Overview
overview
10Static
static
10BoRat Rat.7z
windows10-1703-x64
3BoratRat_Cracked.exe
windows10-1703-x64
BoratRat_C...xe.xml
windows10-1703-x64
1bin/Audio.dll
windows10-1703-x64
1bin/Discord.dll
windows10-1703-x64
1bin/Extra.dll
windows10-1703-x64
1bin/FileManager.dll
windows10-1703-x64
1bin/FileSearcher.dll
windows10-1703-x64
1bin/Fun.dll
windows10-1703-x64
1bin/Information.dll
windows10-1703-x64
1bin/Keylogger.exe
windows10-1703-x64
1bin/Logger.dll
windows10-1703-x64
1bin/Messag...ib.dll
windows10-1703-x64
1bin/Miscellaneous.dll
windows10-1703-x64
1bin/Netstat.dll
windows10-1703-x64
1bin/Options.dll
windows10-1703-x64
1bin/Proces...er.dll
windows10-1703-x64
1bin/Ransomware.dll
windows10-1703-x64
1bin/Recovery.dll
windows10-1703-x64
1bin/Regedit.dll
windows10-1703-x64
1bin/RemoteCamera.dll
windows10-1703-x64
1bin/RemoteDesktop.dll
windows10-1703-x64
1bin/ReverseProxy.dll
windows10-1703-x64
1bin/SendFile.dll
windows10-1703-x64
1bin/SendMemory.dll
windows10-1703-x64
1bin/ip2region.db
windows10-1703-x64
3Analysis
-
max time kernel
213s -
max time network
216s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
13-07-2024 08:14
Behavioral task
behavioral1
Sample
BoRat Rat.7z
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
BoratRat_Cracked.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
BoratRat_Cracked.exe.xml
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
bin/Audio.dll
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
bin/Discord.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
bin/Extra.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
bin/FileManager.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
bin/FileSearcher.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
bin/Fun.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
bin/Information.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
bin/Keylogger.exe
Resource
win10-20240611-en
Behavioral task
behavioral12
Sample
bin/Logger.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
bin/MessagePackLib.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
bin/Miscellaneous.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
bin/Netstat.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
bin/Options.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
bin/ProcessManager.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
bin/Ransomware.dll
Resource
win10-20240611-en
Behavioral task
behavioral19
Sample
bin/Recovery.dll
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
bin/Regedit.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
bin/RemoteCamera.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
bin/RemoteDesktop.dll
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
bin/ReverseProxy.dll
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
bin/SendFile.dll
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
bin/SendMemory.dll
Resource
win10-20240611-en
Behavioral task
behavioral26
Sample
bin/ip2region.db
Resource
win10-20240404-en
Errors
General
-
Target
BoratRat_Cracked.exe
-
Size
20.0MB
-
MD5
c68cf8d1c438a9c59878deb36d17e197
-
SHA1
fc6158fbab2762f1da42c7a486fd04bd8b547f05
-
SHA256
9e7e71f470c44d253d72a78f1ccdde34b4a0bff6242d86006cd6e364b6bbf79c
-
SHA512
67bad918bf1b4d1d1461ae949c7ef9e953fe447df46e7d32484914ef74cc658d8746b5bb2fb354f8c07fb961d9e4b395e7c2dab4e49e6b26d0af51aad5b27ccf
-
SSDEEP
393216:nm2XTCP+Zw6NLIsFfskh1BmXGnfBd+Ly:nmmTCP+Zlnk0rmkBYLy
Malware Config
Signatures
-
Renames multiple (2284) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 1 IoCs
pid Process 2356 Client.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Client.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolui.dll Client.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip Client.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml Client.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll Client.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml Client.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\dbghelp.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.AnalysisServices.Common.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSYUBIN7.DLL Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\BI-Report.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ONNXRuntime-0.5.X.dll Client.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll Client.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngom.md Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSPTLS.DLL Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\THMBNAIL.PNG Client.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll Client.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\jaccess.jar Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-environment-l1-1-0.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-100.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN097.XML Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.White.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\msolap_xl.dll Client.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg Client.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll Client.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Client.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr3jp.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] Client.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt Client.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN020.XML Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-filesystem-l1-1-0.dll Client.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.MDXQueryGenerator.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmuxmui.msi.16.en-us.xml Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-180.png Client.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat Client.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll Client.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll Client.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\management-agent.jar Client.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml Client.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll Client.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll Client.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\vcruntime140_1.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.XLHost.Modeler.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc_sb64.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN002.XML Client.exe File opened for modification C:\Program Files\UnprotectEnter.htm Client.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-core-file-l2-1-0.dll Client.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\oregres.dll Client.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] Client.