Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

153s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\Shell\NormalColor\en-US\shellstyle.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\Shell\NormalColor\en-US\shellstyle.dll",#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	8.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SIB8.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1632 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\SIB8.exe	C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe
PID 1632 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\SIB8.exe	C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe
PID 1632 wrote to memory of 2432	N/A	C:\Users\Admin\AppData\Local\Temp\SIB8.exe	C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe
PID 2432 wrote to memory of 1544	N/A	C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe	C:\Windows\system32\pcaui.exe
PID 2432 wrote to memory of 1544	N/A	C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe	C:\Windows\system32\pcaui.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SIB8.exe

"C:\Users\Admin\AppData\Local\Temp\SIB8.exe"

C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe

.\StartIsBackCfg.exe /install

C:\Windows\system32\pcaui.exe

"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {a6e858a5-e26d-4893-97e5-35da57f59916} -a "StartIsBack" -v "StartIsBack" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 851009 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	17.173.189.20.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\7zS066B6D07\StartIsBackCfg.exe

MD5	3c53b674b9a6a91c3e477ca415674812
SHA1	302e707c3d4e07abda1ca7808f6a84b2a6c6ce0a
SHA256	4a0f3a0fbb19ff7e94a98b01aa10daa6332aa3036989cb1fbd90947270c2ead3
SHA512	4520e016c7778170e8ab8d8051762140cafeca442816c78a21a8de14c44e75dddee08aef558a6b19b1522e4fb7a95e4a6d169b6efea6daeb6992ddf2cc47c72c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:19

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

95s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareClear\Thumbs.db"

Signatures

Enumerates physical storage devices

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareClear\Thumbs.db"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

133s

Max time network

139s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\Shell\NormalColor\shellstyle.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\Shell\NormalColor\shellstyle.dll",#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	215.143.182.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:19

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

96s

Command Line

"C:\Users\Admin\AppData\Local\Temp\theme8.exe"

Signatures

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\theme8.exe	N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\theme8.exe

"C:\Users\Admin\AppData\Local\Temp\theme8.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\nsy356A.tmp\System.dll

MD5	564bb0373067e1785cba7e4c24aab4bf
SHA1	7c9416a01d821b10b2eef97b80899d24014d6fc1
SHA256	7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA512	22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

C:\Users\Admin\AppData\Local\Temp\nsy356A.tmp\nsisFile.dll

MD5	b7d0d765c151d235165823b48554e442
SHA1	fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256	a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA512	5d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66

C:\Users\Admin\AppData\Local\Temp\nsy356A.tmp\nsDialogs.dll

MD5	48f3e7860e1de2b4e63ec744a5e9582a
SHA1	420c64d802a637c75a53efc8f748e1aede3d6dc6
SHA256	6bf9cccd8a600f4d442efe201e8c07b49605ba35f49a4b3ab22fa2641748e156
SHA512	28716ddea580eeb23d93d1ff6ea0cf79a725e13c8f8a17ec9dfacb1fe29c7981ad84c03aed05663adc52365d63d19ec2f366762d1c685e3a9d93037570c3c583

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\uxstyle1507.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2540 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\uxstyle1507.exe	C:\Windows\system32\pcaui.exe
PID 2540 wrote to memory of 4104	N/A	C:\Users\Admin\AppData\Local\Temp\uxstyle1507.exe	C:\Windows\system32\pcaui.exe

Processes

C:\Users\Admin\AppData\Local\Temp\uxstyle1507.exe

"C:\Users\Admin\AppData\Local\Temp\uxstyle1507.exe"

C:\Windows\system32\pcaui.exe

"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {19df18a4-119a-4917-86f0-54bfec4b3be2} -a "UxStyle" -v "The Within Network, LLC" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 20305 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\uxstyle1507.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

151s

Command Line

C:\Windows\system32\rundll32.exe C:\Windows\system32\themecpl.dll,OpenThemeAction "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\ThemeFiles\Current\AeroRoundShiny-Characters.theme"

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	20.231.121.79:80		tcp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	17.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

150s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	8.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240226-en

Max time kernel

163s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SIB10.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\SIB10.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe	N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3972 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\SIB10.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe
PID 3972 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\SIB10.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe
PID 3972 wrote to memory of 3404	N/A	C:\Users\Admin\AppData\Local\Temp\SIB10.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SIB10.exe

"C:\Users\Admin\AppData\Local\Temp\SIB10.exe"

C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe

"C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe" /install

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4120 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	142.250.187.234:443		tcp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	95.16.208.104.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\SIBSFX.825DBF84\StartIsBackCfg.exe

MD5	d7a319ad8f2493c97b09b3f8c878a76b
SHA1	2d8dc08f23e5fdb171119f282da4f1fee1adf048
SHA256	5f69d9e29cdfdffa73c9b24bb401c4284bee06bd715b70cfdc124530e6650701
SHA512	0eb08b3bd05573e0901a3af71442e3ebb22b7a9fbb0a6c942f9af818f5659708c42c20f574b9fdacb568504578a98f71bfb958fd2273d6ccc8c7b0277d43a3eb

memory/3404-21-0x0000000002450000-0x0000000002451000-memory.dmp

memory/3404-22-0x0000000000400000-0x0000000000653000-memory.dmp

memory/3404-24-0x0000000002450000-0x0000000002451000-memory.dmp

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxinit.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxinit.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	52.111.229.48:443		tcp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

123s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SAB.exe"

Signatures

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\SAB.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe	N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3900 wrote to memory of 444	N/A	C:\Users\Admin\AppData\Local\Temp\SAB.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe
PID 3900 wrote to memory of 444	N/A	C:\Users\Admin\AppData\Local\Temp\SAB.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SAB.exe

"C:\Users\Admin\AppData\Local\Temp\SAB.exe"

C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe

"C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe" /install

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4176,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackCfg.exe

MD5	0167745c9f2b33ae0afd7c6289e9111f
SHA1	3e59750ef1887d04e04a2054100ae1dc7ab8b52b
SHA256	2239be004c8b5a31cc996d6bf1c653068adcb06e99f1e2866457b2175a7d63c6
SHA512	7269bcca4490305cc5d78f39652d573962f678c1ddc6829a032f15453b0edd6b62fb967b9db44115c9bdf48df7c6785b428b399295ce0c57cbfb1c4c9afedf7d

memory/444-71-0x0000000002370000-0x0000000002371000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SIBSFX.7FE8FF3C\StartAllBackX64.dll

MD5	f17999ef62984be5a98ae7325aaf2101
SHA1	627e36876a9126b834b0a5a76ec9fa6a8cada3ba
SHA256	bc7de0ae9733e3fa6c9705f87a66b98b3b55a52adfa7088bc729d8908715b7e6
SHA512	e4018426ab04002174b1a555bfd5713982ca7f9395e578f680fc90e9ebe382ab2198cb4b744d6b7377faf3efe13596f5173dedf838b82923ee9b76aeb9ef5b5c

memory/444-74-0x0000000000400000-0x0000000000741000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

91s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SIB9.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2956 wrote to memory of 3540	N/A	C:\Users\Admin\AppData\Local\Temp\SIB9.exe	C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe
PID 2956 wrote to memory of 3540	N/A	C:\Users\Admin\AppData\Local\Temp\SIB9.exe	C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe
PID 2956 wrote to memory of 3540	N/A	C:\Users\Admin\AppData\Local\Temp\SIB9.exe	C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe
PID 3540 wrote to memory of 640	N/A	C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe	C:\Windows\system32\pcaui.exe
PID 3540 wrote to memory of 640	N/A	C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe	C:\Windows\system32\pcaui.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SIB9.exe

"C:\Users\Admin\AppData\Local\Temp\SIB9.exe"

C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe

.\StartIsBackCfg.exe /install

C:\Windows\system32\pcaui.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	20.231.121.79:80		tcp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\7zSC8B00F77\StartIsBackCfg.exe

MD5	2b5f9f9b6c3a6f7530c93d2790d2805c
SHA1	77bc13edbf807097e54e661791423b28e55849d4
SHA256	dedc3556705874526047d769967c778b49926f44c263692c6d6756e12fb5a41d
SHA512	a7d6bb257c9e259ed8729d958894e3e17760b77cda65d944263b0a965eb0d5431e310336c93d403e2fc1cfd1a0f2b1783b9b17c23ac56323ffb2297184db3d36

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

147s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\themeui.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\themeui.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:19

Platform

win10v2004-20240226-en

Max time kernel

102s

Max time network

123s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareClear\en-US\AeroSquareClear.msstyles.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareClear\en-US\AeroSquareClear.msstyles.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
GB	23.44.234.16:80		tcp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	164.189.21.2.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	97.17.167.52.in-addr.arpa	udp
NL	52.142.223.178:80		tcp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:19

Platform

win10v2004-20240508-en

Max time kernel

123s

Max time network

126s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\AeroSquareShiny.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\AeroSquareShiny.dll",#1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1280,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	224.162.46.104.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

151s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	13.73.50.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

90s

Max time network

95s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

97s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\Logo.png"

Signatures

Enumerates physical storage devices

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\Logo.png"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

96s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

129s

Max time network

153s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\explorer.bat"

Signatures

Creates scheduled task(s)

persistence

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\schtasks.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	C:\Windows\explorer.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 5080 wrote to memory of 884	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 884	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 5100	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 5100	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 1204	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 1204	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 3636	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe
PID 5080 wrote to memory of 3636	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\explorer.bat"

C:\Windows\system32\schtasks.exe

schtasks /Delete /TN "Aero Glass" /F

C:\Windows\system32\schtasks.exe

schtasks /Create /TN "ExplorerStart" /XML task.xml

C:\Windows\system32\schtasks.exe

schtasks /Run /TN "ExplorerStart"

C:\Windows\explorer.EXE

C:\Windows\explorer.EXE

C:\Windows\system32\schtasks.exe

schtasks /Delete /TN "ExplorerStart" /F

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4460,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp

Files

C:\Users\Admin\AppData\Local\Temp\task.xml

MD5	b3855da62957c136b78db5b897c92b9a
SHA1	98875ff5475a45fd5a76f1075ea037323948c0e6
SHA256	f1f0d158afc9568e12beb0041153334c182d434c7ea92218f1f872b51d8dcfd5
SHA512	be173a197d46136cf1c9aa62c507c90a4dba024cc9b06aea23d33d6ab121689392db49c8cfa14ee6bbe05291e46d946541dfcc779ba69e8d7062a8696dd2aaec

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

152s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	91.65.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	8.179.89.13.in-addr.arpa	udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

148s

Max time network

152s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	13.73.50.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

141s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\incontrol.exe"

Signatures

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: 33	N/A	C:\Windows\system32\AUDIODG.EXE	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\system32\AUDIODG.EXE	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\incontrol.exe

"C:\Users\Admin\AppData\Local\Temp\incontrol.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x520 0x51c

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	4.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	52.111.229.48:443		tcp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp

Files

memory/1456-1-0x0000000000020000-0x0000000000023000-memory.dmp

memory/1456-0-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1456-2-0x0000000000400000-0x0000000000428000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

90s

Max time network

139s

Command Line

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\en-US\AeroSquareShiny.msstyles.dll",#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe "C:\Users\Admin\AppData\Local\Temp\$WINDIR\Resources\Themes\Windows Aero\Styles\SquareShiny\en-US\AeroSquareShiny.msstyles.dll",#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240226-en

Max time kernel

136s

Max time network

164s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

Network

Country	Destination	Domain	Proto
GB	96.16.110.114:80		tcp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	203.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	164.189.21.2.in-addr.arpa	udp
US	8.8.8.8:53	74.32.126.40.in-addr.arpa	udp
US	13.107.253.64:443		tcp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	88.210.23.2.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
US	8.8.8.8:53	chromewebstore.googleapis.com	udp
FR	142.250.179.74:443	chromewebstore.googleapis.com	tcp
US	8.8.8.8:53	74.179.250.142.in-addr.arpa	udp
US	8.8.8.8:53	17.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

99s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	52.111.229.43:443		tcp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxtheme.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\uxtheme.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	13.86.106.20.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	52.111.229.43:443		tcp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:36

Platform

win10v2004-20240426-en

Max time kernel

92s

Max time network

456s

Command Line

"C:\Users\Admin\AppData\Local\Temp\r8p.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe	N/A

Creates new service(s)

persistence execution

Modifies Installed Components in the registry

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Active Setup\Installed Components	C:\Windows\explorer.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Active Setup\Installed Components	C:\Windows\explorer.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A

Sets file execution options in registry

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetupPrep.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SetupPrep.exe\Debugger = "\"C:\\Windows\\Revert8Plus\\unwin7.exe\""	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstallPrep.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\InstallPrep.exe\Debugger = "\"C:\\Windows\\Revert8Plus\\unwin7.exe\""	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	C:\Windows\Revert8Plus\SIB10.exe	N/A

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\Revert8Plus\InControl.exe	N/A
N/A	N/A	C:\Windows\Revert8Plus\SIB10.exe	N/A
N/A	N/A	C:\Program Files (x86)\StartIsBack\StartScreen.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\takeown.exe	N/A
N/A	N/A	C:\Windows\SYSTEM32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Registers COM server for autorun

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c71c41f1-ddad-42dc-a8fc-f5bfc61df958}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da3306b1-2554-420b-8d0e-6bd29bb4d8ed}\LocalServer32\ = "\"C:\\Program Files (x86)\\StartIsBack\\UpdateCheck.exe\""	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}\InprocServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c71c41f1-ddad-42dc-a8fc-f5bfc61df958}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c71c41f1-ddad-42dc-a8fc-f5bfc61df958}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}\InprocServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}\InprocServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da3306b1-2554-420b-8d0e-6bd29bb4d8ed}\LocalServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\D:	C:\Windows\explorer.EXE	N/A
File opened (read-only)	\??\F:	C:\Windows\explorer.EXE	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File created	C:\Program Files (x86)\StartIsBack\Orbs\Shamrock.orb	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\Styles\Plain10.msstyles	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\Styles\Plain8.msstyles	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\Styles\Windows 7.msstyles	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\StartScreen.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File opened for modification	C:\Program Files (x86)\StartIsBack\Orbs	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File opened for modification	C:\Program Files (x86)\StartIsBack\Styles	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\msimg32.dll	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File opened for modification	C:\Program Files (x86)\StartIsBack\Styles\Windows 7.msstyles	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File opened for modification	C:\Program Files (x86)\StartIsBack\StartIsBack64.dll	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\StartIsBack32.dll	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File opened for modification	C:\Program Files (x86)\StartIsBack\StartIsBack32.dll	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\UpdateCheck.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\StartIsBack64.dll	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\Orbs\StartIsBack_Ei8htOrb_v2_by_PainteR.bmp	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File created	C:\Program Files (x86)\StartIsBack\Orbs\Windows 7.orb	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
File opened for modification	C:\Program Files (x86)\StartIsBack\StartIsBackCfg.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\Revert8Plus\explorer.bat	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File created	C:\Windows\Revert8Plus\unwin7.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File created	C:\Windows\Revert8Plus\incontrol.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File created	C:\Windows\Revert8Plus\SIB10.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File opened for modification	C:\Windows\Revert8Plus\SIB10.exe	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File created	C:\Windows\Revert8Plus\explorer.bat	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
File created	C:\Windows\Revert8Plus\task.xml	C:\Windows\SysWOW64\cmd.exe	N/A
File opened for modification	C:\Windows\Revert8Plus\task.xml	C:\Windows\SysWOW64\cmd.exe	N/A

Launches sc.exe

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\sc.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\sc.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

Checks SCSI registry key(s)

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	C:\Windows\explorer.EXE	N/A
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	C:\Windows\explorer.EXE	N/A
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	C:\Windows\explorer.EXE	N/A

Creates scheduled task(s)

persistence

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\schtasks.exe	N/A
N/A	N/A	C:\Windows\system32\schtasks.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
N/A	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\ShellFolder\Attributes = "2684354560"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da3306b1-2554-420b-8d0e-6bd29bb4d8ed}\LocalServer32\ = "\"C:\\Program Files (x86)\\StartIsBack\\UpdateCheck.exe\""	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\shellex\ContextMenuHandlers	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c71c41f1-ddad-42dc-a8fc-f5bfc61df958}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}\ImplementsVerbs = "startpin;startunpin"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\System.ControlPanel.EnableInSafeMode = "3"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da3306b1-2554-420b-8d0e-6bd29bb4d8ed}\LocalServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\Properties	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\Properties\ = "Modern App Settings"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSILink\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}\ = "Start Menu Pin"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c71c41f1-ddad-42dc-a8fc-f5bfc61df958}	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}\ShellFolder\Attributes = "672137216"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\InProcServer32\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBack32.dll"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\runas	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\runas\HasLUAShield	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\CopyPath	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	C:\Windows\explorer.EXE	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\LocalizedString = "@C:\\Program Files (x86)\\StartIsBack\\StartIsBack64.dll,-510"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E}\InProcServer32	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\ = "Taskbar Pin"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\Open	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.AppsFolder\Shell\Delete\Command	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\ShellFolder\Attributes = "0"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\ShellFolder	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\ShellFolder\Attributes = "2684354560"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sib-activate	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\Shell\Open\Command\ = "C:\\Program Files (x86)\\StartIsBack\\StartIsBackCfg.exe"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{865e5e76-ad83-4dca-a109-50dc2113ce9b}\ = "StartIsBack All Programs Folder"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\ShellFolder\Attributes = "2684354560"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\OpenFolder\Extended	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCEA18FF-BC55-4E63-94D7-1B2EFBFE706F}\Shell\Open\Command	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\ShellFolder\Attributes = "2684354560"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\Properties\Position = "Bottom"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppUserModelId\StartIsBack.UpdateToast\DisplayName = "StartIsBack"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.AppsFolder\Shell\Delete\MuiVerb = "@shell32.dll,-33553"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\ = "God Mode"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\InProcServer32\ThreadingModel = "Apartment"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\Open\ = "Open"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\shellex	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\CopyPath\Extended	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c9}\ = "StartIsBack Menu Pin"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c71c41f1-ddad-42dc-a8fc-f5bfc61df957}\TreatAs\ = "{c71c41f1-ddad-42dc-a8fc-f5bfc61df958}"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AD1405D2-30CF-4877-8468-1EE1C52C759F}\ = "All Apps"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\ShellFolder	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	C:\Windows\explorer.EXE	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	C:\Windows\explorer.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BA}\ShellFolder\Attributes = "2684354560"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99E2B362-3E4E-4255-9B29-41A7F40777BB}\ShellFolder	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.ImmersiveApplication\Shell\Delete	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.AppsFolder\Shell\Delete	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.AppsFolder\Shell\ChangeIcon\MuiVerb = "@shell32.dll,-34608"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\StartIsBack.AppsFolder\Shell\Delete\Command\DelegateExecute = "{E5C31EC8-C5E6-4E07-957E-944DB4AAD85E}"	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A

Modifies registry key

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\reg.exe	N/A
N/A	N/A	C:\Windows\system32\reg.exe	N/A
N/A	N/A	C:\Windows\system32\reg.exe	N/A
N/A	N/A	C:\Windows\system32\reg.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe	N/A
N/A	N/A	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\SysWOW64\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\SysWOW64\powercfg.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\SysWOW64\taskkill.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A
N/A	N/A	C:\Windows\explorer.EXE	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4604 wrote to memory of 1508	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 1508	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 1508	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\cmd.exe
PID 1508 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1508 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1508 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\Wbem\WMIC.exe
PID 1508 wrote to memory of 3168	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 3168	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 3168	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 4680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 4680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 4680	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 5104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 5104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 1508 wrote to memory of 5104	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\findstr.exe
PID 4604 wrote to memory of 3140	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4604 wrote to memory of 3140	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
PID 4604 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 4496	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 1592	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 1592	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 1592	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2756	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2676	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 1484	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 1484	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 1484	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 4040	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 4040	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 4040	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4604 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4604 wrote to memory of 2680	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 4604 wrote to memory of 3448	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 3448	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 3448	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\SysWOW64\powercfg.exe
PID 4604 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\Revert8Plus\InControl.exe
PID 4604 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\Revert8Plus\InControl.exe
PID 4604 wrote to memory of 2976	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\Revert8Plus\InControl.exe
PID 4604 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\Revert8Plus\SIB10.exe
PID 4604 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\Revert8Plus\SIB10.exe
PID 4604 wrote to memory of 2700	N/A	C:\Users\Admin\AppData\Local\Temp\r8p.exe	C:\Windows\Revert8Plus\SIB10.exe
PID 4968 wrote to memory of 2140	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\startscreen.exe
PID 4968 wrote to memory of 2140	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\startscreen.exe
PID 4968 wrote to memory of 2140	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\startscreen.exe
PID 4968 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 1740	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 4164	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 4164	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 4164	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 400	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 400	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 400	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 1072	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 1072	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 1072	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 4424	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe
PID 4968 wrote to memory of 4424	N/A	C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe	C:\Windows\SysWOW64\taskkill.exe

Processes

C:\Users\Admin\AppData\Local\Temp\r8p.exe

"C:\Users\Admin\AppData\Local\Temp\r8p.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName|findstr .|findstr /v displayName|findstr /v /c:"Windows Defender"

C:\Windows\SysWOW64\Wbem\WMIC.exe

wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName

C:\Windows\SysWOW64\findstr.exe

findstr .

C:\Windows\SysWOW64\findstr.exe

findstr /v displayName

C:\Windows\SysWOW64\findstr.exe

findstr /v /c:"Windows Defender"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Revert8Plus";Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\r8p.exe"

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -monitor-timeout-ac 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -monitor-timeout-dc 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -disk-timeout-ac 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -disk-timeout-dc 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -standby-timeout-ac 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -standby-timeout-dc 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -hibernate-timeout-ac 0

C:\Windows\SysWOW64\powercfg.exe

powercfg -x -hibernate-timeout-dc 0

C:\Windows\Revert8Plus\InControl.exe

"C:\Windows\Revert8Plus\InControl.exe" control

C:\Windows\Revert8Plus\SIB10.exe

"C:\Windows\Revert8Plus\SIB10.exe" /elevated /silent

C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe

"C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\StartIsBackCfg.exe" /install /elevated /silent

C:\Users\Admin\AppData\Local\Temp\SIBSFX.8967EA8C\startscreen.exe

startscreen.exe /stop

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM startscreen*

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM explorer*

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM explorer*

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM explorer*

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM explorer*

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM explorer*

C:\Windows\SysWOW64\taskkill.exe

taskkill.exe /F /IM explorer*

C:\Windows\SysWOW64\schtasks.exe

schtasks.exe /Create /TN "\StartIsBack health check" /XML "C:\Users\Admin\AppData\Local\Temp\sibtask.xml"

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Windows\Revert8Plus\explorer.bat"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /TN "Aero Glass" /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /TN "ExplorerStart" /XML task.xml

C:\Windows\SysWOW64\schtasks.exe

schtasks /Run /TN "ExplorerStart"

C:\Windows\explorer.EXE

C:\Windows\explorer.EXE

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /TN "ExplorerStart" /F

C:\Program Files (x86)\StartIsBack\StartScreen.exe

"C:\Program Files (x86)\StartIsBack\StartScreen.exe" /purge

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\ThemeSwitcher.exe

"C:\Windows\Revert8Plus\ThemeSwitcher.exe" "C:\Windows\Resources\Themes\AeroRoundShiny-Default.theme"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x380 0x464

C:\Windows\System32\rundll32.exe

rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Windows Aero\Styles\Redstone\Redstone.msstyles?NormalColor?NormalSize

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\shell7.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\shell7.dll" /grant *S-1-5-32-544:F

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\shell7.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\shell7.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\display.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\display.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\display.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\display.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\system32\cmd.exe

"C:\Windows\SysNative\cmd.exe" /c "C:\Windows\Revert8Plus\cpl7.bat"

C:\Windows\system32\whoami.exe

whoami /user

C:\Windows\system32\findstr.exe

findstr /i /c:S-1-5-18

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -c iex(([io.file]::ReadAllText($env:0)-split'#\:RunAsTI .*')[1])

C:\Windows\system32\whoami.exe

"C:\Windows\system32\whoami.exe" /user

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -win 1 -nop -c $cmd='C:\Windows\Revert8Plus\cpl7.bat'; $arg=''; $id='RunAsTI'; $key='Registry::HKU\S-1-5-21-3906287020-2915474608-1755617787-1000\Volatile Environment'; $env:R=(gi $key -ea 0).getvalue($id)-join''; iex $env:R

C:\Windows\system32\whoami.exe

"C:\Windows\system32\whoami.exe" /groups

C:\Windows\system32\sc.exe

"C:\Windows\system32\sc.exe" start TrustedInstaller

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -win 1 -nop -c iex $env:R; # RunAsTI

C:\Windows\system32\whoami.exe

"C:\Windows\system32\whoami.exe" /groups

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\Revert8Plus\cpl7.bat" "

C:\Windows\system32\whoami.exe

whoami /user

C:\Windows\system32\findstr.exe

findstr /i /c:S-1-5-18

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{BF782CC9-5A52-4A17-806C-2A894FFEEAC5}" /v "System.ControlPanel.Category" /t REG_SZ /d "6" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{F942C606-0914-47AB-BE56-1321B8035096}" /v "System.ControlPanel.Category" /t REG_SZ /d "5" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{F6B6E965-E9B2-444B-9286-10C9152EDBC5}" /v "System.ControlPanel.Category" /t REG_SZ /d "5" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{ECDB0924-4208-451E-8EE0-373C0956DE16}" /v "System.ControlPanel.Category" /t REG_SZ /d "5" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}" /v "System.ControlPanel.Category" /t REG_SZ /d "5" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{36eef7db-88ad-4e81-ad49-0e313f0c35f8}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{C555438B-3C23-4769-A71F-B6D3D9B6053A}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{67CA7650-96E6-4FDD-BB43-A8E774F73A57}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{74246bfc-4c96-11d0-abef-0020af6b0b7a}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{8343457C-8703-410F-BA8B-8B026E431743}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{37efd44d-ef8d-41b1-940d-96973a50e9e0}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{0142e4d0-fb7a-11dc-ba4a-000ffe7ab428}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{78F3955E-3B90-4184-BD14-5397C15F1EFC}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{87D66A43-7B11-4A28-9811-C86EE395ACF7}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{BB64F8A7-BEE7-4E1A-AB8D-7D8273F7FDB6}" /v "System.ControlPanel.Category" /t REG_SZ /d "5" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{4026492F-2F69-46B8-B9BF-5654FC07E423}" /v "System.ControlPanel.Category" /t REG_SZ /d "5" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{9C73F5E5-7AE7-4E32-A8E8-8D23B85255BF}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{40419485-C444-4567-851A-2DD7BFA1684D}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{6C8EEC18-8D75-41B2-A177-8831D59D2D50}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{725BE8F7-668E-4C7B-8F90-46BDB0936430}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{259EF4B1-E6C9-4176-B574-481532C9BCE8}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{A8A91A66-3A7D-4424-8D24-04E180695C7A}" /v "System.ControlPanel.Category" /t REG_SZ /d "2" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{5ea4f148-308c-46d7-98a9-49041b1dd468}" /v "System.ControlPanel.Category" /t REG_SZ /d "2" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{1206F5F1-0569-412C-8FEC-3204630DFB70}" /v "System.ControlPanel.Category" /t REG_SZ /d "9" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}" /v "System.ControlPanel.Category" /t REG_SZ /d "1" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\CLSID\{78CB147A-98EA-4AA6-B0DF-C8681F69341C}" /v "System.ControlPanel.Category" /t REG_SZ /d "0" /f

C:\Windows\system32\reg.exe

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\don't load" /v "joy.cpl" /t REG_SZ /d "" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\DesktopBackground\Shell\Display\command" /ve /t REG_SZ /d "control.exe /name {C555438B-3C23-4769-A71F-B6D3D9B6053A} /page settings" /f

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\DesktopBackground\Shell\Personalize\command" /ve /t REG_SZ /d "control.exe /name {ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}" /f

C:\Windows\Revert8Plus\applytheme.exe

"C:\Windows\Revert8Plus\applytheme.exe"

C:\Windows\system32\reg.exe

reg add "HKEY_CLASSES_ROOT\ms-settings\Shell\Open\Command" /ve /t REG_SZ /d "C:\Windows\Revert8Plus\ImmersiveCPL.exe """%1"""" /f

C:\Windows\system32\reg.exe

reg delete "HKEY_CLASSES_ROOT\DesktopBackground\Shell\Display\command" /v DelegateExecute /f

C:\Windows\system32\reg.exe

reg delete "HKEY_CLASSES_ROOT\DesktopBackground\Shell\Personalize\command" /v DelegateExecute /f

C:\Windows\system32\reg.exe

reg delete "HKEY_CLASSES_ROOT\ms-settings\Shell\Open\Command" /v DelegateExecute /f

C:\Windows\Revert8Plus\ViVeTool.exe

"C:\Windows\Revert8Plus\\vivetool.exe" /disable /id:25175482

C:\Windows\system32\reg.exe

reg import "C:\Windows\Revert8Plus\\display.reg"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im explorer.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Windows\Revert8Plus\explorer.bat"

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /TN "Aero Glass" /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /TN "ExplorerStart" /XML task.xml

C:\Windows\SysWOW64\schtasks.exe

schtasks /Run /TN "ExplorerStart"

C:\Windows\explorer.EXE

C:\Windows\explorer.EXE

C:\Windows\SysWOW64\schtasks.exe

schtasks /Delete /TN "ExplorerStart" /F

C:\Windows\Revert8Plus\ThemeSwitcher.exe

"C:\Windows\Revert8Plus\ThemeSwitcher.exe" "C:\Windows\Resources\Themes\AeroRoundShiny-Default.theme"

C:\Windows\System32\rundll32.exe

rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Windows Aero\Styles\Redstone\Redstone.msstyles?NormalColor?NormalSize

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\ThemeSwitcher.exe

"C:\Windows\Revert8Plus\ThemeSwitcher.exe" "C:\Windows\Resources\Themes\AeroRoundShiny-Default.theme"

C:\Windows\System32\rundll32.exe

rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Windows Aero\Styles\Redstone\Redstone.msstyles?NormalColor?NormalSize

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Revert8Plus\ThemeSwitcher.exe

"C:\Windows\Revert8Plus\ThemeSwitcher.exe" "C:\Windows\Resources\Themes\AeroRoundShiny-Default.theme"

C:\Windows\System32\rundll32.exe

rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Windows Aero\Styles\Redstone\Redstone.msstyles?NormalColor?NormalSize

