8f8f3834abab12ebd792487a89e45bdb8c8f41b51f232dfb3edb8e8140c9ff8f

Resubmissions

31/10/2024, 02:19

241031-crvzeswkft 10

30/10/2024, 03:56

241030-ehgrjsvldt 10

Analysis

max time kernel
2247s
max time network
2587s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31/10/2024, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Win32.KeyPass.exe
Size

2.8MB
MD5

6999c944d1c98b2739d015448c99a291
SHA1

d9beb50b51c30c02326ea761b5f1ab158c73b12c
SHA256

35b067642173874bd2766da0d108401b4cf45d6e2a8b3971d95bf474be4f6282
SHA512

ab883364a8907636c00a4d263670cd495d0e6c521283d40c68d47398163c6ee6647cfbbc2142005121735d9edf0b414ddac6ea468f30db87018c831eaa327276
SSDEEP

49152:0u1ImfQE5L1PtWHeHoQAOs1dKvHHg/o2S1pj798JGKCO8C/eZRwCr:dzV5JPtWHeHoIs1dGHHx2S1998JGKCOC

Score

10^/10

credential_access discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1263212995-3575756360-1418101905-1000\!!!DECRYPTION__KEYPASS__INFO!!!.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KEYPASS The only method of recovering files is to purchase an decrypt software and unique private key. After purchase you will start decrypt software, enter your unique private key and it will decrypt all your data. Only we can give you this key and only we can recover your files. You need to contact us by e-mail [email protected] send us your personal ID and wait for further instructions. For you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE. Price for decryption $300. This price avaliable if you contact us first 72 hours. E-mail address to contact us: [email protected] Reserve e-mail address to contact us: [email protected] Your personal id: 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0

Emails

[email protected]

Signatures

Renames multiple (9405) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	Win32.KeyPass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000\Control Panel\International\Geo\Nation	Win32.KeyPass.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Win32.KeyPass.exe

Executes dropped EXE 5 IoCs

pid	Process
2600	Win32.KeyPass.exe
4204	Win32.KeyPass.exe
4108	Win32.KeyPass.exe
2448	Win32.KeyPass.exe
2852	Win32.KeyPass.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Win32.KeyPass.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1263212995-3575756360-1418101905-1000\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1263212995-3575756360-1418101905-1000\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Win32.KeyPass.exe
File opened for modification	C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini	Win32.KeyPass.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sl.pak.DATA	Win32.KeyPass.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management-agent.jar	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL016.XML	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll	Win32.KeyPass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\liboggspots_plugin.dll	Win32.KeyPass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File created	C:\Program Files\Windows Defender Advanced Threat Protection\uk-UA\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File created	C:\Program Files (x86)\Windows Defender\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Content.xml	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Configuration.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\deploy.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.SapBwProvider.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGI.TTF	Win32.KeyPass.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpegaudio_plugin.dll	Win32.KeyPass.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.IsolatedStorage.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Grace-ul-oob.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Grace-ppd.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\OWSCLT.DLL	Win32.KeyPass.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\de-DE\mpvis.dll.mui	Win32.KeyPass.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ul-oob.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_proxy\identity_helper.Sparse.Beta.msix	Win32.KeyPass.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VGX\VGX.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll	Win32.KeyPass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\el.pak	Win32.KeyPass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gu\!!!DECRYPTION__KEYPASS__INFO!!!.txt	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationClientSideProviders.resources.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\gstreamer-lite.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.WPG	Win32.KeyPass.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_az.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ppd.xrm-ms	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\WATPCSP.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Windows Portable Devices\sqmapi.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Drawing.Primitives.dll	Win32.KeyPass.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\accessibility.properties	Win32.KeyPass.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win32.KeyPass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win32.KeyPass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win32.KeyPass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win32.KeyPass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win32.KeyPass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win32.KeyPass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1263212995-3575756360-1418101905-1000\{1684EBCF-07AB-4125-B65F-56146D49EB95}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1263212995-3575756360-1418101905-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1263212995-3575756360-1418101905-1000\{9B3240FE-3F68-411B-BA4C-42B11429D8D1}	explorer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2600	Win32.KeyPass.exe
2600	Win32.KeyPass.exe
4204	Win32.KeyPass.exe
4204	Win32.KeyPass.exe
4108	Win32.KeyPass.exe
4108	Win32.KeyPass.exe
2448	Win32.KeyPass.exe
2448	Win32.KeyPass.exe
2852	Win32.KeyPass.exe
2852	Win32.KeyPass.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	772	explorer.exe
Token: SeCreatePagefilePrivilege	772	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe
Token: SeShutdownPrivilege	1672	explorer.exe
Token: SeCreatePagefilePrivilege	1672	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe

Suspicious use of SendNotifyMessage 19 IoCs

pid	Process
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
772	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe
1672	explorer.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
2200	Win32.KeyPass.exe
2600	Win32.KeyPass.exe
4204	Win32.KeyPass.exe
4204	Win32.KeyPass.exe
4204	Win32.KeyPass.exe
4108	Win32.KeyPass.exe
2448	Win32.KeyPass.exe
4108	Win32.KeyPass.exe
4108	Win32.KeyPass.exe
2852	Win32.KeyPass.exe
2080	StartMenuExperienceHost.exe
2412	TextInputHost.exe
2412	TextInputHost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2600	2200	Win32.KeyPass.exe	81
PID 2200 wrote to memory of 2600	2200	Win32.KeyPass.exe	81
PID 2200 wrote to memory of 2600	2200	Win32.KeyPass.exe	81
PID 2200 wrote to memory of 1728	2200	Win32.KeyPass.exe	83
PID 2200 wrote to memory of 1728	2200	Win32.KeyPass.exe	83
PID 2200 wrote to memory of 1728	2200	Win32.KeyPass.exe	83
PID 2600 wrote to memory of 4204	2600	Win32.KeyPass.exe	85
PID 2600 wrote to memory of 4204	2600	Win32.KeyPass.exe	85
PID 2600 wrote to memory of 4204	2600	Win32.KeyPass.exe	85
PID 4204 wrote to memory of 4108	4204	Win32.KeyPass.exe	95
PID 4204 wrote to memory of 4108	4204	Win32.KeyPass.exe	95
PID 4204 wrote to memory of 4108	4204	Win32.KeyPass.exe	95
PID 4204 wrote to memory of 2448	4204	Win32.KeyPass.exe	96
PID 4204 wrote to memory of 2448	4204	Win32.KeyPass.exe	96
PID 4204 wrote to memory of 2448	4204	Win32.KeyPass.exe	96
PID 4108 wrote to memory of 2852	4108	Win32.KeyPass.exe	97
PID 4108 wrote to memory of 2852	4108	Win32.KeyPass.exe	97
PID 4108 wrote to memory of 2852	4108	Win32.KeyPass.exe	97
PID 4204 wrote to memory of 2300	4204	Win32.KeyPass.exe	116
PID 4204 wrote to memory of 2300	4204	Win32.KeyPass.exe	116
PID 4204 wrote to memory of 2300	4204	Win32.KeyPass.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Win32.KeyPass.exe
"C:\Users\Admin\AppData\Local\Temp\Win32.KeyPass.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Win32.KeyPass.exe
  "C:\Users\Admin\AppData\Local\Win32.KeyPass.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Users\Admin\AppData\Local\Win32.KeyPass.exe
    "C:\Users\Admin\AppData\Local\Win32.KeyPass.exe" --Admin
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Users\Admin\AppData\Local\Win32.KeyPass.exe
      "C:\Users\Admin\AppData\Local\Win32.KeyPass.exe" --ForNetRes x5I74v4h003xJ0iyhUfHQ8W6o0RDSicmSfg72KVA 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\Users\Admin\AppData\Local\Win32.KeyPass.exe
        
        "C:\Users\Admin\AppData\Local\Win32.KeyPass.exe" --Service 4108 x5I74v4h003xJ0iyhUfHQ8W6o0RDSicmSfg72KVA 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2852
  - - C:\Users\Admin\AppData\Local\Win32.KeyPass.exe
      "C:\Users\Admin\AppData\Local\Win32.KeyPass.exe" --Service 4204 x5I74v4h003xJ0iyhUfHQ8W6o0RDSicmSfg72KVA 6se9RaIxXF9m70zWmx7nL3bVRp691w4SNY8UCir0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2448
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
      4⤵
      System Location Discovery: System Language Discovery
      PID:2300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1728

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:772

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2412

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1263212995-3575756360-1418101905-1000\!!!DECRYPTION__KEYPASS__INFO!!!.txt

Filesize
1KB

MD5
daf2d6b2d0033ff60b7da2b3dabc5a0f

SHA1
b33c6ddaf9782cf29dd69dcc093aeeddf33506b1

SHA256
ea770e96140a6a18280b9cd118bbfd68d72e95d9daacfe0dd1925e277e074077

SHA512
72e154960498fc7cc2b26a98ba0e06920a4f2c8eeb56189448ec28ba26e2667d894b6b2c42228cac4ca37d0e50e0cefd4c197c3e4c7261ca8c0a3a045caaeaab

Download Submit
C:\$Recycle.Bin\S-1-5-21-1263212995-3575756360-1418101905-1000\desktop.ini

Filesize
129B

MD5
8964f74114f7d0a16c5c7fdc1b5cd2e4

SHA1
fbe0e81274a273bfe06a3652ccfd128285bc2a2f

SHA256
668a5b9d313bfbaada40d4e25b6ce0f55d07ff83ac47c26ebc2c6dede763ba57

SHA512
8a01e71400ac8d1ef1174b4e1e0d6fa3b1a24034ef0e2b864f975afa4dae1120e5c9b6ff614500d98eae25e1b42d4895d0906ebab2b897433166a4e861d37f11

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA

Filesize
55KB

MD5
87781339f36666b4f0b69ef10753dd9f

SHA1
a66e333ad7a012d17deee5475c3a1bc2cf5ffadf

SHA256
4c8a53b7a1c029aeddebf75275e5ca2b30b0d237ba796aadbee31283b06da241

SHA512
d1b641113eab000eb1caf39aaafc24df283a2be93d7ae646ebda3d39f412025d1e8f1cdff7e0a568fcd9ff0787a8ef59d00d7cf439d4895e37a9d6cafe0874cd

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest

Filesize
1KB

MD5
5d1814290d4b2d08052623347b8a9779

SHA1
23f993dea32ef36e08c67f165d5d7923083e3729

SHA256
d85dcfc04408fae00c0e721bf5496067e72e00d866fd72d4f0ae72416891e84f

SHA512
2addf75e8b877e65827f4655aa92e11bb1bf64fe42079357012961472cd5871a4170f1051dbc5e02f01ceefde4ff2da90750cac1c42bf7dc606ade016087d58d

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl

Filesize
1KB

MD5
e2840b3b84a03dc0e6bda32bbba26ecc

SHA1
6e8bc942ff94d6457eae6dbc856706893973647f

SHA256
db235ffed8216c26c6ad543ccd82dd87469045be27814ce96bb733e8b39bbdc0

SHA512
1837ed191194f540ce709541a220c14a1853dc4d1ffc02967cd5e615a338766d5de77e6198648059bc5b9954fcf7400208e2e4f9558f17ab192702379529d934

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl

Filesize
1KB

MD5
afa4375800a282c84bd9f8245b23894f

SHA1
b3feadc3e3c05be272c1cad16e63468b0656969a

SHA256
69441a384162c61793ceb4c44358ba617450c137c458c664e0a78df8a703644a

SHA512
242a1d375ed39255c8c61ec1a2c38dad354f2cc189f929f7ff63da554ebba93844b33f425374bc2fba076b13af185584c9de4d9d1175f51d73f1e2e62dad39f1

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl

Filesize
1KB

MD5
044cf4e1f9b32281a4cb1d870156cfbb

SHA1
8a155520857986a253f81706860f76e2943b7976

SHA256
3eb7f02010955cd7a4a59a86e75c133d7649e2e7d3bf5794a126781c44aa2743

SHA512
356ae997a59e1673328f2ce4f9f3cb7a19a6111cd2ceab42760aef1e84a76165f58238fa2f5a35b170b6047647788a6648691da0481aa968886c2693aac0dd41

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl

Filesize
1KB

MD5
98f81373e7e1645938243c13302968d4

SHA1
9e6cb0fe3e2300957afed558f70779e90be18d67

SHA256
f9c9506acb56411331539bb8a9747b8ba5f224664de8610a45025a54a91f323c

SHA512
b432eb2cc4bb485d4ec63ee69a5c15a76d7ce1c5a5623121f99faced5312e9ecb7c703dd0653979a641f285764a40d90e4395e6df2d81a3fdb226415eb2e4c0b

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.schema.mfl.KEYPASS

Filesize
1KB

MD5
e6a70b13b844a6b5bb4b0e4f1a4f1dce

SHA1
ac4a3603abbe35e548967bea7eceee4186b9764b

SHA256
fa780aca908eacbab20c77471cdab609f788091bb968d006454052752edf8cdb

SHA512
2d48b408fa1faac0f1b998a91a248b2f1e73a91c5e6a3e4c37ca3d506e434936c15b1317bfdfe5ffe8a668faab67b92fdce71b56e603415796c2dcae4840d63f

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl

Filesize
1KB

MD5
def63fb6bf608aeeb55af107b94e0aed

SHA1
85192723d801c0031dd2b81565c398893ee4e189

SHA256
2fea9ae1a450522a2eeb095e3015a7ed71aba726543f1551ed4c362f4b66f0b7

SHA512
67c400f8a65c520cc0fecc58fc6060572ecebeba305a0b1a2e618c89f855886226a93b9368654b7afa2a7848b02e27d03b8ae5506d9a13c48aed121f3f32033a

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.schema.mfl

Filesize
1KB

MD5
c4b325d919384bd53598a2db3557d0bf

SHA1
afac5f1767117e0d279f5c6bfbe0b0e3fb8d42fd

SHA256
b392371128c4e73d8e71ad76a6db045ecdf4bf02604a450e6d0eadfbc979eec6

SHA512
ac7a2ae5516062dfcae8ca2136bab4963b5818194166754f08d50586f92c8d2ac6a26041e494930b129ad389210ae7f9657311ad5133003ebfdb9c599d7ac396

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

Filesize
558KB

MD5
58a36018ec4ce92c5d9cc44d1d37160f

SHA1
2700b9c53f81a4b51741b330652d16e93f589623

SHA256
86635ae2f918911bd6ccf7a57b0fc82e456ccb3aec1abf9b90ece5095b27d135

SHA512
24eaf79ac8b2d4cc4194b83acab72e14f26f094e0454174baa93dcecfc243d8f34e6b287efcd0903747ca871bd0b6705643c6f7304e33574b8f81b0bb4d8cff9