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 = 980031000000000084589b63110050524f4752417e320000800009000400efbe724a6fa884589b632e00000038040000000001000000000000000000560000000000f86ffc00500072006f006700720061006d002000460069006c0065007300200028007800380036002900000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003700000018000000 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0 BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "3" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\0\0\0 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\0\0 BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\0\0\0 = 4e00310000000000ed58ea41100054656d7000003a0009000400efbe8458fb61ed58ea412e000000ac5101000000010000000000000000000000000000005dab1101540065006d007000000014000000 BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0 BoratRat_Cracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU BoratRat_Cracked.exe Set value (int) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" BoratRat_Cracked.exe Key created \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\0 = 56003100000000008458fb6112004170704461746100400009000400efbe8458fb618458fb612e000000985101000000010000000000000000000000000000008fc5f3004100700070004400610074006100000016000000 BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\0\MRUListEx = 00000000ffffffff BoratRat_Cracked.exe Set value (data) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 BoratRat_Cracked.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe 2356 Client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1980 BoratRat_Cracked.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1980 BoratRat_Cracked.exe Token: SeDebugPrivilege 2356 Client.exe Token: SeShutdownPrivilege 1488 shutdown.exe Token: SeRemoteShutdownPrivilege 1488 shutdown.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1980 BoratRat_Cracked.exe 1108 LogonUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4424 2356 Client.exe 82 PID 2356 wrote to memory of 4424 2356 Client.exe 82 PID 4424 wrote to memory of 1488 4424 cmd.exe 84 PID 4424 wrote to memory of 1488 4424 cmd.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"C:\Users\Admin\AppData\Local\Temp\BoratRat_Cracked.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1980
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3124
-
C:\Users\Admin\Desktop\Client.exe"C:\Users\Admin\Desktop\Client.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c Shutdown /r /f /t 002⤵
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\shutdown.exeShutdown /r /f /t 003⤵
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4636
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3af3055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
558KB
MD5616d088224a66c3059eafeb752dcea2f
SHA15af9c14afdcb4d48029196a07186dac914cd8f1d
SHA2562e589c071e3964c6cef84b4542120ea202dd15f1d85dc61760b3213be4cec491
SHA5122bf762281c5b74d45e6660607ba93b9d83fd2c6fc643c7a7c200708e745dccf47ed0ca4f7ad160cb1e76b4a74867e8e257f1e7afc5c8f62b314dac1b369b098a
-
Filesize
95KB
MD5ce5e406925ef565384602300782b9745
SHA1fd726382ee299bfcd85b1c787f1b65a6bba4738f
SHA256003a30c1def27fa4e46d7ebd33dbc627e5bf2c59dc7209b1210657a657be9c13
SHA512843a415c8f90920045c4882d5ed67cbeecf9dc07a93cbbb3b8d3d99ab80facb99a5189aa1dcdb560d8f1a508bfe55e115a77204722357cb625613b44b9c0b820
-
Filesize
36KB
MD5ff9792087662a27e98446c05113eee1b
SHA141a76c3033b2903531315826779afd7c7b500110
SHA256408a19e0bd0be40ab78ac67173418943e7b87fc18b55312bc0428b23000754fd
SHA51264010633a461a8874cb81ab0bda3e32d076473b624c306edff74a29fcc046624797ffb9f1851de0b7e8ead1ba6ac0f640b2924a2992c0343b184e026fb979428
-
Filesize
160B
MD56e8ce685cd98fad6d7dddfd56f09b388
SHA1adebc7c000f7c8733ba5debb16d07b2eb54dd2fa
SHA256d1425850f8a3e11bb49688844572c640f3063d09ce5ebcf75562c3a114a09205
SHA512dca7f6c46359be57ad675a2ff4e204a671daf3bb5244780d0d73650254643e7fbf619f28e50d92a71d01718d71c425dd7dda7982aa7c4c16b719c8a30e1d9fef
-
Filesize
3KB
MD5dd621b7a77485fa7bfc727f1122f31a8
SHA1d3fc0a50b1bfc96edf84931b2f75d327929e42a9
SHA256f1a6aaf16f52b66fa6a97c2786e1bbcd2eb9ae76927c4930c105fece31c7dbd8
SHA51293a459cd14f83b137d4a5f8bfc5041f858280aa715cff1caa6911e8ebfe7da3a3f972e1fc9dee4291b2348aac4817ef717062eb69077f1a5ce0ca6f583e4184d
-
Filesize
48B
MD5c6e0945c23fd9d8589906b78cd179056
SHA1807851242d71e0009c6924182bcf80e9317b0445
SHA25602da098b26d6f1a1ac59c88cd2a421ae01b803e33e83a4369ee3127520df9545
SHA512d0883a139ddd685b20dc61d58f0327f230188883a30fdff6584b0905a0e8b71eb24285259c68f4b6296eb575dcab8311152a86ae0ef93ac303e3619dd5d31e2d
-
Filesize
192B
MD52f9f1157f2db593dd78edf4c3992a2c9
SHA10cf3f25c36c9e52ecf72fe529be53efb1eca8a0c
SHA256a58d8a2dbe1920449ae8a9e3fc5b3fad4b4ce017991c0a8eb5578cc14f370953
SHA51223eec0887b946aca0ee11bcc2d03d295768d03dcc78124e47156416eb7d71b160250f9c5252ef97edcc7427382010384645030c354cdeaa67db020c22d7ef2dc
-
Filesize
192B
MD5ed6b736b6e66365ab8a29f049fb895f3
SHA1d22c4899c67f6af87afb0df53eee1d401bf7561f
SHA256fb02b93476f37d19c9d0071551832016431f3eea0821ad97158b8bda5ffe0a6b
SHA5121a9905a3e492ac061c57dea17f34dd146337daa2cee19e138f724542db54d875becb7b345c61a730dc5d3d970acd6012ada5d7c649e5c3cd0f29630d6a260b16
-
Filesize
11KB
MD5aef6b2c60d9240f1f5773181bdcc5597
SHA105490a49bda3116dfd81aeba200cbd63e1fa5699
SHA256b8df6ab4a928aea5341582d93be037f39c2e34c2bdabce726b45bbef00da6125
SHA512457df10a1e677e8a0695e8cb2ef98c870a93f5d7a8bda44fc48602899c6f2a8e0ebcebe8cfbae03c4e21088e475eda3e8c017a06ecde7018f4bc6fd3da33444c
-
Filesize
11KB
MD545ccbdb5111a509307f4a59692a13340
SHA1e1fe0068e96756672211757dc02c66cab32bfb7c
SHA2568f4458b1a65731c0ba9f9d17f4e28d8465d41b7285318639a00c0abcec4b4ab8
SHA51251b77a344c38b5a3e18447628a60831f32235237fdbb44cf80ad87cc99687c66d19ab69f5fe35b2a7a9598a22c19503e949b123b5061b1f62f175e2662ef16b5
-
Filesize
11KB
MD571b281a1f889bfa8dbb0579bbcfdba29
SHA1367b54a1e556f85e892ded166f99aa255d6d37e9
SHA25659623e87162893ec135433852c346b7a34e60e5c64b79a5ce65fef48647a3d51
SHA5123ecaf6f696b55b49d186121e481fde496ebbb33cf78c370611453b1045d4ccb0d921f0431776e2cb4f9c35749290468ec4be6b1270f60aeb028a0b7be40ae889
-
Filesize
11KB
MD5b1e8e41c9b5c57700d3334dc2c8aeed0
SHA1b255da24ec5c54ff9873dc3e5c385d59a6238faa
SHA256cc2c2bf54eba08e86f08cc0259cec5bdc8dbe4a4d1ed4abbc8f2589f0e946452
SHA5125fb83460a8a047a8f671d3f0558c02d538fb11f5e73d872979c748050fa20e69909905370907876ec0c4be90373b065f9946d306b1cdaefe050e3a89f6b6ded3
-
Filesize
11KB
MD51d0e82972d49884339acf95ffe71df15
SHA1058ed72a38e9eef4ec72fe1fdab155531ececba0
SHA2568d307ade3209a4c62d49892b961d31690748e0b50193449bba84ab1896b26fa8
SHA51217e53bc0a6942cab08ca6e7a5019eaeea9aa1200f2120ad80e38f5307afb69e03ac0fde3a0a6d20f0b53a2a314e7ff7a3940ff83ff2394b35c9282f7192a35f4
-
Filesize
14KB
MD57090f09da9249493f35009a5b3e42cfe
SHA196e43c0699e95acf67bf68bbc5c5fc4c4672c7c7
SHA256c380dda516d34de21bd286ae07674ebd84fa018a68d0efe7767e562cebb5d4f0