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\SysNative\cmd.exe" /c "C:\Windows\Revert8Plus\UAC\UAC.bat"

C:\Windows\system32\reg.exe

reg import "C:\Windows\Revert8Plus\UAC\\uac.reg" /reg:64

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\wincredui.dll" /A

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\authui.dll" /A

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\consent.exe" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\wincredui.dll" /grant Administrators:F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\authui.dll" /grant Administrators:F

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\consent.exe" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\de-de\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\de-de\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\de-de\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\de-de\wincredui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\en-us\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\en-us\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\en-us\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\en-us\wincredui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\es-es\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\es-es\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\es-es\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\es-es\wincredui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\fr-fr\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\fr-fr\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\fr-fr\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\fr-fr\wincredui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\it-it\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\it-it\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\it-it\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\it-it\wincredui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\ja-jp\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\ja-jp\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\ja-jp\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\ja-jp\wincredui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\uk-ua\authui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\uk-ua\authui.dll.mui" /grant Administrators:F

C:\Windows\system32\takeown.exe

takeown /F "C:\Windows\System32\uk-ua\wincredui.dll.mui" /A

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32\uk-ua\wincredui.dll.mui" /grant Administrators:F

C:\Windows\Revert8Plus\AeroGlass\sym.exe

"C:\Windows\Revert8Plus\AeroGlass\sym.exe" "C:\Windows\Revert8Plus\AeroGlass\data\symbols" "C:\Windows\system32\udwm.dll" "C:\Windows\system32\dwmcore.dll"

C:\Windows\Revert8Plus\AeroGlass\sym.exe

"C:\Windows\Revert8Plus\AeroGlass\sym.exe" "C:\Windows\Revert8Plus\AeroGlass\data\symbols" "C:\Windows\system32\udwm.dll" "C:\Windows\system32\dwmcore.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\cmd.exe

"C:\Windows\sysnative\cmd.exe" /c "C:\Windows\Revert8Plus\AeroGlass\install.bat"

C:\Windows\system32\schtasks.exe

schtasks /Delete /TN "Aero Glass" /F

C:\Windows\system32\schtasks.exe

schtasks /Create /TN "Aero Glass" /XML task.xml

C:\Windows\system32\schtasks.exe

schtasks /Run /TN "Aero Glass"

C:\Windows\Revert8Plus\AeroGlass\DWMBlurGlass.exe

C:\Windows\Revert8Plus\AeroGlass\DWMBlurGlass.exe loaddll

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\ActionCenter.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\ActionCenter.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\ApplicationFrame.dll"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\ApplicationFrame.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\explorer.exe"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\explorer.exe"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\ExplorerFrame.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\ExplorerFrame.dll"

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\pnidui.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\pnidui.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\van.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\van.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\shell32.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\shell32.dll"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\SndVolSSO.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\SndVolSSO.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\stobject.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\stobject.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\timedate.cpl"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\timedate.cpl"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\twinui.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\twinui.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\uDWM.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\uDWM.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\user32.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\user32.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\windows.storage.dll"

C:\Windows\Revert8Plus\sym.exe

"C:\Windows\Revert8Plus\sym.exe" "C:\ProgramData\Windhawk\Engine\Symbols" "C:\Windows\System32\windows.storage.dll"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\sc.exe

sc create Windhawk binPath= """"C:\ProgramData\Windhawk\Windhawk.exe""" -service" start= auto

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\Revert8Plus\OldNewExplorer64.dll"

C:\Windows\system32\regsvr32.exe

/s "C:\Windows\Revert8Plus\OldNewExplorer64.dll"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32 /s "C:\Windows\Revert8Plus\OldNewExplorer32.dll"

C:\Windows\Revert8Plus\RunAsTI.exe

"C:\Windows\Revert8Plus\RunAsTI.exe" "C:\Windows\System32\cmd.exe" /c reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:32&reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:64&reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:32&reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:64

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Revert8Plus\RunAsTI.exe

C:\Windows\SysWOW64\reg.exe

reg import "C:\Windows\Revert8Plus\vanmod.reg" /reg:64

C:\Windows\Revert8Plus\RunAsTI.exe

"C:\Windows\Revert8Plus\RunAsTI.exe" /TI/ "C:\Windows\System32\cmd.exe" /c reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:32&reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:64&reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:32&reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:64

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\dui71.dll"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:32&reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:64&reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:32&reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:64

C:\Windows\system32\reg.exe

reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:32

C:\Windows\system32\reg.exe

reg add HKLM\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5} /v SortOrderIndex /t REG_DWORD /d 66 /f /reg:64

C:\Windows\system32\reg.exe

reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:32

C:\Windows\system32\reg.exe

reg add HKLM\Software\Classes\CLSID\{323CA680-C24D-4099-B94D-446DD2D7249E} /v SortOrderIndex /t REG_DWORD /d 0 /f /reg:64

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\dui71.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\VAN.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\VAN.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\WLanConn.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\WLanConn.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\wlandlg.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\wlandlg.dll" /grant *S-1-5-32-544:F

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\WlanMM.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\WlanMM.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\wlanpref.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\wlanpref.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\wwanconn.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\wwanconn.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\xwizards.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\xwizards.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\xwtpdui.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\xwtpdui.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\wcnwiz.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\wcnwiz.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\dui71.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\dui71.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\VAN.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\VAN.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\WLanConn.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\WLanConn.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\wlandlg.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\wlandlg.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\wlanmm.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\wlanmm.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\wlanpref.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\wlanpref.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\wwanconn.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\wwanconn.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\xwizards.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\xwizards.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\xwtpdui.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\xwtpdui.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\wcnwiz.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\wcnwiz.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Set-WinLanguageBarOption -UseLegacyLanguageBar

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\UIRibbon.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\UIRibbon.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\UIRibbonRes.dll"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\UIRibbonRes.dll" /grant *S-1-5-32-544:F

C:\Windows\SYSTEM32\takeown.exe

takeown /A /F "C:\Windows\System32\en-US\UIRibbon.dll.mui"

C:\Windows\SYSTEM32\icacls.exe

icacls "C:\Windows\System32\en-US\UIRibbon.dll.mui" /grant *S-1-5-32-544:F

C:\Windows\Revert8Plus\w7games.exe

"C:\Windows\Revert8Plus\w7games.exe" /S

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Revert8Plus\HoldEm-Inkball-Tinker.exe

"C:\Windows\Revert8Plus\HoldEm-Inkball-Tinker.exe" /S

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c "C:\Windows\Revert8Plus\WMC\InstallBlue.bat"

C:\Windows\SysWOW64\whoami.exe

C:\Windows\system32\whoami.exe /USER

C:\Windows\SysWOW64\find.exe

find /i "S-1-5-18"

C:\Windows\Revert8Plus\WMC\NSudoLC.exe

"C:\Windows\Revert8Plus\WMC\\NSudoLC.exe" -UseCurrentConsole -U:T -P:E -Wait cmd /c "C:\Windows\Revert8Plus\WMC\InstallBLUE.bat" ti

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6048 -ip 6048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 1056

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\7z.exe

"C:\Windows\Revert8Plus\7z.exe" x -y "C:\Windows\Revert8Plus\Office14ProPlus.iso" -o"C:\Windows\Revert8Plus\Office14ProPlus"

C:\Windows\Revert8Plus\Office14ProPlus\setup.exe

"C:\Windows\Revert8Plus\Office14ProPlus\setup.exe"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 4E0C01CB713DF742BF588592FD618F0D

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 6526338F9F95045150DB5CAB54605C4C

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 7E3CB8932EC957A9F50B83E60203E27B E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 28C0AB1A3D897E67B52FC92A9E0EB731

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C19E4222B150A0B2AF9D2D32B5D46079

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 2A53EC2F0440FDBD244AFAAB9B961140 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding E012115161B95266219AC14AF614E398

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding E2FB6D224FE9C43383611209C71D7BE4 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding DBBE8AC938F32C60965578D73B715020

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding DC157FDA2F287DAB2BA8C93F0CDDD216 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 3065ADACFD4D7AA50B29F902EB06AF06

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding D105299750A1940480B0007E1EBA9874 E Global\MSI0000

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1A35455C53C95ADE0C21C3CF0CF25468

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C4EFE9EC3B449D5B2B12728DB574F4AC

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 0C0400402B997254D5BE3607043EB14E

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 62BC4BEE8DA4D7694E5BEE534238CE6D

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding B3DBA8CFB0A115FDA42ACDA8B50DBC63

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 8BF1CBBF77E636513B96E53B2C98D452 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding CB988F22E65FF1978E5AD90A65346151

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C77C822CBD1C1AE0A29A573B3584ADD0

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 6516569939189150B03CCEACC58AE6D5 E Global\MSI0000

C:\Windows\explorer.exe

explorer.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 133959F87FB3A71029C1E9768839404C E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1A6CBD458EA41D4159532F0934AE6BEB

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 3E3A38CE16CAF6A7466311715C12A742 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1E862BAED22C022047443C9B18DB18BC

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding CE67F1C1BD6052275B24E3202E3A3603

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 90D40D5DC114F2B09E626D2D8A3D8455

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding ED268215958D08952F7253A168BC0B0D E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 2A367945B6D0DB48D403939ACF14D696

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 538D6A56739D9B0F9B35F5F1B89FF5C3 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 6463950DAAFB42E09057893B21E23A21

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 580DB39B0C61480C92F72B7DDEC08752

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C914236F6C7339B15D24B7C43E5FCCA6

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 836EDAFE18E892F724A6D28290D04A4A

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 8F350CB150155BCBBF8C50D343CF7891 E Global\MSI0000

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 5710C7B03429CC346F1AC4121E384B38 E Global\MSI0000

C:\Windows\SysWOW64\wevtutil.exe

"wevtutil.exe" im "C:\Program Files\Microsoft Office\Office14\BCSEvents.man"

C:\Windows\System32\wevtutil.exe

"wevtutil.exe" im "C:\Program Files\Microsoft Office\Office14\BCSEvents.man" /fromwow64

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files\Microsoft Office\Office14\msohtmed.exe

"C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /regserverfp

C:\Windows\system32\WBEM\mofcomp.exe

"C:\Windows\system32\WBEM\mofcomp.exe" "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.BusinessData, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 29c -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.BusinessApplications.Runtime, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 1c0 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.BusinessApplications.RuntimeUi, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 290 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.BusinessApplications.Diagnostics, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 0 -NGENProcess 29c -Pipe 204 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.BusinessData, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 0 -NGENProcess 294 -Pipe 29c -Comment "NGen Worker Process"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.BusinessApplications.SyncServices, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 1d4 -Pipe 1d8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 284 -Pipe 294 -Comment "NGen Worker Process"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.InfoPath.Client.Internal.Host, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 0 -NGENProcess 1e4 -Pipe 1e8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 294 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.InfoPath.Client.Internal.Host.Interop, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.InfoPath, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\InfoPathOM\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 22c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "ipdmctrl, Version=11.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1d4 -Pipe 1c8 -Comment "NGen Worker Process"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.InfoPath.Permission, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1cc -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 0 -NGENProcess 288 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Interop.InfoPath.SemiTrust, Version=11.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 204 -Pipe 1c0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "Microsoft.Office.Interop.InfoPath, Version=14.0.0.0000000, Culture=neutral, PublicKeyToken=71E9BCE111E9429C" /NoDependencies /AppBase:"C:\Program Files\Microsoft Office\Office14\\"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1d0 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 0 -NGENProcess 1dc -Pipe 1c8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue

C:\Windows\Installer\MSI1C36.tmp

"C:\Windows\Installer\MSI1C36.tmp" ms-help://Hx

C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe

"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild

C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe

"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding B2DFAB61660FF0A6B5BDD0B9B18AEC4B

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D2D91B2F028AE381F8FD97414CEDE30F

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Program Files\Microsoft Office\Office14\bcssync.exe

"C:\Program Files\Microsoft Office\Office14\bcssync.exe" /shutdown

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 807DD90D7424788F65F102B821567C37 E Global\MSI0000

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding D5EDA12A9534E5EE25D1FC60E0AA644D E Global\MSI0000

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Program Files\Microsoft Office\Office14\msohtmed.exe

"C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /regserverfp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1c0 -Pipe 1c8 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 208 -InterruptEvent 0 -NGENProcess 204 -Pipe 1d4 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 208 -Pipe 29c -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1d0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 1c0 -Pipe 298 -Comment "NGen Worker Process"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 0 -NGENProcess 1c0 -Pipe 290 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 0 -NGENProcess 27c -Pipe 1c0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1cc -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 0 -NGENProcess 1d4 -Pipe 27c -Comment "NGen Worker Process"

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 0 -NGENProcess 1c8 -Pipe 2a0 -Comment "NGen Worker Process"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue

C:\Windows\Installer\MSI330F.tmp

"C:\Windows\Installer\MSI330F.tmp" ms-help://Hx

C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe

"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild

C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe

"C:\Windows\Microsoft.NET\Framework64\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C36C7EFD2BD0E0C5414D525F2247E0E8

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 65C4E084B101CAC45AC5018235E03769 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1A50CD1A3CA9F151BDBDB65654455D37

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 628D0B4D1119AFFC765C4E7DA43039FA E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1C46926F4BEFFB9E864A70C8766988C0

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding ECEA82C7170E875723F6C2A0DE5F6C3E E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 3410334E970F04A7333ED0F7CB36F859

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 65C0C3CE8F1416F7250A8D193F4593C0 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1FC94224B44F03C99355CD8EAD5FF88F

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding BFB4AB5E0B31DDA46FCB424C260AD19B E Global\MSI0000

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 4DC372E86719226EBF6FC05011C4C5FA

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 6AE6FDEAEDC8911D4CD9049C23A591A0 E Global\MSI0000

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 5F6DE5316134617C6ED7418759867C93

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 3D61547A76B36B4B258A03498ABEB4F4 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding EAD7D16D5349062CD5178A5D6B91901F

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding DF8AE855DC72D60FBDBC86FEBACD42CB E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1DDD53F5ED577FB2F6C0ED808C87A308

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding DE082711F2391CF8C45D9CB22211E2BD E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C135104DA245EDD36891156636FC9B55

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 648F4DC73500ADC8731D2FCC8C06D502 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 4A19BD6EB1615D81DCE9CD7EAE1732C7

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding FD1B11EFB3A7C1C24BF0199932A2192B

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Program Files\Microsoft Office\Office14\msohtmed.exe

"C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /regserverfp

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding A22A976D18995E02353656C9B096AB2B E Global\MSI0000

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 703980C30055D622396B13654EF68809

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding CBD708F4D77E56A8279ECC997F76FA6D E Global\MSI0000

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding A1B82B605873780528FC38A17FC10C59

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 01245AA5DEDCAFC9EE5BB30052F3BE73

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 2848387AD0520779D20D2A856DD3D862 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 1E36191D0BFEDFEC90333E3B284E07EF

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 0780BF2F25E2686336688CE7633C317C

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding D65BCF53F07F4627B3370BA80AD99E5E E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 01CF93747DBFD23B7960DF4329224687

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 4B4C54E80C31401E8FCA5CF5FECCC777 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 66E1AA36BAB67C0853BA76C636A22FBE

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding E83CCB679728A6B06EFBE9A815300D08 E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 6C70DE14F8CB914629A0BD8AAF369AC2

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 10F77B3C44E8A5A46AE06092D47BA96F E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 0DC6B4AB86B16D7DF7CE6E572D872C8C

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 2375877D3BB7E26C30B64427CE0B134E E Global\MSI0000

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\Revert8Plus\7z.exe

"C:\Windows\Revert8Plus\7z.exe" x -y "C:\Windows\Revert8Plus\Office14Visio.iso" -o"C:\Windows\Revert8Plus\Office14Visio"

C:\Windows\Revert8Plus\Office14Visio\setup.exe

"C:\Windows\Revert8Plus\Office14Visio\setup.exe"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 8BF7C74EBCFCA952E7B81D48B650B9CF

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C272AF793A9056B99AB6DB1D2D9C483D

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding B2F1C092FEFA55E2BEBCA6B2DDF729BE E Global\MSI0000

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding E7BF996B587B4ED9F57BE57DB14D515E

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C82E7202C0D472A0AEC25D39DF43A664

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding E50D40C071203C1AC36C64F412A84D64 E Global\MSI0000

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding C06BDA0CCECC8F3199370451624F5A5F

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 54C35603CB1EB0ADC978B691FEC67644

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding FDE910FA1D4E9CDF2DB42B77F1E7F277

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding CBD708D9CE7B21797F617D17DA58A0AF

C:\Windows\System32\MsiExec.exe

C:\Windows\System32\MsiExec.exe -Embedding 33B7AA2595A14A3F9B52C26E972CEC2B

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

"C:\Program Files (x86)\StartIsBack\UpdateCheck.exe" reset

C:\Windows\explorer.exe

explorer.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	95.221.229.192.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	www.startisback.com	udp
RU	141.8.194.242:443	www.startisback.com	tcp
US	8.8.8.8:53	242.194.8.141.in-addr.arpa	udp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
US	8.8.8.8:53	msdl.microsoft.com	udp
US	204.79.197.219:443	msdl.microsoft.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
US	8.8.8.8:53	219.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	vsblobprodscussu5shard73.blob.core.windows.net	udp
US	20.150.38.228:443	vsblobprodscussu5shard73.blob.core.windows.net	tcp
US	8.8.8.8:53	228.38.150.20.in-addr.arpa	udp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	8.8.8.8:53	vsblobprodscussu5shard65.blob.core.windows.net	udp
US	20.150.38.228:443	vsblobprodscussu5shard65.blob.core.windows.net	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	20.209.117.33:443	vsblobprodscussu5shard42.blob.core.windows.net	tcp
US	20.209.194.1:443	vsblobprodscussu5shard42.blob.core.windows.net	tcp
US	20.150.79.68:443	vsblobprodscussu5shard65.blob.core.windows.net	tcp
US	20.150.38.4:443		tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	8.8.8.8:53	vsblobprodscussu5shard62.blob.core.windows.net	udp
US	20.150.38.228:443	vsblobprodscussu5shard62.blob.core.windows.net	tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	20.150.70.36:443	vsblobprodscussu5shard62.blob.core.windows.net	tcp
US	20.150.70.36:443	vsblobprodscussu5shard62.blob.core.windows.net	tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	8.8.8.8:53	vsblobprodscussu5shard57.blob.core.windows.net	udp
US	20.209.117.33:443	vsblobprodscussu5shard57.blob.core.windows.net	tcp
US	20.209.194.1:443	vsblobprodscussu5shard57.blob.core.windows.net	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	8.8.8.8:53	vsblobprodscussu5shard73.blob.core.windows.net	udp
US	20.150.38.228:443	vsblobprodscussu5shard73.blob.core.windows.net	tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	8.8.8.8:53	vsblobprodscussu5shard68.blob.core.windows.net	udp
US	20.150.38.228:443	vsblobprodscussu5shard68.blob.core.windows.net	tcp
US	204.79.197.219:443	msdl.microsoft.com	tcp
US	8.8.8.8:53	vsblobprodscussu5shard65.blob.core.windows.net	udp
US	20.150.38.228:443	vsblobprodscussu5shard65.blob.core.windows.net	tcp
RU	141.8.194.242:443	www.startisback.com	tcp
US	8.8.8.8:53	drive.massgrave.dev	udp
US	172.67.201.171:443	drive.massgrave.dev	tcp
RU	141.8.194.242:443	www.startisback.com	tcp

Files

C:\Users\Admin\AppData\Local\Temp\nsq9471.tmp\System.dll

MD5	4add245d4ba34b04f213409bfe504c07
SHA1	ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA256	9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
SHA512	1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

C:\Users\Admin\AppData\Local\Temp\nsq9471.tmp\nsExec.dll

MD5	b4579bc396ace8cafd9e825ff63fe244
SHA1	32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c
SHA256	01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b
SHA512	3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a

C:\Users\Admin\AppData\Local\Temp\nsq9471.tmp\Aero.dll

MD5	0cb4305037fdbb31b1763beed3564f7f
SHA1	b584fd7ebffc331b2a08c6c7c74ed1193f3fa22d
SHA256	4f8ac32dd2cca85f9a018eb6a29bf0405af41a725a8a6ff6a7429704feef8d7b
SHA512	e85449f23ac1742b59fb5299737cfdc1c0aae79c0c247f47fcc7887c433d085087d23e7bb521b9f63e470772e0b5e1e3b3afb9b9244f12b425d43d5205a21a4c

C:\Users\Admin\AppData\Local\Temp\nsq9471.tmp\nsDialogs.dll

MD5	1d8f01a83ddd259bc339902c1d33c8f1
SHA1	9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA256	4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
SHA512	28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

memory/4604-19-0x0000000000400000-0x0000000000475000-memory.dmp

memory/4604-20-0x0000000000400000-0x0000000000475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsq9471.tmp\w7tbp.dll

MD5	9a3031cc4cef0dba236a28eecdf0afb5
SHA1	708a76aa56f77f1b0ebc62b023163c2e0426f3ac
SHA256	53bb519e3293164947ac7cbd7e612f637d77a7b863e3534ba1a7e39b350d3c00
SHA512	8fddde526e7d10d77e247ea80b273beae9dde1d4112806f1f5c3e6a409247d54d8a4445ab5bdd77025a434c3d1dcfdf480dac21abbdb13a308d5eb74517fab53

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02zarhwb.dk5.ps1

MD5	d17fe0a3f47be24a6453e9ef58c94641
SHA1	6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256	96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512	5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3140-35-0x000001C0666B0000-0x000001C0666D2000-memory.dmp

memory/2976-78-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2976-77-0x0000000000400000-0x0000000000428000-memory.dmp

C:\Windows\Revert8Plus\incontrol.exe

MD5	69080ffac1b3b5db82eeb0ade8105ca7
SHA1	69c77cec8f8b184848047900656d510302681b60
SHA256	340a0b14e5e94c0ae6412872cd4f8d4338dc9b8a18b96883c45e1e8988524b2a
SHA512	8763964f17e4953228dbea97340d9dfc9afbda5823b8727fa5a6013dee010aeb1b9c69bb10ae7805f1f9a1fe01c02701f0d9894004f8a42888c1c510f64879bd

C:\Windows\Revert8Plus\SIB10.exe

MD5	1c97d80756ee626074c5f85fc104591a
SHA1	8dcd9edb66f7c910b4d43c5ad84541f78c5c6b0a
SHA256	1fcb8b175be1a17e10a55ed453ab526c79e3b982cb2167800b837a8ef787c367
SHA512	445c236c89b7f729fe6c012cba4016339d8ffa5fea063929105922ea24c8699e262c9bcf55849ab794ad0e2855cabd0f02bee5528663e5ce901c7ef3d300f7d8

memory/4968-101-0x0000000000400000-0x0000000000653000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sibtask.xml

MD5	331691375e3eb33ed12214c26797c23f
SHA1	3719bd8407dcc0a40f5d9eedc927eea80d0ef9e4
SHA256	2ffd12fcc5e8c87af2f14605602e8602dcfa2d5638ad6bd690e0a1014fe2c772
SHA512	e002ce601db8cb4a3ad3ce02812752f5c547739df2aa2501de248899775a939a7a6652a3695a0a56b6cc3b2d599230f3278f1d8fad19066be30ee0ddedc2d7ff

C:\Program Files (x86)\StartIsBack\StartIsBack64.dll

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files (x86)\StartIsBack\StartIsBack64.dll

MD5	75aabb76588cd7126a814c0e6581ff2f
SHA1	693d36646af6d09a3eeec8ef5a596d17e2e47812
SHA256	a5b1e45590b5a263faaa427d9ed9b670d4cf92ee6e1b5559266e8ef2efb4b0d1
SHA512	89c0edfec0db06f1569c7f9685b8b98af2b34e1303796e3a5d3f9a2729fdbe689996405867be1957183b408388ab0e36720693a3376fa79a10d89c9904ba6fce

C:\Program Files (x86)\StartIsBack\Styles\Windows 7.msstyles

MD5	ae2d99598c4cef23536891e66a253ca8
SHA1	c72ec083bb26062b81f3aaca0f50864ec89156f5
SHA256	c6c578e729f76eaa1fd6ba0286c383b236245cab3518e46d7eaacae3395f25b5
SHA512	4f1af265f91c0a1a3031cc9989be40b453577d45b043efec1443f4a4fd998a9dfebbfa5029d233f1c4626b175e8cbd74d2deb617f2b090b5c672202dd2b9afbc

C:\Program Files (x86)\StartIsBack\Orbs\Windows 7.orb

MD5	85328e698e8a74852b4061a683915dc8
SHA1	b898267f8574a34e6d605e541e5234c27dd53f5d
SHA256	e5b74e9e7bd6758a0154b11462ae3328edd143190865198104d8bd53b9af7275
SHA512	03945c487c6e697f7b352374a989bfe41d1de7d00624461d2b97fb2027b26d36b35035d5e78ea622c31372087dae647c5d3591c7f9a27941c009993e719ee28f

C:\Program Files (x86)\StartIsBack\StartScreen.exe

MD5	a2d6e2201be02973328038457aa64bba
SHA1	684338bd758a92449d43c49a0aa539f323760215
SHA256	f4e76abf0df055fae97863708412773b51197bae0ddd9692a9509e824d847df0
SHA512	21002b3b3cd01beb923692addaef4e5d0fcbee972154e25bea2c4ece591185bf8e6221959fbcc772fc7e7f73dce18747909dcd9c04423a0ade70f6cfba72f135

C:\Windows\Revert8Plus\task.xml

MD5	b3855da62957c136b78db5b897c92b9a
SHA1	98875ff5475a45fd5a76f1075ea037323948c0e6
SHA256	f1f0d158afc9568e12beb0041153334c182d434c7ea92218f1f872b51d8dcfd5
SHA512	be173a197d46136cf1c9aa62c507c90a4dba024cc9b06aea23d33d6ab121689392db49c8cfa14ee6bbe05291e46d946541dfcc779ba69e8d7062a8696dd2aaec

C:\Windows\Revert8Plus\explorer.bat

MD5	0579d17228afc93c06cad33105bcb0e3
SHA1	58706635ef1b41046eef93bf2e92edaec05fda52
SHA256	617d6d8ff3e749cf084f29b1a27743fc7fc5a405622ac0d884aedeaac49dd6bd
SHA512	7a94af8cdd4bd6b1ad8a67f30af253afc12c55c560f55f7b2c4e996f68b7821ab1ed40053216d0f4a81ebe70736d929009f577e3f79a48e3a397ebe34c6098e6

memory/4604-168-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2748-170-0x0000000004410000-0x0000000004411000-memory.dmp

C:\Users\Admin\AppData\Local\StartIsBack\Cache\appsfolder.dat

MD5	e0701718f79292d93148c46bbf992a69
SHA1	cd2b6eae5fd9c9e85aebc55053e7ecbc5667e67d
SHA256	e6bb966c2e601a981c264a04dd1461b902783df58f67210519085357812df01d
SHA512	c4be1d1603db1b76fd4ad7346708c515fe3070366cf738784726be93fc72cebfcd6bd126035ac215c547d7cda6e5cd3bc2d0462a7305dfbea9009496bab365ff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5	654cc30c8f9de56c2231c474f81aa53b
SHA1	628fc4d30d567c2f47e4bdca12cc6b03af3cc733
SHA256	aaf1e76a55c2327473e1a8ee6cc39f4f0d7af335338644e324242981f0aca216
SHA512	2fc25fed4605a503ea83027d742a222d3ff0c08c736b25769969b804243f1513fb7e0ed403f29ec7034010207c3e4fc4edea65a19360a3656a302b3ab7bdf0e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9

MD5	105caa32ed768e1bff86f0c25a318ed6
SHA1	73c5704ad9e73ccaac6294ab3dadb91932df5218
SHA256	764d26367b9a2d190452c61ceb68715523911cf0ca12fc92db93b4c9eb21f653
SHA512	a4a8026058314a4589890c729af74c935f580ba9ed07657b52cb06276e1b41b2156333626fad4ee36a3909de361e476edb5582d06f4cf34bc43412c9a858bf09

memory/2104-177-0x0000000004190000-0x0000000004191000-memory.dmp

C:\Program Files (x86)\StartIsBack\UpdateCheck.exe

MD5	4c6ebcddb218e4c62cd12b930a5894c9
SHA1	a2e9b5712b8bc92fdd925f6649ca8452c65f5aff
SHA256	1a28ac87c0f2aff7ba63b38f43b05aea45d03c31096e6525df9e880d44f6ad96
SHA512	21eae056e3d2fcb63389f645ab90cd0f2ace10c54b97978104acd292c947e9dcc5bdf8891632ea69465a278c56056ea3732069bbf675ba2217f563db8f8c5be0

memory/1560-184-0x0000000003700000-0x0000000003701000-memory.dmp

memory/4080-190-0x0000000003480000-0x0000000003481000-memory.dmp

memory/4292-197-0x0000000003160000-0x0000000003161000-memory.dmp

memory/4076-203-0x0000000002930000-0x0000000002931000-memory.dmp

C:\Windows\Resources\Themes\Windows Aero\SoundSchemes\Delta\Desktop.ini

MD5	794f1975f13b0fb6c554d96006237cad
SHA1	4a3989d06826b5e8ed30325e3a2527f62de6ae5d
SHA256	b77586f906749b00246a8d8ce73e48ea42ac69355524afe3b1183e1ac6d8d201
SHA512	c4e91baea7b0621765c5da6254be846acef4f90570950e02c8ca733b255afc5ee1ec3378ef479c6bf22205a780d22c5b14b264b55f5f471c66dbce7b84d332b5

C:\Windows\Resources\Themes\Windows Aero\Styles\RoundShiny\Shell\NormalColor\en-US\shellstyle.dll.mui

MD5	60353f535fa56911c1f14daf4afc93c5
SHA1	6079e4b4406296df901206137042a826109fe0aa
SHA256	cfe9cdcf88974d445d5e5138f8243400ecda828c9e5c1636b2638e52fe6ec042
SHA512	4073fc865cbe10a05472b943aa0616e9a25612e7192feca2d66858566192aed3179c521efedcf8d2a25860ee9e26c889077f3ae3d08ea79c6c68c4a1015bc9ce

C:\Windows\Resources\Themes\Windows Aero\Styles\SquareClear\Shell\NormalColor\shellstyle.dll