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll

Filesize
95KB

MD5
3866a8230173a922e73e6211a50394d8

SHA1
cad8d41cf629c90bbe106c3eada0ad01fdca55bd

SHA256
ae0807fe309026d23109afdf7f281e480d80b2ce29dd5a33bad64b0873c8eed8

SHA512
9ef7f734d035c30b2f5e32206cff383a5e7bd645d466963d5ee197be273e25ef56ba55be838e5581ee814ea431f998c5003e59d21009c8f4de52483ab8c0acfc

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll

Filesize
36KB

MD5
bcf693443848824d3a6302fcac28d42e

SHA1
4214198af7b54f224ceea12ee64a32a1d14a5041

SHA256
90127add139064e1f848d767891279d39c5598776b9b105ba139cdc3944a2ccf

SHA512
b0d8638b208174e6b2456227da2b7909e7d05d0331bab456bf6be48c30fbfd6ba11c4147e8173c8635eb5ebffb015d1dd64129c696660cbf5979b24787d92729

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
4dc9bd6202a83a6d822592b05e9c5b36

SHA1
3c6778ae92c5d7f2429920e93ccfa23d09c501a9

SHA256
4f4c6b0458edd400d0555af2e57c1d35b0555134d41751c64248a95742b73f3f

SHA512
3020ca978b154dcdb45d50d9f8f988bfca050d9164ad4d5c4cff0b5fa3112d78f9e942a2c4d93665dca700c22524355bd794825843e3e449b44394973bc7c80e

Download Submit
C:\Program Files\Java\jre-1.8\COPYRIGHT

Filesize
3KB

MD5
8bb14ac06aabb34495949f4342a70f5c

SHA1
61a9980fa3adf3c02424fe63446aabe5560aea72

SHA256
bee109c27ef89360b94ccbd6f919d94c7ac73de7d8713c51ab6030c8226ad545

SHA512
dfc5d6b9420bb25862d06c6e2b14aaf7643975e4a0a9a136e5d38bf25930058fee28f10e45bdb3d02fd4648160951938d62902f3d6849c7575d903ac7b3d6d72

Download Submit
C:\Program Files\Java\jre-1.8\LICENSE

Filesize
44B

MD5
de1c05d6b47b0a1e616ef96aeb5da338

SHA1
8513dfe41db080a7727b6ddaed3f32b06ad97745

SHA256
ed7514588fe3e5b7f2de3efb99cc477223b6a3986a939123eb54c89eb22a33c6

SHA512
6900fa81caa77292665382a6981d26924743208529b9c07df8c684ddafc4be43afd65c0d0fc7cb779aeb1bfb91289b116036eef593de0ddea09cf57c43828d9e

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
aca5035caf979d0f3a7138be73e14586

SHA1
aba6e45bd2b643f044e604fb899ab2c209afdf14

SHA256
9acae26b422aa8be31e0f05e96eb26c9101279376c13652da076c8ddbf1d525f

SHA512
b81524df00a40843e494779edc9717da8060cb61a902629bcd16bcb3f8d5745bb6395234da2c60c9cba73be672cc8bdd6cba5847f4159044e9f8d5cbd8aa1059

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
42bc6b227e03325f9048ac925daac5f1

SHA1
6ece986b6f41dd1e2d29dac5814d3911c7052baa

SHA256
98a23c0985102cdcf53637ce4614c2cb7a36072c11c9b0eeea07b23eecb1ef26

SHA512
d41752cfdfb9cc7ea02b6f98829ee463e601f320cbe712f6e907ea0248ce1dd452a13c3a011935b9379a248e6d356502a1c5babef60c23cc1b8fc1be13b4ad95

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

Filesize
11KB

MD5
69b3f01e3feddebb418e872ad54115eb

SHA1
69adb7fefe8e4bbe651b43627504028e4ed01035

SHA256
8896b18ec183ea24e063d4f3cca972f061dabd9ea7cf59ed4d22c0a042460228

SHA512
a3def456f2bc5a66cb84d00146a2d05d423f360a5b2f30c2836af2c2be45b6c255fd6352370d81658726bf4d9e415ae3121ec384990a7e1c63a1d7575b20c595

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

Filesize
11KB

MD5
74b5c759e56db8dfd430ecb0276f338e

SHA1
8b579ffe0920ec05c7ed9c5e45ef322981873342

SHA256
11972fa1ecb9a0760403d2d9288d22c7f385a513ed53f785cff99c22657dbd28

SHA512
d2684a93a4856bb1eabff7d336aa8db9de742209c60158b64de514da16263fbc0764da706f9395f432ac094eae54822bca7fb2be073fa0a3c565f7e82849513e

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

Filesize
11KB

MD5
c497a29d39a54099b5c46a7ab5419121

SHA1
d9cc32f4cfdb73dcc427eba3cf67c83a0e8fbc53

SHA256
bcc238d86bbcb99fb77ac8c17210869cae8f5ca5e74565a0edf39355b4076791

SHA512
2eee81248fc1c542920b4114ec33a8032e4f310c52fabcb7469ab9158254273a15c7233ae1908930d3b12a514a2975b902244f7a52b0d015153bfe10a86a1c5a

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

Filesize
11KB

MD5
ba2f618115f66cc225637c7d6074248c

SHA1
d305017d28c1bbf235d403557390279d1aa68d13

SHA256
40454848caf6e25891057773df82543767a4cec76bfa29d063746f58636d52e0

SHA512
70850886550c9dfd2aa464f6d52a71f9c03ff699c3dd5baaa125b9ee05d548e20bd438e47478e408704974a16c436e8814cac1587f9a4f5e1227cf536e5e6375

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
11KB

MD5
54765bfd32ea6bea3db07b40644cddc7

SHA1
50a3cf3ecd26beb40e50ff85a402376ae952a2fc

SHA256
93245cb793d458a239e7a168bb7d7c6d3f7a84356d3f6ccbc1e87753a7b3ea84

SHA512
a983aeda87be22aba32eb1245552a865ae9e1b686115acaeeb93bd7980f1bda3570b888eabc569ef602714421c5ae876b75ae767b6c3d8c4fa6bff72209fcd2e

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

Filesize
14KB

MD5
0586c6c06f84419cff468dc80a7e86b2

SHA1
41415bd31000b58ee44041a7edc0b3b3bfdc5f88

SHA256
718e23c4cac0031bde053ebf8cff4c35b8c51558aec723419e49595d1f28ffa7

SHA512
9a9ce07a4e6e382d1f9fbc3424cd1d6c0fb94004312c480d2c9342b703d12c49b2fe234c329efa5c6b81af0b8555517afe3687fc654d602fc55146a95e6120fe

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
659f5808d0b9e1e7b62c1f8d2fb8b20f

SHA1
91e9f92d63e47cb1568fca05fbe6da1963a7f2af

SHA256
712137518036d123fa9ab1633cc7a473be1fa81ee0aaf910ace581f0e8b044f4

SHA512
812d5fe5924e745bad24cc3d0f3263c573224911143838c5fbc3a1df702547cfd84b25563d89c12051facc42e338330f3fb1b2826f1a317d3dde350295f210b7

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
5e2e0216361715326a2e8a7d8eabeb45

SHA1
9740ec205427c26f02cbc5aeeed7621a03722e5d

SHA256
a84eecd74d824652c9dfe401bc5bfcb577911900f7b070cab1b91cbd08cf7b96

SHA512
dae8034c809f2accb01bcb7959694519ee85be66823c94d2997706c5fe10dd6a5e8a3ac318f4ad10fff332662509ed25fc8e5040aceba0ea249c12f482f444fb

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

Filesize
11KB

MD5
4b2bbbb76c60bb59b24d262ac0e2e468

SHA1
851489a171201a45faa81951f9923246ee6e498a

SHA256
973226c89bf68c5582d1dbab63d5d95c3d3880144c61653aef363f6da15aa613

SHA512
077aae49513a45fcdd4db5433900d25cc83a80a930bace4ac2081d540b9d0656c7d19585226712a5c9e78f913521073fbb37ba73db96cedd0434a856edadbcea

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
1cf026c11616d4e238eb2a5ea31f27ae

SHA1
a793bcf9d4f0b48c8c0b50f7457d219e5e6c32c2

SHA256
a0d9d7e72fae14e981c1ef19ec45520ce11b18a5e43f10e3359a6b6f5520180a

SHA512
80a760a1c10b9b24f4cbd44b7f7fc47b1ccf11ef4f08a6f725df06549e3f926131aff476251fd9b378200300cb875874ad7dcce2695dca60be1e2bdc8e94eefa

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
11KB

MD5
3a944ced410b41d91df24c7679272724

SHA1
018b154c49bf36b28bee05784097d6251fb42e24

SHA256
e30e0f54fcce99d8d42b5683ebd839ae8f2340f7679967fcf886cb802a11df00

SHA512
a55d7d4674d78f0b1ac972fbefaf299e6bb729437d04751c903236c77444a2304e7d18963ede77dc3d91850522832924359f2e7613013504c9b040ff7bb061a0

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
12KB

MD5
57d76105d0df991d0022660fff8667a6

SHA1
ac63d6afbf91cc995dbe304f547940f72cda975d

SHA256
4aa9c4ab38b8c29d94ad974f7e003de44429c74292c207c92d756b2d02e8c09b

SHA512
9d42fcaec07a28bd83f16cb425ae7942871606bc47b52a6b8a022ac2a1ab983295fd2345ba513b0677710ddef18485b80d41f727152dd28a27c53d0803292bce

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

Filesize
14KB

MD5
20f9452db5ee06016f1eaebc32b86cbe

SHA1
2088aea2f490e7e766126f68308abc917dda538e

SHA256
1cb35584a49c99d7b5fe5e9fe61a3e849b11a3326114e53bad7907dd0aa8940a

SHA512
8b97eecf6c6d8bd7c37d9f136403878fe5f3d0133fa9af199f286facf65fd26a73e20e697266c262fa7e96ba1a6712d393db3795289da49de2c1a3b8ecdb6906

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

Filesize
11KB

MD5
9838a93cb55eeada969e145d05dda72c

SHA1
4fde14cb23591355dfbb89abd607912f70c54317

SHA256
a441a1c7d37e088db9facafa9fd120c490da9567f79bbba96a2f91b05371c935

SHA512
649178702eb94a44540ac195f1e73e878e5d57088143cd57808ccf360e44f11f48b6d808acd0acfad697459d512fd259b98b30abcd2e94ffbbe2d3c90d2b19db

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
11KB

MD5
09a63ae809426ff5e41b8a10f1144c2e

SHA1
4ed02b021f1f7607b74eea2b4d382ce45a7b7436

SHA256
648afd8be1ee8b8c45bd0e7811436ec857bbc24fb98b4c9e6747c03b1dfcf860

SHA512
97cda84a9810bd3e5ddffe0f2cb050f0b381c921d538d9faf0853a34bbe507a971f9f0a2e19faea490b86a25e747ce3a7feac65f2b0d778fb7b601a714fa5543

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
12KB

MD5
9c25dfb41f581331f228e6f750d43076

SHA1
4088110c2b8c8a6a66c6cfc5068ce4a9aabfe657

SHA256
c8533f59362471fdb9a8fc893f99e6422730d95b0feb98c9fc0fccf9fe5fa722

SHA512
f98400cb307943ff0b7d8900cbb7b0f1a0244e58a46694623d42699e971ce17cf4e0b2f1a23fe87948e5e754c1660d4a253d9893e51272dff2868ad7dad8ea7b

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
c72582b7c223835430ab6bdf990298f5

SHA1
b3dd2e316fbb251bd39815a359eae9361e9ad474

SHA256
f2b07d59aeca995c6575b1c0598c0d328cdd45baaacc0e76eceb163cced7c2a4

SHA512
5e01d775a784442f1f6eb37bf18ed02bfc587db0751e4ceefb9be4668fe0056b5927eb6f28a6902aa6a304875ce0a345b16796511c2034bc1279485290406242

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
3342ac331f8cf7a6e1df322eccde4158

SHA1
e2bb2db348c2c30c9b47a245e350d3501487e07d

SHA256
366ca81f1d7ad902f732560dfd4c82a7a1f1ccc341dce04e721b3b615658f8ae

SHA512
9b1fc8458c53cd62de8a831e39c261249cb5f60a03046bf196753682c327d3e9acd65c25a2b0f78de2f818c45b275b756915a820a7da92a683e643c8b986fbc0

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

Filesize
11KB

MD5
7ea5cffb1bb08f572ee66de6bd410fd1

SHA1
619f7c6313e32e082bf623cb560be33ea653a130

SHA256
7f1ba3368ebf7c6f3417b6f145abcc2d64622ecddc226af29c31f1adc27e626e

SHA512
85d6136e83bb5ff188d6bc4c471cf39082cac8dbdf58a7708515ad7a8f4056b8c4884bcd44d25a3cd20abde6dd52d246f5e5121631fcaa7e1df5351d1bdbafb5

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
11KB

MD5
356c3ea274fd405b5023b8642c3084dd

SHA1
9e152f2fbc91b3377df244b104ac985e11133741

SHA256
0ee967a2a6dc62f8b72e8c74bc3f0965c7f7955aec57573e9d7e274f763fc296

SHA512
4b68f78d826cd5e85db7f4cf56264c69c9a77b588ff62c146d331160c81fd071b794cda26cb31bf55f3af1919a8c09341204882a1ddba3be744fa4bc6795ee0e

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

Filesize
11KB

MD5
7bdfb7b58cf5d3116a3a419d56ff5c4e

SHA1
1c6f66e205b6cc7593e3368662a570f444583d0f

SHA256
1378c7fc6b47caf60c9a8634aa4a30f0df4280db1c0e13685d90d3f212259e81

SHA512
5046ea3953f32b62fd5c4d9b5dcb915954e1fca2bdc04ea513e933090e2e69a871724533053a0ec0f2e9ad489388c3afa181d736fc617bc6981e6d5074627745

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

Filesize
13KB

MD5
7acaa08d4e79a323023106bf78d483ee

SHA1
19f3163a443f7fc93f4564eb9c9d72d350cf7711

SHA256
a1ed05a430db061300492c66ac027fa4ac06c8f02c6442098a1e2c2d73fd4b67

SHA512
8a27fc548f4c7a6c837c2a172c78bf0eddbc49d49c6cb8d6c22b32a829092d845804d7da2d535eae1ba68a9b21a0a81485d7a83ec4acdb2a223c0c64d1889794

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
f83a722cf4df38aaaada5d4a254e46d1