SHA512e9347faef10664ec8e5ceb577dabf1886b8c1131155edd7684099637767742fb385aa362ed6224053010f3dc24059e1c79db5d76f12bde77b59107e3937d1da0
-
Filesize
11KB
MD56e4e62ed0d6d377d221cd66ef8adf1da
SHA1981867c403223a1a940ba2a4408e4b9e714ed855
SHA256d08da4b593317fd69a7fc01a372843876fe61bea86548a107bf890c0d99edca1
SHA512c361a18550bff221ca4db74fdb23dfb975b669772bf120f9b0cb260ec5d199dcc609e0f7837836871a0a9ec36f0db0ca5a1ae303f13e2ff169ab3f290f0b79f5
-
Filesize
11KB
MD54a3af00d91d3171b404a7a9f1aa4245a
SHA15feeaa59f614decad744b3dc14e0b35338d83692
SHA25630a5072877dd064b077d78ff73f3a4d758cb99c61e3aba3f4d3f69995a47a23a
SHA512eb2f792d9264d8d4b3c2fb48cb943d78ca9cff3b3a5bba34092d07c0a91400a684fc2f96eb7ae3ad115f8fec76f65d51b34e08b46e642d1fa67beb6d4a6551c7
-
Filesize
11KB
MD5b31859421c7afc6aba7448ef7f940530
SHA1a43b5943875bad5579cb086a13c47cb2c0b7b2a4
SHA2561548a670cd061d1b80b1dd520ef43d293156426e5aee0f0b7c7b05430e8502ed
SHA5129785cc558d86e34cf236c3eeba6c7cfff401f62c23d7fdef879b9ac75d4d96f813e7d533688d6972291de3d699bf3a595dddc7ab294848d5cbea49d39a3aade3
-
Filesize
11KB
MD580261857522df08329ed6ee7bdf2db9d
SHA1b35161716bce6f56f4e00ee33ebde80ba3c5b5aa
SHA2564f8e41330c432ee7820554568b56813cf3b00239eb1691c83ce4b6722ee39f88
SHA51205bd0c6049f69ca66cee03d013072849197367914dd4dfdd349124ed916fef3814e08f1046cd3bc3df20c327667a147d3f80dcf0de40ec10bc22d46ae3a10c00
-
Filesize
11KB
MD5768cd6e1fc32d88bad557b2e7f298bf8
SHA10728d7094508a3b8d09af609958c7759b78133dd
SHA256f0c30d8c0cd95cf8d98297d309ecf60b57cabebf846b7e343a71001ffb30815a
SHA512c11f8146420e5a508a158386a819a5c74c6f5484ec4d2094ca40f3c8fac60f7d4b58e21ad5ab4c63900e87d9ace8135e0f729a9f42419902423771fb026dcb4b
-
Filesize
12KB
MD5f4fdc8af4042c06cb72e86a9b2db3243
SHA1b67f54d360b7bec91ba97f276fdb672f0a6740f9
SHA2565741cc020c270275a07cc5b3962e8b98118c69ae8397dad0ef530f921e7ab707
SHA512de5c2019746da2953fd54d8fb2c5980188329ded512f0313317e16932f4d1acb663feb2ade938f511f9e18db9c431539631c2586394a5992ea1ab51b5fe03abc
-
Filesize
14KB
MD5802b30b50135fbf25adb64723a91894c
SHA1e628aad347137e786155efa4116b03bb12df038e
SHA256194ea13f96d20b10e07a5f9bf532b9f5e9bf92059f4ccc522020028a598737f1
SHA512e42c7da2ea060ab6fc09627613b5289513365faa1906804eca8fc9a967f00c055490da4c6345c0c46540140271d29acd51cbf337691e44656eccf5edc6489afe
-
Filesize
11KB
MD5ac29b5655291b1e24edb6340f56a7111
SHA1d01a4d560c5f1e863f586299f88b75d86f1b7587
SHA2569708499c86744f891c86c537a7d90a92dec74efa3b22d4356be658b208ee99ce
SHA512e7b39de12e5542e5c2227906e55f8b7f2452c90cc6e32395168f622273c280855a66d794c64d2f7b6cc0056392bed9046fb37a6f433b72893b1d6c4ad5e21897
-
Filesize
11KB
MD571d0204303b34222e9e5498af46d1ff4
SHA124becdfdbadc083efe1b9e1c66b8ca9d1372f55c
SHA256387087af70a57bff105294c0635671fc58b9533cdd5d55a43264169d933fc351
SHA51252b2f06a2335e64220959ca866e119424c2e8dd06dc4336175e39634d92590c29c56ed19c9f2e72cef37bd5f6f9496cec00ecd0f3d9a37604829a306a7a867d1
-
Filesize
12KB
MD551a1e6ba3668763a78dec2ebd065ddd8
SHA1c3ce0afc45210717b5693af7b00200c7fba512e4
SHA2562533906992315fdd54238210e1f3e8dfcf09ab565296834e4989a116c47d479c
SHA512a1de5b3078e430a3e01657d0851fd6dd2becc58bd41bc7d4e040a4899736d55f1389534d75b6ede6f91e536fc30ed2dc4f466dc31c50b49a21cd8efba23cb57e
-
Filesize
13KB
MD55d0d56d8823866490c24f752afe5c99e
SHA141c36388013fbfa43a1de99b0db59faebe4c7d96
SHA256a76a62e6d3868e3061425eb0f34cbabfb5a8ae41231952cf510278ba21ce032f
SHA512c52548a8d7f4590c178d88cf3ed452af1dcef9295938e25daab012ae008a1a58358fd0c15cbbd57ff421ea0dfadd798939fb31d9b3ed813bd9d0a4161620e5a0
-
Filesize
11KB
MD524ad5ba40dacd65f95fa82f4a6a7051d
SHA195c2f1b0cd8806dd6dc2c83b90ded3e175968f6e
SHA25676ad665c37d87119ca214af7b8d21b0c46d88083f25fd4be30801fb776659faf
SHA512262af389a89e38986825e76fe3089d0ec345d8e5d03e325b6ad2f8d502bfe502deedc3ea9ab6bee219ed2fc796e20b634b0842c3913e309cfda6018da4b4a61d
-
Filesize
11KB
MD5aa4517e8247f9257ebfa287db25e4b5f
SHA111aee148857c6683be65a525affc3299db8b220b
SHA256199400b357fa0d08c27b33aee6145ec021a8a11519811f833428477c9ad97933
SHA512712195dd1c63b3b4eee3145fb771f1232879868691eb9c2a081d3014abf3b525b290fc0e14de276e0475d834cc0727e5e0a0557d85a1dba406f36b600a1a3730
-
Filesize
11KB
MD5a0dfcfed011ed9a4e8a2e4fcc99d170e
SHA14626ba4b73cf9362ecf3899c8f05ef38304c907d
SHA25642d59c1f092f9c3be7da7395c03a50f65e7d5196f73e481699302791881c894c
SHA512b4691d50254f4dfc99e0aee1ad1bfaca64dbd91f703e2dab2c072695b3b879bc8b1d5bda9e6be8971079c89d83fa574bc2323c04106e41f18c626319c9addd11
-
Filesize
11KB
MD5f6fde96e821b7f1140e42b7100cf72da
SHA199cb77d2b55cc515b5d0c49728f568e5a149d0a1
SHA256b35972c0b2a60b44537f0ac56a5999da59978938e662ef9ed7628456c5621dcf
SHA5125a67b443cf28e78239bfe7c315ff033d1e58dbc759c3991e03ba748b20d027e2e0c7fa70094c196e6f71ec1744f5dc3b7f154285c63158328ad8d62c00c883c0
-
Filesize
13KB
MD54c04136359908b84fde2a2599c9825ec
SHA15fcfa787af2704c9ea731d27da6a3de357ae47ce
SHA256ad65cd5f243b618422cabbfdecd5f4ca47d29f34d773c9507b73aed3dcf7cbcc
SHA5121403819888ba552110a23214013c8092ea276f5583e8b6c9fad81a913a3e724fa60f7f81639caf6919dd76af509f88e629a87dc3f50171da56713da821548079
-
Filesize
11KB
MD511cfaf3c46ca08bce99b475196dfdbcd
SHA18ae76d85810efe3fb4237d87825704f65eec84fd
SHA25672e97d66b1290c9af664f174580975631e05c4b76ddd18c1bea67fcb221326c0
SHA512e710d588c9d36ed10a494dc9ec2e4b107e4970659e9b768d1035a078181210708b54fa7ee83d08e34ecd403881e07b290915c31e0c41bb2af8e46034f44775f5
-
Filesize
12KB
MD5e0c99a9c000fa642f583d4401be12c56
SHA1e866ed6db380da4e48f8879c2e45ab7b9b7bd710
SHA2565ef093faf6b4dbf1ea560e734184b4d467020cbd1dede7dc82dd2b9378817528
SHA512c27ca01170172b29d6f25cadac214b03be4828707d2dcda83c3c5c5a98c55b07a04c6ab39b3b99bd2963ee8828a40e86b2b74a6554f29bf3585c8035ddd72011
-
Filesize
11KB
MD5f40726f913c89d4512f0203bb4e37737
SHA16f99d9bb8eedb28c2e35c21ac160e721634ff87a
SHA256fb5f325ca5eeda6383ecd0e94d0e9b1f83a5d99d530fd8964d640dd7425528cd
SHA5123e7c74fa29c61ba50a4cbdc52ea27fb7bf0115c3d3381c9dc068e4a5b709ed271c671b90107add98d4c10e56011a7e67025c8929c449b350fd690fdf798ba890
-
Filesize
11KB
MD51534289765969e34696c5b36591d693a
SHA144c742ca49691919e984ecec6036fb52ea92480d
SHA256d69aa1285c55b2d93deef621b308d6632b8ec58709b96ffc6496175c19577aa2
SHA512cfff1a473bc2f7e1a2fd143834a46accfdc4ec66b23de31eb4dbede0af441b8b800b9029a36caff4251e36ff4beb66d15708d5b9938c27612de6cfe494dace4e
-
Filesize
12KB
MD5e7a4c9f190d8f7a97f299e053ff44625
SHA16c49303ecaf0f53ba75459b97c87f31788c5eb47
SHA256b52461e9183ecf623ef0a076bbd8bef9c01983ad3b32cfbc8569dc9ec376798e
SHA512eb9ff85035f0433fcf21ab7edee43720216d0869f378ce9ea98c172cdd691e0dccf7d82daefc4b07923e72c61a3750f42d640559661c8e200a04f7141a2de68a
-
Filesize
15KB
MD563f4715ec48bbce582486af262385d01
SHA1dfd32320765973ae979167d4e3981062409a2768
SHA2568cce792303474f236c52389a4d65ae5ef8cb28a665c39f3ee9a79648d153bb9c
SHA5129f089ac1217c433809a760620d72969453342b9dad81d9e5609d210578a0fd1029c77f865bd428ecc76fd68d686353cf8cd38ed0b02a9009fc73c6b5680924b9
-
Filesize
11KB