MD5	fd8c2e3a44cd37eb31a9759b075c7770
SHA1	89d0098a376e3df4466acfe8489905a30f7a6897
SHA256	fe1144fd5eace45936d02b49b14f01a6f04d39fc8cab5ae94f8c8eee8dd246e9
SHA512	e26c71124fe247d9f2e6e11cf6914e66aa238b31c645d3fdf9e956659799dde9374d2e6c5b3b5a2737f69ef76b0a7ac5433f90870b01db94f1b13fb302759e6e

C:\Windows\Resources\Themes\Windows Aero\Styles\SquareClear\en-US\AeroSquareClear.msstyles.mui

MD5	a60904e50fb271a83790a20796611410
SHA1	c028fea54f86e56d9d0e06231e6e8db073c56b1d
SHA256	719a6a7980b77931861f31ee5f4f572192d5d6ea008a6b6919693bf7f4370700
SHA512	f9d5d87b76a053f61d5dcc3a17484c13d5d75b108b865ee25a501fe726a52e2e43a5d1009bcbd02110fd38faaf8b6832048ae8431aeae447be95984cbb82b05b

C:\Windows\Revert8Plus\ThemeSwitcher.exe

MD5	ee2afc75364c67ba2cec484ec2f7277f
SHA1	033f5a224d3f1671bd11542e8b263b14bdbf48e4
SHA256	d2691082aabfa3a0deeb47add00c8b96ca0ee561cf265a0c1bd68fe81443293e
SHA512	f57e1a2f00bc0f1faeb769b6075f69956b8a2ed6953726d84c0f786ea31991969a4bd8456244ffaafb984e2e920f44a07524e774747f66119e24eb2d2d4e3641

C:\Windows\System32\OpenTheme.dll

MD5	b50e36ad36587418dbb140e3465f28d6
SHA1	2abc4d51e724689f73d51a70eed267ebd6e64cf6
SHA256	1dade3f39fd7eb4f61e5e8a5e22dda2747e309ac3ce793ff058aeea0b4b47911
SHA512	feedc0e19173914b1c3833d13ecc528f82302f3c98cf3030af3755826c7aca74024a78008bdd66ea50bd1fd89d7f15e1994c6e51b25eab3b086c3da14b7b922b

memory/3736-689-0x0000000000CF0000-0x0000000000D30000-memory.dmp

C:\Windows\resources\Themes\AeroRoundShiny-Scenes.theme

MD5	8aac2901f36fbb749b4330a2d4796548
SHA1	15fa74b1ba52932636787fd4f497fadd19c2987d
SHA256	966aa182b839ebb8bac440e706f90d888d9e32b5eff2d950f2d96fdaa057cf1a
SHA512	83b67925ff3b2ad5dfecd193c080d1c5cb44340563fd6d95769ac03dbbb27b552259a1cac08701efb0fef68a671124fb022c10c8d8c7c67f3164e5c0ecc8ecd2

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	1d12384f05e842df58bd0c91939e422d
SHA1	8b522acf20716db297211183075106adebda7131
SHA256	d09dae8bbe34374bc2b25ef8a89f3dea77f78f3d0e0ed90144f324524be983ab
SHA512	aa9398b53e706614807ff7a3eea619f7ff746a84e179a44cae01bb11bd5626bf1856b2135e829b3ad46d5fdadc984f44b60638d47f219d7bc9daeaa5c6bb610d

C:\Windows\resources\Themes\AeroRoundShiny-Nature.theme

MD5	07f896002fc05f4e7293b972743259f3
SHA1	2849a03fc07442a607a15b8b899b21d9fb2c67b2
SHA256	0d1dde2ea897ae2f19bacbd43273f1c874f4db5fff2975ed8c34b56fd6a8a8f8
SHA512	fe8718aef434284b6842e0c942b57258cff052051a071d60ca853b8d9ebd31c40619225208a389c277566d62ed84f26d2f867d9ec280b073481c93e92133173a

C:\Windows\resources\Themes\AeroRoundShiny-Landscapes.theme

MD5	77a66c952053f1c0d85da3b9cba4abdb
SHA1	948ed1c1d5e77c7d4be4498acb2032e17995aa98
SHA256	d9ac24c6d20b919de38d9fa8a810603313097ce2d2d1682771d36712b3993200
SHA512	150bff6188ec5240a18be2aa859692c7fe3539d39e90b766c603d59adafc4039c79864bc8d5f8c523dc83098b27028c285c33520024780a3733d213b6870e492

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	7a908576eeda02be2d62955d8b428f23
SHA1	028b1709b67956a2af7cb9012192a9bb61942dd4
SHA256	7768da97f3e2d911a9ce7931d7465240b7b5b4fc6e9be10a11ed1732c81ccddf
SHA512	5a8ebdd1bfec47446746d6987d56a50c2fdc349722437d7afee6bb52f7ca038b2589eebc8755f659415ef883bf10c3b06287dac577888f51c027059d69c4a946

C:\Windows\resources\Themes\AeroRoundShiny-Default.theme

MD5	b47db0002d5d9204e8d9483219b6f2dd
SHA1	27217c73596f94bd7da6788fd3779e980cac0182
SHA256	54ed0d38512d9dd9812f9ac10fa6967ed5b09ca74199918fa08cfe4b526268b3
SHA512	a8b0d514421a0390d058e68bc1dad32e99d25b595eba6279df3345b31873e532f55133a4c9f72917ff8c6570d930e7f5d5343776bc293b5e6e5b68a0f564901f

memory/2464-1395-0x0000000004400000-0x0000000004401000-memory.dmp

C:\Windows\Resources\Themes\Windows Aero\SoundSchemes\Windows\Windows Logon Sound.wav

MD5	b25dbb1ec64b8bd3f320a9bafd2f899d
SHA1	90a081b493024a64384f2fb8ee5b2117baa77116
SHA256	3d9908bad270909fc063e4cf26e9da35cf5c36bc3074fe6fc9a50ebc7777227e
SHA512	f60d8010dc5f1ae45990c4e5d2cd893e74c50a012472bb3d94789cdf9c9ed38dbc5dd1321fd84262fc691ac57fc94fa4cf0ff0e1d8eb7741c8fd9aca0ad60af4

C:\Windows\resources\Themes\AeroRoundShiny-Characters.theme

MD5	5e16fe0e8246cd911a6966c7a4039b1e
SHA1	6bd718c4c93cdfc0240613f31129dec9803aa7b7
SHA256	109c93c0bb28e951af5d8eeb25638808e408e2ea5cadb58f4c42d1f05f390379
SHA512	99604a151063c7374b5ec9e2a6e5aa760c5c10ac8471b2eb8da3da3b98e4393ac737692d1199e55f48bddb8795a53366ebec6af1c8fb8538265836051a17902a

C:\Windows\resources\Themes\AeroRoundShiny-Architecture.theme

MD5	90dfba100a9ca205b2f8baf94da8b11d
SHA1	f9a919928ea282f3bc45aed5b1d928a76b5b1f67
SHA256	3834c6c0373181437fd363e9c16090adf72f0a113bc0a911e7bd56a3e2708b94
SHA512	138d2f8d7f35e3be4e7f68defbb3934c09c3659b59c96a0d545b7d469b8642ee2689e56b07f16e7a907e39a00bc18da5ab65db91b8f4fb63bf56f4678c950fa6

memory/4604-1473-0x0000000000400000-0x0000000000475000-memory.dmp

memory/3388-1530-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

memory/5028-1533-0x0000017A82640000-0x0000017A8264A000-memory.dmp

memory/5028-1532-0x0000017A80900000-0x0000017A80912000-memory.dmp

memory/4604-1536-0x0000000000400000-0x0000000000475000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	38b1da156c39293b30e6d3bf7612cf67
SHA1	9feef822795eb30a73c08deadd3e2d72da7d4d79
SHA256	5c0022ec1c6aa401e5b8c63986b321a6176f4656d73965b8da971f4e54f60bec
SHA512	7f216f9b4a224eee118522bb662ea3a79293aa6811acacc1417a810aacbcbf990a15693b490cf65faea6dcdb8be8d42bc01c14282400967702fe89bdfabaf77d

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	ecfe54b00f41db52e60fb5fe87b0ff7d
SHA1	360313f7fce068d717ac99a744c07d66e1a4fa01
SHA256	3591db5de61802b62d332ede69ab3ff00c26972518dbe71899e625980ef0ed50
SHA512	41a3c0a42f0f86ce2ccd0a70298adbf0fd0d57053fc756464958beb3bbb9c8a35a27c5178d8c6b6154d6476b57a9d8fdc210d67ac21df7de824bfe8aaaa9a8e7

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5	f3338eee1ad2abd51d0c8af07df35e33
SHA1	abc442bb73060527b227b120d8edff09ae8a3a6a
SHA256	25848a0f353617ff23aa9ffa1cc2de21c595ea70bec098f224fd4f30a267499d
SHA512	6b1a5c76165dc3e6787eb00e041a9c64abbd392a8eb2dfbb629994b6768ea727a5d0d481a03c72738590cb48287e91e5e3b243260768217e56135f063e59f68f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	dd9573921d0b424ff39a407d0dae2b6b
SHA1	fdd31e8cfd249bc95ec039eebe06f5f19de5ddfc
SHA256	eca278b4a0e3241880a27bf2147ef1192cfab2944ad781608a69bc88617248e6
SHA512	2005c5cdd5131404f77468257386583b723db8c0fb23e543f15688855279aefc9fc3712530b4025050e84d6f74770e18a75c8b44992da0da5e79ad37d0c2d14c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	81121b9a2c4f100c77f877e03665a982
SHA1	5e1396880d73868dd8bf4295730624964188daa2
SHA256	f6e76b34519d6230f625e6cc26110230223c198b6b53cc320f0e9f15b92fcd09
SHA512	a00723a67750835221d49dad15b78e23238f81f4f59dea85d28fc9fb923417ba5462138bc4e5ef6974b840df6106b0226bacf401524834ca95d2e5670c15bedd

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

MD5	f5fef41e3d9b7053177844b3f94d8b61
SHA1	c0c6384f2e0b56c6ac0b999d8584a2bc9509d20e
SHA256	68431ab4b4a76a1a635df107e402a68d272c88729c157e5de0fbdf84523b879e
SHA512	7039fbe40f264b4a79df4219fbee8952ad0d05a2501cf9ca5cfd28adc86558dc6df1a2568e486d06b6f50566f1ce74b7b9d0796891b5d1dbabcf077fa7dbd885

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

MD5	ca072038e28b040f637502a7026a650a
SHA1	0cab31fe029c546c7a85f8939481a1dbabfa8626
SHA256	ab821fd5d690414da6ff62bd7332fdf4366b340f391ef53a6cde59439c1ce88c
SHA512	5d02deb6c693f2ff8bdbc9846dbd6f0ac3a624573c0ffa95f8c0b20c71d2648081b4db869a7d8189fb031af473bed0abda709e6b4b61e84b2c7c52133a05af8c

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

MD5	c32b221362c36a10f75a1524db603a62
SHA1	7ada66dbd8d18d58016049206f8ed76de3b75336
SHA256	0b57d44b9f523d63d831e23cb3ab5efae787927f06f7f0814d08c87eea62b144
SHA512	801498d4841d14badf8baa6b0b071b26b266d3db2a4dbdcc913c3b2aa0bd1bf5bfaeab72933a42ffea068afaddd8e568ab77dcb4200e24e4465ba29e5a34b331

memory/3952-2470-0x0000000004C20000-0x0000000004C21000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg

MD5	9fd156d7c62291304a809fe9a15cdb93
SHA1	e942837c0dbf930b13875eb6d5433a5d24aaf1db
SHA256	37870a1e9e68155615cdbb73501ddf2ed6ec4a6106794b7e57b0baf9265c5b2f
SHA512	70d7e4612753a95de8e4ba35ea0c5013e97a00ea5e47ef3795a8753cf9a294c5074fc36921ce3011622cc5acd10d2a09c6d4aa1566b4baeee1ac7f50354d03d0

memory/3192-2489-0x0000000003220000-0x0000000003221000-memory.dmp

memory/4604-2490-0x0000000000400000-0x0000000000475000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	c2c2ba491f220f3abae7e7b402256c70
SHA1	aea3fdfafc557ff81520147a35caa1b909fcd355
SHA256	540570dc30fc0c5ce1caa8b727e943aa3df586fe9023a04407bede91b06efba9
SHA512	68ac5c456dad017cfa42de0c4fd130accc99a78f7e67be2928f625631fd3165ee6f53bbc038e82d7176bfb4156e5fb1d23de2719d12f59ba7381645778c34982

memory/4680-3327-0x0000000004850000-0x0000000004851000-memory.dmp

memory/5048-3336-0x00000000029C0000-0x00000000029C1000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	9410b2e81cbe1888c7c7bf7f656b6dd9
SHA1	85f639dbff500ce74d37e0db8de7cebc581679d5
SHA256	88eaa640252fd2e287a00e2ff4613241ddd881b87236e8326c46cc42c4dcfaaa
SHA512	c6ec26be4ab2f63f2511cc3ab2ecaffe439577c396cb0d972f4221e976706928f5e180397a9cc058b2650e3f039795409e2a032104851cc89c43c4ee8dc31ee6

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	2d6b2a421d6fcc9c645b2150565b8c18
SHA1	1409d0c263d2f75a1716a691ed210896ff394f68
SHA256	799b54c16594983de758b18f508abeeb071cb4fedbbec4c117f6fe512fa77026
SHA512	ca2ecb9b1a3bae8fad4e0f1cd52dedf3cf2239142786a11e9bb5196671eb2f2d965bb2f26379340205f7de6cb1838e511d801a880616f96f581806ea10658f1b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	e3ea6f9507c136c05ff97d14c3270520
SHA1	95dfe3fe4e0544db3511bfc66c80e2b9e785d60b
SHA256	9af189e530dff9c49d4d58ae5bf633c0bb9c504035da93c271d3d4f8e3ecb867
SHA512	0645dbf5bae397084cedfbf9c01acbbc29946339888eba32a48603cf11418d04e90ccea5ccc7d55dc981528a3b5665be942f0d88170ddb9e67168a4b579baed5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	240c2d9bd71cbac4d5d4b2056f915d5c
SHA1	045f7e148490be73c6f179853d2e0a9e4c324794
SHA256	acfd692e1b9a6f4b0cd3e95979b1e0a6c9ff1d9964a24f68b176efe31304b6ed
SHA512	4841a853e7bdf2104170db624ab13f7a7fe910d3a4b7d691b3e4d6247ea5866abd46cd55c6ad8a8c84c1c05c57cb83a8739559d356b73bab166c522b55be1305

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	bc0529f2f2a1a64a17600ee8a4b48169
SHA1	c44e3830bdeb32ac3dd8a390ec2b2b4a810d1d3a
SHA256	1a94c421b58fa6314e5794872214cc238186e03c33fea1308590e66f0afc7df2
SHA512	73b53030fd6eecb3eaa312d9e063c9989ebe79ecfd9bda3c4a33cfa70bb0216cff0f2c6a6c3ded1e376eb9c50944897a2d38067e2a8b9cd48ebdbeaa77c827ba

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	4a0ce4fb98616d4c230ade85b966fad9
SHA1	7e43817626218a79f9b3c49df3dd750b1e412a8b
SHA256	2610d0ebce61992af40248a0817a381ff0555fc02d59abe8582464371234c3f0
SHA512	a30dfafab06e1489b47e6d42cde52fc89196507c9e1fcb33a8ab5dce2aabe77266a52a250cd6378f42d72e0ed8769e4786f216971f5ab90a58ef0b36637cf207

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\Custom.theme

MD5	9beee2d35b7e55e154b15c80c81feb53
SHA1	05752997633f07929b9a0cc281516ec44da9747e
SHA256	701b0a8b11f2be362a6ace0fc95b946370b437a6e810837bc17752bc1e029484
SHA512	a24bef9500ebd198ff67ec4f90c677e44c937630f4b92e0fea2f688cce65103d30bc7e3dc39a959b6fc2afbdbb2b916c3d9d30063547afb29eff7333842f1bfc

memory/2828-4200-0x0000000002B80000-0x0000000002B81000-memory.dmp

memory/1952-4375-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

memory/4604-4438-0x0000000000400000-0x0000000000475000-memory.dmp

memory/6092-4440-0x0000000002840000-0x0000000002841000-memory.dmp

memory/5360-4444-0x0000000003250000-0x0000000003251000-memory.dmp

memory/4604-4528-0x0000000000400000-0x0000000000475000-memory.dmp

memory/5748-4531-0x0000000003250000-0x0000000003251000-memory.dmp

memory/3128-4551-0x00000000037E0000-0x00000000037E1000-memory.dmp

memory/4604-4552-0x0000000000400000-0x0000000000475000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_bz2.pyd

MD5	37eace4b806b32f829de08db3803b707
SHA1	8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9
SHA256	1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b
SHA512	1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d

C:\Users\Admin\AppData\Local\Temp\_MEI56522\base_library.zip

MD5	6e706e4fa21d90109df6fce1b2595155
SHA1	5328dd26b361d36239facff79baca1bab426de68
SHA256	ce9b9f16ce0d9abdbac3307115d91eaf279c5152336ccbe8830151b41c802998
SHA512	c7e377e2854ad5b5c3fb23593817ad6345bf8a78d842ff2a45c3be135fad6bb27b67c5b6c01b26e7c1b1b12ea0814f4f6b6a522bbfa689b89fa50d3652799b34

C:\Users\Admin\AppData\Local\Temp\_MEI56522\select.pyd

MD5	e07ae2f7f28305b81adfd256716ae8c6
SHA1	9222cd34c14a116e7b9b70a82f72fc523ef2b2f6
SHA256	fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c
SHA512	acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4

C:\Users\Admin\AppData\Local\Temp\_MEI56522\unicodedata.pyd

MD5	5cc36a5de45a2c16035ade016b4348eb
SHA1	35b159110e284b83b7065d2cff0b5ef4ccfa7bf1
SHA256	f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20
SHA512	9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1

C:\Users\Admin\AppData\Local\Temp\_MEI56522\python311.dll

MD5	8ba700696fcfb92674d86f1600ec6078
SHA1	86359f461ebad2fcd85a85641319a3600076b9ea
SHA256	16867292c7336288dd4f32e2560d421595c0c22fe46977701b7fd321faafa4cc
SHA512	79f36403a6664d5e958e19344f7c5c044ffb57efd25571f85df0f4a53c403133b8ffae88980528b57d7bca410e18f4047bf5d5b99a53a04a4ac2bfbe6df4e43f

C:\Users\Admin\AppData\Local\Temp\_MEI56522\libssl-3.dll

MD5	19a2aba25456181d5fb572d88ac0e73e
SHA1	656ca8cdfc9c3a6379536e2027e93408851483db
SHA256	2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
SHA512	df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

C:\Users\Admin\AppData\Local\Temp\_MEI56522\libcrypto-3.dll

MD5	e547cf6d296a88f5b1c352c116df7c0c
SHA1	cafa14e0367f7c13ad140fd556f10f320a039783
SHA256	05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
SHA512	9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_uuid.pyd

MD5	b21b864e357ccd72f35f2814bd1e6012
SHA1	2ff0740c26137c6a81b96099c1f5209db33ac56a
SHA256	ce9e2a30c20e6b83446d9ba83bb83c5570e1b1da0e87ff467d1b4fc090da6c53
SHA512	29667eb0e070063ef28b7f8cc39225136065340ae358ad0136802770b2f48ac4bda5e60f2e2083f588859b7429b9ea3bad1596a380601e3b2b4bb74791df92a3

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_ssl.pyd

MD5	e5b1a076e9828985ea8ea07d22c6abd0
SHA1	2a2827938a490cd847ea4e67e945deb4eef8cbb1
SHA256	591589dadc659d1ad4856d16cd25dc8e57eaa085bf68eb2929f8f93aba69db1b
SHA512	0afd20f581efb08a7943a1984e469f1587c96252e44b3a05ca3dfb6c7b8b9d1b9fd609e03a292de6ec63b6373aeacc822e30d550b2f2d35bf7bf8dd6fc11f54f

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_socket.pyd

MD5	485d998a2de412206f04fa028fe6ba90
SHA1	286e29d4f91a46171ba1e3c8229e6de94b499f1d
SHA256	8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76
SHA512	68591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_lzma.pyd

MD5	3273720ddf2c5b75b072a1fb13476751
SHA1	5fe0a4f98e471eb801a57b8c987f0feb1781ca8b
SHA256	663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948
SHA512	919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_hashlib.pyd

MD5	ba682dfcdd600a4bb43a51a0d696a64c
SHA1	df85ad909e9641f8fcaa0f8f5622c88d904e9e20
SHA256	2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd
SHA512	79c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636

C:\Users\Admin\AppData\Local\Temp\_MEI56522\_decimal.pyd

MD5	e4e032221aca4033f9d730f19dc3b21a
SHA1	584a3b4bc26a323ce268a64aad90c746731f9a48
SHA256	23bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c
SHA512	4a350ba9e8481b66e7047c9e6c68e6729f8074a29ef803ed8452c04d6d61f8f70300d5788c4c3164b0c8fb63e7c9715236c0952c3166b606e1c7d7fff36b7c4c

C:\Users\Admin\AppData\Local\Temp\_MEI56522\VCRUNTIME140.dll

MD5	be8dbe2dc77ebe7f88f910c61aec691a
SHA1	a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256	4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512	0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

memory/5288-4573-0x0000000002A70000-0x0000000002A71000-memory.dmp

memory/4604-4575-0x0000000000400000-0x0000000000475000-memory.dmp

memory/1808-4578-0x0000000004330000-0x0000000004331000-memory.dmp

memory/5332-4600-0x0000000004220000-0x0000000004221000-memory.dmp

memory/4604-4617-0x0000000000400000-0x0000000000475000-memory.dmp

memory/5292-4638-0x0000000004270000-0x0000000004271000-memory.dmp

memory/6044-4641-0x0000000003120000-0x0000000003121000-memory.dmp

memory/4604-4642-0x0000000000400000-0x0000000000475000-memory.dmp

memory/2644-4663-0x00000000027F0000-0x00000000027F1000-memory.dmp

memory/4604-4700-0x0000000000400000-0x0000000000475000-memory.dmp

memory/4252-4719-0x0000000003320000-0x0000000003321000-memory.dmp

memory/2164-4723-0x0000000004930000-0x0000000004931000-memory.dmp

memory/4604-4725-0x0000000000400000-0x0000000000475000-memory.dmp

memory/6036-4728-0x0000000002E30000-0x0000000002E31000-memory.dmp

memory/5328-4749-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

memory/4604-4767-0x0000000000400000-0x0000000000475000-memory.dmp

memory/5380-4788-0x0000000002B30000-0x0000000002B31000-memory.dmp

memory/4604-4790-0x0000000000400000-0x0000000000475000-memory.dmp

memory/3192-4793-0x0000000004330000-0x0000000004331000-memory.dmp

memory/5812-4797-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

memory/5596-4802-0x0000000003090000-0x0000000003091000-memory.dmp

memory/5760-4805-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

C:\Windows\Temp\autA2B.tmp

MD5	96c0e61f3298cb745b021f67e7dd0d48
SHA1	a61adbe460c68a3087ff1ba75620dbb86af28e40
SHA256	3e56c22a81ab1168036a289c7ffe2889dd678c422568dff9ef91d6a0f9005333
SHA512	dbbfdd4ad2c80ff9df0b21dfd011420baba54a7114d0e0ff5371dda9c9389d90422a4311881ac2bdb5ba7c4334d210b61c6c0fc691ae503e32930109d9251f3e

C:\Windows\Temp\autA2A.tmp

MD5	09ca17eb552722bd7004097f59b07518
SHA1	36cf9da188460542e58acb97fa0ef0bfd9a4e172
SHA256	365c32c3c09228158ab5aaabfcf93cdfcd858be0b2a00031d82ab03070f61a5b
SHA512	3dc6ed86df50f87b12635032fb30840e94bea699ac193a16099a2ce1a9bd5e39147f115fb938c177991dc0dcfd5abab075632a1d0b46e6009a86eea3a27156bf

C:\Windows\Temp\autA19.tmp

MD5	4a83df1d945c2f5801ed59650d7460eb
SHA1	31827890e1df99268c0f80dcb26774225e4c3a5d
SHA256	2d993be76dfcf35f89b656b4dbc553e078d824974b482e56c6f76eaea87731c8
SHA512	eacb88683e3c999a1cdc9d9e4a4030723164e358d7cd85f7cfc02b99f33be991c89af5602349b48b5388520968a43a2a45b4b6d2f468f2b888088cf95bd591d2

C:\Windows\Temp\5c3r7w2f.tmp

MD5	9e7bb9c31083cc3a0f561d12311c9d83
SHA1	9102b88339566d5f0490c25180632043c8bb1809
SHA256	2658178fd2cb498195032c531bf3bb037954e0614aaec4c4ac2637f08d949bc1
SHA512	1fb30279a1f951a98f609eb749deb6c77082c28a30e1fdd4f3224ddac8ddfad134e8f3c44f82c32501da8a93a978e6cf8dfe591039a0e6af0d4d2a1dc5445699

memory/3972-5056-0x0000000002C00000-0x0000000002C36000-memory.dmp

memory/3972-5057-0x0000000005860000-0x0000000005E88000-memory.dmp

memory/3972-5060-0x0000000005E90000-0x0000000005EF6000-memory.dmp

memory/3972-5059-0x00000000057E0000-0x0000000005846000-memory.dmp

memory/3972-5070-0x0000000005F10000-0x0000000006264000-memory.dmp

memory/3972-5058-0x0000000005680000-0x00000000056A2000-memory.dmp

memory/3972-5071-0x0000000006520000-0x000000000653E000-memory.dmp

memory/3972-5072-0x0000000006550000-0x000000000659C000-memory.dmp

memory/3972-5074-0x00000000076D0000-0x0000000007702000-memory.dmp

memory/3972-5086-0x0000000007710000-0x00000000077B3000-memory.dmp

memory/3972-5085-0x0000000006AE0000-0x0000000006AFE000-memory.dmp

memory/3972-5075-0x0000000070180000-0x00000000701CC000-memory.dmp

memory/3972-5088-0x0000000007840000-0x000000000785A000-memory.dmp

memory/3972-5087-0x0000000007E80000-0x00000000084FA000-memory.dmp

memory/3972-5090-0x00000000078A0000-0x00000000078AA000-memory.dmp

memory/3972-5092-0x0000000007AD0000-0x0000000007B66000-memory.dmp

memory/3972-5093-0x0000000007A50000-0x0000000007A5C000-memory.dmp

C:\Program Files\Microsoft Games\Minesweeper\slc.dll

MD5	aabd4974253599aac885e14b8b59c0e6
SHA1	675305e6d3b557cfd849182c0052222d95d8d817
SHA256	9c2ad5c652b0c183e8f9451232bad811f040d93be5557febf6ad47a694642148
SHA512	8f75cdd0d5e57b98b3a79ea317aa6b6beaafd2e1c4415caa7071741558d69d0425c1dc16812592c223e0c3e99f8b7bc9d6edf169c80b4d1306a17883ea841668

C:\Program Files\Microsoft Games\Minesweeper\CardGames.dll

MD5	1b67fe98d1f5c529755ad044e5f6e5c0
SHA1	008903041e4c5a9f324fe96194fe050551b69781
SHA256	578f8865b36972230801992d7c85c0fdd6afdaf34a089eb6833c4747e909c1ff
SHA512	913ec3337959a013e135da5ce3153ef05b79d416baa62bd995746ea2e64c15900a9a6b308a49aebd85de80737e8317ee888106d667c1e5ea0e6b4cf8ab7df37b

C:\Program Files (x86)\Microsoft Games\Tinker\Tinker.exe

MD5	ebecd40476795d5020d65da831fea9bf
SHA1	26bbac3d52fde6ba20c39823041944a3d94d2212
SHA256	24bb8c2efa71d35f94e27c18e081affbd5f3d4c787113b01efd33b527cf913fa
SHA512	4e1eb40993a5153af3b7ff677fb91a30deeeee98039b3e450a91cab45e97ae665bc2395c88ac80ef9b7032a2a55763e35a611c093f3724950c746838e1c9486c

C:\Program Files\Microsoft Games\HoldEm\HoldEm.exe

MD5	13c8ac4e2e5fb7a0ae76b0364617a897
SHA1	8ade3ff9e911014dd6eee5af99a29ccd15629772
SHA256	7d49825cb06689a9ec9efcec0ed7a4c8b7f9dcd63bad2cd1b43dcaa701dabee5
SHA512	f444eff1d9a7dc5d0f4ad144911dcc2bade9e7f72488cfa0bfe61b0748f873daa2443ef6494b324a31ee47278637ad13610c453714724581b9bda65fdd811a27

C:\Program Files\Microsoft Games\inkball\inkball.exe

MD5	720c10630951ec8f0397f5491ed84119
SHA1	706edc5fd613d17226d881741b506efda595abf4
SHA256	b12c82911c180203c6d101f7671076ea8e87ced4fbc27a93f4a79f8a011eac8b
SHA512	6d82d3180d234c21e0f5e05ebc17c86849b1a5189722658f86ac9e00e29b1fc88e180e2b21fb24aa6dc65c95786f2f613e5c133972d3dd6928e40fbef02ba280

C:\Program Files (x86)\Microsoft Games\Tinker\TinkerEditor.exe

MD5	16367e873d542a572993aca2b1bc7ead
SHA1	816fb4b2e5b523fa4d4ccc2d37b3042e4d399c56
SHA256	ed1aaadd6891e674476457a18296268c507746f82d9f99d70b286a09f100793a
SHA512	62ef9523555daa8680275fac5cbec3e14f1868b6ff1b69d0542041745b79a1ab42143b3b9dadc9d558346a60d3c8c50389972289b6c72b94253f2964e04922be

C:\Windows\Revert8Plus\WMC\MediaCenter\Windows\ehome\de-DE\playReady_eula_oem.txt

MD5	3afe63dda0e15bf2fab14238d091f6ed
SHA1	76ef49a529bdbe65be3bf7bd374ea9ab7e1f3302
SHA256	f4de8529e61898de73ac3fd4ceb8ca512dc3e6c8b17febb9624b01448359104e
SHA512	c80326c7de0666705a4a6265f91673b6882ed4849d149b184573e5bec2009ed2a928f67bf8986b4e87eec43310a39574f3bdad6f685b459d0cb50cc368e2dd97