SHA1
2b54b89e89e8f6a83764b2c9b0c4479cfb557159

SHA256
4a3d61ea75b0bad2ea23dfda677b195c165d5f7ad77fa7332cfbd4237591c915

SHA512
87e96be2128b52c8d412e528eff94f676516dce9de7d67a823298d0a9279227cb52d58d311f4a22bf7fcbb30bc26d006b122f987b1f1b0f83f0252d4fe840d33

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
12KB

MD5
94c34efd7a009a96ffff8a3b09c9d7a4

SHA1
57027e9350bdae55cb8eccf60126b5519252a8ad

SHA256
d4270cd3ed1ea4ae7b34a6eb2afd765a9458ef1a2071761b31c62fd5cf80f492

SHA512
719957cabeb9cfa1f6353a9772a7bc52bd166e92dde5df9a343b231817e6cb4c8e535a315dbe3cc349e5cb9c322ec93a34584402e476921770d2f22158d13474

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
1f07f0152e478ab46644ec4a5b46a4bd

SHA1
8c29c6cd970bb37817594686341d5103e2b6aee3

SHA256
4390982aca71d5c4509c410a917455e8f5669e48313376d62cc66471a4d8a326

SHA512
d53c7b329294cd00e4c3e51a95edca50816008e696d226bcbe6a79ecdcc2cb146f0cfce289f173abef2f05462c5795121ea6924f222a5e7bf338d76ab0f9a0ed

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

Filesize
11KB

MD5
2aeccafca6c7d295c29e28415b36dd48

SHA1
74eb3b916bfe50d1183a9aabe79028878e046516

SHA256
8f55aa7492c6201c21185ca6d43d252cda17094eba06a5b13195cfe57396bf8e

SHA512
e46aa465240b5c78475ad6607e972220589825d8e481f17e2d323d6977cfeb897252cf7247c20184a92d5cb39a0d2c1f57a16964154e24ed233c85ec1fdb7b4e

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

Filesize
12KB

MD5
501b17f09af7d20211bf27e01ff33ace

SHA1
9b2300ad90df171ea52c9406e1d2072738fa14bb

SHA256
4a40bbbc51af4b47b8cfa6faa3e712a7747fb319cd7b7b1dec0e6d8f89691226

SHA512
d76edb1c344f0beaa4e02423d7e38b874b34ef3d3b5d7158a810ce8b94d9c288f14564545b58764eb7053a9a8e27ec1d1965b7a332beb460fe281abcc2862f32

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
97a2375fe82a9dc2af11c24411f90c07

SHA1
744c5c2d1e6011b25d18fa99317a10cd1f3b0e52

SHA256
ce5576247c71af48483b6fd5963899d94d3743f9731281466ff22fc0739bdf48

SHA512
37ef189e88e71c216e92d3da1af3aa829bb246a497d317843c1b445b39ffe44635acb911122a445c86f4a26a8f166537c86a19da350370451df9a81e1e0aba40

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
33facdfb5dd0fda7167db02c3d934ebb

SHA1
167efcd87a27397a61e72699845ae3f761f451d0

SHA256
11711d9c99acd8a37dee62940e8f8d379e82e4a68277fa6459afe0f00a6367ac

SHA512
e6e675a65ae4861732c9fb65254825c0b58094d8506ff2d5e8e7e9659e9a8385e1bcfbfc7a23b985a11d9064fbbf4e6da8d25a8047af34167b87ef7043973502

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
93e4af4530789adddb2fe231ac8d81a7

SHA1
737ba7fc7b06408a4372a0e075bb33b819e03b68

SHA256
582802abea7f3df833944d84f76835fc90a2002c2eaa68eeca4cbe416c7fe7df

SHA512
a7495c11ec239fe4c6480e277ed104c961ea28d1a13d3278cbfe46ec0e0fe3eda916f0f70b9b99511c9fde8c4632aad9d3511bbf66eed2c37c4753fd715521cc

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
9966dde5d3a5b556d34a6d2d6a06aa1a

SHA1
a284485a515cb125589b4f1e69acd35ddf69e01f

SHA256
f3c42bec81296cb6bb8b6c47d30fdbcd70580293759818bf4c3f62fe4b538d66

SHA512
1a62dd23255801eb84b28281fb6bad2525da83dc334369462297433133e6c43969c25e597115864341b6627751671dcef647d06ba8eea41ab73548832bbf8e74

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
0bfc51d8907f844b8091ec703d30d65f

SHA1
20386564144c85d8b97f845d9cd07c0f39b4bf81

SHA256
242ef3475569b35d64f2331487ccc03c059d69af1aea225e937ba4ed1c6cc288

SHA512
ad730cf185a81b3639559a67808e02384c95735cb70920baa656a389dc7dafd9835999fb25bcf7bf88b7c2dd1cc1282219c19b7e0d5d7082dce186db9c904f31

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
1ab812c8a8f7316ed9c988b48edba72e

SHA1
e9668f2c903d98bad70b1c3b72611f19ddb66957

SHA256
12334ce74cd3646105d3245bac56accc84563092965d66641b9b1e07911741da

SHA512
75a41dea71a54ae683ff53a09bd1de0419b88f595f1186be91d8e520859ec686e9bc313e8421822dbde724744965769b2730e863171ab205923d4d4251781de2

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
19KB

MD5
f08a7da3f3b2090232231fe54ff1f435

SHA1
8324e247723458bbf6697ebd41d934b8b524ac58

SHA256
0f5d1728847ca85b9b4390e9e120c22426bcb8561b74c503be20ce4476cb248e

SHA512
20877108407853f0ecffb45ef9e2cd6ce0d988bd9eca12cb4e998ab5c34688fc31fe2b519ca53198920c8d279be914c30461929f240738d560cd8c971ce3cef9

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

Filesize
62KB

MD5
e427fea00b78f12702f55c75923a4868

SHA1
fdc192c2b3ad2227849bd40a71ee65c5f08385d8

SHA256
b00636dbaf0961fbb911d49b5c1acd647890064fcc43e59efe310405bc444b54

SHA512
f702adba31d43f76d920a56c4197f8817554639c22b4087e3b06f548da1573234dd20072326af86d8fc62270c64494fda3e606455476aad52031527bc5c000fa

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

Filesize
12KB

MD5
7ffc1245796f7151b9cd27cc06245a7f

SHA1
a6b32b3efb0f7e07a075b13f7969f468e866c9fb

SHA256
b8559f9bc454df0c36279bf28571393b3beb1f442b2aabcd2467bee41811c683

SHA512
9f4e9cfda7a9d61a1e5603a9e94f3d16656b2a9ce060b7020052d25108622f0a187dc9069f11312508dd18f7ffda2f8374d98a700193d316d87623bfa9ad363d

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
d120fdd0876a169e17184329c9d923e1

SHA1
2fb8636352f811d6fb8f7380900bfaca2f6d9028

SHA256
8c4d41da5bc8f06e05cb063a804300d77a8731991e45c86d0d6a9157abc4cf26

SHA512
7dccf2ec757b78e27e2f60401e72dd1a946e0e89285652e46f481d1a126320c446755d7976311910531306c73852c59bf0a3ece50cc6dfd78e0c28caf0506ca2

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
55340b4b4dac0a9abfdeb67d3c43d1ed

SHA1
03a4a15184534a0863d900fb765557f4c0b984d0

SHA256
b749f496a470aafb952eeb5a8c8df7254b7549fe43292bcf4db703b574375f84

SHA512
2c883eba76fd78a8b1a22c11ac70b89f21be6a95c5b301b85e2f0c1af0ed51097b0cd77b07217f035ee199e0e201d964b310de394dd2e1e76098a401055c7219

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
aae91f0ac6280ff85a983c22662a6a44

SHA1
21040b232c46d897049dcb13fc3c083026052116

SHA256
f2a882fe4771f092280c29f561caa5d01975e076c02f05d566c46fd81763d133

SHA512
7b55a8edaa9fcac5c2f7f392afa8d53e5211039af334f75d19a8eac4c6fc8f07332a386eef9baa65f8d90d19f401b740152d0c33eee31285d984195beef06e63

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
78bbaf1946202e3ce1aa8e2ca6f1c568

SHA1
c34aa2b42268f63b5a5af3c22f6d3ae3593fa3e1

SHA256
34c0b06280ab75d1b6fdd8cc6e72bf4d08933c3568a0685e2d0984f3c5406697

SHA512
3bb67028641a9dc5f03b3da92336376dc86c0eb76cfac8d241fdad8419bb3c9d552eeee1a177c708979e0406b5de07817bc4937b59756a1762a4b4c58eb0b2e8

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
7f3cd16c611b23b141bbff8ee5302cdb

SHA1
cefe04ff119a3cae552f7c6a49bfacf280982059

SHA256
9e02da0aaf5a97772abd7616883d771305a4219895e070283d20ff7637da487d

SHA512
bd3f99c8dbcf80cdb937b0cc91762fd624788997c20c5b9c320a91288ffa98c2318de2f40a440a7c38c001c5dd3d2e309337ed6276a85626cd208b1e7485945b

Download Submit
C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

Filesize
1011KB

MD5
6f5fcf1ed164ee4c64082e0d7ed8a137

SHA1
0e4ba6fa3b1e4c9ab96f5c55253311e3e3ec48f9

SHA256
66d0d41108f0a53f5a1afb3e31836dea6fa4b3331ad42c1a174c1cebb122e20e

SHA512
e40e9c43612000e7f2a12187ec6965fa489a48be5c7d3043742eb329349854af20787c4fc9a5aac595373e95e38c742567f0b4627a52442ac3f883217e87631a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
30b9be56c1accdd4c75bb3fd1a26ebb8

SHA1
8e604f359d9004658260ee23b0e96e0315048a48

SHA256
aabf7a54eac1d46f015c4024d1a88fb5726f96df40b2de1a31063157ceaa2244

SHA512
32cb8ce96267552550d9e599643b102f7b2da30dd30ed577019280b057e72acd64186e0e3ceb48a085f7ed119556398a206f5cc137fc708e50d05c8c9fe95e68

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
021f9d12780ba3d91df87500305276c5

SHA1
38d31d361496a3dbeaab3288c958eb157472bc2b

SHA256
105210ab8e24dfc89e52592f0c8c18c1861a9a2665df22bfd8df1cc0ba1ca0b3

SHA512
7469787ecc737e559bc6cb02fbdadba14baf03396d2ea1b58c482ae24004ba5a104975f4c70016125ee503eeea4e553414c6f91c3df34fa45157d2dfc095fea9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
469da72c04cd71ac9feb571af2fbc62e

SHA1
bb1a2cf07e72b95f4e9fe133decf701a6eae557b

SHA256
fc72e395bd388b0135845851664829d748a163fe7515f822e5cc2eba3b479b54

SHA512
88f6091a93a24022edc84bda24c7e62b686e42bf8890c8a50053a04965287b2ae47f070a4ebe8df7e6495868cdac28308663cb383192389188e602d42e40e191

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
c8d9e89ec9c326af6c6d37c7b78d4608

SHA1
15db759729a28ffed46093df7fe79f8763023015

SHA256
09eb7dcbce36cdffd6e2503b83a991bc36ea5f25cdbf598b47edd75b0cebc9bf

SHA512
e6eb9256e94f62444730e3743ed0c7e10b2d711f7987ae516256e5ef960f6967f68ba2035fe0d2d9e3f7bc913289bfff9cc8c5f50791921250ae6e20b62c764f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
bb48e5b8fdf36a2dd8ec953cf9da441e

SHA1
1e4cc8ae414fe8155b5b9eab0225b214f86e5302

SHA256
85cdb3293e5343b699119b24060b138a06d1ef0e0fd38379ff30f541442f73f3

SHA512
535265a6777d06e09e1b42fee2c1f70e785e630cea9e2de94b9b1ba8a826ee49ec5f6810b20c46bc5721e27d87961adc7258023398961b76186fefded8b26eb8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
0dd97c3d2e991453be21a9aa37e04161

SHA1
eee98d6e87652663494113e4ce5a3f4d1ee3f7ae

SHA256
16cff0f9fab0bb402c9abe34ef609a2a170ed5177b23927ac4ded56453450139

SHA512
18f264bc178bea2531f52b085726d87287fda3d79011fdf7381f52134e125595d3a0bb640edbe6441903dfdfac4de05c3610a7122722efae80de4c1aff7c2463

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
2dbcc25dfdbd6e10a474d27e9023aa1d

SHA1
0eeff9ebaeec59ba6cf8ee0034f9344250e36f05

SHA256
9d634bb224538403975ccb5c280bf1ed53f994d5dc3bab5693fe7bbf839f1cf5

SHA512
4ad4a0c78a559d9b1d33f7fddb55f2f910060b0ba6307c1c6a76c560922bc59241326d7dccba12ef9eb858012bbb8d0763d42ada10ac24094cfdfff9df48773c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
83b60af8cec73eebd55d01efa2a93135

SHA1
bcd2977477ca440f7c9b05af0c6338d0672ee4fe

SHA256
9487fbbe36d8b1dd060fc57f3ee8661fd593f2bec147d93dcd3625cc6ade8c3c

SHA512
6bfaebf3f3f6f17b56a29296f3434380eccec5bc2e75f35f5e598fcb6dbcaf6dba3033bd5cc75e5f8c3ce0fd87102d610efa4c2f996e8ba36316c542dbeb477b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
7b1ee60f3b3381a6d0eabc33b2780bd3

SHA1
48e70299edd06f1cbe2bc182f5bc62da0782b855

SHA256
921950c8ed5f84f44bbb0662562a3912f84f00e64daa98473216de3c92c5ed46

SHA512
a6ff4ad6928cc73010304a72896ccf6a1a2ea04bd501cd145e60a20b034c462f0a77666b95b355ef0689986a746918d2892047b66554b69928379dc4c213179d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
f6319df14134700d6b8d306bb85eff9a

SHA1
0a7a39a5f1101514c37754df9db85b6358276e63

SHA256
ff9f7106eb1d8ce6e0d5765d95e53ab561ba04a50bb62419ab9047b8d109e0b6

SHA512
8229fff424ef7665534634d85a7c2fd5a814d7d21f1c740f9eee15d7d11dc5d045b8ec85678f228b37db9ba34b7c2553adfdbd085ab935ad30fceb945e30997f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
32ab8cf31646a9e556e9b753476e87e9

SHA1
4d7b3aaa265ae18c620f320189b79b4363dd1a6d

SHA256
aa3f1b6290685d3fe2c428848f5f2b05fae9aff66d6cff153ddd51b7243fe84f

SHA512
a896af08f159260f4229d44167a0407299a0b2a4535239eef966ee963ba112be026dca67422d837d7fcbd32b1c34b8962eb654e83547c0d6464b59d8d856974c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
c95a7f5cd0f9ca988f4fa12d89d13624