MD590373d92a681b8fc332966f51412fdad
SHA12593dd2c14bb48766fef53ffeb05060cc2891f96
SHA25616250b519adf860f3f3576fb7fc136423bff3420b4506bc78770cad7ea91e417
SHA512d4796d298e8208426c9e43fa18a54f0ee4d7789942590268dfb3900ef5d851d80c367d7607f875ee3bafa9c94ce3a725a0e81bc117358b0a0f4a28af7fcbf709
-
Filesize
13KB
MD5d74397dae105c4447214674029cb7d34
SHA15fb4a0934ff2e77a45a4fae59d493e1846e905e4
SHA2568ee731ae7fdf40492f077781b7d04ae5f0d58e6797ed60dd2f3dd5ff0fe61a32
SHA512317b2c97cd1aa0a3b39e7780548f6af339316ebe4bc83f389710481a46d976adc6f616da0e6275fea27b7241c27532c4ce70cc04b3c86d59135028b00d80ab9a
-
Filesize
12KB
MD5efd291f525f0742ff9d77f897a710011
SHA1cabed2e5520f74ad2b842469ab8a2d77ab9eee10
SHA256dcdd310a1bdf5d1cb27984db3aa416e1456dd59084cf191e573082177db2d0db
SHA51220fef3e06751a770431edcfb4ae857d889614b1b71621e999c4345482a983139f50d717f4e34c1d6281146964d1d08fafc9ec9f04621ced86ed37af3b377b96c
-
Filesize
11KB
MD577e82e9e0074a2fd438d9effc43312c5
SHA1dcfd2b92e9392855764768acbf5ee386fdebfc2c
SHA256df22b9cfc6d4e4894db08d61ce2ac11f9088921fd3e9c0bd41760a88bd8d5ba8
SHA5122f7f0ed8b66e83b721076ced067827e7c43f0d1dbf542d07ebbdf1f3257863ef3d0c12a16042e96e935a1682f372e651c5b2c7f21e1d24471b8c4d389571ab52
-
Filesize
20KB
MD5764f8bb3084f0afe868342b0332eb247
SHA18f0cf56a6a1133160156f8ec7bcb8258f67bc8fe
SHA2561cf700eca4ef6cefb954504f132c2a44b0a84049f8b76c4e70b172608507ed11
SHA51234ef24428bb6c96c97bac0bac56992b67dc037f1a55f1210a070d525b14789b30c167ac545f5462aaa0e875a5cf46d68a10885900e9774dc7ee09216eddbdf6d
-
Filesize
19KB
MD5ae87fd9db0597a8df0b3e8505987bbff
SHA195f913e906ea7baf7ddb59ef9b1f80602c007ecc
SHA256487388c41d429b62f395a3506cc04bef44da2414d74d1139e81bc4e50dfe5742
SHA5125c8a6d5aa40f1f96c32b641fe73202aed04308c5c25e3d2e39d11c92249fb4f556c78381266930a998c21d7503872dc532433ce4713ca87cb06eeeb54eeb556b
-
Filesize
62KB
MD584efbaf74ea9aa3e859e425f633e3e21
SHA1f97514287db77d0a32937ab04848c5a806ccb1d0
SHA256bc8d94e4ea9d7625887402c0155ff58a6c8ce7ac63099e66f3e8fd2cc7a2ee70
SHA5126e12a15411dbf8eccaf0ed7ed871fbfa56d45dba6c53e4e62190be0d1864c80166b540ca8d9a421bdce4b73bc3c87b44bbe48f341a00f89f0997f5fce26cdb8c
-
Filesize
12KB
MD5ea25f794f8f368beaeb2244af6f9e543
SHA1046f2c9cb930181b5aefbbffaa03c7c8873bba0e
SHA25681c18568b9cdf29f63755250683e4145666cd7d115df43906f413fcd7ddef866
SHA512889b7672356d09e93fee7e0035afe5420f6cb55dce87f79bfde796bb5868ea4949e7f11ce93134ac9f569f5356dcd4f4d78897aa674d882858ff1f2cf370746e
-
Filesize
15KB
MD5b1bb0a214ba04e5b06f3c4b1be00dff6
SHA198d8f622e6cbf76d84f5ed07995032626e1cd5e0
SHA256363d8cecb0df10b2409d8e4305e5dbaf57c50d42c060dc5be1c494ee22ac3ed4
SHA512b575eb046cbf2f623894ab526525761b6980cdf48a447e534ee8959078736d69679bfb7e7080879630bd0e6a4465b92c17c1776aa26dedd8a7abd2247eda8b5f
-
Filesize
17KB
MD50fafb9fdae2c074b34723fe9ae97bfcc
SHA1f8730efea0be9db0ca007d513ddafcf5f1817254
SHA25680fc3d6484dcd3f8e6553d99c110939a3253e34e13a74bdda52ae9500c68247e
SHA51293b9a71e9908cd1fe66181fca56ab76fe862338ec2b3702c9c6ed1c8b7070c441f1d6d0af7e7cc39782f73ac41246b95e81fbbda27757dc367e0feade471490c
-
Filesize
17KB
MD5f464805e321642e86a2e5b394a4299af
SHA120fcf64acb306c07f3a33dd5c7ada577b367a656
SHA2566985260db31e74199fc9886615a86ead22236e66fdf62e6c575832fe2769c7a4
SHA512e719768b8f776b4e139be5e9c652be6971af060fab80791cc6d26c52748efc780acdb1cbcc5b578de0f0ab3b93361bf94501a9c83ec3de2a3b900dfc78bad9e8
-
Filesize
13KB
MD52a049883c1d1491e7940bf4eba91bd08
SHA1d5dddaf15c8a7b9fb3d921056a8180196b7927a6
SHA2564c6d8165ca5b07f76c73814adb4a7d521ffdaca62b797368ab809dc4c0b1c2d1
SHA51254d455978bee216a63be05cea20768d4c2ea288ac6be4891ff73cb158bb443ce4c14f327fc20b912cf22630aba7fe711622207ecdbebe26f1a21229d962973c4
-
Filesize
11KB
MD51f9d4486965fd5bef9dd0df02d4c817f
SHA1c39869ccf1eb8df26445f3080979b11199ea8b7c
SHA25679fb3daa43e0458fa4f92f498688f011100888e1b5ce663768f424f8e4e66f40
SHA512f5c861c06c1470e2be1fba199e924be654c0ab04b0612140d9915f25fa3b8b4a17d42cd282f2e8b4179e8db59aafd18a3f5208f3a67864d2dad6a828dbfb0588
-
Filesize
1011KB
MD509503924b770ab55e979c86f18d65946
SHA16206d66ff4973bd04e840a33b94915182c5781b0
SHA25679068196711c349e09596ab41e8d74ec15868933cf3f7136f9dbd0c4b8595623
SHA51268de84c4d7a2ea3061dd3aed54d47017d08270da5e4df0ef4f6682b5e122a842ed190eabdad6dc92f8f366491b7ed9ff7795988a56d36873c34121081700cb7a
-
Filesize
1KB
MD5b862a678425bf9a6a126bdeb84ca7302
SHA1e7ff8b6e37810fbb43fd8ebd02535506233457f8
SHA2563286993d3ce37328c6ac489bcbaf8d490dfb078bfa5ca78a32c9e7f0fe2089a1
SHA5126a608802cb881518dcabb04e6a401bbb2d55c7bded2da9b2e94448a1f3fa73fe68f50cb45fbd6266d7406bf1004a11eee0e2924956d3826b2133e51976efd41c
-
Filesize
31KB
MD55e5b42e45ee6729e7830015d60945d07
SHA1bf961cdc1c5fe600451d10609eb9246d56b99d62
SHA256c50fbeb059c66aedcc2e16f65c38c7d7f099490db0745d8851f8d2ffcbfd178a
SHA51295b4ac16234e0fd279b7d1352b71b6de2db0b9f913aa6622d1679f52f5565f276cb6f9b9e50b9b094c8c18a430055353604cd987323e4034cd0864ce3543b5ba
-
Filesize
34KB
MD5c240f076682afe928ca44d26a1b767b2
SHA1ccb681bd5ca9f901ba12941367ad0f418e25f838
SHA256e397350809c46c6ecd4e53beed5d533f39b2bbfb82e363d3e44508fb58cd0ba7
SHA5121fa935d5158534fd0260e9f024d3f3424bb42ebcc6f6beca0cdca31856dd8d43682f2557b98b942c3fa630e4240d97b888c3a6376749b57d344a008c3e202813
-
Filesize
23KB
MD5a16c38c6d518ba50d89f86b7972036b5
SHA126381917a11d6b66b18800608859438630dc00eb
SHA256bf06c2421f0895fec554e25c8ec974413f0d2f69c289aea2467d68b3e0e11c87
SHA51211f8596a8559fc52d7d24f9670b40743176b99ae53ef76f6364137bd8f588bc0d5702539b9109dd345d1e9f3919a83f8ad610e2c163ee8b1fbb5dd440825155f
-
Filesize
2KB
MD5d992013b937ae3b34fcd65e494a7a405
SHA175b68c9913ebbd8b9e97152c1f4f46528546bbb5
SHA25637a61357428603424bec3189e9a821a8ef501b8ba95542f4b2f4ee42c0ac5966
SHA5125c3c5a587d42edbb36f0c861a1d1fd1e3371b5049d14a353c4905402a4ca4c75f0c1146b45caaf6f0416ddf3f7b5a724ee309433180cafef910c537552ba3a9c
-
Filesize
1KB
MD54d1afa4be493815982051e4046834532
SHA165830e037ea39def038672e6a97cebcb68cca918
SHA256d49c5e9d05d37b53a8c91d634f07406259f999f922d784d59073a731582bb3cc
SHA512340853b768dbbc26459570d946947c6fe597ca63ac4c89ca349ce08bb6a9449ebbcadc34ba1184fb119652aa74d6af0f96ad72723b08825140d7c0e1eb031a3d
-
Filesize
3KB
MD50bcd55fff7ede7c6046a12e5ada788b8
SHA16538f4fb5f57db812ee199342cf55d52848f2fb8
SHA2567876b253d1b88fc302930fa6b646a0a8cec82d525c9760636cdc29d7e07313eb
SHA5121db09839d8dea3a8f1fdc8fa463f2a2fd862955c75add3984a17df65f7cc7d6a32cc25b071fa4f4836856220e497f61ecf442a790c4bf39af8b0640f05bdf6d4
-
Filesize
2KB
MD5ad3addcf61787037883b348789a0a525
SHA10da430a5a47825d341ac9bd228bb039d8cd2c185
SHA256243c980dc57037392bdecd48608947d1b07b005f9c52bbfcdae6cbc37c475b09
SHA51203ccc02b711eb7b771f1fd2e9634a07b6cee7b5e3f64f62be068ae0b29c0fda8e965a8ec79db555eb6b260d9623754a4a413f21d5377066a7e801b616b28a473
-
Filesize
5KB
MD5eb462f89b41b33578c68e1ea24ee37a1
SHA1724792ac583e9abe50aaee3230b53eadac41396e
SHA256d27f4f68a9cba961704d40a646f37c1c64ca711334c5e1d9092be1647a9ba297
