d67265df194b9b23e4accb9afa15c3bc669e1651316ccf74ebf5c9e162c
SHA512 1731e84d805f69fce8c12ca3842bd662d213f8b8503011b647ee3a65ef256278a5c0ac2a20bad3b8157bb325ae51836079052414e472533844fc60f8817b78a3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3

MD5 1e892e092df24d99abf7d4bf35ebee51
SHA1 0463e6facb8c2680dc8caa61c1f5b9840ec269e0
SHA256 0fcad5074280b8a5abc131a012d32c51a6dab76dd1475ffb7f1f739b18977754
SHA512 e11d830542fd7a5bcf8c5a108637b3249582106b222a239e5f6feef5b9b19755559f5cb19f4cb73dae4db381254abd5be826598e42c52152512e49cfcec3d758

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

MD5 944698636dd1bd8ce383b5f095de1f23
SHA1 bac2ee2be83be8473794b96cb7d48c93e1c1e6a9
SHA256 f06b023de460add364c1ad8aaf0dbd3f80acfbbded999ce344585924e346aba9
SHA512 5e4a01b98aca3d880ccf6d4f266d8e5b9d1c29ec0cd6df1e5037d9b823e8de9d3272703ba72441f19890b149f9440bc455d1fa5716ad808b0d945c11938838b3

memory/1776-12803-0x000000001C720000-0x000000001C72C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp2127.tmp.bat

MD5 9a92615306b0e028fb1a513b6d3613fe
SHA1 fb54c0a3c54a92b6a778c47622d35ccea947d546
SHA256 be1067231d43d6e9002d4c9c1c92e9fd677457053d23272fc7e4d6c6128ad332
SHA512 750f092047d59aefee146a12da095320c495111ab3769e74d92b3f60046eea936accdb6aae800e565616395cf30eea4358882ca28d4009c8b9fd16e680bbfd17

memory/1448-12833-0x0000020CF2670000-0x0000020CF2692000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l5y1q4er.52c.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

MD5 dc1d23f677058bf5f579edf976e84d0a
SHA1 23aa81489ff9f52139c3af24c6f916ae24a26073
SHA256 31f88c33bd8a82f50a536177a81b3a5822c8e552ee2d09fbee78b5342c76e041
SHA512 1ae31adbfc4652719f43dac7a465a09432ffb9715c91814c5096842a110602b941875e5148538a7610cb708176f1c91ee27482493a48958a72877ef93f37e2a5

memory/4184-12848-0x0000000000990000-0x000000000099C000-memory.dmp