C:\Windows\Revert8Plus\WMC\MediaCenter\Windows\ehome\de-DE\playready_eula.txt

MD5	c805a6e962a3b14869f1303874047d95
SHA1	67154c33e232366fcecb500ca2c3d4b2f030ed3c
SHA256	0e987114e15b607ca27e0859d37bb96b4735b4705ae9baeac9c32f997329d2ec
SHA512	047ca26a0681b3f1454c8dd4a5d5fa1049fa0ef8b059d15095a6c64a9bea1dbf712021fe687edecca94f894c4af5866bb1782abfc5b23da7cdd3ede6245af224

C:\Windows\Revert8Plus\WMC\MediaCenter\Windows\ehome\de-DE\epgtos.txt

MD5	dd29313c7ebe203229ff21d0b1c880c1
SHA1	5d69721d8d9d49080f1950160a8c09dfa6955b80
SHA256	7cee8c4c54f79bcb36ce12e35e7c93def04724896f35232052ccbb7aa5a89685
SHA512	18b201d53792718b622bee8f4063fb0dd057ccd1ab1dfce22b43b3d788cb5611af7635674fdd6d03d497b3e249e71c3b6a305af93a092d445164a182652bd04c

C:\Users\Admin\AppData\Local\Temp\Setup0000168c\OSETUPUI.DLL

MD5	8fb443844dde0ad7d9c004bc92bb9993
SHA1	f8985ca7eae503831260ec9d748c4a9a5eb41a23
SHA256	c4b09abccced366498616fd4b9b088ffcec434ff0943aeeb146582f564762c87
SHA512	3ef364c99d904c9088179079e21b0af9f5ca41624891ec352ceb3eb55609292b417817be33eaed18df9e7596765df3e206ce7ad8f67e9bff8712b6ad37f2cfbe

C:\Users\Admin\AppData\Local\Temp\Setup0000168c\BRANDING.XML

MD5	10b211a922f7ca1a15b98f595a10a7bd
SHA1	b8866c4edf6cccaa458698cfaf5d252867383121
SHA256	01b34d2e5be5247d802d5e1eec1c641b55b8959243c27163500511d55ff51da0
SHA512	3b26c3aece22dc4b61c27b91b5743b081c6ee47a2a2fd1bb54330cf08ee3c4803ae4868b0caa96c44291eebae5087054a00ee5ba316c638c7bef31eabc2d18bd

C:\Windows\Installer\MSIA481.tmp

MD5	200eb7671d84357cfde07e377a597899
SHA1	cd2e4d503b8ae89d27ef78b6c4e16800f18d4c6d
SHA256	0780200cc5ae52e19fe5b65aa22ae0cf1c643c9ca175d116570a599946f37ad2
SHA512	1c262085ad9662bf174ac6b5a6dcc3d00505e84e22b63c76c5377b1a3d827aff3458f77372b3d60047d1af2f3d9d21baa7482baf8e36c3e85b7b36bf9e1efc33

C:\Windows\Installer\MSIA57F.tmp

MD5	1ede982747ccfbd64e4e88b4cdf7f029
SHA1	4d990c87a7af54e748c3738e8049dc9be98132ef
SHA256	1c4a2f5a545747e444a7b9e8eb0e4873087569959f44634c2c6c01d3ad81314f
SHA512	9635cf5508398e22932028fdd1d0be8d2f3b72caa4263ab1f709ae5e2f2841745c7d20473bc4fa0da0bbcd7920e7e473eeca52e95163910c88be6d4ad495edda

C:\Program Files\Microsoft Office\Office14\1033\SETLANG_K_COL.HXK

MD5	db9742e49c49c505b293a84518e95fa5
SHA1	406dae0b226900aad2ad2e10d8366651b848c053
SHA256	1c17b95e5098adb0c0e06aac8a8c7c50c6a5ef1b696465d548c8a922f1d3a653
SHA512	974917a72b2b3b783bb0ffcbfe0058489ae65ac0aa71ae86d77195780aeb7800848a3158fbe7ad8ddf9b30145d8a1a2c66f72484305ccf363b7981f105be295b

C:\Program Files\Microsoft Office\Office14\1033\SETLANG_F_COL.HXK

MD5	b8fbbc73ddde31636552ab184b4e398f
SHA1	5cfbfaea56e979a07c083f2340b10a5894812d78
SHA256	3c3702253a4695b5bcb18a2565b1d49f9f32f5f9f2442fd1395197970fa34edb
SHA512	7f0f4b098e0d37ed403be8d54e2dcbc603791ddf00e3a21747c41ecfb829fdf664b6bddda8d51309e1229b197244a1d8ae23e1b3bf3348f99f84a7a8684db8d7

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	afb0d0c9fb8803e21367f287377fc210
SHA1	10a8e2d4cb6924ca170e8c685b5f00019c535bda
SHA256	d7279f511a2b760f2dbe1ec20197eb0ea366756a3a1a541b639d6774bd7f54ed
SHA512	199620c248fcdf8106b99983b7ce01f19ea3968bc1c5c6cc9e6c7e5d0c1d55428fc1c2a758c22998855109a9a4f731422816cb68679d52d3d70c5ebbedeca1dd

C:\Windows\Installer\e5e9d86.msi

MD5	7dddcc0ba9f73bcb390ae7333130c17a
SHA1	d47d143f5ef3687bc387c8d09463b32cd54db0ca
SHA256	87c9f658277e1ac6c52e46d41d01816d1d4a0494d2932ae83877e0e9023a7ca5
SHA512	c7416365af3e40a49edbc53d9012798674cf8e7e3a2eab47ece4470b860269158197348bdb5150b5110135b3600bd94b921d3c943fa02199f595d84cc48a8f36

C:\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn

MD5	9967de3d63702ed4ba0485ff4e664534
SHA1	7d41f6b7b6a3633ceec988f86d8dc2dd65c62791
SHA256	6b6f14e6af2627186bf8a55e474dcf6ef3f6ce81af560da871ec51eb670171a9
SHA512	7ebb81f3b55301a7d77485f9315761a83492022e735ea6ba0a4ed8706504e6723f1222ff56581baaac1983f6c1a62b5530f75c7c42d932d449732fcaf9f04eec

C:\Config.Msi\e5e9d89.rbs

MD5	bd9f13f02c2d9869afc0c5dc2cd8f8d7
SHA1	85fa042a27933451fb3c41b4f76b77bd0ef79c84
SHA256	413070b9762f0b22dd8b7dd3aa178cc7749b0d1237b91e3cb551bac22839a981
SHA512	a6e7b649c238fae4bdc2e865f3c33689ccedde9eb2902cbb4561baaf45bb7855fed37af6f045baab8534a1c90dad3862360d86e8d3d93362965448d4707c612f

C:\Windows\Installer\e5e9d8b.msi

MD5	41da946af5bacaa46e2f8f1991c58528
SHA1	3d676ed2fc1b7850deb1e068434c1d5e0ae62f90
SHA256	21d5258b2cf5214d689a02fbb1aa5609750523cd2cd4c55d9c23e3cba9b1ad35
SHA512	8db42b74050676be693983e87be19f46befae3deee5cddc85e617cce7e813318eaa2a89a85e41d83f1b25a0da031c5842b41aa25519eb53bf0f112ef63f7ba2f

C:\Config.Msi\e5e9d8e.rbs

MD5	1f9038e57c45038c2310510264d73e53
SHA1	b6a612af92ca2f811b11cea441ef5dcacfa4e186
SHA256	263f8eb5d62898bd75edce0806a28bd7165191c53d5b2fda783ee9b9fb6cbd53
SHA512	9fe44901a463666368300bd4d0c40085aae98d96b0473547642757e42ea00180c7b852398a609a4c437ca90c7ce8202af5ab11ed770b3b083baf14cf4ac894fc

C:\Windows\Installer\MSIAB37.tmp

MD5	1040fd31009355cad7df080c0c8ba44a
SHA1	a420f180a076f8c0e8ccf6058fc7a3b4a698cab5
SHA256	25d97c8f597272b4ab70967944dc0c89820e8ccf6fd3b5b19e226371349bb08f
SHA512	3c80c73ef4f3d0ff8b9b6e977f7999f5cc36437f0eca72725470d6ebbad43eb6ba26bc9446ee350d541d1bebb584af4a240621dbba8f6448c9f9457f3198539f

C:\Windows\Installer\MSIAB17.tmp

MD5	a51c3c270bb40fce972a9c86b842004a
SHA1	9571c5ea25e1075fb3a52c92a2e37d767bc8d01c
SHA256	159fcc993ed048937455447e4544e2079553f538f121471cdb9838d565c66563
SHA512	31b7bbd9e3fea63919527187ad95cd54ee3c8ef67d690c9b76a47a7392fe4562a3bf72209359979be7e139640b2ebedefa0485c29975da9d4306f7220e2a4c8a

C:\Program Files\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll

MD5	dc7b679db31baac3ec98992b4d1b59b7
SHA1	b861999975433d0cbc20b5d59d90d23996545f27
SHA256	c5e9686d7c737f3b369b5d4c34585a645fb5a45a4bf32a6cf0a0af7474f08151
SHA512	9aa8776d32a506340f5044d8e5e2844b8a971419e496a0d3ab77a01c94a4a2a66523298452e14cb632320030a7071f1c79a8e281c268161f7630650d991ff9e5

C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.PPT

MD5	ad3af821274de583bcad58524f5d3cca
SHA1	443e37b48d4925b82c40c82d955ce3c9730ff552
SHA256	4125a234e556900b5a2397341916748996b2226b23443cc70566363218d9ed7d
SHA512	41b3830f4fc43349ba9687d03e2df420d44e8c62b6a5985a92ea6ea1ff6569857838d3b688eeba3328325e7af4ceb62b36ba9e7bff3b4d958202695ecd474af9

C:\Program Files\Microsoft Office\Office14\1033\PROTTPLN.PPT

MD5	869f9133110546c95f112b850a33f98a
SHA1	3c8000224b3dee17f86b893ab7b60ef21fbbc14d
SHA256	8e3385e40b72d42de5564395b005c12680d0722d82c1b35c9213e6bf7368af1a
SHA512	9b508a82735f618b09dd0ae56f986c763ac5b82ada56fc0a9cd88e9c511989667f2253f8972eadbe2888275802af19dd5dc3dbac5a4b81630e61802891422637

C:\Windows\Installer\e5e9d94.msi

MD5	8f441e6059c09090322459fdb5b54f0e
SHA1	d4ed711a888a71668a394a590b0a08a6f8b1cae6
SHA256	b7bcc0be3bb389905a77ad5719ac89f89cceb05a9e9b4506ed1df41f93833759
SHA512	206f8ca922b50970039a86f10b5c93922c9257966f9e79e2fafbf7e6991f429f3ed7a6386bdafdd6686f669f60cf4960702534e608261e06a0e7114b4f215abf

C:\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn

MD5	a0f37fd486b76044569bf172f641ec81
SHA1	a9c1e1f236bf50ad931047d2bc02c739cd0a1114
SHA256	8edd97f24946d7493ebe0b57888446ebfc788d00f3a2f6db82a35d19c570176a
SHA512	fe9eb8b0fb43bae56f4b426a26d3fcc67f8a3e4d944326ddfbec36cc9a950607733721b02dd5b071bbe0d7816809df8ff2852bf7858740b0d48b868ef1872310

C:\Config.Msi\e5e9d93.rbs

MD5	44fa600936c4f6e4dc57645761ece416
SHA1	4dd2c6b8aae625dced98050d63766d19614fe4fd
SHA256	49e358267de6cc40ead545cd0baed0f6dc8192d402079d0374ae32a2661d7999
SHA512	7e5b449340f698792f7cc45a5f484fc90ec7224fb5e2d90439b09497661d001529d33737542916d37771eff7ab8a789f0c84e89148d5859f2f8cfbefab4af532

C:\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn

MD5	298a52e50fac740b67a21211ddba56db
SHA1	4c97d85c3386d61232376fc310d76510a5ca341f
SHA256	7fac0384ad22b8c3d70e88e9fedc7ed6f66f11a61e362c69ab7b14e210dc5c80
SHA512	2010a6a85cb7d72e3690f9af92ec4773532e7813c17f907b8aa84a8e759777e633e95f07a8e7eac24f61c63e98536c2abfd413318e7b2ae9776e342005c7fe2b

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	511322424dc5d54420bc9473ab385072
SHA1	5872495c7b8dc4b7c05b8d3fdb58e6401c0af06b
SHA256	336ef4d2ec30d58d3f30039ff9cd7fba3bb37c8112b77f6583b448709112a38f
SHA512	be8eaa7e9a8c0d7ff7a2213325a317e24aa12ff49e17760ed945e69e4132b87798e3a8e623807ddc449caa3a9fc7b3272f1296b1e7ee0f0f9a14514918b62a1a

C:\Program Files\Microsoft Office\Office14\1033\STSLIST.CHM

MD5	320e99c9504a95d4d85fc930b5865154
SHA1	54666a649e3b568ef2afda7a84bbaefe116f834c
SHA256	07cfd6934043ca1fc1ff87fd978e0d9221b9b913ad4b383c0c4e0ff695a7934c
SHA512	8f4003f9e89abbfdc5a41c6e7b6556b272170ed464e9a3ea6f2a9b56140a22cfbd962774d553e8d9292969b12268544f4fd044ada1d246a7d0c2f69c3df17487

C:\Program Files\Microsoft Office\Office14\1033\STSLISTI.DLL

MD5	1e63fe2c0081ab8d44ceae7d4102a7af
SHA1	476d01ae90d366e98591b9642cc5a19cd8d94e8a
SHA256	baa26261fb60bb94b68b500cd515eae1acd6db3f4e7ff6714152589fa8fe7f54
SHA512	6fb7fea2f31c0f3954a4c65a6ff8d2693537bdf5f0dfa462bd35eb01e68f0b59b4ab8ce968fbb43da8ab6c43e39c7f24e03b5e050dd8e8491c2d0222ca9973a9

C:\Program Files\Microsoft Office\Office14\1033\XLLEX.DLL

MD5	53c199fa553b64faef6904684fd6f94d
SHA1	19372c401c6a1dbf96d48dad0776c3619f2048bb
SHA256	27d4f530d2df4d03c7f9511ebb59e62017e214efa6f58ce4443c1063e8d080fe
SHA512	c288b4737743feb4b493c6cdaff142d40ca0f5573b15fd04d0593117b5b4a717af307c794d8e8e287fdc61ab3f9544c410e62820fd42f08a4a9f0a24f1d44bd5

C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.DLL.IDX_DLL

MD5	2f4cf8799283201b828323bd085c12af
SHA1	cb8ecdd65191e5f01bab8b780e6b0e36e40d0c03
SHA256	7ca4ecd60d6815be96685bfbfd48a2f5e933e677edfa58fa8f6bdd92885e5f7d
SHA512	1bc520ab79a3d00bf01abb2e71d4e309244748e2e24a75f6c5b7590ce31f356ceeb2c22f0930d789a3af4945d5a5ce966536fde75df0cafe647fcddc8392ed9c

C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.REST.IDX_DLL

MD5	a50cb9bf8d01614d1c9dc776ab5e5f89
SHA1	198c3bd5edd1c9dd51cc0bc2feb806b076113ef3
SHA256	21924ba8a31142ffb754c14d33e512fe1f019476b29b85cf976b2d9267dac4da
SHA512	49a197752304dd41a1b193609a879d9018df24f32d39074c09a1fb748d2a2a8e27f9a52a6bd3a6b977f2c7bd256f4898cc044d49245e7da222f009a0797203a0

C:\Program Files\Microsoft Office\Office14\1033\XLINTL32.DLL

MD5	611ea1f53221f459aed237efc6b079da
SHA1	279ba2ce82f58ec4ff6c2115e8b1a28ac995443e
SHA256	a85de370b2989f3d35cb2004f8f0b0b70fbcae247c1a6dcbf27404d04b219450
SHA512	ecc0631fda28c5e72b630db2584d725fdb1a547c15df23821eb30c2c48d2707da408ce4d08dea166d5f65abfbd99f2e3a38b3a4faa75583522d244fc5b008558

C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.XLS

MD5	d06585f0c1dabe598cb56f2776263401
SHA1	b11ff8f594a4343c56decb80aea8ef537d03f797
SHA256	398110335cb8e62bc91b4117b613c4c699e9d1cb3a257ab67e0a86c51db961ea
SHA512	7e2851f60920ebe6f3a5ea32e8f34eb131fdb5c16eb231105df3ef7db26549ee583726d13e84f6ae7931c8e4300924e8c91d22901afe93c5823c36412414229c

C:\Program Files\Microsoft Office\Office14\1033\PROTTPLN.XLS

MD5	9bff69aa98fe3e0d7ead3622f4e67b34
SHA1	dfc416d1f1786bdac331f617a1ee393010a74b57
SHA256	df0b742b3b70f19d3413c1827925b5eb207997cbec14a8d8aa9a38400433c195
SHA512	dee2966c48468ed03d7d3951e0b72f0633b204d99f398e0ce1d4cd75b1ab488f12815439c316120990e2ba779563727872d912744db3b774311547546ba80dc9

C:\Windows\Installer\e5e9d99.msi

MD5	618f0c2b908bc2465baf5fe92ac1ccc1
SHA1	db2fcd4606da408cb0e18c1465058a879e8e77b3
SHA256	7ce9bef9dfa12554df6d39c57c0846f0fb0913f04291b8e517d1efbb3b5f7aa2
SHA512	060f68de36766653e6d039901f668760dcc52733bdd9aa73f9f49735de6203478f7b8544ea308bc28de1ee54440fafd526a3b7d964ca78bd16fc3e1ff9dfc219

C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn

MD5	b234d4197b703ce45611b7a9d5c6dad0
SHA1	d2a4205f07bb3af7eecb1b5921639227bf192ad0
SHA256	889ee799f05b4e822292b93b4fd0e0df9f4f54fc3a65a76354fc8c000c467c2b
SHA512	2366d0c52e059b3b9f2148d5dfd10b8ed6a046cfeb67f4862fdee2494ea380af6c1c123b56ef3a7cf6c87955de493b2df877121cf7bda0678d42cd4fa631e573

C:\Config.Msi\e5e9d98.rbs

MD5	f9f84db7956b1b40e69ff67137fb433f
SHA1	83145c5d6f5b8c8335792f77334506032c11827a
SHA256	a2fb3ce119a29936a07dcdc246437b63a2227f49b499ad36427ce14dd013c313
SHA512	e8005ea82d2e800bc552b40208d2cbe90a4772596322bddd081e387023d9704c045c8f2563e77c9a717088df8cede5951326c701bab753a95a429b9966403cf6

C:\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn

MD5	ae510308faf836710fdc97330a278a1f
SHA1	20961529b3e69ee1d956c47565c66f355540899d
SHA256	6d6eb0f5956055b65ec1ff3c9734269e0f82140164eab6b85c58477ff31c1cd2
SHA512	3ce916a87df35dce43ae3b86ea45a6c9467104b328438bee2e345affbf31a5db2abebb7287cc10fbbea4bff0f0529cb1ef4363fa1fabba0bace896b19e9100ce

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	1e8aad330c6505810a1bbc2a84932f05
SHA1	ee241f995233b2afeccbd2f44069f0333fc723f1
SHA256	ba53e75930dfe645bdfb5a3721d723834118d223b5992530e64b690f13fbb998
SHA512	0e5908e323031f12520bc7ed9fe8952230ac717598d9d1303c331d0b479a2e337055c41b41247809c5a365d343bb28377d7599553298a53b648e92327fb3eb98

C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF

MD5	a875cf9caadc406392ad4bbde44fd55c
SHA1	847e6491a3699254781e581f107becea8812ffe5
SHA256	fff5db9fafe7d0264df2c4135ca0a6252f4f4bddfc7b62471c2cca0a3fbf5954
SHA512	5b2bbdb377737bd4892e41ad1127b5767af9d7d873300d065190d03e7a130810290bdd44500a01758c1305b7e0d50bfa5694dc188f60aabbff5a9f679fc4c036

C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF

MD5	f4393bdb40865ebd0eddf5a27b87ddbd
SHA1	823b5e046d08576ac33517eaa93c61665edbb65c
SHA256	87ff13b6c9f725a3fb2e5c8ef524cc5819601e2d8331822333087a72dd035efb
SHA512	73a1db5a02928e2f903ffae6c477e7ce3d313048a0faf2216eeb9183db9e7406c2abfd8e36861f5a8a96eca220fe2d6a7771b84820ce27df232c944e56b62257

C:\Windows\Installer\e5e9d9e.msi

MD5	3185cbf03865b5ed739fe6a55ba58b74
SHA1	f95639aa6c446f22780767dffc9c192a7bbf64ac
SHA256	d1b4141bdf0d36b5314740e171ec82f1967947f3fa600974e36f84aa5bdb3b46
SHA512	f1040cf389d767c7f13fe37d62af701d7271077b30839ba2217ac56e2713f9457f038baf9ff7f737d2c7ecaa5eaedea8751830a20a704b58bb6b94b5ab1d33b2

C:\Config.Msi\e5e9d9d.rbs

MD5	afb17e88e5d54806d4a59b57767d92bb
SHA1	dc1cb80f99e771496753b25931acb8e44b6e2944
SHA256	cd522c43a5f93a5c43730590cba33e6eba36ac0a82074952989033ba09012f26
SHA512	a95d131fd546581f504e00f65cd1b50974587e4c7926e3250d57e9a38ae5a5240248593a0a26b318977576e94721ad159f67bc0fccce5fd345990349cb616d80

C:\Program Files\Microsoft Office\Office14\1033\PROTTPLV.DOC

MD5	dd20bba2c4db5cc6949844174b1ba279
SHA1	5cc10bd6f3f446ac159bdc13daa4d91f1b635be0
SHA256	cee85dd9b74e156c969fbf55a12a68a2b388f7dadbc446549a07211fa3697a63
SHA512	0c4d42d42cac7fb8fc808ec159b33cb2ba357fddc48937a63fa9c5bedd2e07b1df2c9d15c4d97beedd922e67992fcd0b5641d476fa55c81d1743d8186cb89277

C:\Users\Admin\AppData\Local\Temp\HxB93C.tmp

MD5	de8c87e04db6bdac780eaf0fc5e1cdcf
SHA1	012a4375150bb71e30e175ea4b9d83e6e3f4b0fc
SHA256	84df4ed8cd28d989b40ec3c718501db7a96dcd7357b947c038c89895bc31f6f5
SHA512	0f249dd9c7d88ab5d620300539d29419b450553c5b5c4f81806deb4cb2c2bab64a05d19cc182248b9c34e34ad4b2bd184dfd2645c7cba354630e4710cb82ec5a

C:\Program Files\Microsoft Office\Office14\1033\PROTTPLN.DOC

MD5	de8ad0e10036055d807c48c6e212d525
SHA1	d3437bbffab3870f46e0448330f27f94f9a03a96
SHA256	1ea89436ba65e17751325f9b1f80d68f32b02c0b257d74295ef9914d2608aa92
SHA512	c05ac8c446ddf3b74109948effc7ef0e8f560c84267a59e1aa92c843a8e5fd49e66748b3000ca05e083b5c2583690ae3251e01288cbe1ca9234c44b116ddefa2

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	440dd0e2a0b576a5898f287dcfca114e
SHA1	ec0bc4b2a08dcd0a1541ded77c917e1282f88351
SHA256	89d3ed987ef40f3541eede8829b8cb0f70f68a0c2dc4d033b71c3059607934eb
SHA512	f3720c310c44968c8c5532267232f0fe9045ca4064d9bf07f5d07d6e0e7dc9d72d91f9d6446b73e34bffd73bcbf6c1c287d123065ffb719eee9a1526289e5833

C:\ProgramData\Microsoft Help\MS.GROOVE.14.1033.hxn

MD5	9e05379b9ade4e6ec1d8a49e5904960f
SHA1	d1f97b9e44e6bc253814ba496ec3eb445dfe761e
SHA256	16d892594fef69fe99b22e5d0f7f886b191e2526b05baec6c5660e9f662bd39b
SHA512	3667c9003e825729f700b58d222923fb486d9203294226b210ff42c2892a5dee164a5a979c9c1a37405e95701548d84185b5d13b7c9b2846aec82495065d0ff1

C:\Windows\Installer\e5e9da3.msi

MD5	184bf4805a32cad68d4fa85de8551c28
SHA1	0faa160db9a64c717a3e6fa8a7493e98b42def13
SHA256	0824613c7c00c0b623545bfdbaa3f9d5e392b8e530f3da11c4fac02d5338c22a
SHA512	7f5ff5abaee9a71e0e9fbce972d6efcd328f78a95451a7513884e4cc68c8a2641bcddfa58c3e9d527f20b23dbfa4813db3eebf14dfaa6393e8a285b57bacbee0

C:\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn

MD5	bb89d112ea9ef54eeda8b5326215453b
SHA1	69e79507aaeb66205ae89e1ad96f3b1c560f105a
SHA256	18439e83ceed2716bc078bfbbf03e20210c39143f68e2ac463df4b0eb70a201a
SHA512	481e23685029feea07e51459a41eab35a17636226b574efce085a5fc51cafad7085740ed9b36605176eb72b202a3beb28772168ddcd5f1d526ab509a79afa0c0

C:\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn

MD5	cb18b431af6d84479a64e639e9881360
SHA1	c96789728604f6cbd4eaad1dfd5665cc2b4d2f13
SHA256	61ccd539001d42dbd283e23103ceb72cd27fb7264ce09437ff42bb6ba44aafe3
SHA512	c2642f2eb95c638c7cfdbe1c30b0dee30aafabc2d7badd8e7bf1079222ad5c3666c1292449a96e07794876e542a2db8535d73bceaf7067dd157bc6297a6dde57

C:\Config.Msi\e5e9da2.rbs

MD5	3c6df0d6990d20dfafdff9ada8cc8e86
SHA1	af8f6a387264f249663423932eecc8c527d26feb
SHA256	0c24ceec22674504478105973c515d3796728581d1e78aaa8c860bb664491f9e
SHA512	43bb7a6cb11b4f5d7348296d878d1e874dccd96734851e979182ef0843dae824fd86edd98d7c214933d06e9c6450eca897aa5da066a732747674593b6413ff98

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	11deec7bd0858b1353c6904b33f16d96
SHA1	6ad666824e82d71b1d2138c72a8cfaa0ea815ec6
SHA256	c10f7fe1396df488e55a3625702e9c290264190d6861f61fc79dfa2c4739e9bb
SHA512	32df700f1b1d93a69153012826bbed62533686544bb932fd733512f99b27dd981adbb74e244f8c860e90d2f95fc6f2ef00aca8c8ba8f2e354d18ac0e6796ffbd

C:\Config.Msi\e5e9da7.rbs

MD5	d710ecd913de1442f6bc40b10a4d101b
SHA1	90eaf05a1d90c5a667b186d67a5d21390977e749
SHA256	a9beee3abeb4e948b2606d98088d4e9c8543f533aab26dd92023cdb419dc5fdd
SHA512	cd576a734cc7fd1b32d7bb502e9788ff177859e45b2eabe7c00515c8ac969c0456d039d2a7db2f5693e357119902c1436eb373b30cd8f9d891f12e2411fd874e

C:\Windows\Installer\e5e9da8.msi

MD5	0484e6ee1de012b6d39550d6168d85e2
SHA1	88d63b5eb61035a4620b1c88be9bdd0da10a9447
SHA256	256931074d87c6f0489fd94ff91cc01f3d55c05cc7130dea9dc4c476f89a9090
SHA512	31824ed927ebd69fe0f89ab55b6054675e621cbdf7f74166901f9ea4c569f0bde2316ee4cf49b5a2eaee69a5ba0a775c01926b3578b740e33aafd98ff556d7ad

C:\Program Files\Common Files\microsoft shared\TRANSLAT\WTSP61MS.DLL

MD5	86cc13ee1d093ab7d8c409396f256ee3
SHA1	331baa47778af13c2f03a2c84f77bff00b43128e
SHA256	7043a6f05c96b44fb3cbf51e434f20d4f5bfe6b7c72375a311b940b6e5b4bfbc
SHA512	c60b0e88c3b1a606f17f53ff232fc41c9dc6aa2df9b39b552265c5cde5d429a4ad473d62f603409bf2c7110b526c2bfb1bac6d4b111a3c571517456c9f53883a

C:\Config.Msi\e5e9dac.rbs

MD5	6f92e5b09f218464f564d8c4239fb715
SHA1	7346f5362f4e12b206a2e01223e6c80ccba0cb30
SHA256	3b70a444f6ca00c47ab481054cdf52b56549f3b5fd72ef001cdfa96296c48798
SHA512	b3d4906371954b66de5b73f7e010b310b46a7ee28568f70a0288bb0d1604de57c427cce1f016cde4b744fae30af351d2b691c609683422bbbe430245b4313817

C:\Windows\Installer\e5e9dad.msi

MD5	59973d1041e17368015b704531677131
SHA1	31eb51e86ec7b31db02704a31f94bc871d3d0f62
SHA256	b0018c2407ae40ec906a5db01fdf41fe1b04b6849e4898dda4dc1428e7863e6a
SHA512	012b87b4ffd5fb5042731fbed8a50e15fe9a74d83cf1b923f22a8d593f2ef50df7be0249b15bfe306ff6f0471d7ca8d2d0f71b14a08baafb99e349f7c0ce3ca0

C:\Windows\Installer\e5e9db2.msi

MD5	ad6f09bc1e867d7c0a90b05827fcaefa
SHA1	9790af6023deafbe67476ccd8b0f4905cef0b342
SHA256	47ec31b82e9940aea07eb92fa45eae882b41ec979e710a839cb2f60843b392b3
SHA512	e10fa9c44e23459c21790a5fbac82b1d2b85f7e785540e675b7e968d7bb5092a9e16fa07591ece4ca7622c2ac02cfc34f9b41c04c6e177300c7e0eb6245ae703

C:\Config.Msi\e5e9db1.rbs

MD5	239aec935e7959c601e7c908191f42d7
SHA1	746c5427bf7d1b4eafe3cc56ef5362c7760b4b29
SHA256	37bfd74270fc9b790421a171ee27a57d540fdecb1002497f09c4bcd941e82bed
SHA512	ed7010e9addc094b44506ca4af61cc30afdf4ee7b05dc91b46a3cd76a92522e58cdae8b5b126d81cdcc9b39fb551dd2905a15c789e303535e15ee426de0780ce