SHA1
3e23e4197caaf92d1a63c0fc6efd207c3ab1e17b

SHA256
fd1b35a9970819ee26ffb9c6de15adc4c78afbebc34ad735b64df088cbb3086d

SHA512
d6a52d2ebaaa29a73c6b616a802b1638f36b50ee7e62a6b7c408e8025704a9629dc923b8b5a90c8fe9f1c0eea3a36525bce483257494a0b7ea5f1e91f0b05bba

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
a3ffb73a0fa817d677ca30b2af30bb43

SHA1
75e11abaa1354d6ccb5cbd07da2853c8ce09e2b3

SHA256
dc6e12dfb30e0ad03f4e6ca76a1e8c8825671f31d0edb7630eca2d7fa9e96632

SHA512
087ead8d113949b54c84885616fc7dfd9d3442a5d18c8aecf65a23790d1c2bcf172f6f65741fa457140788dd3f3fc480eb3ddb6e5337518f2ea2fc79321a7700

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
bbe90f8dded09451907b6262e1feed2e

SHA1
2f7aa2174a361df343d97e3a54e5b1cffac8b071

SHA256
082ba4a170674daed3ad9014ce587cfe47627771eff6c3c3d81fbea104dd8125

SHA512
9b875d198db1e383696f573bd26802b8c3079d7d817f8768d0e23b4d99a123f89b9746a6ccc7b3d6f670b466ddb6d1928f1c5aa9383caa9b3052a485ba5b6700

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
55c2d7196d580368ad22b660be152e1f

SHA1
8f39218910375e0e18e67ae7bb003ff67d83efd7

SHA256
4b4ff8acdaa0d596eff26867c385cd0208c64026a716fae27e808adf3defcc2c

SHA512
f4b8a688288d12b2bc0dc2941a935f41fdc08f6b7e899f7308df6480ee91a99d9520d885f2206472c9b977cf7a9ffa17cd5fd7b880632e5ddb53cb6265c25dbd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
6b29ccc4f2afda246beb014f80536475

SHA1
7ee7a684071d9879b6de332dc20aa30d96b62474

SHA256
bac8b15f0511fcfcf08ee79e1557cb372ceb041122ab239c53c0e83492ce426f

SHA512
874008872f0956d3ded28ade6b11a31ef8ff398d04d38646ab9b58093b5839bcba8e372670b8559b6b6b60c869460547f0f03e991bde32b20fe2f367cf7a4d36

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
2d16265eb2c34eb9105a6abf76440c2d

SHA1
b703b7499209414f1d5008d284f0326f44afb65a

SHA256
c2901ab66909eb5a036d2d7165541faec2277279d9de631ee88eac91f550c6cb

SHA512
6247209ae27f647c7be6943cd975472d92fab298006f21bc354312c8dd24cdabdf903100c1862a9d4f3e3f31ba4cbe7ec8cfb2d725849a0f5afdd892836b8a02

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
b23af33214b4c9a31fe50251a20c8143

SHA1
72d493ffdba3959c5505fd2fd03512b7859397fa

SHA256
09e06e603f3b23704cd044086d450f6a4c68a9913ec34d0c420b17d71e7c422d

SHA512
21a705552612cd7dc20b0c5480624b49c4b69b95431b16e33c307adc7f68a4772e9d8b9accb583765c2ba420fbe69c5c1c6a2aa4b6773ec4db85cbf8d65f0fbe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
35d80467960f1da7f900764e254b75a7

SHA1
99511985c13679d5a0a308dedd0e98fc1d4b3d7e

SHA256
34fbfa62bae42521918ab36784b6c0709d13fb18a421f37b5f80648df2638414

SHA512
3cda92e0c0d5e11a8ccd177f14030928c36d1797569a5594ef59e7ba2e58922a2c888ad04fbdd2a8ed9c1edf7999f9e57b62925af07d500165e3e00815de100a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
44aa8143e1ecb514810c77aa278a6c91

SHA1
1067c960663e8370d8757fb879e099dcbd2b1881

SHA256
c59208858ab673d590a1df08b6dd7273c4ff54ec79991db631c13ad290373b3c

SHA512
398acd7c9671fa1743bb748f0b2a2015a282831a61a5731c88e6df3715ba6ff90334fb7ed0cdedcfe37b1b5d7a817d0af6b631e45bcea0a51f49159c8bfd1a20

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
21a649a9a10f2825aef0145a30e560d9

SHA1
18929155676a91ff9063aadaa9c40c182de68375

SHA256
300fcc68b9b78d93446e8703fb2d63f15b875eb37088ecceee0bb9ca6d77056f

SHA512
d03d06f3f5c5f92e079e6dc6fb0f40ce65b7e19f38d4f9c44519e86536382f85800426ee8acbe04700d47ed9c08ab80bd829d3585065e82c7f8cde7f76448f5e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
134da3527f19682023d800980a7306bf

SHA1
ad5414abc2f5f89a6b88d25895c5e5ebef272dac

SHA256
e3c22b6f68cbeafb3a3285d1fd9bc0ee7acb758525c5e34286ffa3ca3ddb1c8f

SHA512
c2160facdfd21c185a1df39c4a028e82f040be2e3285eb0ae9f5cc8c1e48b48f3fd5708be2194d5690de1cea160049141f221eca282462606bb9a4e1c6c18092

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
4e2f59e66d8e5e343c6df6afddc78909

SHA1
acbc1988d39c570cf91225baed0dbd0710bfc386

SHA256
055edb4ed12f55e57ba65373d16b3d30a5f3c171c64ab321b3a749b18a54c227

SHA512
247b2c3d1cb41ceb7f02a046c565dabfe0d2ff8ed77d776186f9d06ba452f426954975a8b27d5bd57c4ff4599207487f650ac8b89e44c5f6b651d8417ba09e64

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
aa0638816b6c9dce924b9faf2bdadfdc

SHA1
e49fde640b00528180a1c06795114477dcc65ef9

SHA256
f7d49371230aeea952674383b8e3ab90ff08a77b2d41d3d69c291c5d37f9e2cf

SHA512
cd3c344048bd4d943a40e12184d7a4284ae2b61d89b8ffb59d8b0943780387f5b94aaf73f3a66a25893a2dbe1d7ae2a849fe23ada9d037d5c18e29a7aef2df18

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
3127aa615c9554b85524aa00c540e05a

SHA1
a4e1857aae321805f9b5d47aa6be7d6d5d6ff7d4

SHA256
1785135354d2d2eea3693deac575dfd87374a98a4bf1077bf3496d7dcf484a55

SHA512
feea7abd50a16b392c3f0e0325d626214bf6039a60c0b22f690888af89d3770aedbceb959b6ae4211a098b27dbdd37825f2a6b82f719d55a7232d92f069fd99e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
ad10efaf1486b06ab798d3ce253fa898

SHA1
3221a897f4e08f1f32064d97cac4d576a84d3581

SHA256
fa027e446446e54cb1748f086c3bb6cf78dee343e3234224dcebba102bbe7d4a

SHA512
bf7b720dba24dfc4f56cce449c19882497b6d2e26a9f028277406428d32caba1ec802ddb57cc3e52a4283ce83accc38ac32135808de284d8a1d98abdbb3ee352

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
223f0ce8f190ba3ad2f78cee7852fc34

SHA1
b6af31c54cdda8a1488d3c5a19ba98d8e26c54de

SHA256
6ff0b3a644519981fc380f53842446aaf960f585149a1198e5e1a0726702b1b5

SHA512
c4ed489971f8b12466afc51ea97effb0169e346d62449c6c79acd127a36823a0a770c6b4f14a2dfc369b077351818872e628ceb715ba96121045242edc24d702

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
73910b9cc608394ae728bcdc4cf85747

SHA1
5dccc56b88c6760147fbbfc32c8c6e48f33cc637

SHA256
91282e603f2643ffda7b50ef4d2dbc977ec0412c76df515191ab394b61dccaab

SHA512
8462b0d6275d916d0187822833e407fabf6c5883bf6a6dc66f60c853eb797af367a954119fd21ba86f16549cdbb4304d6abf99929a6cf3f98bdbc6bd4235d314

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
1e72d584b7da7db373e8c3652c463314

SHA1
51cd51cfc1c62405da5b9ff54dfa98644d03fb1b

SHA256
ff6713bd5a17b9e054e154a46b205ebd37d953774ec86e4c9fbd3ee5f8129b6a

SHA512
ed395920b3ba66f09c361436c4bda02767b75c12fc6acd47f112ed69f6bec5edb3b53743d732b8dcd477d54d6c9644ee5187d01cd4f0228cc9fbb100fcbc8da7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
f2c7b8b9701671abe20b9968a4c0b526

SHA1
4d4c8304b3a6f358bb803a6a55442eefbeae1282

SHA256
8b08169b4b0df54fa4a93fbfa441a38305ff310ea1b70be4a91e3c7e9cc5a4d6

SHA512
8d1f700346d52cdf4a1954145fdb50c7c1f536e2cc6726317549c7ad517effa75ad1736f43c57efac88e443d7051197be35faba02f87b8f201d41fd562821317

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
f90fdd00754fee44a78dca2616cd37b0

SHA1
80ec047b23bd63aae33f9612a9e48c56c6b01588

SHA256
6a0c1557a32c82ff3863855bfeb04119182c4bd9a33595e538b3a2a4077797b9

SHA512
89bb611f2c5e755e1cb6edebf6a885c943b00ec2a552dac5391219f0b495c35a9a5de75b2cf8d685226f2cf7a48fcdd870c36bb7bceb2c06516a06fb99332bf2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
f3425a8c218c0539a04b691f360028f2

SHA1
93afe706379c3e5cb3ad2c6e6f54f0f57b3362d8

SHA256
e19e3e2f99656b2d1c2a1da029f55030965310031e255b2eb8adbc2ac60f5683

SHA512
5a38edd5b24e895f3c69a3a8a639add513900c22fadb347792624a2550364407fa9cff61668fa697a607e64e6260fe5d197b6da805ab1251082c3068a5366ba3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
c4a4e14192873dcd2cee55c636ee2b24

SHA1
1cdb1d9ce28d256854c43b100327220b161026fa

SHA256
b03da1f2a03ca3bc3d927f19c326df224a6706414dcae2fb96694c09c75920e8

SHA512
566b4038e19da509e4ca0437a0f0186056a06c24e4288411a71f2f7433a09d3b5126e3ed1839b2d78a723b221f7cb34a91088fc74a3a0cdc17a5b699a141b1d9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
dd3b2b9e1c7738c6fa1f4ff2f0c312fd

SHA1
b463855d4230d01aaec376895fa4b971f57e2399

SHA256
f282e36cda5d4e40aebf19b0037c59c323dacd23b418a0be04955dd337f5e4fe

SHA512
c73e8cc331991ea4981e2dd2af6221363d55a3cbb0fb0380eaeae5c8d791014fbb19071c76e600b90328f8f6a702c3edff1e205869b35fa08af6dee08ca7eba8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
8961daa04374a68c03ee09f2223d0e78

SHA1
0e112f6d9712e6560fa6d494d7fd5e2fa07cce7d

SHA256
497985443572608174cd016efc355b7a47b31d9705b50b47305affb953b0d181

SHA512
963298d8bd117a19967b7387de1dc5b5a64214cbe8d9aab015e995ebdc302018fd82c627484a23abef5c33be0e55a648efbae1c93f6c4a8225a442ad0c7740fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
4aa0696af9f80e3e402d684c282905d2

SHA1
fa99bbc20080d8a9755305b13245d93b5200c103

SHA256
9d20cae20db222ba79bd371692717114ec0b55f250de5e26103d064ee23168a7

SHA512
b0b60dd63f436ae2d0bc77b22d12c1a18731da71b09e76f64e84219b00674d3f3334e50ce8f066bd386b9949ce5627e215f08d82d3224ef14d5035183fa9e7ba

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
61e3a9a998cb7e36df947ed7403fbf70

SHA1
6a799ad6d84cd2b400f8eb2a1a46d172880293ca

SHA256
a36d7c9a5d317a525c220d368caf5008c1abd3118eb2cb384a9c406b44b2e0ab

SHA512
c82c93da0e1a75bef4262c26d77de7a34bd97513a7d88ccbb81fd2ad371a3685b356e38cb9e5d3af340f9bfaaa9b6ab98aebc89259f6190c770fc7fec8f183b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
364672ae851e368f06049788bb827ad7

SHA1
e05afba7f59876974e6d36ba1669408b5a3db947

SHA256
77aa373bd58192815d7c5f304d881ff844ae1e3b724bc8d5b4652b54d3d4c3b5

SHA512
211107b594a88497a397c5b6dbd5a003c0b144497b0681dd1fef7267e6f5c7f60a62f25b83e6ea02354bafe71c17b308aa8e60efcb0cfea32698e41a7c959322

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
93aeec7e6b903db7dc6b741b47b428ef

SHA1
8cb8847b7f1ddb4516261aa0ae95e5f5c0b27609

SHA256
6b9daf55db96fe849eeb853b357427a80ebdce3213048b71a3793bf4bc9b6e0f

SHA512
b83b46c6d168295e8b23ddb9db7d902ed273177c5314f3cd79af77b7a9184096c1b83321ccf9c62f953b75cdac98ad0155cf95c5f8cc00ba2b6e1940705d6365

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
bb7e40c32313c0bd84d04b7f05147676

SHA1
5ad84ef492e4bcec24e6b9567fed78ff4d18f2e7

SHA256
621c3001a5928d3cdc2760841b859716acac66b142094bcf94e9e60c1019b684

SHA512
d1dbe65340df528beb6147fa27f33af42bd6b7b098ee5168f48fc285436e47d77d265f1a77a45b95e2ba19826126befa77c12ce9c542dc3488c0677c8918e799

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
b2831367dde5570543d7ce2c29ac911c

SHA1
267690e29ee7c5bd281574a5903ad1703b4cad1f

SHA256
eebaa7b9fd2cd0ba09857e8dd08d90d03bcb5c52e50413f6c9fdc202b4809b75

SHA512
a8ec4396f20fa3104da1d971d1024650a164b3dd090a56e79d491db32f136c31beba5890b12fea862315ad3c36ee4b74da6e9400b8fd276723f06bbef53af04d

Download Submit
C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties

Filesize
3KB

MD5
a201a1d23d7b985a202bb1c53784d4b1

SHA1
c151c0e27d22f75bd1bf4d78866d9c98b0fd6780

SHA256
2add4d8cf3f8da396fc71b02f185bb287563d95ef320402295ca3388c4d58955

SHA512
9bb809d5e497b5d6a38e2ee6dc6ff275c373aa76386c663d768e9be36f4a9721842fff4084c8c82ec485978885530644943c763adf16e09b9179b94726780bdc