SHA5123507a7599b646e4e52dc430b1399698e342a95c42a47b2d5d6a586493c9fc986e3d004d864e2903aa428d5f624a002387944042ca90ffc58fda25c3accc8e9bb
-
Filesize
17KB
MD53cf7c933106a64bff79e6945cb10c97c
SHA1413b45b4488fa36a53d780ca69670531bef6e5c6
SHA256fba849604b8ccb3cd2c1b027e9a3227656af4fb441ae680ba86965843a4db747
SHA51292cfde6321ca13ba7bc2e77e913988d68d30eaee3fdb1c005b1660d7c4b8c0bc8535149fa423dfa5bf7f1780cdb5fc98a6d050b09078021ec60ec488adced34f
-
Filesize
320KB
MD53fa1b86e8b74aedfe854c01f7e4847eb
SHA1793a1a16c991e00cb3ee5947c6f8e02383b9794a
SHA256c343073a759c03e4c27258b0566513005cd799a2f829f2e372efb8deff7fb380
SHA5123694d3fb9f64a42294382440fa666e2446335027f45949f76f64ac001a0a3ff11748afe485e4ee718f20d8faff371ed5d79ba953e06cba871ee9eb5034a6421f
-
Filesize
1KB
MD51c2385513ff95a2889c0aed8d39b7212
SHA1d91279059df3b75cd64ebba7de64f6460beef990
SHA2564bc2834cfc80e70ec3e8b940295963d15b98ef65fb762b79b3b678cf2368a698
SHA512353f9a7ab5a33087d4ebe47263ff54c5b08510cc5b9a6da230ca1ef325c52566b926e2a8d3ad611030aed999dc17a513ec01203805dd8baee93650e18723f78b
-
Filesize
10KB
MD594d6330363d4b2541c9665988d9761e3
SHA10d8ad106a15e9a6ebd573788f2018c17d7393408
SHA256e3a0b371e5b0b12ded4b1593f844e4abec3cf5c37a2599acb7ad094fdcb7399d
SHA512f8d493f58b2155b0baa7801674732d70bf042700db50d8a14abf56485e933e419c11cfcf26e5cd45728096cea6cc556a06284dc246616b6c8472ca8f79fbdfe4
-
Filesize
3KB
MD583ab109f74eb5beab0181b5dd504d09a
SHA102ddd7a102d329b09e12e75c39f260289d4101da
SHA25664ebcff3da6add134f7878e23fa827a78585c1be8fb0a7113cc10a09f179178d
SHA5128cee25b46afd0ca37c48fc26bab03525a1f58843f24eb818efc024ac829403c23e0d6439155cee4ffce22c4efdc0c4c75b33598ed5d17ae2947c6292ea83b7d4
-
Filesize
176B
MD5dc869d04708fda32c4fb5516f9de345d
SHA12760d546ada036804ba733dec1a64685fe1b946d
SHA256d550b90fe8d6797ea0974c87e402fc8b7816871e4633efec2377aa20716f468e
SHA512c218fb4c5ff03d197760b6ef58db2ba9c3d2b3941a062029581f27ca927b5cbc6554eb903781b7307dbf0d661e480bbf00c933d4da3b22a49619eb4bd3b65e28
-
Filesize
1KB
MD5c5faced3808d3d7e039071159fb8c560
SHA1628a4ca11bfcc070572087bcf2d39bcefdb56962
SHA2561a667e35e57da207b18396bbf2a42e0df8f52976dc9ebb1cb750178dfecc3df0
SHA51201e0729fa2ba9058c09fed7f997e4a47e43643165f71dfc08bb27300425e03ff2f3ed4d2f78b4394544b90868e1a1fd14d542ddef9fbbca123c2996be78afbac
-
Filesize
3KB
MD58fde676cb63f22d9d9880ddf3b4e2662
SHA1d19ed3960fd82302d924ea72a2c854766fc5b8b1
SHA256a1183db53f392412b74a1bbd9fb16606a14f7403dccc1ee70a5c6137b8e81d08
SHA512706a500bc786b9d57c18e70f55bcb86e7603ee110944853fa9189d22dbf93ad37a053f48fe8346005e4a8793cce167ba23ca7f21d2610ca3dd0cbd7b76072e76
-
Filesize
1KB
MD5a13dd74b2d8b3897cdc0a29001637910
SHA1234ad2aef35df2e92c0c50872e97b7a70fdcb06c
SHA256fa38a11657e3fdaf8212be577c11001bb93dbef9bc9a083f5949512773d952eb
SHA5123c42efbe8eca887f9310a06d20786b731b4244f6693d4b3791d451ec5511658f30226c9f6ee2907ef8d761b3735dcc256fdf85967150a24f725c257243cfc44b
-
Filesize
28KB
MD5372f83d3a63b6436bd6c3fe8d6c131ff
SHA19f3399f30750523efb6fcb1970a533c4f1c8a192
SHA2567c53274ff86a11b833e36ddbef11a0be9d74a1cd95a4ce461c6c86dfab0118e3
SHA512cddb399fe58de1d54f6339e01b5f2d799ec9b49424fe271810b49334b8e2b5f84ee363e55bc2cfebe3b9f41c58ff8c189caaf150aac3852e880da0efe261943b
-
Filesize
2KB
MD5bbbc0b3eedb02440a8172c921960fd11
SHA1f8dac6241d7111c5082687e9e99aec322c72f896
SHA256e20f9ffd237309825563ba0ad5bb789cb605895b1c0e2cfd03d02aead5aafae4
SHA512f311e635171df1cf0c6a36320740f204726ee1fe9f074ab347cf319c977bfffee51017ea99b985cb0d8a82230f9b4af6d575d6612426862e093a2e89601393f5
-
Filesize
1KB
MD550950dac8ed1e4aaa6a3bdd7f9e04424
SHA103093a8a9e89e3456130e530adf4f649928c9ff1
SHA256e5997e68a39424d3ba5522f684079b41fd45bc7dd8cce16c98c7f71086bde6a9
SHA5122c5e25ad4119f249601fca7b0933254839c5fd9db5ebc744f4078c293948d825940d27a49275b7841bffa8f8df1ceff97ecd7a9862092b013cbe7edf6ee60be5
-
Filesize
2KB
MD5659e466874312983564ee574b0eaede7
SHA19850538153d96a7694a489c64a6bdbde1b559efe
SHA256fe2ae541ba060d92d1df64b0369d157e3d08737eece40e6f26084d4da175b9c6
SHA512b4349b0443d45f33fc44028f3d6943b440626ee7cb9beca88a764f205e80975ef4327121218c7d644ff8f1629477b41139edc137b3cb9f2182fc5107a3daf235
-
Filesize
1KB
MD5718e777793b9a52481569e90b09d5a6c
SHA1d6937a3ce52881cecea686f1381876e214508c7d
SHA25641779d3b01656e7086e36a23c921cf59fc4cfd0493992baa66fad6d78236a37b
SHA5129433eff09f314324f6d9aed460cf627c1ac6dc474131285ff6e77208a75ec61d67ed6d6c698d14cec6ee24a4b3c6a20d0b26f4b9fa1272ada9160dfb51b58a16
-
Filesize
1KB
MD5ede811a1c424f4550459dc244351b4cd
SHA1b8da05dddcd7dd8a4403678554173227ced7a7c6
SHA25686c10c7b9f879457f34dece7796dc348e6d42cf22ee35285caa97907eea1e650
SHA512ed2026ade356161679c6ae9e6bcb4afe466a982e839e69f43bc73cd74a929812a2a489b57d2e615997071a5cfdc559cc123d49fbc060aa15065e9eac845a4fcd
-
Filesize
1KB
MD5c210e83a4105481b8ac23b4ff66cbabd
SHA1b68deec453bc1e661a319f0557bde3d67783d098
SHA25652e4bb866d0741fe8289c8f7b1da873c883428e7add5b49a2647f6245519a936
SHA512b8a561bc481055ae67776e1df9d02abd2f8645d6ff50087a21ab90520abcd820374e8cadd9d23fc4cc2868458068aec62826d10e25e43fe690c48b7e0ded4a60
-
Filesize
3KB
MD53cf3170213a953e0f9031ad47a526c99
SHA157d38906e5b3b2bb394bd04b83bd958c06e2a3df
SHA256073c6a46efceb2eafcab25bdd56bfd9fcef113a833d768da23d195804164bba6
SHA512b6b0ae2758ca53a2eec47fcde8c2cf2810c5051296b8463546966d2567720ac285ac58346040808908cc73ea3785f517f8808b4a4557e1f46140e051d5369260
-
Filesize
2KB
MD53423623ba9ac9bbfcdbafa9bf6038df4
SHA1795d88e9807eb90d886341dcd4c05b8fff149cbb
SHA256b031c93d796db976e4b2a28d118c1f4e1ee6f1dcfdeccbf06f765ba850d731af
SHA51263f73a46f473c407e8e2c783bc8000df3a42bb6b135f5aa8139595286d99c58f887c1bc814cd958dda54f042726831f4e68c425eaa6e88fd7872a630485afc83
-
Filesize
6KB
MD5b2e794df0d9b4dee84db8d3a81a6bd2c
SHA1105a2512e5ff6899d9bb8cdcd7dee1826469aa8f
SHA2568d8ee1593b7327bb9c230b063233f6a1191f51833402de76aec7c8a3cf92c121
SHA5127feccad83fe648a44d655fb404c92fb1e5a60daabe3c2734174f1d47d94e0814cdfc3d2a2626dea417501b19db9c7311491204172fdbedf70dbae2890aac6e81
-
Filesize
5KB
MD592ec79440fd3eec25c0d3a1147c8a49a
SHA1e860e311dadc1d87955949055dca9743dd7d135d
SHA256afa103d54f32b5efbdeea1e607f778dd23b382c839ea812fd80536c3bbb91d86
SHA512bb667ab3b8426de48d351a001dafdf06875d40104f098b55009d4b8d9d58ab00db33a935f532a9cd144ebe6de3965a83abcee71433e202e39d421107c7bdc632
-
Filesize
3KB
MD505f5d8d710b0c5c792a6e946e68bdd4e
SHA125baa77feae8704ea28ae5cbc35eb2ec2a0e9cc7
SHA2563378cd6cfb9b4703328ffb6d0f7e6940f3744ab389b5bc87775b6f16b7311f71
SHA51222fb4d123dec434277aa6e5f738ba8a35579ea65823314f487096770ce718819f22be8a4cf9bbe756a282e225e8dce3749669fd2db956a420b8c9e7b5e47ae28
-
Filesize
2KB
MD58aa5f43e64325406b3486cca0f6848ed
SHA1cf9da430847a3ee3eb29c59f5c039d516f25d617
SHA256b80ce1c0f72293729569f4810136baedcd1d0b66c012a2302853b6a1d6af3602
SHA5120657526a2b0b26b6cf7232c48a140375f028837b6cc4ad69683082834387556373d49d6b7aa7a3ad9b47e119ab03385221803581fb9a43bc47f1df08bf83b631
-
Filesize
2KB