C:\Config.Msi\e5e9db6.rbs

MD5	fdf6bd9092466bb675f93e0823f87872
SHA1	5ec06336bbfbec7bd9cd33efa70ddfbf1821d35e
SHA256	5a2ca2e2ee0a8301459b2e7c460174d2b3eb4d41702cd108ddcdf06fc4218494
SHA512	d72b2dca79e6ce7054f344f2e141341110300aea19a84d02977f4421a11cf50754ffad87dabe289e3d537b9104030feb9fde85f90a0b63faf7da02c938bbc061

C:\Windows\Installer\e5e9db7.msi

MD5	e194b89f1bda329f1145149442d56cb2
SHA1	52a7c6ce4ee1991d44caa78134579f392239736b
SHA256	76f7e57269c9684ea08095e9458659fcfb7d367790685387ffc2e84af8c3a3a0
SHA512	9aed179676708ac9a95f69167e50f761595ecff0c16f4745c51f950d8575f49db664af433e500ed14e43d4578c2aaf912aeec31a12b9a82da9794b764d2e7b9e

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	bc356b52d576dd1800d66e88e974876e
SHA1	aead98beb5b5bd8be0c1ec7f6e3d631d34360ca4
SHA256	33a86478a26d3883f32c2d8de98a0b6f393c30ce727caec0275d31c5cb43d2f2
SHA512	515d5b4fff47250feafbbbf83352ac12d9f5c85d90295b1aa2f494f19e46b12e39b07f624c2df8d3f2ed63589a50fdaf08b338144bfd0186125d33aeaf38d15e

C:\Windows\Installer\e5e9dbc.msi

MD5	2297ec20b9a9548ba3a507bc25a50ab4
SHA1	afe2ae12310dd8b9188ea07a3923a29953e5b9ca
SHA256	2765dccbd32d6fafaf1628374ba2202f9620bb9f558eceff51f70515adfbd901
SHA512	b71cf405767284ef1d313ae2acd7a819a319995b677989d9772d599f1ebded02398ef38f2c7b8866379133ed9b7ce92beaf73e18f90a8ddc0a2d69efdd767807

C:\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn

MD5	7856d25c5a7816a4f913be442d0ec220
SHA1	b4535634690186e21e21e1400af01111d7477dde
SHA256	992d0772111bd2205dbb77befda9352dc9adb58055814c8376f15709667c4d1b
SHA512	4205f352c91e00354d1a8b4593157fa1df6c8e3c95d20e67971476331bdcd5a9d8ddadc3a9a55b52c5de02e0d5a4c3a3d916aeb19acd766f25b3e5dfc87099ec

C:\Config.Msi\e5e9dbb.rbs

MD5	8a2c85da5dca377aa926d10b260648e7
SHA1	ddcb1e6f739db16d813e4ab10fd34d02dee13c73
SHA256	50a954d21cbd166491ec8586bac280c247d82d9c229aa19b18fa9593de04b1cc
SHA512	83c11f560290742adebee5a6f185d2249e864e0382f8c15eb47120160c4aeab38a215f16e2fafdb8f08e181918311141a1e1842d31f3ca06a67a510e5ced3208

C:\Program Files\Microsoft Office\Office14\1033\IPEDINTL.DLL

MD5	aa428b3f86839e11bb1baacfa00161a8
SHA1	47f9abda63bce6a9dd1153533952c1999bcd4185
SHA256	37ea1d1ba7546426981fdae9261067abcf579a036d51be90c56ae7b0084fdda1
SHA512	4bd0d167ad41cf0c03a9851fdea32784c5d2041003b60deb172fb905f590f5ab77da1a5e770e60cca9b44b76f444e13b9f6f4108a2bf632699f3fa837c35a440

C:\Program Files\Microsoft Office\Office14\1033\ContactPickerIntl.dll

MD5	688629e4389edbb98b708a118f400b65
SHA1	f3cb94990d0f02e873dc8d2c666570fb4941acec
SHA256	e552d91ea4a6cb4f29979f3a22551dadb6eb02b166600144441c99544e1529ce
SHA512	d39af2f4b3431f0c4eb362882e149c563aec2152a48ff5837b0e9d25238199b1643ec12633ce0465da22aa4914c0df7dd6a8e30d6ecf07bd0eb5288505fde93d

memory/2204-8466-0x000001BEEC910000-0x000001BEEC922000-memory.dmp

memory/2204-8457-0x000001BEEC8B0000-0x000001BEEC8C0000-memory.dmp

C:\ProgramData\Microsoft Help\nslist.hxl

MD5	05ac1819e492957b4a99431ad9775d35
SHA1	124252e813a0601e7795179a86584220a625efbb
SHA256	f1522cfd57eb302604de2652ee34519add82f610cfe05aed8e7c049c8d54ad73
SHA512	5fa56280e6f07911b45eb3ca42e9e76a03b0dd1dc3541c313f44d00b7bebcde5a3983f1a6ad1b37e898ee1d43cec01538ca45e5307f44d2c6b991d4058f04574

C:\ProgramData\Microsoft Help\MS.Dexplore.v80.en.hxn

MD5	b0ac6c74646057d37fe7bcc225ac00c4
SHA1	f463cc83f441e10d3279fbde4f635e138bc23b72
SHA256	764795fb5cc07db1e0d6ffef2c99db6c0ee0786f101df6dbf5dc4b5bac42a7d1
SHA512	c320cee94a54216c6222d543f29a6cfabe94cfe01652b7f1bfbeacdaf47cb6d44f5d0032b168d5a0fbac0e789a56eed8a664845692389e0b0191910054333c5c

C:\Windows\Installer\e5e9dc1.msi

MD5	ac23a109e4f090b1133e7ead91727448
SHA1	83694dcd8968de11eccda4950ce41af108e076fa
SHA256	d841cf1b791a8f290bbaf7da0eeea7318f8c4adfb583adb920369a91a7a41ad0
SHA512	da79d6508ab59548a65c0af70e56d191b7195e47a689267254c297aa6d682b769cfcb515ec00f281fdaa0b7eee2780ff64e87c377c4fc0e566731947357b9a32

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Zip\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Zip.dll

MD5	a0501c542bb7028efd6ce64eb460e5ff
SHA1	627bd01a4620177fa06928537136af637e9657e9
SHA256	7ba7cefeb3bb5be9bb97b171f64604f28ace4f3347cae33010e3b3a201cb3dd7
SHA512	57a767492c468b15020958073de539676fb8031a5c28d7e31cdb17efb6ca5155e929fe6e69aa7827512d212e8a494f4218cdcc55c59f4aa64062c9e8dee48cf8

C:\Config.Msi\e5e9dc0.rbs

MD5	b26458750940f01d9239ce2c497cc5de
SHA1	02c99dd1128c6e4158b7ec6d11b645ebf25b0695
SHA256	3b51cb40ffa1ed0c36a503ec5f0447526ccba31f5267738c485f5348bbccdbbc
SHA512	9e09cfc50c82b4705f422f4d7ae56e09d576eecabfac95eefa12be53cfd1b81207ec11e1336ee03fbdd70695b34d4737daea8cdad94ba16a91eb27c14c80a294

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBUI6.CHM

MD5	4b070caef0f6dfaf2dc1b50c765c0f12
SHA1	bfb35948cfe14559bc9dfd6b269af3eebb7368ce
SHA256	b2476ba8a874935adec29c4fe5b17ab40a1260ab1931bc3b53de9b1796a175e6
SHA512	e561bdfe231eab2144a66588ba0908e330443cf1641302851d10767050f9cb998f7e5bb3b8269695635d97ef4aa55c37006fca7890d349bff0d7a75975dcfcaa

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBLR6.CHM

MD5	a13f6786bade080905aab9cc630c5b7b
SHA1	ea7b5af7158c6ff2df91d6fbdc0f69ebbbead22a
SHA256	529dd69d307b94c00ff7bed924bab529b24ffdd06617df0e312a9a587403d7ce
SHA512	29e49836395bae05c2c1cd04c8381cca0fd3996fe97e5cca00a9ce9fe79023885c1dff1005074331bb43706ccc6fcaee18f0fe3f5b7d697e4419bc8011985c58

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBENDF98.CHM

MD5	a447359d734ba81ac475cd27ef0c71f0
SHA1	24a18c5e6e96437888c888cac18513277c23b39f
SHA256	30b013e894ab44bb84168c1e7fb671604b5e5d03e90dffaa29550b66f7df2f13
SHA512	d4dc949b77f5ca6ff7a03a546e28b7f36942891a763374c8e7c899e6abd535889b1c5786358daf8b80ae0f2168ce9133ff7788f2d9613a05d867d72a5327e732

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBOB6.CHM

MD5	7e9afe12fa8c1cfa164789a720417032
SHA1	769ac0d6783d322c805e0fcd9743504c00ce40c9
SHA256	9bab02384db0e2cf6968e662673c11de60b7e22c80317cc42822e72d1b67004b
SHA512	36f8f6e5bcbd27079b87d85e7a8e9324febdabdfbff8dde7e7b7aba5c03ff7150f033da8b26f053e5220fac155f8803ec806c1d6c8b5873951a31c31b7b6d190

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBCN6.CHM

MD5	b0fed0ab07d07439fd0a310928c41075
SHA1	9517aab545a28621a86eb182941249ec8ce1f629
SHA256	c24a0d184124d3d5487bd06c23b6f2fe2ae26b26e05baf89c5d80a602319a860
SHA512	c7033719d4357cabe4c2a2826e1a4f265159889a3a7e647fc8bb84fc12c86bf893df01ff59de64d7244b550b149d516cd9844d67d16b5a21a5149d19a3d25ac9

C:\Program Files\Common Files\microsoft shared\OFFICE14\1033\ADO210.CHM

MD5	ecfdf9da4454159199f1ce8eb78873e1
SHA1	79368ad8cc9229a825f514b0d3920f1b077d23c4
SHA256	2bd516cb3ae32809511a3335253a3bec548cb8bffb167c4e65112d2a5afc69ff
SHA512	cba2c04bda3e91a31e0ed29fe52ddd11502933129aa33ffd5a4a508a210e888eaaaea9784283ecfe0d6858ad1ff87df942165e4e8beb1f95f934e70acc956e72

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll

MD5	90d9225a444dde09f6be1defc4825ee4
SHA1	f066b5e4ff2498d9cdfdff089f52ea7204507f41
SHA256	54eb66b52c72e7063482e3f503a3fe3becd5cf3cb4ee4d69b7b2f72d02d9a607
SHA512	096a1505e2f4d3536ca96d75da46f1db5e10695f552d999d70f9f27fa089d89ad4b6edab50d08591618bc3747fdaf70976d0eea402511d82023371e100389fa5

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll

MD5	4d43ca0bbfbe20b03c94951b0977e7bc
SHA1	38b73901dbd4a0eebecaf27787ad54b75226cdc5
SHA256	d9b9978091c4451478527212ec7ed58d0c5562bb8888f9ee137e1c0477e1e2d6
SHA512	b5fe15ef7edcda192a5088bf5691dea42ac13200d897278f67e592506e2a4a005d6c32f142ad876c9da205aaea0d33f1ae3687bb9aaee3de1fe897b4a39702bd

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBHW6.CHM

MD5	5256d15e92ec519584547594febd1e47
SHA1	67ca07a6f7a73d5b4e42dfd6d5f2dc7a10a21efd
SHA256	718441cd1d60a28b1dd0ff726f826cdb7ef9d230991b6f38248fab680348afff
SHA512	b7b037a721ae2991c293540196d513a8cbba47484f72e4312810cbbb27f776f4791f5ee62b328b4bbddea98f1a8a163aa474c5b1cd120a3ab38f3a1682c0ef4f

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msmdsrv.rll

MD5	c2a49cc9481dce44f5f0383c12bd8a8c
SHA1	1f5e142a02117e4655e3274fbb5ce270cc95fac5
SHA256	ce8c2fcd3e0d566d076444959af82926a650e5ae326a078b9d9876f6409a0949
SHA512	601c48283cb551014cdf687af5dcca8009e9726bef97aad3839e82132d65ddbe961b0f90bb49438ce246d27a914938517d5791ff278fa0cd60aa4740fa31d6ef

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\msolui100.rll

MD5	65a37aac933f60fbb3c5ff1a627135ad
SHA1	15d44a569c7b363505a346158e24b44f4cf1a654
SHA256	24ae37d9deb04e042f04ae0fcd8e97f22732de90aac8e6aba4274ec761845037
SHA512	66335cbdbd26fecb26d79f44227f6b79e9d1aee4af1e762329f223f8ebbe3d617df870e5e6c6d1b4ff9c53adc365a870eee01429f74b243fb25f128cba222805

C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL

MD5	8d9296a56efdde72f7e99888eb8dcc80
SHA1	376dcd95f745b061317c939d47d9b780d9e890ec
SHA256	be0c812d18c5d59b30ed55e678f412e1a5c9300d761956dff09c57e455a2744d
SHA512	14081660719e924be189973b39d0d971ce562324a6ce415dc80469294ebba70c42d95a4056c867df5de82f03dc0a633eabb20313751e08fce9f93a91f86dde31

C:\Windows\Installer\e5e9dc7.msi

MD5	559604dcd4bed679f77db0eee3818f5f
SHA1	0be0e31acfc33134b6ce36ed8f09f7c551ac5091
SHA256	6d36882dcbfeed2b0ee8b674833a0840b8319c928fdcad6a22c56b259d4bee3a
SHA512	19649cbe0ec5b85ffb13eb700a1d7e6d5170035cf9282facff26bd4ad4c3032940f2e15011301786744a3f497ecc2ede404d550b01a3291a3e24d638279ada2e

C:\Windows\assembly\tmp\ELYQLNMO\Microsoft.VisualStudio.DebuggerVisualizers.dll

MD5	8ffd16d76145b82509c9d75d22515ff2
SHA1	766de425d7501cd09b4b155b6599accde1532a85
SHA256	9e2a90374950f4c148635f54c1fee74025cd14f5f875c44dae824a1b3b2aae42
SHA512	ea708b6882607fbac71d34b4c3c29edf7645800e416525e6b7960e93300024b1beea6c157e86beac7122082ee4afa6959a37021698d579879cd4e692875f8cc7

C:\ProgramData\Microsoft Help\MS.VSTACC.v80.hxn

MD5	ca99bd00d5a10cd85b7607cff55d8df3
SHA1	eff3516dbd7801d96fde1b0e307764afef2cf6c3
SHA256	097238319140e1b8deb1b76077e85f391e7db1b22df56418ed481e160dee7941
SHA512	911f015309d3eff9bd798ef1d8eb87a9ce9f9197ae64a70a7bae815bae2843363a10365ac5157ed39151e934387b630129c27c02cc8707fa293f572826b62bbc

C:\ProgramData\Microsoft Help\MS.VSTA.v80.en.hxn

MD5	71fbb90e5dea19bc3dfeac46fa7727ae
SHA1	ae3ec95a716203f06a795f0c19caae3a635144a6
SHA256	04633ce1cb3862ff8c93c22bb515d9d174a0e37b51247353f8237c8319df4665
SHA512	9f25c1a7c0a97337f15cddf9e1f1d7161a29a8c456cbf1ec419e7fac67437e95bdb0c8f3f1a312f0e8be3155d28101bff21bd29e688eb8e3daee46481be09205

C:\ProgramData\Microsoft Help\MS.INFOPATHEDITOR.14.1033.hxn

MD5	5262c01408dcc4d72a3a71dd63c96ef6
SHA1	5d892536d38b2ad6e23c6bbb769883242870a526
SHA256	d460be2e812576e50468f0f46511949bdda33f23c7d6c1c58ef3309bf3fdf521
SHA512	e77c8156f15203723b656f698777e5550940e6357f700c92e2d0e6aa5b11da1662aa82ff8ab409ae720fbdb0b6c4cacfd5a22c050ee1793d131df01ed2d43527

C:\ProgramData\Microsoft Help\MS.IPVSTA12.14.1033.hxn

MD5	fccdb7c4f72a42efc044a0049faa7485
SHA1	29f4bfaa12731f5059012395afbb460456226748
SHA256	1360b152a62773d17ad7c61dc9a5061e0f00ce7a9a2cfb848fa1ee3af8b2eae3
SHA512	30a87462f40aabd2a195160236016ca4029fea1e62280f4f98dcd209d4bbc1400273ad309193c73a423e0166047dab77d8384a4aa187021eaf136f406e595aab

C:\Config.Msi\e5e9dc5.rbs

MD5	27030e5822a927580b00f70fd76aa49d
SHA1	681cfe24897d18620f54924e9087360054151197
SHA256	77fe427838482ebec6855d23a08934a99720f6ac970ab834e157dad8fb3db774
SHA512	5f0ac9ff7cf08b795eaebe42a9769a6b5e0395b956685145fc7403296a54b0ffbde0b1bc31dec027e67e90e173101c0e26fdfa142ec688252655d953494a72ce

C:\ProgramData\Microsoft Help\MS.INFOPATH.14.1033.hxn

MD5	79d7ccfa65a31dc23693e1e37aa6bf79
SHA1	72f9c530b3c2b3ca2775b58a9da2fc09257e056d
SHA256	b487dc4d3f7094e453e33450f800f63de22d0127bda4b0811c8ef59c1d524bf0
SHA512	6d0cae41c0a1f2f854f9836da088ceda7f32715d4f56e802914042adcf6868a32b8b303fff2ac8b1f8228b5c80e046b1a3e16084a7bca6e6e8bbeef913f6db60

C:\ProgramData\Microsoft Help\MS.VSTA.v80.en.hxn

MD5	2c99123f1788b3cf977dbaa5f1ff0472
SHA1	ec3fa1dfc36ef889299812913358ee8d2cd7473a
SHA256	842545b21d971e6e96655f043a6bee06f7eca866f2e1628c571f8f253a2af82c
SHA512	e6a0bac80a4793a06d4a99945f1a67cb58dc130fe8123071bbe49f4c261fe144217ce8f7b6078d1f06524991b636a715c43a9d20f8cf76d1c733b27e4b78d197

C:\ProgramData\Microsoft Help\MS.IPVSTA12.14.1033.hxn

MD5	5a2a408b91c9170088ca34cfc179d44c
SHA1	9f447ed1efaf30a6a9fccc98957b722a0b1fc874
SHA256	559682745b060c140165a7eac95bc62210cec0957d06b0c9e35ed989c0e6bb84
SHA512	b9a0b9a8d17f2eaa9a2566dba423840f70a33b527c47f5db2034cacafbd84c4d5351af2ebfc0dbec6362825303c3147e317ffd7d40887424d5c06a2504c4c32e

C:\Windows\Installer\e5e9dcc.msi

MD5	18dbdf5b6eb043556f49092d923f1a77
SHA1	c0258dd90eb08434ef5aefbba2383762b22ee940
SHA256	56d98bbe0e376611aff7f362fa5e3c97253e21cdbe613ee5a996ff6e7828c3e1
SHA512	e28232f3eaacb68495e4b1cac6d273a4863ada18dec40d7f7ed0dcce3637c06b0acb81ba983815ce889209e94e3f99334c57893eb51679975171759c4bc821c2

C:\Config.Msi\e5e9dcb.rbs

MD5	1145bfa51a8064bad952404e41c62d5a
SHA1	71094a4006dccbff4341d7ff63b262cd25ba7ca5
SHA256	2c5d829f6483e1a6803d0d0634e07b124d5a9b0b5f541f94d40c0dd3046d3f1e
SHA512	e810eaac26f67cfe6b9cc7bf6ec784a33f0cf70ac02c514c39c5e0d27e523a16d71680afcf93843aefec93488e30f3a4d3e0b936821508ae3d1e1b080a246540

C:\Windows\Installer\e5e9dd1.msi

MD5	983cf5e1c34a88ca29b27987c9dfac40
SHA1	142fab8a7b3c0d5c3a76357996352e33d62b264f
SHA256	b4aa1b3a6d8ad0c5853cf3371707533b34aa811f3c944025c7ff6ec22cad79d1
SHA512	bcfc1a7145d08bc0e6d68ff80735430b76f345c177e849c654957d0f25dc68a29f5aa94e6c540e4eb2fc718350cdd9c246d00a1a70852469ec635d607a811735

C:\Config.Msi\e5e9dd0.rbs

MD5	f7fd595c8ff54d013ddf3dc91f363f47
SHA1	019a83782c8621fd271f5668950d8016dfadb53f
SHA256	8eaa3505469a5090454a044d1d8f15029d2be6e95cd1d9522f5e199cd1a0344e
SHA512	221f13986b95e9c5948253da3dc9a1ba896d5a0abfda176f7ab74294fec38ab1bfbb9ee722169117bbde91a4db3929544420a8fe231c3744d3b6f8cbe3a4f2a0

C:\Windows\Installer\e5e9dd6.msi

MD5	c5004efa9a08812b33abf81c7edab074
SHA1	d3e959a61519876fc96132fd785a00a357b89fe7
SHA256	3a5ac50983ea579d6047d67ad21e206e69bf13851c5e40115c35f7b016788d6f
SHA512	cd909a0d6d06cb904ac064d7d83008e66bf1ed231ca0294815fa87f4e7e8e2077aa99947e6ad0a2bdf071e6f8de10668e13a170717087e17712f91c38e949a59

C:\Config.Msi\e5e9dd5.rbs

MD5	f5196f55878f7d586f09a2e7db170ee3
SHA1	6a272e5946ccb4a8bc7c175f014c638d90a282ad
SHA256	2020dac0c691e49237c73e0d6ec41bbd57950c6298aab72d88baa452aa2c9ed7
SHA512	936d89a114d79a05090a6cea6f3cf75616df9732183b50f16c7b760338925b3bbfe794028933620937f32ae29ee1b366130526d5a1c13ab406e8614fe189f495

C:\Program Files\Microsoft Office\Office14\1033\WWINTL.DLL.IDX_DLL

MD5	8874407f7400e6189b2f91adfc66790c
SHA1	1dc8772ec1994afb1d8fee7eb8cea858483e567a
SHA256	6019925cf56b34963c743ee085e2da949477292dabf55487cf18b31d4186f200
SHA512	20f43e3b4f9190aa1a733675f4803ba7cb82652361ec69c32208a2ff7f9e8c45c6dfb0b6aee978b7f73379d8c89a6e5e26fbf35fe00d014205060b908c64a030

C:\Program Files\Microsoft Office\Office14\1033\WWINTL.REST.IDX_DLL

MD5	151f13e6815a51d7dd8bb0be0a19ec35
SHA1	c1946d21d3c98e2f36ef77b032f5f26fa89a0823
SHA256	348f5995373eff18492f491a374a270f05eb283063df920e5cbbfc6de91d1e91
SHA512	d9d8dec356f8f35d42c4c489df1ed363a37de312ff113d937ba66f697fc1d4c5dbc73527f578116ecbf296b8992f5d77dfd17821321c5fad89a6e8f7b6bd09e3

C:\Program Files\Microsoft Office\Office14\1033\WWINTL.DLL

MD5	68e8d053820b6ea4b1b7c77cfb6700f7
SHA1	f63d78815ecea4877c1480efdecb0e0de07b2532
SHA256	f66b2c4d5bd4b94c4115a90ab6cf67c67c4a0aba97ec799c29cf66b7abe52fc0
SHA512	acdd0eaba7d1fc51549163da94012437cdcc7d7d0c31f2282b957407e747a94c479a6d59c5cee771bf32d654b184c76aa591d1c10a7e3dc2ed3ce9cdc08781c7

C:\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn

MD5	78ce28dbe10f12421160febbd122343b
SHA1	46aa31184e7523cca8866814bde14e8684ef1ef3
SHA256	47774d25d8171c2ff8f8f1aeeaaced5e20759619934ee955d79f1246b98cbbbf
SHA512	2e7681ccf8da0baba321a0a81c52ea4c23bdee1ac39441fc85eb366b7b6a0157cd5542e6323f5cf6b542b7fa9217f67f297333727ea4f4c3723ddbfed9077968

C:\Windows\Installer\e5e9ddb.msi

MD5	57f8d354e3af194694382c54566f4578
SHA1	022dd55654672f47174017bb9d8acafcc8688285
SHA256	e13a28dbf516aa1849e55ab8a98c5c019461b160be13026b4c6dc8c81cb4fbbe
SHA512	96fc3b843178ffd6f657dfa787a2852a3bb513ce7c8855889294547263ae7e4225203c54091df1ab4aa027ae891c7b458e0f1e4709e3cd4e3b92836f4d5750da

C:\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn

MD5	fa91e475639a8ae19b142a84b90b586f
SHA1	04c600c0a44162252488bec4f2c799b43c886964
SHA256	8e479b28e5bc42edcc7637aed43bf08c4d31eb003740bbf41616869011239d01
SHA512	7f2ec111407b1333938fb109e6486562b318aea903c980864038131c8b5099613d4c4d38fc24682e5fcc749b3fbec46da7a3e4538df8b76c9f8233e0e2add885

C:\Config.Msi\e5e9dda.rbs

MD5	35e3aebc3cda5b958f42fcc5b15b4640
SHA1	730c308309fe85828712f3fd814e19359a45188a
SHA256	c7c6a49f39961aa6f3c54acce99fa26ca64567f0b33127fc5744ecbaacc460cd
SHA512	ec23a8b3ff6dbc45dd0dba06c95d450f9017c323ce6d194c0a186cae4c991fd7c3471411f890298383ff235ec3428dcbdb675d295605a1d7a4ab8248c0cbceca

C:\Windows\Installer\{90140000-0043-0000-1000-0000000FF1CE}\ShellUI.MST

MD5	1d2075357200e9de88813dca07c99be1
SHA1	e7bec7cda44a7a997fc7c9631e1273e1a721cdc8
SHA256	3939f644d193b5a6930c32f2e1fd14b20d3d8ea3ae6950c2d75ee010a3520272
SHA512	cac3ac43115dae18444be5c27bf77120f67ffdbdd5b9dac2a70d08ceef93c5cbc4a0cc27c914c18b61771398831f490e2c0e175a091905086ec8173ea7cac0e5

C:\Windows\Installer\e5e9de1.msi

MD5	30c0597ac1316681c541a3663f369e7e
SHA1	bd91ef0f5e0a102e3dafd38e0de08e4f681553a8
SHA256	92217c2a8aa2de817a364e4e97b448cecff0d86a88c305d817696e45d37b4690
SHA512	cbc9709009caf94c177ded77ccb9e020d9a9f7d163e8870764f0950e44de3c41760dc5ce4d6fb4c098adc36bb0809855c9b72f8d1a5f358807b0443a823c9e42

C:\Config.Msi\e5e9de2.rbs

MD5	256a9e50527c09b5f389e2a8b848ab65
SHA1	3d950d4b2767bb9f2ceaadafa75b83929159dcb7
SHA256	b8988ae86e2c20716202dc9aedf55608a13fd9613f2e5eeb5ddd9ece9777d1d2
SHA512	3504076f3e60fb487101e3f040cbde88ee16ec893fb635c81d223d5c16d1a8be89c25e78d0a3136d2375cecb5650441f73827f6a56680a2a94749a602c87aad9

C:\Config.Msi\e5e9de0.rbs

MD5	4feed1cf1efa98889bff07c7ad2065df
SHA1	1d3b0e8f8f82aa96f31d64aa6381cc24cec20245
SHA256	a48a4551479f4f8d3782f146e91e9eee78a864cf6611c4046fa4b99272636203
SHA512	0a6c169cf6ffa8ffcc5a4d9514fc7de0f1b401e87afc86b927e1a1b1c8a371af0f4279979281cee1216f789927a91d8f60af096e14799ddae86d2c1be24388db

C:\Windows\Installer\MSI444F.tmp

MD5	89224211281a82d4ac63f5678edf6006
SHA1	35f7c3479fc72098db268a7bcda72ab806d2fafd
SHA256	214203f9f6edca8e35cee90dad167b293731a5eea51d450798fdccf93fa45965
SHA512	865d0c50ec061623c1914fb4cfe1c809f516f4abf1fcdb4f1a823911d0ce8200abfb84a98c39bf418de67b200302cca80497eaee21f6c7dd46d96c0ef3e71e77

C:\Program Files (x86)\Common Files\Microsoft Shared\SQL Debugging\sqldbg.dll

MD5	507f7bc7219608de23f678728277c4f8
SHA1	2cf097695a970e385d99731249f70770d7eb0658
SHA256	bcdaf0ad05bba7da3fe45f1a8bce15855ca6666cfec1a40b52eff5f2d3c8d867
SHA512	733f08ae3236df1b9ebcb36f783f0baf996a8ccd340c962d6b0c763971c798c93fb838dc01d05adf84c7ec18a06a4042b96fc2b7d865d3de57108108a9a85e2a

C:\Windows\Installer\MSI6EAB.tmp

MD5	3ad03f91cae3717b4283dbae40764b73
SHA1	d17c2d0ccb56717b45686d6b43ac92fea1a9cd94
SHA256	5ac7b6095f6a7ad947510a8e84863d78785843ae442ecce4cb197ec1d1d8c37a
SHA512	f2454a5d480de96e7958b4c3fcf06b27b1f84649097ec01ba4970b138cf90e6887e19e97291a818594bfff9ea84eafa62df0e74560f1629024a0b4485efd2609