Download Submit
C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe

Filesize
4.1MB

MD5
e55bb491f9cf4f3156b46266f569c1f0

SHA1
4e203d603579223738653771c4babc59d5df103a

SHA256
a67d59c0e01bf7f5bf0c08ba852a2f3fbafe1e49c85a42ec044b3ddcaf587dd2

SHA512
d9d7fd5109d4d29fbd9e1dacfd2cde10f67346e4c7605b8869cae32a797fc8f9d2a31f640c51d6d40e8d412457d36324c1d4e3864fac901e494638664809092f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
cf9c57338f476e9d69f68bf85cf2a15c

SHA1
e78a7580fc57536c3fc8fa69487fbe2f0ebe4541

SHA256
05807ff625d8724da2e63ef2b7b7dee44e8c1d39339b4a9bd79e0717937007f6

SHA512
004b57be0f7ade475df57b7487343e24e4e996a92617a670252c3ec06966ad0cc92981668df3daf47e239c75f5aadd2431551b87d5db55a4ce7bf83d78a4e0f6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

Filesize
114B

MD5
8d10d878f388b5c7726ff3433fc79204

SHA1
45b25f38831830f7c935e87475c7888f365cdd22

SHA256
e05db82824103b6d5c322c6880e85a5d00b36d9335740dc66b30095f966b10e7

SHA512
1c4ea5c3b7299dd57e204af74ef8e6cb1f5b07860c519c96041577be8622ab1ea66ad5831fb2548f7813af2d7d39a0c942f6e8bf3f0c0111d890cef4cc8d00ed

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

Filesize
113B

MD5
36b3d706127f67f7b6a44a5f5ed00b2c

SHA1
059220c9137ec81b2903ef0183730664b6e68e88

SHA256
0404439dd2d4f55740bde30183f35c6d124cdf925199c2a557dc92a9db1316c1

SHA512
ba63b8dee51efbf5efa6d71f60afc25ed4ca41b4e8f675f6424c607832d61877bd1ae59957977767b3003da99625d0be60ad3a40cf3629a255e74d247d0b5583

Download Submit
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

Filesize
18B

MD5
c849a5c3fa16dc9e78a88c920feb533a

SHA1
9afd56637a3db622f5063d7e40d5d1e9df4f733b

SHA256
4c58b2d6f86463ef63a94f6efd89586156f52acade3a9be145ae57e99a9b4117

SHA512
974b2b9a972f3e2dde7ef978616ffecd9f3b5092ec6ae22bc73146bc5274ad793e53982d1fd425262470dffeb1cbbfacd58d70841e240526771119ac211a1f92

Download Submit
C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

Filesize
245KB

MD5
ced7ee2c5f4df204d37230af7155a335

SHA1
62a8f494ae8a583ca103fa82124bec57b098183c

SHA256
51cbdbc93e3a9f55befecfebd27300b3f958865ac0b3d3607554828cb69716b0

SHA512
b759ad240526c1cf72b0625cc932c335ca46f7da0bea6e1875810c3892a33802622da760c5f18b952428e4ba2859b08fc9c26f7ebe635101e4891cf29eefaa12

Download Submit
C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll

Filesize
274KB

MD5
62eb0f355ab28e148195d8f6e1fdb001

SHA1
b5f0482cf79b63c21d3af8cd0c3efeac28ae6303

SHA256
4130cb6998c5d9cc806421b89d43724b4ec1e9c3f72311f86f6c84c7c318799b

SHA512
2e69a28ef97808bc18a5c864ccbbf058e7ad7532978722004ac204fde56f9c88e1c180bc1181b8bffc2f76f433c2144c57aad639123e3eb46b0af696f86ead1b

Download Submit
C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

Filesize
5B

MD5
2b618649848f68252886c77fba8042a9

SHA1
bf60f06b7a5800185267f54c6d16e9170d0f3a68

SHA256
26999dae9dbe39b2a12087924877e275b8fd60a9f16680cfe23a1a217b2a6ae2

SHA512
73b933c8624e57d8be8b7744c2dacdf18a86f21447e8946f76bac0fed8661c66e7401eeb22b7966cd0142ac5650adb0518d67801e6fafa22e8f84cd259fb1a1e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
3a415ea18274ecf3018fb754f9c15387

SHA1
69808a08e045097135f5b0885e3d23f02c96704f

SHA256
1bbc9f5f0788d6cb8691254c4b8984125a094ec20bec177b4e1a1457d5176ef4

SHA512
137e07d70ba60e2a72b1ea1c9fbf9468c57febdbbd4fcb1f5028aec0a7e8943d4b08a0f6d0f9f52fe469b7f9b35f663b0c798b78fb4d44115bd608249a6d056f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
60c2ed2f4895d7b6e900cf30984c7814

SHA1
f52c126d486401f91670ad222c7952fbd2dba613

SHA256
b7e4fbddd3a47194109833074df38303a8b039215f0ab2aa3d322215968461d9

SHA512
a090971741a3196725c1a5ed7e02c2ca07c43eb13cdc8ae22d33c038cdb38a75335fd07750f90188827e0ca2e7973fc3d36aa1a363d49fd326c7c5aec66a231c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
0fdf95a7b939acfab3fd9b8884b5f594

SHA1
c65e4b755dd8d25f549172f6b82455d888163faa

SHA256
880d9d20cb1dd9ae5da2dedf9dc5a391d3e309f75548552ac279c7577db3a376

SHA512
97b54a42b697078bca4ab912698d9cb3a49e19595a917496584f4ae56b7b4ef708a73e5e6751aeb3fc32508a51d508a76f33484b892d4e6b78a0cd97227b93a6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
cd97f400268a1399b85fae1890e6420b

SHA1
266250329d38b7896ac2a41ef20b6df4a3b51a87

SHA256
4910d2c6bcfaa04d71db2ce0cf8d438fefac6ebb221dc1afe9321fc97e80b541

SHA512
4ca379fcb683f549f4744b5622ff0370f77a844eefe9cefc0572760fe66ae322731e4f7ccf9f0ab7bd989fc0d8b374d3e07dfa32729fe06326dcf9eb7b6902eb

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
47bd4901efa9b361e4df6d99ace8f8af

SHA1
8901301e58d13030d8d5680d733bb50829e3f41c

SHA256
2fcfaca9ebe47f5d392538f0f0ad22d8c402c1f1c6a95bf23764bf4c1571a6a9

SHA512
14d63cf6e32dac5bf429e69b038b632eb7b961638c309d4a2a06b34cf2e6475b6dd760f2b9eab924cc8c9c054f293fda02e22f50fe6a10e2c0c2f32446ba2312

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
0583ff9bf146b5a809a9def9fa743ebb

SHA1
114acdd3298b953327467df9cdbee93cc65e1202

SHA256
b9cd3ee806191a521596d407adc5146509133b0fbd3a06550a9d521afde3eaa7

SHA512
12333921a9af05dd7a6d597f4fa8cd3cc46ad263eeb99aa9e784ca0a91b3b98c7f1d3e55c2ad2c347386dff6abc01cb6b0722a5d72b14bcfba62410fcf1689e8

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

Filesize
11KB

MD5
7d1d8730b49354d6ac06a92c4a587771

SHA1
4586d4e9921b6a79bdb146de08e32a1644dcfe30

SHA256
0bb4fb3e71d27809dfd37893a5d6ee8c202a0986ff006d2345aa91f6dca03612

SHA512
147761aed46035e1e1331d3cb9e7f0283c1473fb2c3faf2f04bcc97319ad9333ec452d77d5106c248dd2854ad258356ba1568796f676974de0f9c4f7a050df3a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
29faab6c7468ebe2f8b52ccc594f5dc2

SHA1
d484637a4b1ef1c5b9b5acab7aa067aa10527418

SHA256
e2b0423f8df23b5f5d81f33bb25508a47032080bd4ebaeb430c9cc6d5ff571a7

SHA512
552c2bcc15d48644ed072321b8cc23d383b54accfe17ebb3f32f64a9d99527094ed4e550c1733d097c90dec80aa40c77e4354fb35a9c74ddb6ee5728d6b65f4c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
cf100709e2678281dbd1ec9ca96651bd

SHA1
1158361ee4772bf9fb416aade2ca78b82940df1b

SHA256
6cfd9a99f1a92a219b4e460f96cb03ad757d704a0a7629d3317ff7204239969f

SHA512
a6c4563c0d5bc49f5520f45573543f1d0c17b6df8e4ae3ea1ebabac5f3ce4d3f0cd41df2c81469527d3541b665c140ce883294d484d3df3def605589838eed61

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
81109d56f81e16b35e351855c00b2946

SHA1
f694acfdb34f63f125a5fc68632b621c038b5565

SHA256
2b81b6c855821e9850b01e5616d4fd55e2f10c67d8bd63c7b56d9f68b9c019e4

SHA512
0e97aae501da8081b76b85b826e68010ba76a6347ca007ab62af58831e4cdb7fd9e3c2d03241bdc4d7c8d5a32936395fb14b5dc6764b103bb05e8cbcc41f250e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
3505e92cbd78a0dc87c6b3e89062900b

SHA1
471b7b40fd2d5d693e123b9e10a53d00a162c4ca

SHA256
68e253d365787ab36639f26620c55aaa719ce8c3f71dbbddfce202ddcc2e7f8b

SHA512
575a9867d0b34bc20644e51a6ebbe87afecd1dd3e89e3ec5aae1f17d1ed41368fbd71db3a20636d2f093162492e4b4abdf11125db9b2710f8dfb195858ea6ccb

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
83b08c1ef642563740aaecca9f006b7a

SHA1
4622feb9bea74c83b23ef3ecabcedfb2b327df27

SHA256
f295dd2c07d007de1515b63ed4715d449629f04e4f9ead5d13c0716e7997059c

SHA512
1653615a0e308c6b28d4b5cc54f2a25639c8f47ef705ba3e6eb038dd4b946846b75e1c84ab77dcd2256ddaba052f48b794069cc5071d6c46fd1e2a961d74e36c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
b4ee343584286055f5c5bed182853366

SHA1
fa008eab6f1a48d2a7567087d88243c3bf36daaf

SHA256
7b953feee8a0b66be5ee76ef783a92596c30c16419b1b1cb67e102deb76c6d39

SHA512
1eae1d3ee1aa105bf20c35ddaa54b0b2dc9107eb0f437f98f2e3fe244ca61dadc4f6f093c52c93cb74d4c85fe0c604edb4d881720ac6c67356d03dd4a6a57bde

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
1dc2c854ec8ba57d780170ab9504438c

SHA1
e6f52dd512bcaf413323fce706a9ffc2484ab188

SHA256
b68b4cdc3012e4d1ca380410261799ff751ad83cf55c2275483b9b8f01bb0af9

SHA512
de6a2e63d25ac8382e139a5f388bba155c4ef541fb7d42fc821f698623bc6743a41761efd353022b1ee49d425f67ef6be9465c9ba13a7412ebb25d6bb3c753cd

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
a8f7a8b5d8bbead2dfd9e31460976a66

SHA1
fc7d34b613ae7392ff4f33d6207e86ae32a96e3b

SHA256
f76e1f8be79748ca2646be47bae8d2a23fe17044c777e61f44fc5fd7f0e432b7

SHA512
79a9b5c9f3736efe892e564d4f435712aa8a5b5cf407c21c66de2f6574182dbacc69b71afe2398966f4acacbb2ccdaa84c1da021798cbc10c3323420802a045c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

Filesize
69KB

MD5
d5a6d62dbc8f016db3bb718304585112

SHA1
ef7c3dd3d92031f852db10c6ed2adf72b79e1081

SHA256
3de3b3747f4e39e275da4c08f9e82fdafdf82f0205c2cb0c3efc6ffc6c8084b4

SHA512
86f60f56eca0f0e22f67c2cdc400f095909d6d93d2f06df643b9f0d6279a25076fe1bd0b680d028f08124377e38b15641f35dd6af94dc7f83ab57478bf314148

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
64aabebe5db649865e7d396a3068dbe6

SHA1
b20a98acb73f161bac887665cebfda3e85b7dc3c

SHA256
46d9119275bff9fded89d46beeb069195bd3152f1b4b3c57e600324c8d9effac

SHA512
96d0bc0cc0b74f6c9fd6eb37ae15b812290a4149e24c711e1f16e34430bf05b4419181ef269946cb446fe54335a6609b165d1b3f935c75c44d365e5ec5431757

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
e61fd007e5ae3123cc71d88fea41f315

SHA1
7b9d2d3474accfac7cd3e25863b45a0d4af09345

SHA256
388c1d51d10ff8cad4bbe0ede7e3e6b7a1f35f528352ee96d2d8e5e4927258c1

SHA512
3fbd1c5ed4f4c4988b7ca821afee67153b74b7b8474da4f53f738f6b66eb8a8f900eb7ff05193a8f1a480c26c50af60bd81c85fe82d086490399589005f8d06e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
1b577346de8113499d3afe727532bbdd

SHA1
223b136099ea4197f450a287046ea7de71c882b2

SHA256
e1022c204ee34c323be3c75fb09261fee47fc844b133faa61bf879aec15f76c8

SHA512
6d6185a74c39a0c05aebb77a084856d1bc087f1243e7716639ad2882b9936edda3e331eab7d9cab56ac67a7bb42a2f970a674897efbc7518cccc7c0e4e9b452b

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
402b4690e7d495689ae8f76a57ebe58a

SHA1
b54c7f6a39241ee661e9586f10814064b6b8a18c

SHA256
84fadc64a8a449aa0732b11b070d10f03e341ef7041e20bc5653a9876cbcf6e7

SHA512
5e556b3465c99d8356cbc902e6d9ed923114cd569e360948dba429e6c18139ca5d583c368c20568951dbb8425fe237008ed3428188303c192a1e9ea76b348a66

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
b05d547a08cdb5011ce84640ed386114

SHA1
ca6ee9dc8db0000d81125623abe407bba973eae9

SHA256
745f3612709e502213c7ed969021e335b7bb2f7044aa56a9e2b06843865d126b

SHA512
94f573abff9bd4240a46eebae03e693cd1762c616fba41bbc3e4d89e1bee2b1794812c2bbc68c934eb32cd35b8ca98b60c11eb4085bf997b317a0e2b9b95bdca

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
98c17094f8f3e44d6d6879d260c04bdc

SHA1
52aafa182008eae819155b8dc12a40460fade0a1

SHA256
0e2c1a868bdc8f9a8e8a0f30efc2081bd8142329ecb7a5da332d5cb22dc5b2e9

SHA512
56bfa99d84a73f8e9467a6af3e585468e0d888143e51b4214f16dc5e34cddd1bc468d13e2c65a689716612e30e97f5f8c738e82e690c771ec7bccfe2b786942d