MD5010d2271e7c297237ff7eaf5b358a422
SHA12deb56bca4e38d71d85bd4dc08c46ca34c6ca014
SHA256309c780de2548ac13cc5be495039e06b83996485e39b4990fe12419ad543c548
SHA512b54e5466e9f24a1c5cda84bfcb62f9c3642f6931e5f0e15fc9d1e495e8f884ad90af9819ffdc648c305fa8898f43a5482fe731f812dda6f8347f7807fe2d37fc
-
Filesize
1KB
MD5b8842b045b6cfe4f7c5bf06f23ec3294
SHA1713ab0403837857dbb9c3ff8498fe9dd6bd303ae
SHA256fd571da2eabd896aac835f7187a0cf35a21875ce112eb8c465ee14fba5b815bb
SHA51217ff9cd652ca82a9303011fdbf9f92a216aa7a926d7ad0780b1a477766784b6f5d25c0d976dc5c2bb2f5622d9fcef9481b535e9d21f17081a485059ca1152c27
-
Filesize
1KB
MD5b0c68282136806415ff7feb9284681d1
SHA1eddb00a3cea92d8c090ac243ff152e5d42c4b16d
SHA256ec4885edd06759f310aeb66d5ff01a36d7be9182af0321b61f7875703f5b5eba
SHA512b33f958c4e824ec8498fd301186f496a1fb82864e1051db3fd513a86cd6ad6d3fd9002345cdf0a4f461acffd699e20d90dca450d1d597b0355be09a2b382c4b5
-
Filesize
11KB
MD5f39578c741cbfafa47f4b024e42919a5
SHA11a83f1ed47cbc11a9940bae411efd25084c77c9c
SHA25670c0b3754e1dcc3ce1769fca54b12ab14d36c9dc7eca9de1b449ecef1f173389
SHA5121fa1105823c10b6f499fd67728f53d3844383426cd788bfef4932abe9ccbde51825cece172200b1908e502c92de0341d46f255c6006bad17f911f38e2b39d2fc
-
Filesize
1KB
MD579402444f143cea3d7c58b419d2e9b47
SHA1ad05805155dcef4908810f74ab635556424116ad
SHA256a06c62579a8097fcd54d75289d8c65ef545aa00d7eb65861eb931bb04351d46a
SHA5121307f8392bf4f1554e6322da8903c6776f594534d916a4e78405c9d9747e5a565c5155b23ed568109c8e9b3b68947850d3db1df6904f6a6807f02c7badb01db0
-
Filesize
2KB
MD5e4a7df08481f5de4199314465a884649
SHA17755991924584c2e7f45b9e3e7ee19966c3adc98
SHA25686ea6eae223e964ffeabadd26b0b624056ca36b40eac1e2523a80ffdc6727d15
SHA512c9057ed528930d175e19bb8d816705e9dda864eabbd053626d245486a5e136f13b17883321f56556e6f4705f195b2a303871a71c39fce458c66a224dfc90fd24
-
Filesize
11KB
MD53a9cdd7c462120ff7d04c863c541b04f
SHA14f334d6ddafd52b932de4ba95ce28962a4c1b85d
SHA256d1fb311e12c3c1b6bd921331254fb0370f0f9eb718ed0ebd66929b4a42bff45e
SHA512c15311baefa649772eaf52c089e74bad9b05350919072d4bbeef8a0d3cd85f08aade0ce16ad2ba55248ec89c06b68d06e8f0b46c3d78a7a678d92b0d52f38f2a
-
Filesize
11KB
MD54070403214a3d912d8b52dcca9fc359e
SHA1672c97868f5192cf3819e325c74038b401c85753
SHA256449b0808560a1c31698dccd4a9c83a00da8b4687ccd32778a41c433a8b2991bd
SHA512b76c00778f069157a3e3096b3bce01743213cad65f13edd288d2f4adc3488a7faf11df640441774045f9dfafef6fc803d6da01833215a44f58934f91dd72a008
-
Filesize
11KB
MD5a429e4309b2cb679dcecc3c86338b95e
SHA160d39632000d0f6a76172a152f1719079673a686
SHA256c3a516ed057cc57eab35fc837abe1b9ab850130870dd11f2854c58d9d6d92a80
SHA512ff128a4605fdc2bec97c9561fe6bcc5d6de73b7998fc1211708e090045056f2d90defa50579a867e7bd952c729b6169b4904bb39d69469826eb01aaced6bbc6b
-
Filesize
1024B
MD5c840f4b47afd896bf3f5ac5dc963d63b
SHA1d3ef96dbb0d6803239af37a9c99743e4382eb86e
SHA2565947c25356ab89f1f873c05672960b39caf74d5eb5bcb5e747b5d0c954cc9cba
SHA512e4b228876e1495db2ddaef045e2c8cb0c7cccdcaf5fbb7122563b2b863d641332dcad0237a541a3c9ff5b47b640b1e043e4300e6eea7435bebc3b1fa5a515553
-
Filesize
48B
MD5848f40e70eb1eb4b32d330bfa1d60e73
SHA119c95ae9c562f2fb969d9f7109c981f7a9da3a29
SHA256baa6c732d6896b894ab74c7ecdde994a268432178f3e1bb014bd6f7d84aa7feb
SHA512a8771cfa9a1c1345c039dde4b0f7a0968543c9aafa0264ebb7bd5bfa0817b2a57aa6b7ce38b5942a76148b6d59f27ec672f6fa7bcde1ad9d9d2a39abb38140b9
-
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Localytics.dll
Filesize16B
MD5afe7185109a886656ccab80cc20023b6
SHA1ba940426722d027e38c29f6b711f4ba752007d4a
SHA256de843b95d649e0de82195743cf501efd77bfa620cfcd51103254e157f5d1cd64
SHA512e7d293b588a35d2b299fef4007234750dfaef8a70079015b61d46bfbcb36f66fcf5c2edb7287b9787371fdf91bdefc618c99d19b9839a7d03e53bba5e3575c78
-
C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\zlibwapi.dll
Filesize274KB
MD5f6b2036f12e2a435fe325727cf9df10b
SHA1c88bf2ed6b4b93b35098ce1498b72292391d99cd
SHA256c2fbde1d263f69bd26a25516dac33e03b4a781798fb7279aa5acf68770f912f3
SHA512d0b3af258f24a82a623b82ad921df67bc2d3af4de4db435455570bdc9d0214cfb9082a4503c834c5f70387feb6f9a9cce1c8892e2987dae8b902027df2060c97
-
Filesize
18KB
MD52f37d41fb908337412b49e2337d37c42
SHA1ed8fdf4b86b6fdac535a1ce8abfb8b76793fbfbe
SHA256aaecbb8d8be095732104d947330ef0ca65df26efaaab193c5cb2fcf79d619dcf
SHA512c0761a34d89a907faa37885deb6cd00e0f7460d5a57ea6f0660d6eb8dcef1c453306201e86b88ddeedf31041b62f09554ad00b6ae63a816439f52d9c35baf0db
-
Filesize
18KB
MD572aed65db8ff70673006a731d91888e5
SHA15fce8eccbdfd25f684aaa0983be287e8a0d53f4b
SHA256774313245e17cbd3aae9095435ee3a5c37f7f95292e57e2c1035c12eddec28ce
SHA512a17c2fadc71cf5a814662f221e6261c40d5542dd3a9745e676f34b6d3c19afea71cc40f766632ad75ae95e86501f666b35727d3e30710c8adfd49572883c6c0b
-
Filesize
20KB
MD5a6086f41c1efb7d0e0784634be4f6dac
SHA17c05d389e01dc296686b04ac256f1a656b9243ca
SHA256a2a613c302e20e0f4c02b0b64fd302ee1064fe73cabf70c35d84714a73597494
SHA512bc00babc0a2765f84af940d515c0207a96bc867bc4e6c635b52d708fe44750da081d2c6389835e056d18f05088860c03541edb9e8f3f1443a42cf6f303b6f49a
-
Filesize
18KB
MD54f59ec5ee4e2a40d4d5a544d2016b11c
SHA160fdd8235f8d0ffbb3273366bc722682469e0282
SHA256223169b0ec8b27a9714f97b673e30f84dda9070e7892c8bd73b71e979bb2508f
SHA5125f40c92812d57d14eef625e1ca99e97a2e9f009d7177d8c126cb61a14c1605441e6b58413e45e2e920ed4ac0ba5943f09f01fd5fc466d10ce44d40374170207c
-
Filesize
18KB
MD5c2450a71a0b46079fa8840f3f9faad17
SHA1a247a44aca9954edcf60470c07c6604202395a13
SHA2564d25593755f358574b9d636d6d49fa2fbe372483cf23469f69640ca7fb310012
SHA512e89defe8cfe843db07fcf76952d93b5ff18293e394f8ae816795ba0d9c32bd12e36212c64cbc39738bf5bca33a8624d747aea1137e736217fd2f6a7fe4b61e26
-
Filesize
18KB
MD51e7d2287105801c10de676169dec5ae4
SHA1e909bb6f024cdf4e0bc6231f83282257c907e9b3
SHA256291527b75b8bc73a21f2178f72ef8c1d27503d941218081329a73566619e0cbd
SHA512ee6e3152c520cd74087fc8c27b8c7d10bd77a893638215af0ce830b9e25adf240b66de175ffc58ad2a532f2214591c9a927354167bf0ede5c338e0560259f6b6
-
Filesize
11KB
MD5df846025ffa614b633679465c44adbe3
SHA16faa9f4f93987441df0b65ecaaadf8f589fca344
SHA2563d60e93448779817dd1056a2b038b8e1cd2b80129d2c74f4d7543e7b3a0f2da0
SHA5126a44b6d56868b3de8408b5f730fe412442ec960a5199c520a99e848a26417d9e98288243a1cc4180fe69524ed65f3271d1eabe825d7ba7590865c3bc53efa499
-
Filesize
19KB
MD5e80fe580ca4a79ca88bfaad02618147e
SHA1a735c762b2552420cd6f1499d094a27bcda5308e
SHA256d9fefd40aaffbf273ce5dc9da0d65997bfd0cf034f11c821f3a9d4b965e7e6cf
SHA51204c8ba53e3303dd2af9cb6ff1588167af0161a30e76a02b3e9607057a35094f01ebd89bc0a47fb9eb29f70eaac39fc6e80e8f34429c2c5b89b0802f131867e81
-
Filesize
22KB
MD54896a71910f0430996b613f56ecc1cc2
SHA154dcb6add1a0ee3a49601f832abbac3cb1578066
SHA256e1e22fca5d5ad4719e7f16039422409275411d1ab284bf33bb6d9b5e9dc37c02
SHA5121c63c7f450654a5e132ac30222dfc34fb81742f5dc5699127fd381706fefaf70d19fd1dc7ce8f48fe2dd7bb9856bbfae493e583498810c3f4abbcb48e76bd7a5
-
Filesize
18KB
MD5355024e9302a963b216b7605d14c6ec8