C:\Windows\Installer\MSI6FAC.tmp

MD5	c2b4a611a12e4bb3b2b6ca3a604ad971
SHA1	2007de8ca34bcc3ea6dabd651bc2e7c8f63c29f1
SHA256	0634fe80c0a57491f101fddea9e51d9cae549a9bcaf0cf05d943d9c24ca65276
SHA512	76a420649d68a913c0f0477bfd7849c3e90eb75a6d1b55c890fe7f1ec86a87d854d89758121aab8fd5d42be9fff1713d44ef6423530ba8d717d2cf5921f3d6a5

memory/2204-10311-0x000001BEEC800000-0x000001BEEC808000-memory.dmp

memory/2204-10307-0x000001BEEC7F0000-0x000001BEEC7F8000-memory.dmp

memory/2204-10332-0x000001BEEC810000-0x000001BEEC818000-memory.dmp

C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL

MD5	c635befe45c0c0a6adedc6d32d91224e
SHA1	3e9437fb5dbfcac626397b6c200ef06ae52977e7
SHA256	a985f2f8e7708388d6ba46c0963b38935e353d86d72ca2e20ad68c620228cb8b
SHA512	cb2ccc033f176bd510d8674302c4bed95143afa863e3dcc007cab25b6f6b57ae50993647af20a315577ea26e7ef2f05aa67c7479acc17d8dc70235da94271529

memory/2204-10803-0x000001BEEC880000-0x000001BEEC89E000-memory.dmp

memory/2204-11005-0x000001BEECAB0000-0x000001BEECAF0000-memory.dmp

memory/2204-11018-0x000001BEEC860000-0x000001BEEC868000-memory.dmp

memory/2204-11076-0x000001BEEC910000-0x000001BEEC92E000-memory.dmp

memory/2204-11106-0x000001BEEC870000-0x000001BEEC878000-memory.dmp

memory/2204-11162-0x000001BEEC9A0000-0x000001BEEC9AC000-memory.dmp

memory/2204-11194-0x000001BEECD80000-0x000001BEECD88000-memory.dmp

memory/2204-11178-0x000001BEECC70000-0x000001BEECC80000-memory.dmp

memory/2204-11142-0x000001BEEC8E0000-0x000001BEEC8EA000-memory.dmp

memory/2204-11313-0x000001BEF14B0000-0x000001BEF14F4000-memory.dmp

memory/2204-11310-0x000001BEED120000-0x000001BEED13E000-memory.dmp

memory/2204-11137-0x0000000000A60000-0x0000000000AD3000-memory.dmp

memory/2204-11335-0x000001BEF0380000-0x000001BEF03A6000-memory.dmp

memory/2204-11134-0x0000000000A00000-0x0000000000A5A000-memory.dmp

memory/2204-11131-0x000001BEED0E0000-0x000001BEED116000-memory.dmp

memory/2204-11128-0x000001BEEC8D0000-0x000001BEEC8DC000-memory.dmp

memory/2204-11124-0x000001BEED140000-0x000001BEED192000-memory.dmp

memory/2204-11121-0x000001BEECB10000-0x000001BEECB30000-memory.dmp

memory/2204-11118-0x000001BEEC8B0000-0x000001BEEC8BA000-memory.dmp

memory/2204-11115-0x000001BEED0B0000-0x000001BEED0DE000-memory.dmp

memory/2204-11112-0x000001BEECDC0000-0x000001BEECDFE000-memory.dmp

memory/2204-11109-0x000001BEF1390000-0x000001BEF145A000-memory.dmp

memory/2204-11084-0x000001BEEC980000-0x000001BEEC99E000-memory.dmp

memory/2204-11103-0x000001BEED050000-0x000001BEED0A8000-memory.dmp

memory/2204-11100-0x000001BEECAF0000-0x000001BEECB10000-memory.dmp

memory/2204-11094-0x000001BEF25C0000-0x000001BEF278C000-memory.dmp

memory/2204-11091-0x000001BEED000000-0x000001BEED04A000-memory.dmp

memory/2204-11080-0x000001BEEC930000-0x000001BEEC944000-memory.dmp

memory/2204-11422-0x000001BEECDB0000-0x000001BEECDB8000-memory.dmp

memory/2204-11427-0x000001BEED380000-0x000001BEED390000-memory.dmp

memory/2204-11419-0x000001BEF2790000-0x000001BEF2818000-memory.dmp

memory/2204-11415-0x000001BEECDA0000-0x000001BEECDA8000-memory.dmp

memory/2204-11411-0x000001BEECD90000-0x000001BEECD98000-memory.dmp

memory/2204-11407-0x000001BEF1460000-0x000001BEF148A000-memory.dmp

memory/2204-11444-0x000001BEF1500000-0x000001BEF1518000-memory.dmp

memory/2204-11441-0x000001BEEDE00000-0x000001BEEDE0A000-memory.dmp

memory/2204-11437-0x000001BEED390000-0x000001BEED398000-memory.dmp

memory/2204-11452-0x000001BEF1490000-0x000001BEF1498000-memory.dmp

memory/2204-11449-0x000001BEF03B0000-0x000001BEF03B8000-memory.dmp

C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\BULLETS.DLL

MD5	7fca041a0f76206ddf13b3b4f7d22459
SHA1	a3501fd4a32bc8ab7d12c28c20740a4cf69aef32
SHA256	dc041ec10083e934f10869405c85b9c08574e09bea05aa9c6b79695af824b371
SHA512	a44d4d070a0f66ef7f05e92d28e40266859cc9c1add2891346ff2e79d97adf7d40edc2c75c037c18dae3397f5af424c6cd3326fae2db853c5b36c773308c8261

C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL

MD5	b3d8984eb7549ab4f555f68d4ed7a3f9
SHA1	e51540510d483546f576859085154867ebcf0f6c
SHA256	d868740e8c632e1f98d263a950f9a101c4811ea9a5fbd13a19deca61bacf1a26
SHA512	f31e753740d5b1983ea1bdd5c11f42c7bf348daec599316f167919eaa86feb82ba2573cd4d8027d87813042f3cdeee952b51e3dbf21a4dd1db184a0321f417cc

memory/2204-12086-0x000001BEF14A0000-0x000001BEF14AE000-memory.dmp

memory/2204-12099-0x000001BEF2E50000-0x000001BEF2F3A000-memory.dmp

memory/2204-12095-0x000001BEF1520000-0x000001BEF152A000-memory.dmp

memory/2204-12089-0x000001BEF1560000-0x000001BEF1594000-memory.dmp

memory/2204-12113-0x000001BEF2D60000-0x000001BEF2D8C000-memory.dmp

memory/2204-12110-0x000001BEF1530000-0x000001BEF153E000-memory.dmp

memory/2204-12106-0x000001BEF15A0000-0x000001BEF15B6000-memory.dmp

memory/2204-12149-0x000001BEF1540000-0x000001BEF1548000-memory.dmp

memory/2204-12213-0x000001BEF1550000-0x000001BEF155A000-memory.dmp

memory/2204-12302-0x000001BEF15C0000-0x000001BEF15C8000-memory.dmp

memory/2204-12308-0x000001BEF15D0000-0x000001BEF15D8000-memory.dmp

memory/2204-12320-0x000001BEF15E0000-0x000001BEF15EC000-memory.dmp

memory/2204-12336-0x000001BEF2820000-0x000001BEF282E000-memory.dmp

memory/2204-12369-0x000001BEF2DA0000-0x000001BEF2DA8000-memory.dmp

memory/2204-12366-0x000001BEF2D90000-0x000001BEF2D98000-memory.dmp

memory/2204-12567-0x000001BEF2DD0000-0x000001BEF2DD8000-memory.dmp

memory/2204-12570-0x000001BEF2DE0000-0x000001BEF2DE8000-memory.dmp

memory/2204-12527-0x000001BEF2DC0000-0x000001BEF2DC8000-memory.dmp

memory/2204-12522-0x000001BEF2DB0000-0x000001BEF2DB8000-memory.dmp

memory/2204-12900-0x000001BEF2E10000-0x000001BEF2E22000-memory.dmp

memory/2204-12981-0x000001BEF2E00000-0x000001BEF2E08000-memory.dmp

memory/2204-12977-0x000001BEF2DF0000-0x000001BEF2DF8000-memory.dmp

memory/2204-12994-0x000001BEF2E30000-0x000001BEF2E38000-memory.dmp

memory/2204-13024-0x000001BEF3140000-0x000001BEF3308000-memory.dmp

memory/2204-13032-0x000001BEF2F90000-0x000001BEF2FA6000-memory.dmp

memory/2204-13019-0x000001BEF2F40000-0x000001BEF2F6C000-memory.dmp

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF

MD5	973779cfa96b0be367e8718db325c4ba
SHA1	be1115e7d145c8181f82b66ed30b4d5dc60bdfb7
SHA256	09d2a546c57dc9fec8fd5efd059ab8e7e21d51f582fd678f05900efef154db0a
SHA512	baba3c85e1f49e2f3b1c26f3db0cedd7a340a67c8fd5ab80e70957418d658bf137ec32fe529c01f122b932a3961fd4739eb557588d239471aa84cdfe99aa9dfa

memory/2204-13949-0x000001BEF3310000-0x000001BEF348C000-memory.dmp

memory/2204-14017-0x000001BEF2FE0000-0x000001BEF3004000-memory.dmp

memory/2204-14029-0x000001BEF3490000-0x000001BEF354C000-memory.dmp

memory/2204-14026-0x000001BEF2FB0000-0x000001BEF2FC4000-memory.dmp

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5	52236cec3798df288705441118df4bcc
SHA1	1fd595c15b27c07a7185cc39bcbf66c52641e32c
SHA256	71e4d48ed4515f17faa6505256314a8d6022e103714193785e7fcd08a36a051d
SHA512	0c949c6cf7c1d61978ae838e266c845cb9990ae574d6f1e80d96c5f87db15bca354aa4499ea80fa7fb47c8734b0db55d581b8e8cda07e1664423f957ef5f91e7

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_OFF.GIF

MD5	94f8f9cbbc7c55b6035f08f846d39cee
SHA1	2dad7a9174aea6a26301a00a7d3277595cfdca8f
SHA256	f1b55bf40b6fa794c1e614aa75985258a88e2165bef91eff545438b85baa5c3f
SHA512	6dabc2f1cc7872cff3682bb1d4e852d97e69cc7ae232dc9dbbb0fb3333bc3e3d99e9e2a2478cce03875abf9d2f27be964220586ae146af41484f78c98509c53c

C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML

MD5	fc9a01384283f760b245bafde02893ca
SHA1	27787bad85297baad51216df565e409dfac1d440
SHA256	7bdb5be38475510a7c05a3444b122a62e8cf4c05b35e656ca4deccce4a55d968
SHA512	a35db9e5336b752fdd25db32ee0584fcd93c9c366ab3119d1e5cdd235c8f77e44170fdf2ce6c182d02df750ed89b85926c2cf4bfd4b4f6d634ec0c20c100c0e0

C:\Windows\Installer\$PatchCache$\Managed\00004109110000000100000000F01FEC\14.0.4763\OSE.EXE

MD5	ee1ca3c10fe3edccd0eccd64ccf00e83
SHA1	eb10cc31b2dbaca8bdaae7fe779f5b9115f24d64
SHA256	af51821b2487c6ee575015b3d6c73e5eacb536c8325d723e31b8c164d6a39d8c
SHA512	b88a5de7acb6daf20e8af6cabadf8cea155cc8bd1bc6978603dd3cd9ca6d35fd900841ae870ed0f92e00cea8012c920634699fd7b76ee4a1fc71a3fe2c9f13c3

C:\Windows\Installer\{90140000-0011-0000-1000-0000000FF1CE}\misc.exe

MD5	59710fa177c02892857a3831d11a06dd
SHA1	67e8d8cbb29631c58e42f3b46ddb247dd5e2a968
SHA256	72eca5b8ad170bd3354691617db88e61e2b24e60e8f6015ebcac594f5fb936f4
SHA512	6ec37d1c01ad4dfee0fa18b9c028be28ad7781a2e2acfb431c48f4e4ced61160183a4f93633bdc32b6d32725e2168cea39b5b6671c83ffadffdc5d86a7b2f562

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft InfoPath Filler 2010.lnk

MD5	53cd93a4118e0c3f9d51a1cdcf25e7aa
SHA1	95bf51e56d0dcb48adc78950503b1c9a3fec4c5e
SHA256	9091d24dc80aeb919388af57fb7fc6637236583d4047c3aae638559332582770
SHA512	3ad1ea9e769c9500f8b63e10a2a6f890a79e15d068ab9b1f0cc2691e468bdaf1c7b1c531d4242c4cb205bde2724f0702bcc835ecca5be9092aa232c758ea450e

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft PowerPoint 2010.lnk

MD5	d8c789a65d75f4d71a081e1656632454
SHA1	f8f4c31612a77aec1ad4f1357c854751ae341395
SHA256	6f021fd7e30a36904407e91a02d88f344ea3f227de14bb0212eb86f3abb2cfe0
SHA512	f67774e510e984a68af9d142927e3abc210428aa67eab5485b7061f5a10c9d3b7e2a37a13a6072c024968e5074d42d5c7f8af522d299fb2937818974ea61d340

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk~RFe604124.TMP

MD5	2262d3ce4c949391fe267ebefecbebc0
SHA1	d34d60c20f493c9674517258932aaf2b39d6e3c3
SHA256	eb7f3c6f2d50d2a2e53448c3104aacd1532b68d9f7256a4ea52529e715e26513
SHA512	335e1023abb745cabad11873f842a385536f7e6c5af7093ad78a211b9c6f0a79063d43586c97722b395309a44fcad627816cfaa911ff7216814e32dc9a02fe9d

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk

MD5	5d1f60df35e1118dbba533b2587eaf46
SHA1	4696365343d70190406d4a7c294dc1d4a1f801ac
SHA256	389e044ac998daa2ab9f4d85c90cb170f8d0145d7869543fc005be5bb2fc3948
SHA512	6cdb24f36f710a7cb134538e184ab00435cb3cc8c97bcd0ce32ac8b45e458233dd522dba80c9033dd7230633195d3d4bf740654c1962411e85abdb187563dc8c

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Publisher 2010.lnk

MD5	0d962fb626d0f81ee22e231775af7667
SHA1	ce03611b2043fa00de81f4480824471f440350bb
SHA256	fd0eb7452a963d83ed03fc6bfa8fb16bdce490f83de4df7714afa13c069d5e8a
SHA512	8bcf4f3c9338d3ba417135f0df36a6c32ff2a7bdb4e5b83a5d32f07d590f3852bf049425effcb5f10266213cfb58b20a208fdffa52d20d21253c845c27ebcfb8

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Publisher 2010.lnk~RFe604114.TMP

MD5	bcf6c3e7569e055cec686bff30ecc4a5
SHA1	cbab9a088fad81a2fc7b1742fb0febdb74eea823
SHA256	89931f5c0fc514b54c860ccd34fad07e195d291f0107999e4fc1e250ac8f03cb
SHA512	a23732b9e4184fb8f666aaa0d0aff155098b5cda2d93a299c41e865aa0febc9bfdbaa452176b9d012d7b4b03ad5b09aed39c0c5d440f7a4e49a3755c52d34f1f

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft PowerPoint 2010.lnk~RFe604105.TMP

MD5	e77b7dc67f0e05b6f48c692ac92ad873
SHA1	f72f67a87cf68b1d8305755dab0542a8dbbd1a08
SHA256	4d63ad05ce06536f19db558aa4f554a114e0e1a0fc8a56ca1c822b648e2695ad
SHA512	8076787eaeaa537ffe69f939490a2f508919c8069b5cb691012db3de602d1a84b44d9a7eb1b74bd517dc037c50c3000504d202d0ca5a377a112d44e067a0343f

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Outlook 2010.lnk

MD5	35bb31c4a1c45f5cce26755c3af64b07
SHA1	85b90c1322cdaf2375a47362ba4812b5cf72c656
SHA256	b31333e230ab7dabc6ec040005f7b9c22f8d7274064f50e37f35709269eae96b
SHA512	bbc08c37cbe1211a7bb780e015c1b4ac9408684e56890bff6cf5c03f0e4bc3cc65684f2418ad18112211b8b1e921d934ec0480040113898f7ffe2bf4ee9799cd

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Outlook 2010.lnk~RFe604105.TMP

MD5	712ccf2acd12dacada3561b4597c9a55
SHA1	cf48c87a86d9374d03133552e82285ff8cb57427
SHA256	82bd1f4a1e6c48b70e7a286c61299c76adc297da50efad1d09a406888b2a0532
SHA512	699a79aace3ecd61cbe78a028be39c2ecb0f7fbd767df841350a94bb64621235f458abc5c17971a08351ab193c1418dd44e87188f12e077012404110768a0ad4

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft OneNote 2010.lnk

MD5	745139d94b3da8e2eefa7c361d04c887
SHA1	3d555413e31e621105ac2de779f61f0ca1471746
SHA256	b48011736bec78bee8fd40539ecdee7ec36fc20c85bdc73e686d2f9f632216d4
SHA512	d4b06baf9c55191208919159ddd5f4984d3cc4862e6c236c5afbbb3a82c34a38fef90a61faef017e4eba09b374287d7f2f5ee464dc9819337bc19c6445823aea

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft OneNote 2010.lnk~RFe6040f5.TMP

MD5	1fc2120b304ba9185b568ecec789c398
SHA1	86f6693e2da5b282b52443507fbea2eb986b1efe
SHA256	c4e1d31ed5641b45ad49f6c1b34c5eb3d4931aaf3559338a5881646786682a9b
SHA512	d617d8351fb08e3076c54ac9f33d351e47a689d667146606940041aa5c0e7c253b10856faa7871764223be9d986a7c3738b9bfb126e07b93b2ee5eabd050d5cd

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft InfoPath Designer 2010.lnk

MD5	df939bb5785860110df400192ffe5c1f
SHA1	74362b293525081a00475eb1af01f5ddcd02c47d
SHA256	a66235ac657b31d73f8b3a385cf456398431401f7848410dc8d003aacada9437
SHA512	ea0e67e690f91722f359e76d14ce00f59af0be521a06bb46a041bb98aa99282930ecabe38d012668c31dcb20b6c5e52b219444d5fef8f7b872d2469db2bd3b36

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft InfoPath Designer 2010.lnk

MD5	1ebdfef36d3f0df6977601ecd58428ab
SHA1	0cef3e06d9916c74e2755b3e24963630cbe2065c
SHA256	263089691d2479cbc451e541eff634d8eb9b58882d836510c6f2597e0dc5a21b
SHA512	09d4cf3685a5940408211c8f9510354217ca2a462858c526ae4ddf9afa8ad49a55b82fdd88827576c0ecee5f250371016245e97a93537bcac93516cb2c352e4d

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft InfoPath Designer 2010.lnk~RFe6040f5.TMP

MD5	a8f588c7e5e3268b3f7234a8a0a0c82e
SHA1	4cc7adc13b5031f6c76b009f4108ad5b76ebc0b3
SHA256	8eeb7d1340863260b2ce68c65891d8bb9bc4493dcb05579fd4953f6b3752ea4a
SHA512	cad47bc6f655e87abca21f9ee04bda989d0b7e9900974417aa195ddd6f329fed75e409ffdd681c455e3e0d5b6af9d501af7e330e9a4ff4a62f3c64aa23ac7e70

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft InfoPath Filler 2010.lnk

MD5	cc202ea64c167153fa0802a2a2d5b57e
SHA1	0c76b4e49562f59d437c54df2c5761d1c2249fdb
SHA256	529840d88797cbfb98e75e566861ce6c632e576a2e3df823b6d1f97cfb512f59
SHA512	c8f6a272663af9453f4202f35ac492ceb315b95b4aa01a247abd940cbe816646a50009db72dd49b8f553bd181bbb728cefd9ba9483f57e9c112dd7f5c4a4a593

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft InfoPath Filler 2010.lnk~RFe6040e5.TMP

MD5	1d4aab0b01842c24ad27cc3ede5315b6
SHA1	faacddf31b70bf2120a32a06894b95302087473f
SHA256	bb208256f076d692d7cee5892b2b3fe25340dfb1c86b48eac57b58c9c5dfd8d1
SHA512	2aef09b93eac3a9e28999fd35d175e63f46610de4afd5fb5f7f0be5649a75c51dae00b38a654ff9f464fed73643dc9c04779015a51c8911a0a365ffbdf29cabf

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft SharePoint Workspace 2010.lnk

MD5	40d2f4cb56bfb651946b3134e17f521f
SHA1	bf17b9297ac05273dd496d9ab59afeb4736f301d
SHA256	b1ef9b2d39edf2c858376927059ddb37ae545a80fa7952d5c8c1c370952680bc
SHA512	fe3153f8993704ea52a60d0b09da82e59b2abf1543dd2a301c380a58b4bc8056cf372b4a3cb207fddfd4435f20162ee85871465ac3571cf1c1ac362e570eb06a

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft SharePoint Workspace 2010.lnk~RFe6040d6.TMP

MD5	3229a4aa8cf7f7eb8b1712370ea67b97
SHA1	5bb23ee8b2e60d8b5ed47eb4ecf727dc9fc1ae67
SHA256	90ccd14b16e669771a2c1b5eda338a4d2b138afe13f21134ab27c9b4d817707a
SHA512	112c0abe0bae06654985c8cbccef0258b12ab28022ec24c0905b6a761ed593613f4f3ee71baed688473f40310de5b25c2ad5d219da848b9ee44c7d2321eccfea

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Excel 2010.lnk

MD5	1156926d7faeab338f282af6ea4cca8d
SHA1	bc0cb4b0b85470bf2bf770f0580e6e600588842c
SHA256	6c4d5885715f387a5018062884f96dafdfb78dc3fef023fc0a191a598bebee16
SHA512	ac721bb02151816ac723ece697987df768e483d2498d670d9f71af8b60d6dff7972133580deae2f6ab98b62e49321ee5c75478b48a08df600f3d66b15c94bb77

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Excel 2010.lnk~RFe6040d6.TMP

MD5	452162e0f3817ca7a7ccc492727f0bc0
SHA1	1f2dc5830d34244e536d61cc52fdff61d710f881
SHA256	6e95ca1acbc4f7ae550b79f8009cf215ff0b84346418b5379d0307dd796ac67d
SHA512	d54fd4dbc4fc74f0b8d580498c0ddaffdee51d54b37abaf9a3b9686d350026381efa7dc5bf2c3c09649d7df567b884acc69efe92bb806957ff04347e30ab6bd3

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Access 2010.lnk

MD5	0b2cfa4f0aa0a85aaa98fe57e23b69dc
SHA1	495fb03adb349dc3f12b2b6128b6d02d36c1f166
SHA256	72f95638d7c34f72dd205ef3bf7209c5799be843aa61180b5adea68cedff0e79
SHA512	c1ef6a1832abdc18f1f7f883ada4ff8ae4ea44b91cf857de359c896dd81c43ff81c7d2c32f9a7f07e875b0adddb35b9a76e54c9453da867c5fc514ef89c11427

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Access 2010.lnk~RFe6040c6.TMP

MD5	a8b04bdfde6ad0f29b749fdef2c923a5
SHA1	ed9a39cc4edab5e42f853904fd81e13b198b1b17
SHA256	36aeadf61c3f93c752e7e75bee20c76c2b9a6c6e2dc7b2b7a9cb585568ad4f00
SHA512	ce69db7d9ed41a72f6272b9c20b64cbe8008d7616a18fb62709256b15fa92565b384d09c2581d67df653d5d6b11c2131ed3251b3ecaf17c31f4554c3dd0b6a9c

C:\Windows\Installer\MSICE36.tmp

MD5	ff58cd07bf4913ef899efd2dfb112553
SHA1	f14c1681de808543071602f17a6299f8b4ba2ae8
SHA256	1afafe9157ff5670bbec8ce622f45d1ce51b3ee77b7348d3a237e232f06c5391
SHA512	23e27444b6cdc17fe56f3a80d6325c2be61ae84213bc7cdaad7bb96daa7e8d2d3defc1b96c3cee4a3f32dc464b0e05720bcf1c0e99626bf83de1b6d5aac000a3

C:\ProgramData\Microsoft Help\Hx.hxn

MD5	75ca0862198f6cd378bbd14fe06f19c5
SHA1	12b15882a00f30af6dafd1eb79be79b5c2ad9228
SHA256	15c6e9b23950867b48dd2e48dae398b48e7566817d20ca3ff79311ef637aa887
SHA512	a20ffc6d4a5852d516f3bbb627add7c2e600902d20ade80e0009f69b693120e3ca7791c6bef48e7d82281c69799800d22f1edc7a790b119f6681f26914aa97ed

C:\Windows\Installer\e5e9e13.msi

MD5	8a6e692c70bb13f3f7e35cc5e090c1c1
SHA1	4efd08f438b3fda43f2635652ff1d1b73d29274d
SHA256	53de253e3f9e3bcedb4a8993f44b1ebed97911112cf5c361d6bd2bf637b420ac
SHA512	a17f49ec3dd5d0d8ae7a305e4adc113b7990af21dc4e695e97d03ba4160d58cfa661bb27f70e43bc1160c35f264f1a028a49b0832a0ef63373dbca76095a6257

C:\Windows\Installer\e5e9e14.msp

MD5	bc230d5b914c10bbfaf9fae3f7b0f63f
SHA1	7c46b4b943f5ac0c887cd73cac03353fca1c22b2
SHA256	8924e8a26c1e8391bb124890f7e4c9561fca3ad794123adf10b46d292b0b9063
SHA512	4da6b73bddcc0745380f25c939d9830f2357b0f77aeb3028c18a453a8e344fec7bc2f212a9461bf9fb1fcfbe112aba7ef7ab9ae562a6c8b9c837f8e2b6851273

C:\Windows\assembly\tmp\4QEMMX0F\Microsoft.BusinessData.dll

MD5	3f13009ac5169cb9a180689127f1e382
SHA1	248a263539735eb982d34d90c2ef1cc7ccd6171f
SHA256	e99761ffc21442e298dad82f4c87cb3fac6aed0b9c6b9e389b95b9683984ecfc
SHA512	e5656af969cd0332058e7f2afd2d8c1dd76b1eb343ff9811ac35e832e0bece1109beedcaef820803ca720263cef24d76ae8a63d442d551c0e88c8f389186dec5

C:\Windows\assembly\tmp\3EKRYH79\Microsoft.Office.BusinessApplications.Runtime.dll

MD5	cc872331972aee7370fb9040fad23fb4
SHA1	6ebef1b6e63cc2b72df37cd560acc0ebb1366076
SHA256	5f716c64ea7bab157abe9db0fbd21fd1a06ba0f998a0b9d4597dd5ecbb62c03d
SHA512	ca048d4cc8d18873c01d99bb25e09e7d368d2d7cdbefc090766459017a78066567129806aac61b5a940fb4bdcda9df250cf39b7e9414e809de6ed45695dcf99e

C:\Windows\assembly\tmp\61AX2LHS\microsoft.office.businessdata.dll

MD5	0c6cf147dc0b4e2496b00520bf1914aa
SHA1	b9d3249f794b9c36b583fe6141653e7d07f74143
SHA256	2c8b28a197023aa6f9cebd65ece9b9207d0aef3822fbf1fd36481884a07928fa
SHA512	85ae38357709b8a5f7a63bacbabc8873c5b2214cd6c194052c2ca54b638686549ea8d983d8950b461cb2fe2a33c5336a5fec178689ff3ec8590652d39622987e

C:\Windows\assembly\tmp\PTTSQRX3\Microsoft.Synchronization.Data.SqlServerCe.dll

MD5	cdb528e57c8b2f62b773e6224cb811de
SHA1	3d1086448f3985f4fde510b84f03f5d8a848a6d4
SHA256	8ad8a71e1ee372c878ec605e0de645bdfdebd0ed9bd7e23acc409acec5d23688
SHA512	ca516132320ea9dde94a7001dc7bb9ebd6e0274727123f96746ea05207492ffcfa195512038fb192051a76f476ced4b199160b9eab556409174446e26d083a8d

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Graph.dll

MD5	71d8a3d576f2e236b91d30608b887853
SHA1	dfb152d45384586c575effe3ab95f465580afc59
SHA256	8aeaf1ed7e98f365a26313e8471b5057f8b127e20e8cd87e752a5e6b8e072d7f
SHA512	ac7bc0a370a8433d84104468d197ebb0a8dc3a1eaeaf209a068178be23e77a059bfa8a6b793807981d4f978a9c5075101e07c30eda3d76067f5c6f75676feabc

C:\Windows\assembly\tmp\JD331O0L\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll

MD5	5949df7b1bf7951c55a31803cd4dc6e2
SHA1	93e914a9bb7395d3000120dc73a1012bb8df5049
SHA256	a0a57359f91f6dfe92bd1f20d56d2f463b33954b096a7151b1d1d6e465aec5e0
SHA512	58fcde07a89952a33b8056ca3cd29366f979cc18b5c84c7f1c88e3fbc02130f54ad402a7d23d2402707c4a0569cf964fc652f70e67f657bd4cc5cbff85e077ca

C:\Windows\assembly\tmp\C3D253VN\Microsoft.Office.Interop.InfoPath.Xml.dll

MD5	171e5a171faddca58ef97ebd26837863
SHA1	23a81e5c35e5039d98f6bfcaff4f1062c5cd7899
SHA256	aee75b562d4d45de54f2b0454891f629c4b14313487848b0db64f3c731acba59
SHA512	08109e9b6794433298412de4bde2eefdc56324f936aedee2495c19efcc6ecd6da5121d76ede380867d9716692bfc70a637437c1f5446d1c13aef75345ecdcfd2

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Permission\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.InfoPath.Permission.dll

MD5	d6971fc530c07b6b7dfd3ac9df8695ee
SHA1	456d80d63d181aa33c74cb3687fd905b2050ea90
SHA256	2e32bcbed0a31576334fe0b79421117ecfaa156eb25533c90b693a56d10678ff
SHA512	4259bc9ca369f2eec6a633044bec89288fedd5e341b5d8f3b7277652412e7d67815d2b3b5e84f5927520b3fa83e47832c5cffff6f7757842a17977c64e2cdb67

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\policy.12.0.Microsoft.Office.InfoPath.FormControl.dll

MD5	0826cd2ca41b5acd3da5164feea7022d
SHA1	f6b67f2f452a09cdfc177e48d800edc7da7d8627
SHA256	61991c11727a5c38d3c2ea30ab13c8ce2c372f3940a05d542088acee9e6045e3
SHA512	da25d76588fa0ba2a74843f7b678b0846c4de1c2da686864076a9ac5411af09477dc848913349d3fa5d5bf7564eeef37b8449d83b88c72f19a90265371ab7ec3

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.dll

MD5	042463eb8e2a6fadffce9ad2d0046bf9
SHA1	46095859ca7dd1cd425e273c873becbbba40714b
SHA256	69f903828e3586db6bc1a0b9b10f1e937e9a0411a694ed67e12dc87f0a84fdbe
SHA512	c82f7fc422205b50285c28d9840956a0ffc5e97a952566b3f842d400dd2008b98a38524818efcdc1a8ba87480ae36a229b0dbe352a8e86eef0036e6dbbc17eba

C:\Windows\assembly\GAC_MSIL\VSTADTEProvider.Interop\8.0.0.0__b03f5f7f11d50a3a\VSTADTEProvider.Interop.dll

MD5	7fed8ccc5bf2843d2c5d4b3a5c1d4469
SHA1	aadf34515591930a39075c76bd075d8729dc3405
SHA256	c224e5eadba91bb70be0f44ed59a5b912df0b1c97097dd170a47d05b9547daa7
SHA512	1637f7803d8113ff99576a7e2ea587b462433669f85f2caf0d248fd7a275c2ee4e0102e219cfa315654edbda3de5f342048bbff41409d8497ff0b547680cf807