Download Submit
C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

Filesize
324KB

MD5
1d289927bd2e6b0e12c550e24c5c3c43

SHA1
e98529cd57d83f43f89a4c78afab680dba53a3d7

SHA256
e3bb23d483a4a29bdec173c3d4f6a7c0df4c4cbf32012fbf35a46d2df8617621

SHA512
687eea7e252b5720fdb1bd24c4d29653010d072ac1d706d369213416dbfdfc693ef7b071e89b3ff129f6c8535da85e34a82cea209e8964b63e9f38e45f53d51e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms

Filesize
904KB

MD5
6814978fe23def469961d7345c73f59d

SHA1
1a75369e8b47b822c8c5814754ffcaae44c26179

SHA256
2222266557d8ad83bdbdfc3896c217e87e25a4d41c4e15f22fab45fb9e9bb1f8

SHA512
a52e02972b6939f6fd6418ca31a38f1de93e6c3aa920188167c000b7f122e9dcd01fca3fff03b9666c90698ab6d68c55560a27e30c9800e0e185c31123a3a9d4

Download Submit
C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

Filesize
358KB

MD5
6b74ba605a4f7a25961898d8ee81c23f

SHA1
c4dbcb0cdfe97a8f573b3ce9e1217852c8d276a0

SHA256
694ce7dd829666259c4f6f5c391a2af4fd7f4a97238e73184b325ce220ae0a8d

SHA512
f273f88e01629f8417b1dc70502eff5d023a3ec356af787af1b1ca8db8546f6eab33a255ac3a43b406db15bfda5e8accde24ca737da0eebb9f67c1f374212240

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

Filesize
3.0MB

MD5
e96d002e15133edb45709f2900dbedf7

SHA1
dd63d159eb257802c0a6239dfaf096e52446a6fe

SHA256
76df1ce26330565940c8195221798caa211659e916daf5db4b70c756693bc664

SHA512
3185dea1fbf5dbb14f2f926fa69c83c070f824a164e8648c394b1be8f2dbd8d123ddc20657a971eedf52ae7708cd35a9fe31a65d7f756fe51dd7e1d05de95ee0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

Filesize
5.6MB

MD5
78d877cf28643b6897168ef383870b91

SHA1
0a6be4f0d08c63dfc46b59aea6ff8269dff9f2ed

SHA256
f71f9d3849567d3892e675a0742d84b896c8a5855862e0f624b2a33f075878ad

SHA512
7dd8932d1b28f72b6e5e70ccfee3fe5076ac23628c10e61ca7ecc22fef0bab82a5da23e26e4e81ccd84d9066aab6e946f71606c8d2de663b119407b441f4d3a1

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll

Filesize
644KB

MD5
1dd1950420cd67ef37058b97796b5a19

SHA1
671ca1e2d9e86d2e81a38dd277c5225b748ada3a

SHA256
431100b2610af1bc08741950b82175358973f6f64d6be6706f99669d1a8ae184

SHA512
d08233af50f600e841e1f12ac8380b67cc5f59126aa3d15b26a03bbdfa3c048eeae7d44cfce1aa3a7e856f3a07367901e0eab24a35e7302f1523e61441a03007

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll

Filesize
940KB

MD5
80852507382ee4861c6f71bbedd7514b

SHA1
3945a3e47188b6026e8bccfc779bc43c3471c23a

SHA256
f8d701ab1c6d87f08c68c40fe752d401b07acf9223531ebab9cb3f7d6939ac2d

SHA512
f0149877a2d364175eb6dd9dfac62fd75836ccc4a0669116e362f9794925fc4a3e42220b6037a04271296ce78f306026bbdc7d020fa6bd8a294f43ce2ae9c4f3

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ucrtbase.dll

Filesize
960KB

MD5
2474ffdd3b5d70f6b5fe82767386f1ae

SHA1
015fc405f018579be361121dad7af56605a458b8

SHA256
92f3b00fda10a95e0f5a3ef387e3f39391ae68c0e43a2b3a20d891944e8ef60f

SHA512
0baa560eb9254fbd57520951e6b1fd7f799a6303d2c533db9473d5bbe23f87fbc82ac817e56b32c20383812f2a00f87a4c2caecf6d17aa0b9d2a6e7132986456

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

Filesize
31KB

MD5
e23abd26a8ae0258451673550692f4e9

SHA1
6f8d23d1e1f1701e796d44bc7bbc108bc20882af

SHA256
0b861839205769f8e68847dd3e9d7e83344e0482fd3db5b7459a1290bfe3b023

SHA512
cc51acd66628fa78978c661a32c9c3d291973f4640257c9102997a3d130c999ecbfd3e88fa882e17a34ed726e5bab2edd6a2a64fd832b6da793ee25a9b88596f

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

Filesize
30KB

MD5
dc7b5047e97859157891056580c611d0

SHA1
c6d20a11d258a43c320933c91a6c96c1da54cf17

SHA256
d2e86d5c99e70b268010330c0a4be9b6b5d0de6419fdcc7563594674163f91ee

SHA512
620a34a95206be32ad767cfa009bc37f8396aa01f0654d624448dd781f6f3fe20794179703155af7f486b9a1de462710728e1debbb8b0b4e954a9f08e59d2fcb

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

Filesize
29KB

MD5
77481cebfdd25034606b526ae8621423

SHA1
14d89c38b8a1a47e039db9edc27e16ff401ecd0d

SHA256
e138a145aa5e10592a4b8a3649856b235705ac9288c6d21b0e41038de8fba5f5

SHA512
9f711529bfa02247f889e1e5c6a767f1e708a47fba35472f3f0dd8a821dff1dbc6b510a632546dd60f71376e67ce7d54ca40f81cbe101fd3b52cc97c18323ad4

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

Filesize
34KB

MD5
78e752bcf9e9a06386337320eed7f63a

SHA1
0d41db254750c2174a49809ec33b063803dd8a7d

SHA256
49b81d7ae9409c2e8f74a7a6e5054ba553e05c03dbc0b657ccb39551b8545d6e

SHA512
e17dfb00613777f04f7c699028e7ccba9cce9bb799ac5463c1df4fc36a246b4f4a5bc10cffe584e505c6b1712b1bf52f7b8a554b26742964560ac0092ccc098f

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

Filesize
32KB

MD5
5d47ea85e6e8b7e7d00e884b1a06ad4c

SHA1
37eb543d38d949172f7b24de949a0592f2eb2c2e

SHA256
067bbebae5d2a9ab3fe49f9cd90c8ff26f37ada2c36b06e9be17641d0280f44a

SHA512
eedbee2e3f09dfb6a71ad23fa02cad52cb0844b57bb076cfca15cf4fae8cb713d025dc0e9d06714887f3356dd94d4088e081ab78a9c6d4f69a73c6c2d75c0b1f

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl

Filesize
79KB

MD5
d141b23727259f2c2b90befc1ea8cbf2

SHA1
02e4d4cd8fe7bdeb7dcc3dd7484691f19cc10359

SHA256
9f24f74d70458144eca0845bcc373b646bed8891eea2396c88630cdc04301abd

SHA512
f647ed6fa6caa1c176de883da2d34dbcde1335c81f7aa78b8800870c47fc4d24172f7b33938f5e66ea42812e412ea50de09fc445a0628c673303d6ec02310687

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\MSVCR110.DLL

Filesize
946KB

MD5
7c7a9f5b1bd0a8c5b794bf2fc2eb0abd

SHA1
3238fcd59ad1012ea6f3e940641f9dc8c6ea46c7

SHA256
725c801f56467975c8dc2a8ac8f5459c70f72e0d42d4170faddd3516505c7779

SHA512
e000ad1aa944f7ead4e3058ebf979e0158478eceb9d519aaaf98b3e2ccd5431466ecb3ca851cb249da03663351982c35ebff5e78dd79a5eb01fcde0d5e86b07a

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
ef9b6fadcbf6cb8bbeb8cc76d8836938

SHA1
3c99f0ec16880675ce778eaaed84051bd2314dbe

SHA256
7e07bcc879e8adb1cdc15e6e5f034e418292fb5c28630623c87addf01d756211

SHA512
14ba96ee094349624bcbb20af25cca96c7ecbdeb7462fef4786e64ec66566cad9f17395ed0194d3131b0dc467884c172b6b90d37255a9bce4e5df4a58d3eb178

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
d33e6cad39d4d4a3a18c1da4f24b546f

SHA1
643fcf72a32e32d17f7f986c97f6b36c7ef2fa5d

SHA256
58b68890e2141ec052d220d65b35acdb0f63fb72f30b67a5604beab8da992554

SHA512
0adb95ef81ec4357b4252d2a2885f318c34c12d0c3453ec8e89562084189ce509f5dbe743b926ba1d5780be312089856183b897ee129c70a453a2b10b3605b83

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
e1b80d5741c2ca5f864a8f468fe7006d

SHA1
e5cb9442fc0272478bde34bee2ca50c4c1a0322a

SHA256
d4ca27f9d6cba36a1fed04f08d7bad7465abfdd78afc75caaaeaf1cae26d25c5

SHA512
37ac621971fd9cf2e9a521f0c2227a7399a795006ea1d248863f0fad8e3978955a47fc65f1027c002db2dbba0ee8e4edb8034feffce524c2c17f39cebe8e44a8

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
f1610b80dc77bc3c4d9316e505db2718

SHA1
7e588e773c8cc17f9e80878a6a5c187328e87a18

SHA256
251a31b984b0c325f1b244b7eb7889f0d624245f4ea35659d822b916aa68634c

SHA512
c5fe9086df2b80a745d8b1df859faa15fc04272f0bedfa72efab435f51c505b15b36f1b0d3436f00bf36f03cfc9ed2d770cabac608e827a1597bb3cae9bbf018

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
456b9e694a6b65a9489417a4a5d353ac

SHA1
8bca1f117246524b2471719de4402d9e4c12ac31

SHA256
d4e00eb74a124fd5ee04706c5e766cb312bcd514097a2b332fe7eae0aae04429

SHA512
82fb9774cd171eec2697d37b27e666c106008942930ee29651210a4ea7b77676c74b3e6da5c74bcbe3dca2ea26ba71fc3e23e3c5c4f795279090f95c2ad8ec5e

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
afdbf2c65e36b862f0d5f05e57fd542a

SHA1
44e09842208afe406491ccddfecc5650eca5cb65

SHA256
b85689f04b1b82d5250d4bdbe5f951f027f1f71ceeff4d7826ac7e1c52c54c7e

SHA512
3989b1726523be7cd98b7daafa5622690ecb96fc17498d13c10731e1ce9225a3c69c32d60625a7ab7299dfbc5616fe4fc7ea4d029c792f324f1bc199a337b394

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll

Filesize
11KB

MD5
2c6c31bb40cebed050d5d2647dd8a5fb

SHA1
de9332f882ed6a4d10f4fb806154aa49e26cd613

SHA256
36e134c2a6fad28e0ce4cb1b9af82a1c3dfdbc4e7aee687064ddf2e8043f0529

SHA512
3f0ac453c2b060b5018ece7e89c06179a07a3521af1ed1c4f81452635be7a4c9dab8d01b9dad63e2e8681e694dd247bb837fc4b37c66f464f11440b085ffa8e9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
d1991b1985032753a8326ac7d7849a46

SHA1
4358a0c75ebfca4f55897e43abedd364d8302664

SHA256
69f4d4225d3d82be019de894773ffbc1be209ed72810934f5f7242239295532c

SHA512
d4c0f089cb9c27ca073fb63a179bfd47b0f870e0fc2dae929fc7882be2a05284b27fab1a0f5b92400e9a249041e4c032871e15930e324746eaea036c8ec7467b

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
75b31887dbdd9f8ab83ce5ecd3ed6b5b

SHA1
c8152eac68065b4ff7db1cd39f35c38fe8603099

SHA256
9af80fb95958c6831fd88fa8d90b697ec4a583f0046a1547024501fba124cb44

SHA512
555e8e6f6af95338cddb28a3d60712fa3ca46077b2862735a01a90a38af63818f6896cc7f06f7355e1a3a145e5ca1a9577b84dc6d049d3b28a6874f2c5c40677

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
7b69b2de1e1a91a71e4e730d4563032c

SHA1
9d40b89869bf881018625a144c6441aedb25bf31

SHA256
68ba7bfa7af5472c346de9f7957bf536c30e0608958538d29aaa485d0db99192

SHA512
bab7dc26875ced124dc1d11089a5d9d732b7a135d4618d7eb0faf480a1e1618eb05f279a15422a6d0812763c432ef2716cfbc6c15aaa56a15365390819e9ed1c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
a8ad09002f74f01941eb056c18675433

SHA1
0aef7b077864568fb51a4f75949ea218b0867279

SHA256
d9f7e4cb635b963845e2717a3652bddc94c26a73c9e5d505a359772eca255b31

SHA512
2f0a5be97456c315fb79b32b2011637df76e2b17662835952437db40fe86c5b7c11c69e7ffc6bebe508c5f39957fd530342d03c837016b2bfdd49ac224f01106

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
7b5ca4d9aae254e19bf64813ba2c159f

SHA1
978e726509819480dfba3b64f3874a050c47a549

SHA256
8e9d3552f44ed0d99f03ad7eacc5bbe94bd5341a142c331bc4e72a7cc5d9b23c

SHA512
99d80c5928159cdbc2c8d78caba0222c67e064ba1d65de68784e4ceed9ac9fe85d184b974d18a46b5313bafe702757dde36a0a4883de30a8442177b8964c9e7c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
4bc76a3e4ba4ded8a331cb85d4f251d8

SHA1
15c4f98142c4305c966e22548e77370456405251

SHA256
ef6cc2db0809699b43ed922dc751af0dfa578054658e112e9088e1f71391e80b

SHA512
e7c9c714237385af7f6d4ef5277c538007fcad38037958eae2b339ef10c2a66a1ed75b80987fba3f6546b8b0beddb3e200d3bb6a13f8894bbe325e6222078fa6

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
84d7b197457faf6d14102a2587f1822d

SHA1
8fa36398543b5e91bd8c085517fa5eebd1f60a1b

SHA256
cae4e63368a90c9cbe79cc2e43d34ccde583b9f6f8febb2fc7a47fb78b4578bb

SHA512
298cb39739f8c5889cc1da49fd4f9269d49a7fd6ee01606ddb9d12be7a7ee8164f7c9a17ea43abc84a7bf5e832e75b7ab610ebcfb2d34f651a7c53df68df519b

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
3f4dd306c15dd5a4e4296410426bb1b8