SHA10b816033e52284191bf27a029d0b8dd82d01abc7
SHA25644b170285f5f66516c290f7e2306af0689183c0bf49458f6a8d0a500f554030c
SHA512db829b8612ae755f071cf934291f44c9018f56f5f56c9116319cace2a23bade3f04beb2d3e50a2e6d391ad772e95ec0cd0d48dc69e276f452333c1d3e532c511
-
Filesize
20KB
MD56d6c869b70ebfa82647da3f085a29458
SHA146af314caea95398d64b6352de534b10dbf6fa66
SHA2564cf9be5c6d4ff30461ca48306eca4ad731a16bc57cc5d7d30a23ab54bdbb3b81
SHA512f28954fa469959e34343c97e0b45b652ddc3465c13e355e18745ac55fc2067df08a9cd2b0a3dd818202ded9dc4ae737d92c7aca5367d5b0ef7522d79dbe85a33
-
Filesize
19KB
MD52cc00b26f587426970829f51afb35754
SHA1d03b33ae4c762b61f6a42b40b22d86aa650993ca
SHA256f17f85217e9bd7e617cc307669329099708be5540257743b04fe7ce65b76d685
SHA51292020cd6970ff34f6932aa9142795c61b1d25ede61538a01751d01a608a3306823459f323699337ec66bfdbf53f5f5f923f368f3b0a00c7e70229e2cbdef3620
-
Filesize
18KB
MD53d14d708322f162d4433adf43fb0a441
SHA155406945d44cf579746a09e6b195f81875aa28d7
SHA25678267c9d37c64c861cd4d480013d436e71575c82bc8a7b8fe3d7189aeda06de4
SHA5124741238ab89f9fe8543a9ebc3b2577a0516aedfc5b604a8474a13117e2f4858c8e97817380187a974a226d96632c93e352564c639ff16d73e4f85322e0a25916
-
Filesize
27KB
MD5d093bf4c06efb7d5ac42a57b2b87ec30
SHA1f0a21ae93dfbd61bdaf35ef2191d21f7e45c4c27
SHA256c767097e8384fa5390a0a31fd1793cdd04b1fc7eaf691793f42f3a5df9613f81
SHA512cdd5f10916b448ca0120c06c6c9742aff7314f313911fb9cea15552c75d2ac6a07b27b8f9d32c0e3f5ced5a3e48a0b68c23b11aca086ef92bd824d8385204ddd
-
Filesize
26KB
MD5a49e6f6fc2db560b47d60af6d0ed3e11
SHA1f4fc8151dd34ae9e28605c2a7a01ba0f3ed7ce37
SHA256d7632f227eaffa21837251775c03471a2ca1e9d694aec1dce087c23612c5babd
SHA5122d6d46bba06d2adf777b5fefd8e0bb79c1b08989daa691ad35a9552e9e9948f559137a57aa6cde8a57b89d28005dad0518a5f291041413df569d25a67f9fd2ab
-
Filesize
69KB
MD5f6fd7497d78eab75ec158735cfc6e40c
SHA1359fb357e19ce729422b17c2de6012e5ed7d7f0b
SHA2566ad9ba5f9cbcb3667a802ed32e12bfb43a9ae9fe231171c4873003720c4f36a1
SHA512bef08d709c71839591499b208ed60a457eb4d095a575c7c3f1fb7df862ab503b0fac6af058b08db17b6bd757a0dc61c578ffef269c8ac511883082ea62a059dd
-
Filesize
19KB
MD56c55da9ceaeb816ca971fd7f6429d42e
SHA1db7455c3127520c2d08a555d36211c9fb172260c
SHA256d5df55edb14e16a5cd48080e8a4eae77da4933d9c79075d6af90a6edc92ecdee
SHA51240540c54acc075463775659955d1e1ff8716a99151836fcfd580819b3931a889692e26a802ab527fb2b99ef42a20239809775e2056b74162d84ada894802de15
-
Filesize
22KB
MD505682f1b6f8daf67db707ec4d9cc468a
SHA11eec0023b1886bcc6064c4001c6149dec6fe3564
SHA25633c745275ef1a9082f1f84185ac004b2c0004942f4d32f6ac6683d98cd48a019
SHA51228976cf4afbd17f3f50426407885af1019cec05752d0580eef3bbb45b59a45ee1a1a863865dce66c256303282cfd55ac06981ed251ba6cc52cb9f61a2202247c
-
Filesize
24KB
MD5345be699b9111c9d46a7107d6447b81e
SHA17d180282301786ca39fa2a576bf3c41f6875799a
SHA25603e2e15d1f8224efdbd668919acbc2744ebe0ba3d6b5c636e53d9e659d99863e
SHA512c74643f41745ced78ebe8a384c739d257bb116b46125b972d46cd4d11a29d246d1d293f6503bc37d287c5c03ad12d3952d2b11b99c54fad557399081514ae0e9
-
Filesize
24KB
MD538935a5ce35bee9d7c8fbecd9bd50adb
SHA17e46e7119e14eab2b47fa1b693139fd1d5672e31
SHA25665b533267f3a4ce5d7cd57ccd48417ef9684a1fd9c952e489279638b994b9db2
SHA5120ea1b47d18cbd18f94c21e43917cd5bb1faec7833a42fcc4d988a2fd2a50749989928da063657ed8726d8c00c67e877a48d4e7994f29e311719ee394bbffc313
-
Filesize
20KB
MD54f9499c4ad9ec0735b78982c9107fc25
SHA1f09925c9320b7efee6d97c9ee3e842c3c4af520c
SHA256130437ce34fa8e18ed868a81a14d9ff1d3b0f727a91419e2b634c45a5b217693
SHA5129ea42833227169b166c43f658f604759fd01171d27c677ac09fda54d7d4b59f0491d3c807b73835d9ac45ad9b22179ac4872480ea56293c615ddab103ba22e9d
-
Filesize
18KB
MD5a9c014de015f0ae5113e1cac04bb36e9
SHA14fb42224193abf977ca993bd7bbe0327217e810b
SHA256a9dd028c01f3545b9cd06653c8214ebd701bc2bcf150a7ed5b4e761414af3a81
SHA512a209ddd73eaca8b7cf73026ce37ac93e32376ca9ac3f6c7970085c68ea0ed7ca1d3391e2936e4d264fc456270d680a5cd72b2904c832ceb6f335429aa8e1c6eb
-
Filesize
324KB
MD54aec84cfe5822b48ab26829676a6e3b9
SHA1a80a9ef84b389376271cf2568562ad18e8e5022b
SHA2568eb843a8302002a30c2a402274fe006fe23c95f969d434a6bf5c2e76f11c8cd1
SHA5127e5665ea330f5f06af4d9249860c9dade6b82547ad88123ae048c0c224c5fb06ad9571da0140e15ab52be3769a8f35f929a9dfe27cb5bc245c7ba705737a1e30
-
Filesize
358KB
MD58a02c5dd436fae6ccdf79609c507ea68
SHA1c9f2c6e73e834ad309fe29676ad371a966433a77
SHA2563894895cf7a94d2b05e951def94c1496c1e05bafd81419c2d919b06bb6e98008
SHA512d6e478e47dde6f9ae792dbd8214caa101c8f684d6f415aee1121de6e3aa76f483902c153c7c63ff62af8aad1d935d017b12d0e40f82fd7f33ee019cdb1ac772e
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll
Filesize5.6MB
MD5acba4c0b56962bb7448b03120ed990fd
SHA18d6e1ff38f13d56df440d34b5a631d1ef3726ab6
SHA2565178dec8d7f0667be8894578ba560ab3db285c10f55c66b601e40f28eda7986a
SHA512f398acbb1018a1aca71f226ce2c9c0f0c570e89f8a82928ba3b970c468a07bfeca7cd87c5e1bdcf995656c851b76e0c3b83f6d1b8a298d7502e51ba6af1cf8b3
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll
Filesize644KB
MD5e8d4fbae5ef4d5e740bd9deb055ec851
SHA1d964f3eb55b40ea5bc6570aca3ddd6b5f29c44cf
SHA256d46d77dbdad89d0f46e95cb0cccac95844696f41db3c9fe8338e9117bc8ccb71
SHA512248fe9e3f2820252c35d78e8dccf8f876afbd807c8bff813bc599f10dddba5a8f1946914d7a75fc5f6e89bd802abfe12098cf85a1204319bbaeb0f615a530683
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll
Filesize613KB
MD508655d48070f1a8a6fdc2ddd118b4bb1
SHA1ec65798e0d7d9b6baff34b76abd40d5184c43c9f
SHA2568259749df40e563997ce43394e907ed9bdf1ac46e2749741923e4e9d8301087b
SHA512758c965c40711c80c7cbfd03f5f993f5b78889a2b1166b4b57d46d6227bacaed263a884a3974610feeb1f1f8551f0212e50c7af5103040dd07487b2f8baeb331
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll
Filesize940KB
MD578c85a0854d4becd2955e8722b69125a
SHA17a0f5ba8f58d1b57026fc1d9890867a3b1d46921
SHA2560dee5b3d2574ef855ada7ec9d3c2ced077ed896d6e09b2e7c3fa88ed72378df0
SHA5121b37c6b9a9ece7d9d5ddc9ffb23f64569c5ebdc8d02ec2ecea2e3349ddda683896bb494bd3960e3063000d09990db6f6992cb01a589e9aaf7f5612eacd326471
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ucrtbase.dll
Filesize960KB
MD56c51991718a1195cd0f10620f2780cf6
SHA12791030df9440250ba2e4fb33cc81caa48765076
SHA2565a23064af8063e41558fab8dd9622fef3d32c356d40a12af5f859110a94d38ee
SHA512e30c103e278f8d9117f1b1de4d3e366c2aef9d25ae6bf89fa79d01e6f95038e9afaec9f6d029c1c7c60af3c4a139f4e864f1ba1d3717845d8570439029eaffa5
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll
Filesize83KB
MD57cf0c3c5c363ce2b774e6bc06d8887ef
SHA1724dea72b22c178f4ca12e5c78725ab085fabc34
SHA256709232735d334fb87208d6e613ff1223b1d28b1a0d6bfcaf2170704062ac9cba
SHA5121f56535725e0bd4262cd51f7d8dc96c5ee58263853a854bdddd7ce6cf07c6188b06041e48e7487f55f6914a29e74b52bc0029c205dd61922cf3992289f5d0e96
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll
Filesize18KB
MD5dcefd5d012451b8d8aae68f055cd07f5
SHA19fc0dcce2f66b34eeb079284e8b536ab1a03f8ab