C:\Windows\assembly\tmp\Z9O2D1EO\Microsoft.VisualStudio.VSContentInstaller.dll

MD5	32595b8e2d63afdb32845b094f039ab5
SHA1	6fd836db90086ace8b51052d3fd6dcd39784bde2
SHA256	6e121a50b9291a79eef9fe114a6654316ac21d7a074784dc30e794f39e7f8bb6
SHA512	d3288ec5019b944c4e1dd3572ce4c9514d96ab6bedb732071d32033b4ee26215f94277e5d2fd3cfc5c0d3ee7f60181ce5e8fc391b610185f4404fe9c964437c1

C:\Windows\assembly\GAC_64\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll

MD5	9eb570e2a7285b5e5edde963874d6b65
SHA1	f454aaa1cba1d0b78a7fb4f2942f9e7e5d4b8599
SHA256	f6cea59f9119b1926ab5de538548cba5fc20056db3babef18a510890a936e635
SHA512	f19e41fb33667a39fb1cd8258d41212feb40400df2c88b6a3111013a7b0080762900d7f21c38bb7fb6e83ced093f12c16bf33c2873e1f7d673f4356b0ea8f42a

C:\Windows\assembly\tmp\X9EBX2UW\Microsoft.VisualStudio.TemplateWizardInterface.dll

MD5	159b4f6c0fdb1edb217087e5b743a38c
SHA1	0b340c309d35d805ebd95ec389c11432eb10fd54
SHA256	8fb3e7bff2f827bfe8081ee28b7e139b07c78b58c14e53346efd3ed97b9af77b
SHA512	13608d36e419f4d5c00dc8aa76c3556604f805f527f0f64992598f9f422d864f5abe6337d472bffb8ca8617eb72a7e6f2f9d458cec15d40a11a5d9bca8b272d0

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Package.LanguageService\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Package.LanguageService.dll

MD5	cf32afe885c8c8c95b507fc76729f37e
SHA1	32eeba5ef818fe039338525e4a0b105f4a9831da
SHA256	34c46cbefb42b2e8473e571a7e9a2b39d5219381d53eee6a43e0947405c1bbb7
SHA512	0b5dddaa420a8fad6760c6c314d57e8264dc2cd49cb8d26412e0d7f5b2b2bbc4295dc5f4d48d704ddc436025a3283af50d4faccd72f422ed7d6b9aa166b56912

C:\Windows\assembly\tmp\8POJSAG3\envdte.dll

MD5	8f5a91bf5ba4964e5414b674c713bad7
SHA1	a5963826b260e7815525797cd169fbce14e6067f
SHA256	5a89ccd35b414191d8597be6ec47c48d72486782f0ffd4873d3b71df56da2420
SHA512	a2b9374b77f581dc77a87abc075f2dac424c38220198de5fd7c3016c6a8b4d20444b80774fa27c7b6ffe074b0bc285f8c410bd6592ca9f2842c5a587dec1f17e

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ManagedInterfaces\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ManagedInterfaces.dll

MD5	7ec416cb86f38cba8b0df9f8fad2a1fb
SHA1	8b65e620c3d692aea8fea36786bdc1a7fec054d7
SHA256	85a8de8b07795ce92942f4be8c8d8fdfee47170d29853b35ecdfd1ec656765f6
SHA512	a62ed7c4a9f38968f65daf3184dd59d8bb814cbb8b6b6ac955efbaed3d1315a988294e87be05220895910436550f3625de9fa50cbabdd866658afdf1b62db994

C:\Windows\assembly\GAC_MSIL\Microsoft.MSXML\8.0.0.0__b03f5f7f11d50a3a\microsoft.msxml.dll

MD5	10c19f7f60984e70f771b833e0543b1d
SHA1	bb6b90f0430bc2ba86ad2628f93831dda48de414
SHA256	6f39ec631222bbf42d95694780495ae53b362e46c9679a2df08636c73217d2b3
SHA512	bd61383616e85d0f0078f1c933539d66cdc229a3c22782bafc54e526b1825ec8afbed88ad4a0e629bb79c2ff0b105c5ae018baea21c4c08b09e187241bae7c62

C:\Windows\assembly\tmp\GBHD7YYZ\Microsoft.VisualStudio.VSHelp80.dll

MD5	3ed037e93446a1239d992dabaf00e4d5
SHA1	6ed4cf6a2d1deb54b89ce040677d0348d5d88f90
SHA256	458daeceb66ad0462f30a6df7bec82865f69925c336e81cd99ed3e61657e76a3
SHA512	16144a326bf95b01f69c9613f5419a2c71deab47897ac887e32950ae2c331ec6b7f70575875b466ff0a5043aaafad2e8ae6ee24d1748716266cfacb2b134aee5

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Outlook.dll

MD5	812a8b0fe904eef755646c5196a858c6
SHA1	4aa8ef129bd543d9f2d76fa94e0ff3f4fd804bfc
SHA256	0b11980bf778e65f5b6c3f6cbac081ba34c7b42d68621a68da335a9034b0d694
SHA512	72c94c9d268174ef63276abbf4014e741156668dd94079fe7cc70cfe17b7acdea46d88a1617d8d5c6d47ea410ab389d3c6ae96bbf0d1327770643744b7af76dd

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll

MD5	6b9bc53bc0a44cabb1f7fed4b0208d58
SHA1	f33fa6131caa234cf435c12c685b3fee9c53b564
SHA256	8b410ca6e0290559c0926d540abb449d89688d56ad7c9856a035f8bce962dfc2
SHA512	28de350242f5a54a135c544100c31a2f65baccc3e3744a65a4978dc11f2ce643fec8b46ebbbcf739a713d17f7d0e9e786419d972ea72a289bd2797fc1b8f0545

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Publisher.dll

MD5	d9d04f052b2a2465628825464ca578a7
SHA1	f59a065775d1396663511b47b92267eb7cbc8023
SHA256	c81ee2abd24ee75f526c0a7ae116e300551195160c0adc1e5b808d90c48250c5
SHA512	a00920081c1308969823d3d312bb5076115938fbc33630db79a60619606c7e4b96c7e9c06f67c7ca3c6f2a9452c35b4fe830517d40b199a2f3dbe07da15d4c0d

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Word.dll

MD5	a34037b99ebd76fa30d73e6c8503e8ba
SHA1	70b51008b1efb28cc5ed61473c61dd703510868b
SHA256	ebc889fce674b20e7905c246de5022d9a34d17c8c9e8ab0e978d24d1e51aa49e
SHA512	c3a6a30ddedc3134a7a2b26c3536bd052da80ee7104690cedb6a5279d140f9790c737534e17854e979f75357a7d4216ff9dae1165af922d721c8ab83420ba4ef

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll

MD5	0c560fe70843b466e8364dd2bc878f97
SHA1	41261788895caa393f15dc522e0fb0c723fc358e
SHA256	e53f7ab472788070f1d4c3a34ab5028017ba05cd98ad818ad68f5525def1254f
SHA512	49066e28228ac899b567f62a49264bc31dece605d7655f65c75d7d01e66542c552b5e44596970ea7a08af44446caa8a98253f6d17371f347c696d633f25324ae

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Word\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll

MD5	7fe6a604b9cce92c319819872f7ab285
SHA1	cd8ef608670bf33e9bd9ed812f6de16afd221c50
SHA256	f9c65a361003b6823093166890d02aeee9287926c56be6f401486f0b7347f956
SHA512	cc2add46d9c0501f92dd95e1650027a45c7e4fed56511e8d3f1afb1c3fb6219d253f9634cd973452345b8045a4004cc975f51cb21a1c9491c4ec6b954cf3e7d5

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Publisher.dll

MD5	89c5f582d77dddaa775dc7629c35c592
SHA1	380fb069b05787a322786eb1b3c02903d229556e
SHA256	4e448251c62808d3a8514c77163b1fe7b5ec3f91d77925b13aad87b990289b0d
SHA512	01a152cd87df75d631c5dc5a326dea298d6b2718ca64454b76cea13802cf5e5af2b87b280f4adadc298a54f35f4133a8819de3403e47ffd5a490c406cfceb64a

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Publisher.dll

MD5	aa8582b922bf6a110ad1422b40950720
SHA1	842a0e855466aca24e3139f5a0c1917dfdb8c857
SHA256	19c2e3e541d8fd067f7e1a1b35fb3bb86d228e692a5e7915f92e39b183e2ab3e
SHA512	e230c0fccee696ce947678104bd0d044da424914f3ed3a62bda8c40e35cdaa7df06e0c13e08aaf1e22c5fa3ef0c0fb654788b15104938dc7812b62e6e697a6f1

C:\Windows\Installer\MSIE48B.tmp

MD5	9471017b246f1b3dbbd8984ecc1f4293
SHA1	d498d3f0fdf3c5d90e244094f3df3e618da36341
SHA256	e75f900e7240da9993c267a11f5a68d4c2cebb205fa690200bcdf8e1d0b6e7d8
SHA512	d950f8e613b8585ba8148cad5731134105bf992d160cdedffdf914e78e7b9f1eac0fa3d1071c87343ee942a92ad8ebd1970850edb5fb278326ef03e9ab4160c7

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.PowerPoint.dll

MD5	31237bbfa5730b335b37a15d71623022
SHA1	e7edc6b956b18454797a9b9d050fec84e0f8b5d6
SHA256	9f411b98dd23f7609eb38e85315ce36fc5f7b9569eba260ae6fb37f28fc39000
SHA512	2c1243582ce8a54b4100931335b1d0add990473cc5902840204cfcadfe11873d3357c6be06e2f89856d8caf9421231c3a8447f20bed5802a26fef40ee2b86371

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll

MD5	761343b53e834e3587e7517d37fe9d56
SHA1	3d07b51b71f17eb0023210297ee938052eb1dcf8
SHA256	b9ff412610e36e71bfc64d017bc0e580d23af82616efd42f9855901220e17c6f
SHA512	d04415f5b723d495cfa9e613ac9a5c314780e04f2a345e0206ce4b31ff30a2bd8f553d2639420a81e25062e22033d34d2bd1f0e63a56a8615922cfcedd285808

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.PowerPoint.dll

MD5	0c9b60fb4468286cd50a49e9e1403adc
SHA1	5d1f6823aeb576534f953b4f36ccfd3602b3fe9b
SHA256	508b832b1a13a903dad969fa37b4b5aa68ca6a02e482da00e455ef0ca94764ae
SHA512	a57265b2898fe5e4b0e984e6773702e2d24db1c9000fe239c32679d81622bfe23b6c738980e61233f305513cd50ac78708c6b71788c42a7a4ca141075c90b8a9

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl.dll

MD5	45ec3053444ca47bb540e7036f50c0ba
SHA1	12c1ecf570dc11948f040db3dbf2fb64813ec563
SHA256	ac70ac2cf55618c4098542c333756422c8ce0c7313a68670dc35ebc9ab32abb5
SHA512	1681a1b3fd20ca1ea560f537db0b68a86f37c3154c0d2a786f16ec994e9487a0fe3d130fafd2842549c52b1bf65b9c9bd8f2d4601f036f581899569dd2e6fc2a

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Outlook.dll

MD5	f09cdd3138e5efc8662cc948636f53a5
SHA1	e39b9dd327a92a314b96d957b06a7dbcaa358869
SHA256	e9cc401a81329193ffb0d4a6b85aa16c26c7a0f1d4303c772c864f5362cbe955
SHA512	d6ea14ab284780d0746233ae7072e0936ec8fac26078400e8c401fc7485e91391bb57114471a4444f440cbe3a7070f1249c4d9f516430e5d847160ff7993fbc2

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OutlookViewCtl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OutlookViewCtl.dll

MD5	95adbfbdc616027379e0f9dcc8e35370
SHA1	848a52eb45e9e33a992828b8bcf324024e027f6f
SHA256	78f8d7b572c7e965f4388fd0d7705d8a3853943f585c9c8b0d66d4d5db40c01f
SHA512	0cb5e46a6c1bbf85f7e76a5b2a79ff5dc7eea211799b57b310ff697f3bf9fa66c04e958305a1ba1e11ae1a9af6e7fcd291590f68a0b1601204ebd1dc553d133e

C:\Windows\assembly\tmp\UJ20U5UM\VSLangProj80.dll

MD5	c3293a5fb62059a8e67ca0fd52021d8e
SHA1	8bd923bef805cf0a09f2a7e48c89d9b68de8a459
SHA256	9285fe41ede31bfcd26fbba8c81c941889db134895358333c5644c3632fc1240
SHA512	87d41f2d3d44574bc017d9767a9a45dec310b1a3b41eb6ed346729d341445aec9f60a34fe7a3b0906f4c4737383c4dca3e1b7861bf9227bb28b33a8bc2215f48

C:\Windows\assembly\tmp\C5LC32OD\VSLangProj2.dll

MD5	8d85b2f35cd05192a9c7bb71a472b02f
SHA1	8d06158a86d5ef0cced5719895dad0a6c61238d5
SHA256	b9e4e6b69e83910cff6136bcdded66e75873ed92d4c4e36bcfbb10d5ae1ab6d6
SHA512	b324e5ffc64f2dce728387d259387c24d3404513e0715792b15c2964fec1b74de1f5efcccde9a140f1681058144492119e74aabe7eb08962b51960bd3615e720

C:\Windows\assembly\tmp\6I107GMD\VSLangProj.dll

MD5	b2e444d38228a013e5daeeb6c33386d2
SHA1	fbf33b5ec43690f4b3f91783c125afc101a78c9e
SHA256	e36be6d6b58485162c9be7ef9641569283959906038bbe9778c588b3d221f115
SHA512	047a08b36e1b5f53d05f97a0b7fa18c6d25bd37486305332c22bf406bdea509048c0634fdf68f88ed662c4a76ea2994801203118e0a182bab1eb1888bac54fb4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

MD5	0531776519b62d36669b97d2ab3eadec
SHA1	155d2d4130d6e75608b23db52988277e38c4bf89
SHA256	7f43b2aa4eeb16be9ce7d37b0192c3c2bbc4e98157a581f309e57da2d3a26d1c
SHA512	194359a8e4d2be24f327d0a9b278a4c17da7cfeef92c5149b24b62f081e55fa6736edd01ec8317b58072a3f5e0e8bc912543390712b5350e90b76c4a06ab6352

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.BusinessD#\4fe59091aa007f3d1b85bf380b9280fa\Microsoft.BusinessData.ni.dll

MD5	7eb34a419ea63f7c3ec10dc2ff5b5601
SHA1	3bfe5b22232aac12aa00cc9f093108c151bb6c75
SHA256	ca2e11f8441ee666e561e70f9d4f5a77b0fe7aa3411c1e42fb2c11dac69e5d6d
SHA512	bb5860af799712b6556f5ffc59ff596013a0e0ad6408b564e82e7567c8e1fcf189bc269205ea68d2a48d99ec4673e5f47b715f2582b169ba0879342c78060629

C:\Windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.TextManager.Interop.dll

MD5	60ce2613e100817b2ea77fce6049ba0d
SHA1	100e051333f82689e6cf481bed33e22c66f6945e
SHA256	ae187e6852d4d643565ccb48b8551204c4669f47ec69b10fe23147f749b6c857
SHA512	aa307c15d5946398ec1066d35dd0e7ddb19e430bc7522aa2435fc622eebd73b6985d0f0d684ce9a70f5197b1d74627a633c0dd2e76ff023cdd83499023ce513d

C:\Windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Interop.dll

MD5	dca33602346f7d20f50bff5b69b18a17
SHA1	f527cf460fd8e1e1cc6c02dbefd548288891500f
SHA256	d8dcfe9879485bae7f03335c88f78b45e227a6a50e5a14fe656e9ad45c310395
SHA512	62ec218d8dbf479b0381b60671674f7479ad1530bf22fd9c474acbfda0cd6a5bfb9547b3b27c868aae83d7083199f392c1fcaa67900002c3b02fc8b4cdddb43f

C:\Windows\assembly\GAC\Microsoft.VisualStudio.OLE.Interop\7.1.40304.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.OLE.Interop.dll

MD5	cfef6db63e3b54e1ac5418eb8aa5cef2
SHA1	c9c540d7603b138feb6fde2c5abe4e82fb2d6a52
SHA256	09d742d19d13ffd6d62e3d2d0b82dc12e9486c37508789e644463052cd056798
SHA512	70cee8a071a22c4140c77ffee01d5852c0cabdffdf593ec8bd58d1141ba2c737b444c97c9f221bae0b4b26154959febacf27516177bbcae48003fba22e5bb3be

C:\Windows\assembly\GAC\Microsoft.VisualStudio.TextManager.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.textmanager.interop.8.0.dll

MD5	ca184191038ae1b452e0367e57748752
SHA1	18f1f2c50d7fabf9d109e1d6bba9db4b7fe1abc9
SHA256	13f823053b1b7b54a27275b2bd07e65c6b0bac9009b99932723131a2f5d48108
SHA512	3349430cb5267fa899f64c8e135ecab50490caf74a076271b020c7266ad0553967db3f7b30d6f45989c737ef7140b925daadad17299f43ad96a961bec12b2f5a

C:\Windows\assembly\GAC\Microsoft.VisualStudio.Shell.Interop.8.0\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.shell.interop.8.0.dll

MD5	7e6cbf86166495dc66b9d9361d83d663
SHA1	2c081041993e64d73b4ea78462a66eecceaaeef1
SHA256	e2683796ca7c71755e353698f89e473b79adccd5c91b2bfeebc1ebeec7224c93
SHA512	12db4ea2c4de77371b0f47a32fc51d87826332d921d0c1f885927f2e097699f6a48eef29fb8acef890dde0521034a95ce6ed4d5816c3dd48d2a28a934a6760c4

C:\Windows\assembly\GAC\Microsoft.VisualStudio.Debugger.Interop\8.0.1.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Debugger.Interop.dll

MD5	34564e761f6e4d1fed1f2c25ed51aa4b
SHA1	ca6cce9b1b3125cfb158d71959f3d615235b0b3b
SHA256	6b88d85ccea18ff53750faec0a194ff64ef97a0460531cbf1a9c42e1eaac3012
SHA512	2e4c49fe41691646e80300227820d1c8ad4fda1b133e949a68c0b92d79fcd9c9a1ab96362057c4d497af5d30feb16dababe883a708d5951e5c2bd819af0af503

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Outlook.dll

MD5	5c513bd2ea82a89e15509d4bd59cb55e
SHA1	7b13538a6c73a7253a3b69c7e8dfd0093cbe4b20
SHA256	488cb1082f769100b1883f804b02e84c2269bb8d75b79ce459a3ecfe216cbd08
SHA512	df84327ca85351dbc4fd5421882a91b391a70755f4ecd20465501f9bd3c99d3b033346be6684a3f066d9e64164b68f26268694d25104014f1d667abaaa30a22a

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\14bf2968f5dd5a9f660e792c459b682a\Microsoft.Office.BusinessApplications.Runtime.ni.dll

MD5	9e5d686080f1aa02bc54dc9d6abee2d5
SHA1	1252ec97af89a2714fba87a2536d1125f6904ad6
SHA256	4da4a382d5e3eaa786c554d4b329e29f171a9aa6493161f8bc2cb89c1ffc9f8b
SHA512	414913b5758814ef421596f01352574529128d3fd7165afdf310757dc930888b8440275bf03ce0d0537b2b23d302e4cc4a0cb2f7b2f9748f551b1d18f92b2547

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.OneNote\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OneNote.dll

MD5	475a31c143a723a68b3cbddb91142650
SHA1	7d026e5e131d5a91b97a67dd4b28d8958f4953dd
SHA256	03a15cfaf6809df30e563df751449a53f7194d3003006b1a1e299d60cc566125
SHA512	2b8d29d312187618b10cfed44a5e9f2414d2dc78d47a59f74388a2073a935c24f227e24c27fed636562aa49577f40412bc3852f7dc8e6c0ddf1794ebcf95ea72

C:\Windows\assembly\tmp\DQTMQFWA\Microsoft.VisualStudio.HostingProcess.Utilities.dll

MD5	2ee6d1883e2d22fb49b37101d71e081e
SHA1	d896ffb3986338a4bead0b253d272236b4978678
SHA256	a73a0a1ded4da4b3354f2a378a2c998df847548daac89a3ed41f5aa5b46aebee
SHA512	ddb1c2467a91bb1d50e6341f21fa3af5eff9ba0c587616a5d7fd00a1cfd39ebfb3072b3f37e92bb8ae83d4898a68720a5abe6f1163b450a61563181a5ee5f285

C:\Windows\assembly\tmp\Q7R5AMTJ\Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll

MD5	2403c8d7cbfa18b0be60dcab36242bcc
SHA1	c143d20ced8b22f8e8355f972e00f9ef4255c85a
SHA256	9b3bd8c24403ce590594e4cd97e73e25bbb1e06f2630f3f2e3f657c476eff25f
SHA512	6b3c806766c5336e680cc8e493c4f977ddb14ad55ea9f3a67f0ddea5bd52671394a1068411ada733be782508c9b8a683a52d2216c5c8797f797a36476ccfc08c

C:\Windows\assembly\tmp\85KMNX9M\Microsoft.VisualStudio.VSHelp.dll

MD5	b8db6edde57080bf76ddb25e6a1a2784
SHA1	a88c9442db005aae9c6d3fed2eb4392c3fb8939d
SHA256	48c666ed08f6b109d6f9b1fa21bcf0160c2635be10ce6d23fadfc3414bcfdb68
SHA512	3e57c1be49f4293b8956e6f0a9b8baffed934f05e06fc1c6a8f0a148eba8b5180239d5d3dfe64633bd9cb1d876db66631f5bfd397f9ce4b9150ff8d61cd0e88d

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Editors\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Editors.dll

MD5	8a39da7a168a5205ba3212f8ad1459be
SHA1	f2ac20cca6d64c7ffe6e7fa71ae6d09cba7eac4a
SHA256	b804bc9678304c861fff28680a6f05e16a0a9267dcbc34ce1ed8546830100204
SHA512	5f3c8c1cb9b8c380c1af2760adec1aa8a5cb2c582ebbbd6de82d69d5e1ab1897a37c2d676d155465b085753348be9a00aab2fb821925238f8904d47c55266407

C:\Windows\assembly\GAC_MSIL\Microsoft.VSDesigner\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VSDesigner.dll

MD5	584e105aadb6419f91c3b54be436fbfb
SHA1	9185510a18fcf9e0994a205009e74549093cb76a
SHA256	87b0601b29d147020c6e2349ff68d48dd6ae160741daf4470e68ca746d0e1dd7
SHA512	eb79f0deef98498baeda9537c08f56bcaba0e7ab83e8a71a27f7a0a61df5154c4266f4a60b0965750f6df7d7f641f6e268716a13d554ba19df721c38c267d48f

C:\Windows\assembly\tmp\RDGVDYX7\Microsoft.VisualStudio.CommandBars.dll

MD5	a307d0f943cee606c71c2111ed19e443
SHA1	206cfd58526fe7097608b3c41398af8b533d48fd
SHA256	fcec8bc755b9eee2c9fcf16f3e834119c7f8cba4476c7886ffa3e33f7be19fe0
SHA512	9955d5c2ec941abb62a5ee8a829e8763990666e8fd7326a70b5ac825afb187ad6f7c3b5ae1410679ea71fac93fa228d7b328b99f8d1b066dbd65d6f5638af0de

C:\Windows\assembly\tmp\TS66MTF7\Microsoft.Build.Conversion.dll

MD5	af474fa9653af024b7f02f1fc7013470
SHA1	d9a45f4e565193d35338f1119fb3de9d17a6e268
SHA256	255ad3a7518eb88cc5d89988f760e6d70836eaff42e2e35b800f889f887ff522
SHA512	1c5f6218c3162964c63ed9d3e13e4a24dee8c54196c1b44e22d1667a161a2e35f65ae417ee9e08dad71f082817da1d73b810e63ebe54b1213a063f5b66ed9c8f

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Publish\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Publish.dll

MD5	de1ce903a38ea61a61503c2e717515d1
SHA1	bc18e3d8f8e6da54705dd33820dc0f22a5e72cce
SHA256	6b578b421dd9d13603aa115548176b0bede331ff5110a120197aa11d67f6d454
SHA512	584bb1c905c898ebab58c2d341c270f2b32ddf264a571fa363debe75d9df2a30425cdea71c54b8b904b0b961fdaea243c9e20f83bc8311df4bd9240113ecc94e

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.ProjectAggregator\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.ProjectAggregator.dll

MD5	211a8c944ba151d7d672f50b5281200f
SHA1	2b6a570a518e5724b1e19873b4bc0b7f10865b2b
SHA256	f32bec0c7c1f69f8215389e4119f4e60af9a653ee346c5a3da11131895a5b832
SHA512	1cb2e91997af004928ec0f8d9341b329acb119e78d5ce7a4351fc2a1a998251e36fd7c03b6fb5fb23aa3f04b6fd0e188384e4490e71066c2e9b3e7b725573f11

C:\Windows\assembly\tmp\BYPVIW60\envdte80.dll

MD5	59e452fd58256b30fbb5f8583fac5b67
SHA1	d033f69e737d866c3da5369b2af262f7bdbfdac4
SHA256	01d79d8f2dfe016117e404b80154d4fa2ab60bf7c2fb544ed55e0cc8a4b0d393
SHA512	2acf421fa6853959e086b7588c6f4b9c8560fbb1d9e8d6536c5db3f19eef7374fa97f2eac570a701ad4de1c07680df381d78f206ea6a30037882b241898f5251

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.Design\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.Design.dll

MD5	67122834ecf139212b822e2607cf58fc
SHA1	64eaddc58dac332a60f15fec1f4772e03e01c91d
SHA256	a4d2b15596dfafef45067e456e7082ea6c3c891aba3727b6f8f37d8ed75839fc
SHA512	b458dee38df25aa2c1886ee27e4da1e7b96ff80fd3df68fd93ecf942a1e5d6732beb7f3a9d1db7ab6ac6003f227960d741e7e14a791928f487d8dbffcf08eef6

C:\Windows\assembly\tmp\BQ6EUFDA\Microsoft.VisualStudio.Shell.dll

MD5	a418f88f985f26c98da7a61115cccdf1
SHA1	071c35005c4620f1727ec30f8a2268e60ce9d14d
SHA256	3bcff28ec1eee268a7aca8c090792235fbe132ecf998336fd8cd8653b544df01
SHA512	ee376a428bce4e9cdb28f57fb27fd0721693f13cae62cc8fc6a14cfb63d5e20ddcfbeacd57f9ab2bf17b739fda500e675884ce51fc6af5ba73b13200a48d753b

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio\2.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.dll

MD5	32dac9c8de25665a56bbda394a50a0fa
SHA1	1e946b347383baa59970a7c080853fb97d93d077
SHA256	2bb398910c321ed21cb0d704e5abd7cecd1d973e6be8d72925f03b78a9d0a547
SHA512	dd455e1814b19d5130fdfcf26128366b81b5e6ca2767729d4af9fe5c2ad797347f4880b779dbff829b3d8813096fa752b3ef3208e5c66356d9e454995796077f

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Windows.Forms\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Windows.Forms.dll

MD5	772cf79a7f809c3842a8ffa435c7616d
SHA1	8f67950560cbf1f886271f32d3cc62383a5dcf0d
SHA256	a8a238d73c727edc4ea7cee9bd7eca4db73f9d845e2fe60f8e237d63be8f37ba
SHA512	37e437cebdb3d44aa34d3205980d768071445317e448c6658847273c8e70086f6c8e9eeef1970023950abd187a58a029c3bd59ae9e2b2c60308176a530731ff8

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Design\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Design.dll

MD5	492dcf11858b5f29585ae7f0f26af695
SHA1	f07f6ef827d9e25e0a386c353fef76c7f78b6e07
SHA256	40a9ce0ed4ea13f145a86f03d441b1e999ff55d7c84f2c5c9c80cc17884b802c
SHA512	5203458462142adb2519340ea530acf68cf0dede2261477b6c8451f8b7ed4e6f015ba560a8daa4c449749e74b996596a19392737abee990ca04952fedfa90a9b

C:\Windows\assembly\GAC\Microsoft.VisualStudio.Designer.Interfaces\1.0.5000.0__b03f5f7f11d50a3a\microsoft.visualstudio.designer.interfaces.dll

MD5	4fca230d88b5afa87caa2428031ebed1
SHA1	4a350e06c30aaf1f7f62a6cd50cb1a7d355f98b2
SHA256	e030f6f525673325d2a605d418f6869019e4dfa83809fb367b71538ad796e7b9
SHA512	109deca8be8d449845c39ce4f297c547d7375a756cb76a61bcdf768e71d44a6347b474cd2093bb765b1beedf36c60cdcf8041781e05b2143f61e7427108a5772

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Configuration\2.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Configuration.dll

MD5	09defdd89f8baec0c67ce24bb4b22755
SHA1	9c78b4fe6c4ed1cfa87a5f1d5f956cdaf0c9aa53
SHA256	210ad8146d834909417d224105c1c9e104fdb847d37eebf88b4f673dc482a0a5
SHA512	558d75deb1a4beb5454d9a670e3b27cc6b97139f9702e5b3e04ea129e10d4650f551193c8ba0e4006f8509b09b26537a94031d48b362fd6c8bf0377903353f3d

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.WizardFramework\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.WizardFramework.Dll

MD5	763356614649448dcfb951b6341178fe
SHA1	b7a5432ef85d2bbb9bf777342d4e36a33e0bd5ff
SHA256	e3bac9c47627b55074712ce06caff0d40838798058f16bcc187886b4f9d59808
SHA512	8a2796b013bb35625171db0418aa01d440428eff81af6505e6168f3f72502cd9139e58d162b7fa50bf9684a75c31ecb8624f3ba3fbae7a630955efb052cef23c

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.CommonIDE\8.0.0.0__b03f5f7f11d50a3a\microsoft.visualstudio.commonide.dll

MD5	12fd5c85cc0a486e3f8947a902089a7f
SHA1	28abe2c9bf4518fd918969b880c04d6ba1db8ac5
SHA256	2e44eb2afcae64421607e71abf0646249ec38e14f84b820a79ebe8a0babed9ed
SHA512	9ba4b77649c6386b9ebb5021a52217057f4165d4a3961e3cb69cb026dba5da6776e06fc775361f70ea0c383c0b817590b2f6acd070eb5acf3067003b033c58d8