SHA1
e4bd0fe30601f11e7a937819a6f0fc0f7e35517f

SHA256
9c6353711c5642a8c31b26177be1e934493c2dce4aff9915e065fef7d1f50e4e

SHA512
3fd6bef534e73bbab9c9c8d5519f1106d42082b242726f190f6de04c34602862e5e46f5e483027d91ac7df4a75b7f1d8c100436ca2273b4f8e7ed981f50d5c33

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
aa07dd7941fcd7ef8e6357847cda20e1

SHA1
bb590af36c49a60329252a5d29978cb5e3da463b

SHA256
5b7d6cfcf7057fa53e6c46b4b6a3f903bb925af16d1769bed2a30d39eabf47bd

SHA512
cd1688bde099beb7a3fb8b3931585dd08377b46d384fb4cef3db5e885e1637bed978862b26b3c3edc61aa745f0c91a848ddfe93055e5221903a5d8ab89922b2a

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
20daa976dfdad65b0f3527fb305c011c

SHA1
76b3fe58345991a7f0854987cfb0d48a9d3c0e23

SHA256
885dffcbcbe7011a9b384080282bba989c1b8d25a2690abd7337129343548f7c

SHA512
ea00c187757535c43a7a4df497a67c3bc46725dc0e622c66212f0556679ed3e1160ee94ff822f0dc6e45170607ca5ab361babdbe89ed8a81bb94f5fb77b91f04

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
ba13a9b3c80e9e6d8854b1cc900c977e

SHA1
f8caaa602ad4d46f9bccf173560079541d82ce00

SHA256
397751ab1eeef4832706d7004b59f0946adf438876c677072f6aa9ac09d15035

SHA512
53b079f4b7dabdbc59dfcb806b7da68f5ae829e788b1e3e8736ea13438e4d85e5f2e601aca989ecc1e616832c8405fa75ae1d0bac8308da6de2297654cb5e91f

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
e1aa3f685c1a835c3d71456ba153ecdf

SHA1
fc14c874f772e75d725b72fd63e371ce1c6ce22d

SHA256
8bdd183f21fcc66b5886bcd788708ec68198b9518ae6d9387cb610ae0ac83986

SHA512
45b0c733c4c741fc0c259547d55e0c23d12258f7c09ef323029dafd9c7c851b8157623cbba9a45773f94e318b88ce318283ddd8f33e7e90cd72c83cb5d17b6ab

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
0a3a470c6a302086b65b36bd9d96650e

SHA1
d05e8ee0949ca78cc8a243c8fa7ea8d51c73101c

SHA256
ee6e1e4ba3c60e1e2e3409513e4a4952762c9d270aca2de3e8e2ddea8ec1ce18

SHA512
ca7fe5c1db1b359bb1ebef97126adc1e709ce6f4cf3f815dc0747e6fa7a9b94d3bbf898b9cf26abcd7c804e593ee2f11e0ca584021c44104d3ef2ef06310c560

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
4f094a453e94b97557ef65cf78212e56

SHA1
b663c8b061452c8647b0f083f6152ddca88fbc2b

SHA256
3830fe22aa1473c1dd2eea51574fb39a2b1ecd8eae4c9be8d300f0d6944b6bb6

SHA512
8380cdf0f71685f57d7c89d0064d6bb6ab9ca1da8cceced9f56a0035958a732be9f96a202105621c0fb3345c6fe71b56740c403b86dc56dce43e011af3adf31c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
55ec941590255316946b848cc52f1e15

SHA1
0b5f626e6237dbd81e8b3dfd4d007f59c198ebd9

SHA256
f6c0d1767fdd5672fefae7b15c1fdd58da19396fd9fbec775e061941fb9eb8d7

SHA512
68e60d2efc4e8b5fc3a462ece769c279b8b38c4524ab654ba924c6bbe4b9dfeeb05eab359cd754da35ed9c2876791a886d28d543965c99c6470c87094ff655e0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll

Filesize
244KB

MD5
3b3b6dea7429cdbcaf6a392a85e719f6

SHA1
95fe151f5e27a4edca7d0c3a679c197c603fcec5

SHA256
bc9bd43f34b979197c45992397e1d0079150629d32dd811deea8f7d6353d8e57

SHA512
ef83f5a7d270b8d5a953e20a7441f48bedfe344b14c1432a78ca138019188d337310cc572e9edcc99565783cb0ce755c48b54eddd7d3f8a571746ab7a6d88b36

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll

Filesize
4.8MB

MD5
8bc73bacb99540058b7135d2d2f41d05

SHA1
c29417f0c3a3e22847d7dd09659453ea9e60a831

SHA256
60a7150e701933269ab2879c4961cfa2fd0b9ff8ac798075aecf2a52fc7351c8

SHA512
51d0f0fa25fac6e77d2efe50b70716dca7252d2c289bd0e954f13490683413231dc12e30270035e76f0b8470b9e05fb677769aefc4c9f466e4974848a5be60eb

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll

Filesize
444KB

MD5
f6eedd6622b310c37d7d12335f8fba27

SHA1
fdb24ef8942bbf96163bceffa022cd790bf6745b

SHA256
1f9b4764bf35e89700f7039c20fd4aa234c28312a4cf0a98a9a0f79a9d98e87c

SHA512
22f0f8ae5952871f2651b636698337d8dedc895e5ed5c9d5f9934d16f8600db3df5afdab09984615a528140a92f175d63a4591bbf0a27824a2093331bacc314e

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll

Filesize
439KB

MD5
92a738d58343b71c0dacd0b71a2260d6

SHA1
bdd6bb83be34e31f201eaf38e92bd2039a13b765

SHA256
0110cc3b44d232e5583c2208b9d3a92c474227b2fa3a888f5668d5e08a7b26f0

SHA512
2494e0f20f5838b74714d44e951021220e0373b81a325e4ce22bc81862e0cf2991cc1f25a49ede3a61c1d924fd303e0a6c894078dab335e75750c1fc3b695e72

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll

Filesize
879KB

MD5
ad8eb0052f167c6daf8a6bf8d3f8e69b

SHA1
aa87305b470b0027d6a1394870e0aede694c376f

SHA256
b4f03ae9bd490210e96b5501770f05ecd3dd445ecfa96fe36a4887e2fb61486c

SHA512
1338d7aa3db4ca83cfad300574c103a47b374c6b4641cca4ae6094d4135b87ab2539636a8b3ffc82cc7b1a5f9a7b031b85b52b0f97abf648dac784fdc121a08b

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll

Filesize
263KB

MD5
2594c003d658939eb35f87b9fab6e0c6

SHA1
27ec4d12570460a74289d95d28791d297b4e491e

SHA256
39078351e1fd95bbc0bdc33ed1f072c48bb520c6a9ed0ed026420ac8534c3885

SHA512
a03128d714d9777626218f117f8519228ee154e2f4c9fdd83b3b80c966dc3c7637dbd2368d4106e8451606c989ad72a3ff4e41bfa94cf16f3878f88a341cd6bc

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll

Filesize
78KB

MD5
24f7420fc9fa9b4ae4e3226820f226d3

SHA1
d585e28b7b234e5be929453d68888b08f72a96c4

SHA256
534057417f7de0bb2719a31bdda8602b59067b3a6d298093ca092ceb76e077f0

SHA512
b7308165b15ee93e5037b8a9d29361b94979cb976456d01aabfc87db8ce5bbc07d9969dd9838734f73d806d1d8efd9335fc1b01d5953cd663ae17caf35b419d2

Download Submit
C:\Program Files\Microsoft Office\root\vfs\System\msvcp140.dll

Filesize
613KB

MD5
6061d343dac9ec41360c276b0ccad1e4

SHA1
f4d5b880707564adf6a35b0bc3689bdb47f413f3

SHA256
fc4b5755a8874e853ebabc8b93b65056e1af258bbadf66c559d9f85d40dc6590

SHA512
7c6ac4a345b67c5268ff105f867d9a2068dabd9d9d50e0438dc6f318fdd66e99e011251c383e861f389f8d6dadd77ac4edb78e1885bccfc9df7328576acf7cf0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll

Filesize
83KB

MD5
a0135aa4517a4c419f353d9c0a652920

SHA1
d543944843ac5102758d6cdc4c705e30c2fb2924

SHA256
e1722b517dafccd2a89f7755e92f3c0d9c4c382fe10aa9f1c82f9f51fa7d7330

SHA512
d3eb3448fc96a1f7682f4400622f87b9670fc226c8ec441aa0e0932b93ae6253bc437fee0e9961ab55f955203da716d736865a14c23f235c164792dc5a40e1d1

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

Filesize
1014KB

MD5
a6ceaa45557ec8f574fe454de0f4266e

SHA1
1dec2d577068fd9cf8a8746cd98ad6fda885d7c2

SHA256
7883e9f92c2ad0f57fc43c0b4be0fe45f66129ecd1904356c1a71a0cf54ac9c8

SHA512
719b7147b3ca32f61a88667e24a753487517655069aa4155c38646aeca2e5b4231e8534894de51d9a0d88d1ae3185664bba095344ec36bc1f01c437df1a71a3e

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

Filesize
584KB

MD5
356eb356d46d6c156866032ca9e7a3d0

SHA1
4262ef5b6a6caef14e474b906533e7e37353af42

SHA256
fc7bf719b8146e4de91d18f2ea908dcebbafdfb5c397c7ef567151c0a088f357

SHA512
c5420122bf7773a7bd6663791094e0a0560c555a715123b3078753a05ec07dcca04d5e73bb43f62fe8162dd6e44330a19260694e514d3fdfe9330bdfb4f6af73

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

Filesize
1.8MB

MD5
57df927835d103993c701ade7a990cc7

SHA1
a96fc1c8052bf456640178ffed9f9b2399e7f046

SHA256
f1e85f94beeec7057f04b8a4333d07abf52167dcac816c4f7a2e26bdcf68f1e2

SHA512
87b14cf86b4a1d12b88141c23744b26c3f18ecf1282160e5b7547877f785b7a7f59d121520b2aae6c4e2dc25c56e58110cc3d29050d4b3c1dabb7330d16296d1

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
230cf8f600e28a2e7002bfd87df8303e

SHA1
9b57719a5153520b48528e77cad6ebb51e8b45c2

SHA256
d0237b18f28e9bc7b984ea428f4461b28715e4078e5375ebdab337cf795db5cc

SHA512
d160e83fd7ad449b88ef37aa2695073736842700827167c9d0f7e0522e04dfa7635e86b7dca62d21b5a2120882284fa04fe7f1fad755c4db2a84a685cb64f3b0

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

Filesize
116KB

MD5
e78198d3fe58885314fd3d25f8f9804a

SHA1
7fa6153757e8364d01a1d727eac61b6d7a5a6b4d

SHA256
09fb737230184badb7c8c92f512c058838260e27e6c14e4dcbe5a4e4f5a46b7c

SHA512
24831b29f855b1ea6abf82877c32c73dde46df1ee5dc1b352c82eef92771577945b2ddea3f1ec8c51df1855ff3e7ec25cc2aaf604f2f9498e8d652580c17550e

Download Submit
C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

Filesize
1.2MB

MD5
179c3b12a3703fbc6dc955a6a687f363

SHA1
712655884020176f13e5afa85c20308271fd76c1

SHA256
cbdd9b3f34406973fcca6543d268c03d28c35afbb746c9eb2cf220308822fe18

SHA512
28cf5e6bab6feafb0cb14028b955e9116ed0d93754e9b3499a79287a4304824078cde00b3d097bd7b866d9d7475a4b6f56ca49720752152a7544f089f03e4c12

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000003.db.KEYPASS

Filesize
289KB

MD5
8f9badaae47ef6bc6f6b1e81234042f3

SHA1
8b66205cce9c0e9c1dbd5a0b6472dc9ff1bd714c

SHA256
71df49e365d122b2f23e85279eca4a2e0c4bf4f27b38cd78dd0b7888a311853a

SHA512
a9680d448b62d83282579caa532b42244e07fe063277b5c8ecb972201e6d56e4bb5ce4d442c1df3ecc94fd773057ccf1514385a0667f799deaed48293482d486

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.KEYPASS

Filesize
623KB

MD5
08c5292fcd3176c2d31278c4f92fccc5

SHA1
2185459f2de194bac7f09f2a1aa1155c97ac5523

SHA256
2aea9fc35f0d323e9c1023caf72addadc586c63fa087b46055fd260e131aba28

SHA512
2386eca18a2506cf3b62821dbab04afb55520722bd0440347bc6c2a7aaf1bbcf60bb087d1af3873ee8a285982ee9829b4231b8feca8d2db821bc92533bf54671

Download Submit
C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

Filesize
140KB

MD5
9a7117437038f91225442bdcdbfeb024

SHA1
8f4839cb95fb622e293df1ac993c41c00f8922c4

SHA256
521c7539a4d04e33626545d33798d19016096ee7e78b8ac2b2d8c99dee9b8022

SHA512
04abe6456cc81bcf3102a2c40f0d4726828d7576e19b923cc0df8ae8169264654d689658de1eb035e439f222d0c192c1de1fd8392b76a36e8ec5a58cc09796e6

Download Submit
C:\ProgramData\Package Cache\{CE4D7AE0-FCBA-486F-A58F-DBA3626FBE4B}v56.64.8781\dotnet-runtime-7.0.16-win-x64.msi

Filesize
26.0MB

MD5
c3fd0efa10426dc535d63d90c467cb44

SHA1
a35e40cec4d2d4e9eeef3977339f5d84286c0c7f

SHA256
56f7bc3110004789c4576976b7118eb259e1e2f26fd84b01c5bf7f169023d2aa

SHA512
d53c41aa96db096a42dfc382fb13315eddd97c14018779e5fdd09680d835f6d06b78138a7e700ec7651f9d56f599c6117d60ee7c0fb8a836190b9bf66d90712a

Download Submit
C:\ProgramData\Package Cache\{E634F316-BEB6-4FB3-A612-F7102F576165}v48.108.8836\windowsdesktop-runtime-6.0.27-win-x64.msi

Filesize
28.5MB

MD5
8504b8d2a43e22e503a4de0d3d34d4b5

SHA1
0f3badb4ff824ebeb47ddc3ced8191b5522253b5

SHA256
37cb5e1ec0d236ee9de1028d3002a0c58f13b522d8c909df7ef9f70aab4aee0c

SHA512
ca40635aa1666665ed8af77fdb7c8fa3762066b58d46322b6aa83f116f155920c5d7fc7e09f8e5a50edd74c7bb280033522b2bab9c1945e60ca47bb7e2b61d96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
5ba9c7337e346b4234c3178ee08d7f8b