SHA2567d248a5dbc61b33fb932787b730369bf27edfcae4bf1427d344cc2b4f39ea9d1
SHA5126123775d44a7991dca47297c850237f42bdbefb2421c1001ceafe4d2da3fd785ae7a6a9a42fef45bcb77bcbc9521fbc521ea7e185e3652bcf6aa13dfde2cfd50
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll
Filesize18KB
MD5028400c156ba7ad783d789cd500fe87b
SHA18f6024582f2d8f549d349804f2ceffbfb1fd99d0
SHA256786540d8239e1fc05483ee2f15f0b6273e445bbb93b7f598b8424fdd0579ac6e
SHA51261860c2cbe76a9f03e9aed1b3f442f6dd475f5a1325ec07233fd434b6bbba8c00803d2e806630ebae0becc901bab25bbbb08214806c2351723dab140266db5ff
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll
Filesize20KB
MD57a56059ace22f6417717c76036e127a2
SHA1c6cfef7b581cfd959d24d2d3381ee93f49cd5e41
SHA2561d75d33c2de2817f6bdbe6cf7acf45a014f1471a6250f67bc736c8042c21f811
SHA512b66a079694371a47114181cc93d939406c342c36b24bd83b498479fd059df000b4dbbf9971f084cf15954460c8b8191961ff56eb1cb3594ecbe0882e9bee95e1
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll
Filesize18KB
MD5bad6244ae98e8557bdfacae3a41d5334
SHA15ad2cc369e494f3504c99e876c7755c90d685fe8
SHA256075937fc1b765c35edb0df45077d5f1cf85e8a8569db1a960380a1caf35bd8bf
SHA51256a21686cda24017273468186b3272ee4ef14b60567023a7a38f547722000ec919246e45042d08b912faae4b896ede24c5a6f2b54616535b98ee260c5865e234
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll
Filesize11KB
MD586a98cc8af15310a5a90a8d7cac7d86a
SHA132bd79c99290058c0a0c783f8d1e5b4f56fa6330
SHA25650ccc83fbbb9fb56e7623f56c47ca46ed0d21d8e47144568d394e70f0faa5e66
SHA512f298b7918385298d03db1645dc8a6e243740e51f381b2f5b1f6f6d4e911783f94bc1304440d05fbd9aca68f2202d56a5e01d40016e31311ded1adb34fedac6d9
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll
Filesize19KB
MD5b210c91a6e4531f7df201075816fa607
SHA1c080f7983c7a7b201dfd8d95960392b87f6c41a9
SHA256546cdb40b67b345fddc8efd4c570d63cfa51258cc0ad553503b22e187995a27d
SHA5127bcf4620a65523e4c700c8fe189613136b03657369aa39f837d7470421ac5f3a8c90c2b68facacbcc459ea41b5cc474be48d79a7b79c7bc23b546acbc798882e
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll
Filesize18KB
MD5ea683b93b11f800c1da7f4fd4351b502
SHA10062033195fba388cbcc830edb31f7d20ac088e2
SHA256ad06037eb8e1bd431f4c89f32b35edc2dac2f6a6348e78813f42e878b2a52ae0
SHA51290a8aa8b8f69f512c7f1785451e804ed678cafc44d97dc6b74753d2c4db9e5982c30d7434c94c74c5811aa3cf28d250cbf694fbfafbbad11896dd05fb142d01d
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll
Filesize28KB
MD55f99fa858705055a1749a62ef22c0281
SHA19ac7175da9dea08d0c67a1e8b8b0563902b6719f
SHA256d3bfe22bfbeb4d871fa5addea77e5df061c55897618d8b15e6b7cdd0dbae60f5
SHA512464ed3325c0a2390c8d05714a1ee86496037a2e53165c8fdcf4e0005c5e366b558ec6ceebd8cbc9277c4e6bf19173baf01853a4d8ba10332340e1693953b7bc6
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll
Filesize26KB
MD557189c6b51f11c87f990a7e9b07b4eef
SHA126ad6ddc99f40127f6165aece44213d0229a99f0
SHA256f8e51bae23e3dc3b68c959ca1292f6bc811c2e8d0bea4fec0f4e654457df68b8
SHA5128d7f8b094b87be6cb231d7363f4bc1640e4cc845daa5fd9bef3039a3b9dbaa9a51d984d9f075a90732c04ca247d82a5bdfd8e071891d769e60fdb8829e58d350
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll
Filesize19KB
MD51054f22f7920a81a4c5ad6f7c48c8d68
SHA128eb498ca973ddb5e0d4098f1f1d1b35bcd32602
SHA256505355149172879a004a2193c829f91adabca4eaf3f23ff84edba687cd5663d3
SHA5128bd153dd4756a1199fad1d13e8b1dc56385462f8c95de977127b8e60313627e61e67a9e98d4833427a2666da79dd3f02383bdcb998d043c4a9a588bd94ecca68
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll
Filesize22KB
MD5569a0d5d61c7a12bbc217508a87db9c6
SHA1d4c047ba168c3ecf0f0f9a910ddd23f99eedefa4
SHA256f14cfa2f0809ea735304c9389dd15a700898251e4c4a70422a09d24a49575ab3
SHA512d301edcfcde457b04f68b32b6de69fcb3abca58cfcf16325262e29b7e58f2e8abcb579046443582eff91395704cf440d6a13b9c578feabdf3f32dac086dc2b6b
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll
Filesize24KB
MD51fcc87e0f14751d2e39a04b716b28ad0
SHA1b15538c3d489cd2b2221345dd3ec6088b5944664
SHA256dc13182e1bb435a50be071aa4e1c62dabfb595d04c570242211088dfef874e43
SHA51284823faf79c7aa13ad95ca68102c5594c4a917987dd829d20f17066b7c46c2dd969da9dafa3007f5bc4b28ff07a2a7974019d50e55766b49029fa509b603c721
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll
Filesize18KB
MD5dc790b297fcee42de6fc96f38d53c3f2
SHA1d0d2414267d54dd1c8d96b2d935b6b701e5d771a
SHA256a9f0367ff69e17b63c9b8a193f192f18c0438189a725d4a7c53332bac829d773
SHA512a61f16fe90a255e29cfde0ec8e05ed5e85fa405fb728991b0dcb15a9b9c6ec540a6ca3e48659b8033944a843d4c54be72a3a895d276afcb70c532594e8ff75c6
-
Filesize
244KB
MD57dd681cd95c66998435c1068ed1d3fb7
SHA1ebc736918fb1c0fec8bd1cf93f9dd1591d9a6843
SHA256c8688ad29e13a57b899686047ba8e61d19099443e0544654cf6eec453c99ce5b
SHA512134d193630b3d6fdd451a52a5efb089dd61fcbca5d107150f69b7cfab2ff6f0ebb91875c74666b3b247697060e9e7cb2e8d5303bff11aa27c2357180c4563019
-
Filesize
4.8MB
MD5fe91cd97fdc125d7621c4c95c7b7c101
SHA1e8f97f38db2b1994d07e74f06af669f3f71f02e4
SHA256fe4bb4b911e0df3bc3887b020cfe11689de935f15edf0c2c10aa478243904153
SHA5129877d065e93d72f7226204387445c3a074c65deb41961c1adec5a4a913d43ca1d22ef20d4a331cbf8950192f3a8d7ce7f7ebd33a9fa430444266da065d11ed74
-
Filesize
14KB
MD50ad676bd8622c67cdba00ff0c03a4bff
SHA1340d8b535fb8878a75e067e30be4c326d74707a2
SHA256f3fadeb1df4c6752f24448127f822e6c3c64dd1e388932a94d667dd422287795
SHA51231f60f7c8a8a559f82eb8e9b63b843b45a4e864df2e444443651ef4f8993c49b9b84d333f24dd3df56e356cecfc7a7e5d007d76fbf199453f52567bd6295368f
-
C:\Users\Admin\AppData\Local\Server\BoratRat_Cracked.exe_Url_wi0iqtchtc4kqw3og201wkj2ust21obp\1.0.7.0\user.config
Filesize309B
MD50c6e4f57ebaba0cc4acfc8bb65c589f8
SHA18c021c2371b87f2570d226b419c64c3102b8d434
SHA256a9539ba4eae9035b2ff715f0e755aa772b499d72ccab23af2bf5a2dc2bcfa41c
SHA512c6b877ff887d029e29bf35f53006b8c84704f73b74c616bf97696d06c6ef237dff85269bdf8dfb432457b031dd52410e2b883fd86c3f54b09f0a072a689a08c0
-
C:\Users\Admin\AppData\Local\Server\BoratRat_Cracked.exe_Url_wi0iqtchtc4kqw3og201wkj2ust21obp\1.0.7.0\user.config
Filesize580B
MD5acb6df8bd0fe9236ea87ea6e3c28173f
SHA18b1d88bd749b58905c6db258e7224a67d1179938
SHA256ec2b3fc4d011e9b8a04188d8f2ff280de854dde7d6ebf8e871e0642f789dfa5b
SHA512a4222c0f5aeba58679c21361dcb6ab2c7ed1d9cae41d2839089fdb7bbaac3b8735afff8b302557f85389daa977b826cee77b944ba598e3fa6c2a16781453a832
-
Filesize
1KB
MD545a891ade9dd05b2ff0eebe8767e054f
SHA101844d1fc994f24eb037ecb9b209fb79f5d374c6
SHA256bbfd09a287ce6850ef284735b6039efb98eb65fe002974b9a18c10d836fd9f1e
SHA512c9845e4e356e7c1743cc760cfd542ea5ffeebbbb16576144cddde5d7d5ae8e35454ae98e9b6469d32f545e68af9ee223aea373cc873a71f9b8c4704e30855cff
-
Filesize
56KB
MD50593afb05920fd12de1de58d4f49d3d9
SHA1eeb6ef98bbc0d108fed40d32924841689fd2db8a
SHA2565a77c4ca5acbbf04035d7a3b4c239cf6114b1f7689d4093a939da17e6835a50b
SHA51292c362cac9346adc3c10af65473e401aee67ca8baee2885b77dda72a625a3a57d756019d86be181d431be296451dd19ef7f943a6f5e9c01b22cbf7437787a974