SHA1
04f41cb2793c497c056ed6a92b22e917558a6a76

SHA256
6b5695fc6289a1364ed10cc0cb1db9f5fba5faa791baae524cf02b0f2488612d

SHA512
3588cfb2e0c30a8590b6bb822c650a0c6129bebc53965e09268a3675202d46401cce511658e4abb54fc26da142111e2342af3b5c2b199db10dc7ace66165d81f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5008671d0d283e943f7bcde12a68e5dc

SHA1
6e82a8c96d8813baf8f1e4fcc6be3e07e97cfce1

SHA256
5ac446e8467eefac2430fb31662653c5c298efa6035513ba6b75627c97adf3e4

SHA512
a37eefe90579226e5bece23d596014841b8612eadcf24e0d66aa27c6c576dec8870faf7c3c0b1b69a5759dd25327d0af83c298c8c076c138c6571ac447e5f2c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index

Filesize
24B

MD5
ea0c8a1ec215dc98747744dd9b16974d

SHA1
707c5714c6c793af93fe0036d51447189eb23a2c

SHA256
40aba23b47b8e22d208bc8a2f0d3fdfb2ec52122bcba10143cd76c4756fb23d0

SHA512
86670060b66b4580102c366df13336854181f07d77497e202dc964d2beac2ae5336c3a767b354efda829dfb1143cbe8ad1ae81eda601a090e70f2050f743f8a1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0

Filesize
8KB

MD5
c9b6f0707b005fdecdbb82a07ee2ddae

SHA1
bfe342382421febf4887b1a7d3aa90888836ea36

SHA256
3bb856bdc3aae76f73dc49482ae26aeded2731025826d7eccd64daad3db3dad5

SHA512
23e6f68a0d50f9f33eec553201a8814a1042af391d837dcc68a797496915873ef2de2a2d5b124dc719842547b0676f5812b7d12c161b46cc9937a0d15442511a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1

Filesize
264KB

MD5
90f968afb83058c702cb20d420417e7b

SHA1
eb96eb0baf32c9a421375409ee88513fe1735c5c

SHA256
a797bb473f198bc72904113b88eabc2566df399b224a59673ad972eb4da0ccca

SHA512
efdaffd1bb494ef0e74cfe32c9b5e012dadfd0e068707e138f22921e034ddc702cd6cae167353b2068d7643ffdb94e33d27f026ad63bd754f2fc261e5015428e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2

Filesize
8KB

MD5
c094601eea3e04ff40734c8b0288d1ba

SHA1
aed700ae74b3807eb1dfc1ac78caab62a3e2360f

SHA256
0cff048d2e0a95f2f2f343191614b91e44f1786850b5b756b2620181ec196d2b

SHA512
ec6b624c1625d0230ee07c948ff562e4470c1d7cfc7ab0c3d504e62d08054c8ac61fe664759c6ea50742dae3b1228985bf9f8507c2afdf53f35af2aee442adb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3

Filesize
8KB

MD5
1984268f962e3c76a5d29e29a2e5a882

SHA1
6fec09fb26f758d9901b61e7ce78f0bda796364d

SHA256
a273e221c9e07ea63176cb22bb194a64197ecd55a8f1d72a3116f875b07f6f35

SHA512
480b0bc11c530d66a424d38cfd94213123d3a4b3214d67196337d77bb583dd320569e947363e814f8585462853e58f56b889522849a47584fb164619d23680a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
331KB

MD5
25fe2c53846b19f7890ea8ac94cef119

SHA1
b10b428305c51d067690943abf5bee2f405464c3

SHA256
95554bd7e5129a1d5e7c64d7075b957dab067a7123fbe6c5e02217e2e655e96d

SHA512
dba57a1dbf96e2dd44ec9c97de58de8f5d3fff493be3eeda77211ffae995d4620bf011d69ac9f1d71cdf8b081defb09c94d6a4bebd3a1520139476fd56c62a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db

Filesize
24KB

MD5
169c429071df14e5dc44da4b9881ccd7

SHA1
c956d4184a35085c6c244eaaf00f4ad20a40d04b

SHA256
4572d002428f3384c92700368027802c170e0d3ee8cf00914df9614af4ab2890

SHA512
f24bd13c57e2a934b0b6ed6551b364aeb92f1ca481c25855c7d86e6ce2f6eecc41840cf1fbdc71a1f4b65f1ee9971e1af591e07843240e72341c764ddd6559db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

Filesize
414KB

MD5
1dd8dfca3836e083d647838a6af97a6a

SHA1
517411da12e743fe60243af6e21b25a37d2b31c2

SHA256
9b62432e5406f909037d1c9bfc565f51a95c8f50f12e02398593cf92d8cd508a

SHA512
8a391e3a14b4e83785f3d56e97ef6b2f16ffb55a1e9169de3c1b293c454bc945875e45dff8ce746d94a9873dfffa2051739305e7ce86c83cdaa264b73694944a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini

Filesize
174B

MD5
412458223017be4094791bdcdb449948

SHA1
2e5fdf5f3620978fbcd577f5a1aa54845591d5c9

SHA256
41ba9af0b9240c4dd0d792502e470df8c6206c9f146e98efa0db5146f7409354

SHA512
daff8ec1280fca423e0e3d666985828f241eea6ca0bf88b72a45275da6e7ae6771646908d158f937234d32fd88499fbe5c9a64baccaa2806cda74e8833ee8180

Download Submit
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Filesize
8KB

MD5
f2fd07e74f78e3b948e27211ac8da3ca

SHA1
3da6a03faeb2935be7b909d42352f4322a1b1a16

SHA256
7149dcd6c8b987d2949b9357d3024486fb6c917a762a683800a21d3328f65844

SHA512
683b4c90e13ef90b94216a68d34bfd22f73b3bef5d7717add71cc5e55e283f6adf1479a85e52f41416f70f11a2d9b4a1d92c5130ec3f2f8a182dd525e6cc5907

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help

Filesize
36KB

MD5
e86ff49ae302efb310488b35132e866f

SHA1
2a7604ebe540a9a6ceeb5ea4c668257cc7526241

SHA256
df4cab88c8ebe4c66aa4bd68bc72acf76bc5608ef29413c7a80754b9836997b7

SHA512
5c87c1de37882a2f80d533d43172efc578024aef73228868f801b594f2f093bd1b8ee804a260b966b89288734e66c5a41fbb63a4131091732ec210239ed87f71

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.KEYPASS

Filesize
36KB

MD5
69cb1a9721f66949deff7ec89027cc27

SHA1
c69fcfb4554194235c3fea7b75780c85d3c59059

SHA256
14d72804c6938544d68f778a66ef19fd732c599c3db8f01e3903be6174135bbc

SHA512
f90c58b1eaa6794a60f3adb98227633907edc84720bcd10c81a20ba441321e22a459a8b356543b31c5b132f0b7add3c2ed04bdc54fae9c785d6b39248d81b0f1

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url

Filesize
36KB

MD5
c87cad1a6cb1986604118871f5a57d6f

SHA1
b12dc7ff68bd6ced51c6eb2356f557d59629706c

SHA256
13a166702fa85f866ce8fa79807ab88e60739fd3e3832157c394e01e462a321e

SHA512
59c34acc2e982ab96deed45477f7cade39a769bb7bcf6174411ac54ac464d5c744743ed1d472e77dd72b41dab74a5442b5bdb14f9b6f8092191fe7e4077ac7ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe

Filesize
36KB

MD5
55a478d49fc2aca82783fde1474a8e0d

SHA1
18be80f90cfb411e71464485992607e78087b92d

SHA256
2b084c768fe7b053b4b16a8359d15e808d674c4023b1c445eaf76a8e19e71a04

SHA512
e53eaf632659b52482d6896c1e9a9f576ce8f1f2c7ea266a5437d14edd308532c9a3ebe18c4fde116e74237b5733d1bbaeb501a04e37e0eeeb1d72e2235b09a8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0b8e9d4f-3524-4418-b9e3-5945b07f6ffa}\0.1.filtertrie.intermediate.txt

Filesize
5B

MD5
4182813a3e0f06c6f8082c77b610c13a

SHA1
7d0dda96ac41da4f46a97cf5377d74c02c089a74

SHA256
a035d39f7473a4a473f5fc0ba4b28f8a1b605984bf1b0d293834ceaa3f430d72

SHA512
72cdf68a907e1a7d3561770e8ac3f8f7dd371568da05452d7e8e6f0946b8cd49e852713cf199a4780cffda0f16ae18e4a85d4aacc4363f5d56cae544cf668047

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0b8e9d4f-3524-4418-b9e3-5945b07f6ffa}\0.2.filtertrie.intermediate.txt

Filesize
5B

MD5
7b0ff6b1bbcbb5ffbbc9a66960b5cb43

SHA1
5dd261a6f7b79e5a824e542a93266b5e10d548e4

SHA256
217b914ec40e566fa508f3cdb5a4d8a861cdd7a372171362a103a26db079cae2

SHA512
2feea1d3d4cf09d7d6479d918fdd6c9f304a2ffac08a0edbac3d86cc9b1e3f20c1d54a9a0651e2cab1256e556ce8ba8cd66540b50424a0f7aeb91d7df8040507

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133741689491587589.txt

Filesize
53KB

MD5
1fdf1ff3a049afc7fa53c6f92ac27b0b

SHA1
7680fbd057d4f7354011afcca878d90ea82cf6d8

SHA256
242a2493284db4750cd905737146cf15006b28a770351804467f1f408ec8801d

SHA512
08ec1ebb9f163076c91c782f435b47dbbd6e3f453c9d13621063cad79c9efbe394ad3ed1ed4f3f7364c7201580f294a50178437ff140b4952ca724b93e685e46

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133741696266519034.txt

Filesize
69KB

MD5
daa4a4a64bfe97ba6c15a023389412aa

SHA1
b5e38f0efe30d525e71853fc88d2f99860ee0d39

SHA256
1abb1df6c802a47a403b40e7d5c2af8a2e15c9e263d79842f0b6c707eb553f05

SHA512
b71cc3daf8ca7ae1e301eaa8b0e4b53bd44da6ca3640cf5af85e87b478bac8064b513175e5674f1ba923eb8a703ac6fd1a91fc870d8ce21d008c4b225c4dde7d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133741699600623649.txt

Filesize
81KB

MD5
3ebdaccbf75d1f0ef9311a7c0064b6dc

SHA1
781a1960f4be17496ca908920696cbe08b0e0ab8

SHA256
7e4e668e17f4ffbb5f397c6911c990b96d319abbe7e0d022d7f33a5f0595d795

SHA512
51bbc0390b326083dd53df8b8e289236718e8850a462a9df4a74cc73cbc93284842fb02de747fdaf3447e2774e2df9b24046f4f15b21ec0fbe46d54f965ce34e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

Filesize
2KB

MD5
dac4813ee96b26d7a4300d678af04090

SHA1
55f243b09b552a845472e96419299d9e0ff587c6

SHA256
9288e3e19e2cabfd44324464309686ef40faa8fd411efc7189e0666984647f81

SHA512
e61b57eff218cf89edabddded79b529faf0424737235480597568170cf9e33608eb9aac9a00510866b8914a9c7f7eed8915370e877d8b22953fa423524519b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
190B

MD5
458572b98340c906125b1613d0a7d433

SHA1
0500cd437edab8da6b8f7cc2ac34d3d6856bf200

SHA256
06d8efae4b871c09ba1506fe5979906c36d71cf3771b7e8c5d7d67282b8840dc

SHA512
43e5a9cc4825bdb42c1a3fa4c61933aad8b429b1d02a222918f28d3578a607edb42c7dff7375b11180a6c0514b1c939400f8dcafc5e4ab3a93d3f5e2dda69cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\delself.bat

Filesize
200B

MD5
b3983389c22ce7abc8d7d533ec4a6e35

SHA1
0000be94a2dba6c8ddfecb14201b27fb5bfb87e8

SHA256
d5943bf46ba851a1531c92f373cf52042c8c9b13fc2032405620d466815ca58e

SHA512
092a32eda2f272ec4f3149e7cc63557b8d3aef8b3366e899335da46718b266446a17433b281a282a4d36665dfd330e81e6a620df41427df60abbbdaab602d8a8

Download Submit
C:\Users\Admin\AppData\Local\Win32.KeyPass.exe

Filesize
2.8MB

MD5
6999c944d1c98b2739d015448c99a291

SHA1
d9beb50b51c30c02326ea761b5f1ab158c73b12c

SHA256
35b067642173874bd2766da0d108401b4cf45d6e2a8b3971d95bf474be4f6282

SHA512
ab883364a8907636c00a4d263670cd495d0e6c521283d40c68d47398163c6ee6647cfbbc2142005121735d9edf0b414ddac6ea468f30db87018c831eaa327276

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\places.sqlite-shm

Filesize
32KB

MD5
f5d8f2e60f8faefb183403b73083ae2a

SHA1
9e2f62c9c2301aa9593b3743404556676e9dd03d

SHA256
ce650fce28229fe8e2381b7f4eb6fb9282051b747c7e967d30fe39c04acc0ada

SHA512
4dba04315a717067df91be5b06e2d521b9e58913eaa5eda50cee607906f66c5f065a3de2ea45c036077377ed4c1bfd752d080d39f414cc43bad900b9b4c89b15

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4ld3ilkk.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Filesize
48KB

MD5
bbb1de0c04f1844e2d6e28272a9e76a3

SHA1
07a0e80631e41b1554212323ec11f44001dd10d0

SHA256
691540f55fc022b796d2a21548e05f6b9ed9d58772b922ad66af5bb3231d51ba

SHA512
c70eaaf9c77534165d08fe864153448511b7ac45659d25b2e52cf01365fbc3b8c89831b154aeb03c3998c001a875be17d18256d865747870045a4147a4552870

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

Filesize
170B

MD5
43d6e5632ebe07d03f6a85c84c55f703

SHA1
21eb906d00cefaf29a9073d24ed9829374417f3f

SHA256
e978415db7b05909d96cacf44e81d037aee731ea44dcd68f13b5d567d6d415ca

SHA512
425c129a682bf1095868d29c17b342f9be7069bdea48a0822c660633f6d6e8bd822559250bc29c1dec49df909763e9a37d315139ce1e7197e8b534d8729aea43

Download Submit
C:\vcredist2010_x86.log.html

Filesize
82KB

MD5
53fd342c79d7fb390b117411a5043cdb

SHA1
c4df2d796520686632beddab4c1b975b0fd4f79e

SHA256
f81600e517cc3543694d013be2d18f2f607ef35662fba1c4b1ee491dc0d865a6

SHA512
d8438e151ff196b2aa441ae3c6a54248c453615a8b04c361d2bd8e2751e158a5bcebfbdb951e2d7dce6859a57868dcc1366f8c3f061d7ba83d8ae70282546f26

Download Submit