C:\Windows\assembly\tmp\4VG0H4G2\VSTADTEProvider.Interop.dll

MD5	2f85d4bb210633434d7d931dda7e40b5
SHA1	4e8457bfd2024e0c778d6caad997e703c6ca7a3a
SHA256	983d1261f40f5559d58c90bac34a6ca17dfe9bbfc292e69e5e2124d686c9e109
SHA512	3488a276231cad2a5e7b5f8e91872e229f707421909f5fc56365a93f574c69379973b5a67049ee5e5ffa4cbee47e5900976ff0ef4af8b78a056552a19f78a92e

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\policy.12.0.Microsoft.Office.Interop.InfoPath.dll

MD5	01dc8872b977b52fcf94c6b37e2e3eab
SHA1	f953156f61d865b230b6bc001fc38d6b4a6f3539
SHA256	e0287984013e41999b4987fd56ac11bc30c7723409c8c561a4ff371e4bf972d8
SHA512	9019755275f0714a8b395f48b69763cd06ccba1f597c5fb6e780bdf1a1329f8bd4a3e77f61916fcc11d2b6d68d23910fca531f52d67afddb59371209f159c144

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll

MD5	b53912ed4735cf05d504d4aea025ffe7
SHA1	a5c65c04e7f38cf09ffcf54a9d04002e34fdb613
SHA256	0630d6d0588e7947c5bc9232c06c38f3d1f2796f54059ea04ac1d696c4891a4e
SHA512	76dcbf10330af0b8c4ee61334750e04ac453292e168691228c4d6624c9f740bc84ab11da4582c8ca8170df9204580839563014b72d37c2f82674bd4c7f1790d7

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.InfoPath.Client.Internal.Host.dll

MD5	b2e5d2f672b638cc9fee5efdfb09b70c
SHA1	80d15d8658c99b87b07878396de8b3b4885bcaf2
SHA256	92a401208f69fe478ca1b09d1c16c8546e964072c05f0be549d52d847f48a8ff
SHA512	8a2a39e7ff04fad653aac813aa4b0c7099521576c0ea7fc1fc9ad2468268c7564e1de717e7c1d8fab67036f52f46f453f58eea61a585c45207c0097ce4b88c07

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.InfoPath.dll

MD5	869f08da5e80c461f698bbb4528310f1
SHA1	59b013953c4af2ecb11367efd8f6ca41240fd174
SHA256	a2aadc8a7ba78a73966971f12ddccff63d4b321a3cdfff99fbce7161bb09e964
SHA512	b94e61ed497b58738c6e9b246774b745746f2367091547448bb1188c196a68acf24207f5c894754f7595e30044ca2adacbf5ddac77024e216c6522920e54ba23

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.InfoPath.Xml.dll

MD5	b4285a86fc714cc0574b9070fb0e511f
SHA1	889c4dd517314adebdf0b1cee4fc7fb715e67d67
SHA256	028b3175519e570bc69cc7abf990c76d04a88e953a5cb456150329f936b08ef1
SHA512	47d231d0dd175d35e9b3fb40bfc9bd52f1b6db75bdae11ad0d4545693b6f1860bb55ea15fd93f079443923df6ae231b093163c08c2003397c4b75e949721f6e0

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\c57c090ed75ebb19a1a88c2b0830415f\Microsoft.Office.BusinessApplications.Diagnostics.ni.dll

MD5	ca78dab897dc43013806f9cdbf8448e9
SHA1	67185fc399173de9be12c02f30d5a7b309b358a2
SHA256	f73691349fcf0fa5db7a25937a17fcbc4e789fe8a7599b659b5738865d0f6e7f
SHA512	b00212792845ace6fb506b3312eb97cf1db431054adf3803fdc7eea204012e461813324a9a8e3f8c23fd0a6cbf257037e7fea96bfd12ba1eb4ce501c7d3e920f

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\6d27d1badb928af6d0b93082d7716227\Microsoft.Office.BusinessApplications.RuntimeUi.ni.dll

MD5	587fcd554d08c85d83d1dbe70c55020c
SHA1	ec3c273eea535d443416dda806163b0e68eab352
SHA256	69a25f485486d4dc1b00f289e528858914df80ed08b277b315ac77cb8654f42a
SHA512	ee9dc6bf8d619301192158cb4b56ad4c40072c4c9da19c3ed4ea90a35e19770cb1d291cf571c3911803fdccb258461e787f75ba6343ce4bf019c674319e31480

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll

MD5	ea39607c138bbadb76883fbcbd264ac4
SHA1	7585ea602d453cf5ff82f907550f2b394449fe9d
SHA256	5480a81da15f162cf86beb307c7560e63c3ff2345a490320d54380224ef2fb0b
SHA512	70a8cc66dec53e2dbd6b8ff7c1c1687fd9944f809d8aa692a6a14c3ea3bc7f2cb9e79d7fd3d2c49a24c192f2b89be09687e623e343aa2a37b0496f74e0caffed

C:\Windows\assembly\tmp\H9VVJR9C\Microsoft.Office.Interop.InfoPath.SemiTrust.dll

MD5	596f16ac9ac8a38e3c4da8e7a58e7310
SHA1	eb6be95f37cea49d1c4b449f7761be8d1c424182
SHA256	a9e79edab567937f1c570f32696eb778f091a4705dc098d4947f4d03fc7a9036
SHA512	bf173fcb3f57a8c6ab12b2c6d4647f08deb07cb874d692047e1cdc2972d0e70ab94c5edf7b0c38e883dabf3de0e14afe4bf07d584f0e696ef917f032d4899427

C:\Windows\assembly\tmp\Y995LMK5\System.AddIn.dll

MD5	7137b00cd3c6ad6aaac4d7ee614137d5
SHA1	03592204d38d754627bf7f1cfab6fcfdcc13fb14
SHA256	44af30b38a26ae7baf5d44b55f092e03a77f1e92857cb181ee228561d0b71657
SHA512	cbbe072ccfda80ac5b554c4ab10c1ce6f5f410f645a914d8924ccc7a544db00e1f67c897bde7d688792a1fbaa69b8da43f58fc72a5fb0e234b11f6c43d564241

C:\Windows\assembly\tmp\5N9YIOOE\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll

MD5	cc5ecb09ffdd2a7915e3e98a15df262e
SHA1	262d6be67df5bcaf07e11e8f56e830cf8bc98d9a
SHA256	8d2a32b15d7a3f2c93e78594a9645f16bfc1857ba4fe5647776e6f25558ca24d
SHA512	ca4299c205d80a772ab90af1357221a293ff49cb190afdac6d4ea921121773aa7b743bb5363ee2ef835001fba5c6fcc0c71a466e6600d1e9ddae7bbb73f012a9

C:\Windows\assembly\tmp\F79S2ACJ\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll

MD5	9c7403906909e432ea6a2511d1b3cdf2
SHA1	87d3d6b6c2d861aa5b61b0f9975429c7e9c9d252
SHA256	5087faae290198a5082351f97e31f3f09db1219579d65ee051f50128c53cb2b1
SHA512	5c10dcc601982f2b685b33b5d6ad2e5fb38aebc8eb071b02868b5f242feaa6c23612d556b5042c3021d4fcac505e33a30a8b67c61fa6e28d4364dd72465d51c6

C:\Windows\assembly\tmp\QGH8K045\Microsoft.VisualStudio.Tools.Applications.Adapter.dll

MD5	d25761bccc62c0fd2edc5770909db8fa
SHA1	9364bc5f4e02f326bc3014c39f9d6f018ae78919
SHA256	4662b1e874b2b460a49502e9e8dd4e41050cd67f5223b629ec519f507b7c36e3
SHA512	fb25f44e1b2bb996b6054cd3a588195f57fe3a399c8645d2f24966c6912ff588eb2869e2eca0adcfd710673c60d77c621317c98c0b7c01ef084a5a756f56cf90

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\14.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Vsta.dll

MD5	f4bc7dcb4bba0919bff710d929f7bd14
SHA1	efc3813d492af901a71d48b53a1c3109a18588d3
SHA256	b43f2b1cdbccc9649c0f29e03a699ebebfe57833c6e4223db334551d79cfd233
SHA512	21ac95494f36e1dadd57bb7dcd602d4e43d9679bcfe23a635196e792c48e6ad53e8c4fbf6acdd97b100580dd5f2f72c93a5351d2d75c05cfe1edaa373208233c

C:\Windows\assembly\tmp\MSCU58SX\microsoft.office.infopath.formcontrol.dll

MD5	cf202a917d36e48fad6f57115d643536
SHA1	a1100bd4aaf114a2674c0dbdf9a9484acc7b52a3
SHA256	312eca5244bd1a841dc7fd8295a7b2f0040512cb960488a221aecb9aa464390c
SHA512	509ca33bc75f20ea21944d48a2d31a7a7e8aef7cbcf9a6b9d5f4eed743e4267e3cb27cf3dafc1c4789fe89399d9fd88d3e1023026a012abe17d46d03d3754113

C:\Windows\assembly\tmp\SCLBN2WF\Microsoft.Office.Infopath.dll

MD5	d45565a49811dd248532076d4374bd43
SHA1	f75523a957f1401785b84c440d9c00cdc959f65d
SHA256	d89989a4e021b8501e1a4ff3390923f78dd2eee2fd8786a941515960414ba2e7
SHA512	3d0102286b7793ad9f24e6b3ba96f656d3a82378277177d5a44f6f24113524eb0a1b86822982de42d80d1464bfa9b11c312c996a1266bf3ce62f659e12a01525

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Excel.dll

MD5	a0925184cb51086a5a8f28d6b7597edf
SHA1	d48efa788e5b9e01f38f9f42e8b2baff9940c29d
SHA256	2a7fbbd9bf3a41bb1f81b9c88bf14cabad3864e39176524135b76c58526d8907
SHA512	f997684ab845731746028f3108b818eba8554f932c62176531966ce8e6fb64c5aa63214996eb51672ca1b9e9442e4bb1a5fef12e1c3b915d39761a5a2d755ce5

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.dll

MD5	879aa1b9eb9923c303737f9a9684e654
SHA1	6bde153946e1c39fcf5ee813df2dd222757d2fb5
SHA256	bcd1b187d68816ce0758aaf655a410712e51360b90a0af16a99599f38909ac48
SHA512	9496b6afb50ad283683879aeb1e6fe52245563158cf5cc09eef39206658a680bca3cb3cadaf9cf9cfff5f2136e92a2b98dcb14f4f65c4fbdaa5fe66fd51fc2e1

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.dll

MD5	272324c3519292e26c20bca9add43864
SHA1	1c7947054d66a07f996c7b25006bf96a0129f30a
SHA256	602b925d40d671dde3d8eb69b68834f82c11f6cfd220aedbfb5bf717785959fb
SHA512	bcbf932afaa41ce430d8f6291356fbb0e7b0ad2898bd8ed5059d240d142d6afeb9dc2537684da9597b535f703fa6e7c2f907b83a4f93e1b5b505caa74493e10f

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.dll

MD5	e922699ae3647b38a0d3e3982043a9f8
SHA1	07323821eb46b373590f468331ee3bd817f16e90
SHA256	8cbf030f0ba29c9c3a982b8ec282073e42e1e20ec2184102aaa8e6e96e9b275d
SHA512	f3194820d84c612d5daa472c03d8e6c973fda6f43b35ba4717442208e1b98880283b6456a922a6e130258adfe7e4ce4a207c8c9c7c9178242e6e8eaa0d1433bf

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.dll

MD5	91ea1e932fdffd3d8e73324c7e957df8
SHA1	283366c64ad9caab6e300dbdb8e91a633f8765be
SHA256	513af068399ea0ad9072de919aba1009e91aeab6da820ee93d39ea33760dc340
SHA512	03e1b467aacbaac83db41d857f795e984bbac36cfc3fa28e9b91873bfe05d68f83ada316cdd919b5e35699b9383af41c28b4f3caf429cdad674d637a8cfc26a3

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.SmartTag.dll

MD5	f94b126921f404ec30faced9c5d6b890
SHA1	949d509b41f4fe372e05c5d01df321d21779e94f
SHA256	60915e8b64b85205a1b251f16197532e4023ef4b490228f178ee537a9b0456e1
SHA512	cb36fd08fa094200625f1fd3993b2aab752f78f6f07738f4023719daac0516f71f4fd1d838bdae435ec853d4ed9642a78f623577fc52dc5cb5739ce387b33a96

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll

MD5	4e0d9a85155f91cf8b9b66991c273301
SHA1	ae454f56c579c2470b4d95960227f3f9343dcef1
SHA256	a2d58447fb026d56cfddaba5730a0c1f77ca3d9f2f2c3235ffe77b67b60fbc9d
SHA512	abde8780ba68bd28343dc454d6449775a36244d97ed758397cfcbe70e66a8cf040ca58bfd8b6fc79af5de242e9a6ac8ab7e4686a7a31e731474c3915e66c9ad0

C:\Windows\assembly\tmp\HG6ZG59R\Microsoft.Synchronization.Data.Server.dll

MD5	aad9a3c46dcca09dda791a2a200d9151
SHA1	02f9d9d4aa4dc4dc13eadafc33ae8ece3ca39e49
SHA256	1a04854d7316f644863eb36c4d1019b373cd03a4ffc145bf1077339a77ae0d12
SHA512	2032f914ff6358d6f7496ac7e6fa9c6bafb84c56731ab9f10d0a9d0df4d146cc1fe96ffeee3e2f5b1bb0c41de5b89b80be752629a1c92ff41073457fa33b7b42

C:\Windows\assembly\tmp\CHOY1OT1\Microsoft.Synchronization.Data.dll

MD5	6e414bf4a56638a4fbce5cbdd02e5711
SHA1	1a2cdd73a1d2d67500b04620c27bef28c9691086
SHA256	6e5ef120c8955632e0ce891fe2876c46cc6d959f532cea81380847e3a36873c8
SHA512	cab3f2ffc4c292d5548af97ce7757c497becda6e4537c1824c289c544df893b0e48ae01ccc27269fa100af6709fe2a189ac6c34d42fe55a865233ecabc668fad

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.SyncServices.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.SyncServices.Intl.dll

MD5	7133e8677e11dc09d12dab476c068de1
SHA1	d6c87ea9d45cf3f97474d0d836617c08dfd4eb97
SHA256	a88db0bbdc5dfcb2df568f8a35806b4409a1212fd190c46c1248179f9bd1619d
SHA512	32d5b95551cf266e7582c25e9a76de8c4d4cfc83cd0592e1058ae8d581fe29cada6943b50f8d84d37a7bddf2a7d5709893190122d65b0730c0ef2cb7aa7d3bfc

C:\Windows\assembly\tmp\YX6POT4S\Microsoft.Office.BusinessApplications.RuntimeUi.dll

MD5	af388b0d2b08f8ad5d29cda8ff6530f3
SHA1	9a245c51f3a48a6b0d67ed0d7f5f11397dc18884
SHA256	dbabd7f03680b505db7385cc98d09a9f4340a0d6a6acaddba39c0b6f437bd917
SHA512	a9969d853d69f608718d34b36978c2bf399b381ad9e5e91d3f963d0bf04c41fff50dc1eb51a1e1218bb0502477b096aca98b0e70c5decfba895410d2f982b425

C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.BusinessData.Administration.Client.Intl.dll

MD5	9256d865587b7ef3b1d566f7e43f3e18
SHA1	825c1815996827ef644d7a642e25a928fb41f35a
SHA256	09dda91046b7d32e7fedb7fa602797752ee197eb9f420d03b6f138931d963653
SHA512	d3ee849858d9a4ed4e40a9bd91154c718224e631bf38b2fd126b78d29e34ea1b3492681e9a1e4a7ab9ad7f816abf7a5ad618cfe3c8701e6249663452cac3c95e

C:\Windows\assembly\tmp\IXE84AWT\Microsoft.SharePoint.BusinessData.Administration.Client.dll

MD5	81cab68a663f02d8e3f0b3a7c0ae848c
SHA1	1e347a0db2fe38b6779048440d48eb036c3c6bd6
SHA256	734afaf19823a03131df14932cee0b02ed4bfb1bb3a74e8400d8a4423dd5937a
SHA512	cc169ac038e569e1305e91938872ed32f01d0dede364ac2050899e9bc86cf3915c6cb1803a999fc6626b9974b2ada191cfee7114f6d2374b888f061093f5a293

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.Dao.dll

MD5	84c6457af1fd3600fcef8531a9cd325d
SHA1	765b0bbebb74e12a86844f1294c1dbc2acb55304
SHA256	923c2b9b308606c187c2403196a38902ed8cefa98f82c14fb28a83135464a1c5
SHA512	776d645a8a6d522796138c2fd91cc937b48d8f03db786fd3341ec093784bc69a2f4f567202eef7e4d294c989b8f31fb57818ee5da0e9d642d202f82e8a084877

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Vbe.Interop.dll

MD5	7063ff7154582442f6f533f12b3f0f20
SHA1	c8e9eea09fad492c4cedaaa7d003e9533c170fed
SHA256	64ae1b410aaa5fa85d70ad7830fa2cf43636924b2bb599545ada589faa1a9ba1
SHA512	c02aef28463666ead4820ee5c1714b9b6139de2089d1d9b82fb74dbdbb0ee62b13324b78ed98beee17591b81f13ca10fb6f9b2aab4b7303c2a1e7a59ff166200

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll

MD5	375b11b5290424a3c92221235346cf3d
SHA1	87f46c6781847c38be29135dfcfaae040ec0ecb3
SHA256	c989074b60f130d685d11316de7375b92bdb5b56f2ac2a033077a79862aa0099
SHA512	7ab051464de2ec678889e9e2f4359040c53b537c5a49dde601812bbc4fb6b13b7c9838e0d401b662aeeb84a130d681f7e1cb7e6974eee30bb5ea9cb0960f0a34

C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\14.0.0.0__71e9bce111e9429c\Policy.12.0.Office.dll

MD5	bf675629e050915c92d6d66f72b2aeb6
SHA1	26d772ead9beb027c9c77a0c8039ada7087a73fe
SHA256	2ea5ea1c8b104e43340bef779116f3edef3a7b7d12cccaf1b06b17cef82588c8
SHA512	5ad8bdfb892d6e14ee38adc2c1a68ad2ffe2167d12c0424f7917ce3862c42ca9d87d02ede4751df7c5ef9775e36874bc5e675f5e978b32b1e55ebb0794fef20b

C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\Policy.11.0.Office.dll

MD5	fc885793eac0a87c43c8f5d6ef5b45b2
SHA1	066b2e0b382b7770b24a837b087101648680186c
SHA256	e91d3e393c5c8a78f915be4bfe461aed9d8a3bbf86ef73f9eeaef3c856a4c075
SHA512	69075b0d5d49ced46767896f968dc4a282b4a32de800aa91f25026d3bc857cba27d2d58f266b703b05fe3ed3da4441346fb22139b0293aa60c2bde311004c99b

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\51714ec73936a38393e2a601e132fc28\Microsoft.Office.BusinessData.ni.dll

MD5	9f7a059b40136129b081f30549f4b40c
SHA1	271a53cb0d449afffc9bf6ce7693b95126520b27
SHA256	c9ed7ac9873c41a0968e5110b02d8541c497c68c4694653b7e3cabf56a02bf6c
SHA512	4996f792d56ab0da15cf299913a2de33fbae2c52327b47c542e18ffbd37c838becdaa67c69df1b037d7b3ff2a0fba46123d399da9fe094eb78a405b2b4f4be63

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\29af545a93042a5658936c5ab7364dda\Microsoft.Office.BusinessApplications.SyncServices.ni.dll

MD5	110125a5ce94a25127fc070d159e2df2
SHA1	4483cecac7cfab6c15e419369ea09fd3b09ba60d
SHA256	7dab0d044eb2ec0a17d17d359063eff1603ddef8f0c511fb6ed5435ddae170f8
SHA512	9f5336640739ff184a55db8206c09106e084d90972da2ac8e46b44fe4db8a5ef4c485ef8c435ca765525f6c0ba3200f5a3df1ef63144feae8121aa9a49f68357

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.In#\ab8916298cc76c59f9dc7ec386f0bb1d\Microsoft.Office.InfoPath.Permission.ni.dll

MD5	5bb4450286bae3841149c693d164c012
SHA1	b784767ec7a90b95eac7044465cd34e6b7c1a886
SHA256	2a19f8c4c9955d14078e1e2318a89581bc58cfc508542b36a6b6078efc09e0b1
SHA512	24e3bc3492666d033f62d4f82386901f87540c013ca78a817281c95d037b56f42f0958dbf8752ea343f961242298a811a5ebf5cdf011c7968a66da6c77e21313

C:\Windows\assembly\NativeImages_v2.0.50727_64\ipdmctrl\1faeea6c1e6b86e3506c3005c993f782\ipdmctrl.ni.dll

MD5	52fb6c19a8adba255eaf0fc96769187f
SHA1	5df3cbefd250be7a176ef10127001de6cb3167b9
SHA256	b1e521b7577f4bd0641e02dd84b3be72e8c6f4dde427bc04bdcb8f28c5a23727
SHA512	2d92ac59caf1b4495233a23e43f7fadc1ab567fb39bb14f0ff9235c43847b3edfc3883700fd64a64e21350989491c8bf9fc61f99b96695a7c2cc33ec1ec90aab

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.In#\03f1795085db28702af56ddb94c62c9a\Microsoft.Office.Interop.InfoPath.SemiTrust.ni.dll

MD5	f7ac4121fcf1ba63e7011c6a25a5c335
SHA1	5482241776b9e0636a352f02e5818d89ef14b3ae
SHA256	63b890b3c235509493cfbd2a0db50f7a45e89e2cdc0d98d10926858a9a46a2df
SHA512	fc2482fc6263066e059c1c1c870db9c4f6de9673464a2769cb449209ba078f588be70ab284bee96f69a397fe42bf233dd6b6b093081e82c5d71a9ba120772909

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.In#\5e62d477699bd9e3c08e1401018a523b\Microsoft.Office.InfoPath.ni.dll

MD5	cf2f7f19a871e1d53d0d849ee3686ddf
SHA1	32250529fa994a73a701ef922000ca0b57aee761
SHA256	7babb1b18e9ec9ce52cc26d1457a95fe0d3c8aad60e752855e5316d3ead0f1c0
SHA512	9898e9a9eb6af567421debeafa11cb0a1c4e6c00f59857510fbf594468d2ac0ce4582b2b3d0652e74845fb5e76243e782cb387232685d9c5d00a948a3f2f8b4b

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.In#\4566074bffaecae27c0a126b3c73336b\Microsoft.Office.InfoPath.Client.Internal.Host.Interop.ni.dll

MD5	5218f72afbf76f1793679677bed3b423
SHA1	1d5c6a732dad28694aefdcbcada125c1ca696fae
SHA256	35d52a4bb8728f0eeff11731a47e14bcdea9d7b36bb041646b0013058d44697d
SHA512	36241bbba109948b38720fe9c6e962735b5684b320d2628598dd9f2d77081130eab031aa5968f57c27c15b58576ea1318b562409715599e1fd3e70f1e540e283

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.In#\0f134ee034e6694038c19600e3e76a72\Microsoft.Office.InfoPath.Client.Internal.Host.ni.dll

MD5	9f0ac88fb0b705f375b05211d62de084
SHA1	4a3c42c30dad7cdd215e83d74be7a6d4971d2a7d
SHA256	57de42a4e282efd223d68d76534ef086b9ab18422c4d49cd71c8ea779c8eb6fb
SHA512	16e4f520bcfe9092412efdbe17a2061ba0464bdc99e0cd9cf6bb5287c24e79336ebdaeca757fd5c1671402e7707f43e52a7a72dca9060acb7fa7dca0884eb2bf

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.In#\b67c49fac9db51d065f6d898de5185a9\Microsoft.Office.Interop.InfoPath.ni.dll

MD5	b94963e07d742d42d866d85701cb64cb
SHA1	d76e42f79b53f6ac8a5e9ae9ea5842be7768e42a
SHA256	d6cab4f591b0511e36d43fddc7fb430ff10a6ec70b983154c676fc57ff9dc9f9
SHA512	cc010fe561f593a737bbd2d08e3bb162480d8aca37ebd2d3aeaecedfb4b29314642a2f77d73082247483966833eedc5c66874e47496c729b252670424fb971fc

C:\Config.Msi\e5e9e0c.rbf

MD5	e1eeb7e26ab04075eecc7275239b20b3
SHA1	ba62b37d4233b88948fdc2ffed08f3c82e8627f1
SHA256	d6cdf961c6d2712fe1958815e51a30960d79fff1e97788b7741627dba972e8f7
SHA512	dd64909c983794c8ac6c33b74711a89b3b33e4429bb5a3a2a2b4e38f5d74902b1589a97014a35fbaf97b469fa57a11314c02d68e1db0934de5244308699fc262

C:\Config.Msi\e5e9e15.rbs

MD5	ea2e5764c90f4bae3069e0cdb4a4e832
SHA1	f95775f708136179a8b5985edc11811adfffe995
SHA256	4bb37331d50fb0b74d8487e8b1a29fb6c14d83f07cf6d330ee0623c5e138fd2a
SHA512	9fd771cc0a36d78e3233d7c4edf37b40045c8765c42f2b8418dc09a287d33c6121bb6bb8df94e2d485fed8d191c9f4b7311bb535a50692dc1005258894389a04

C:\Config.Msi\e5e9de8.rbs

MD5	7e1df3ef129b58c2c2ab386f68ae26a6
SHA1	32d696a5d534b3bc8e521ab07faf22a844bf1d75
SHA256	003f29a00a665843e2ac900296dc0c10fdee9e9024954d63624b73296856e32c
SHA512	41dcd23c32ac10696f62a1014389a10dad0d42b14babfa2ade6d0ed8d48f12b5f321428f4cb69f28c5d233c3df0f5f537b79bd2f7d7fb69306c73a574824c6c4

C:\Config.Msi\e5e9e11.rbf

MD5	df0c6bb7965a3dfce5f0f158e9d5251f
SHA1	5250b2c7d557a71dc9fb0823fdc0cc94f0a81e35
SHA256	883e42e3319fa4c059623e4d5a937215ad2f2cb123e88aaec27955f258627c4f
SHA512	8b5f7cfb9d3d857b2396706cbcda445b9131abf79e84296ecbbffff0dc1588b19399b506e4e3110ac4782f60ddee081cd5243e598e0871738803512358efee04

C:\Config.Msi\e5e9e0f.rbf

MD5	04c77d812b1cd040ea6b0246452db018
SHA1	ceda09c1de3e7cb884665966c98e1915640c4ed1
SHA256	aa139c2b06c9d41c1cb6a1bf975358b278fd6f0ea4e23eedbb63e374bd53d17e
SHA512	c51107862107eb5916ff4b8aaffb7e568b1fda989fbf5c29e659defe2a616a513cc32814f3f32a2d837f1b5c710817ff5886019d33e190d0efc5979caae8f3ca

C:\Config.Msi\e5e9e0e.rbf

MD5	f8d11c60b70acd2ec9154ee676f615ba
SHA1	a869fc75f44438d9207511dc73bae976f558ba6e
SHA256	b342088c8a4403092703bf40062041265e12edd204aff4f6532226478a65cbb2
SHA512	c4c324e22ff7570c6d9a6fcd5ea3bfc4917a404110b3e202be847355c57c189096feb5c37c0a36c541f4a9d9e80bb1f1bc5db3f4146e515ba34468c5547ba907

C:\Config.Msi\e5e9e0d.rbf

MD5	22d700dcb35882995f350672984ef388
SHA1	8acf6e29a282777ef0b30532c93a22189c0e91d5
SHA256	279603b56cf4f794add32567c2a996c0b617acbffd9f25284398b294fe1050b2
SHA512	c96aabb4ed0f02dcfd7201d69ba72d011919d840a1316d0b88857b28d6666bdc206d4dae9ba2296b2d4eb511f1d1c25d324e5683a833fd6edf9e743e1fc3caab

C:\Config.Msi\e5e9e0b.rbf

MD5	101a9de4513660cfe7f1122d290c22d9
SHA1	23d3783c0c746c1bab508f5e99a7f3ee25a75948
SHA256	a4c5f92d695d51a3ffa32375eb1ebeb7632a0ecfa57efb6dc7a2b7965c77f039
SHA512	364fd62a5c1e844394fc8e88d270baa402fc6868a2e3cb0ce045bba9366c85fc51b9e897207bf00e3424e9907903a2439955a1f33ddf0c163b773430700789e2

C:\Config.Msi\e5e9e0a.rbf

MD5	aaa2e20588e154a10747bf1b31b55125
SHA1	03cf9f79b9cacda13aeb644a88180222240b6f0c
SHA256	fd12cbad7d1155b311d97dd5da05869200c50e7698ce997cb96004f18018ad2e
SHA512	29df908a09bfd551c50a3c64074c88814065b5b4cdc0d8a1fda5b1d01cb1f1597f2b71b343b59b9fe99ec7123fe48f9a83f93c0880275c19969523a8bd56dcaa

C:\Config.Msi\e5e9e09.rbf

MD5	0afaf60392d07170e6720bc778436364
SHA1	12024ede7a0440706ee94845dfaa8fc8231094bf
SHA256	8c934b6b5c90b3ab9ac03ed7e510eb3076d7d5e936bb77ff296ed48d40eedd3f
SHA512	585ddd4776e514ba5093356364cab99b4c9da4812e626e86ab0a2679aa7615f89f773b8e7b69341fb47da754cbdaca96cb51ec0f852ec01dde8f989c5f7ddf2d

C:\Config.Msi\e5e9e08.rbf

MD5	d80746b2f94a3a28e380735d4b8a9ea3
SHA1	adf85a8d951e2ef30100f88bd072d333839462ad
SHA256	45bdf89c40a35f2bb5e8a49a8fe3b67a9984adb4f65bc40ebf4e320c50194218
SHA512	cfc016d2f98385f407d660e276e31891939792d7de667dc8fe0faff37e38fa7f02b55526084682c75d474757c2dd790b714ac2fe1300f39f54fea61b4b3780d1

C:\Config.Msi\e5e9e07.rbf

MD5	218e31b07c6e07633a84f0248730e220
SHA1	47ee36529b741f3d52c487e6dad151f516c2eb5a
SHA256	241e01940f6f128aecc75d21f148468eccc2d368883f0f5a869fb7f58f57e5ec
SHA512	e0481b2a424da192bd9ae9728a89f7c1496e887f198150016ed262b924b1634b414613bb80b969effadb3e34a108992768102f48da7a41ea87b9f2a459a2ddd0

C:\Config.Msi\e5e9e06.rbf

MD5	9002a577c07ab2b99979435cd8b67acd
SHA1	5b3c6231c113b726ddd55fd8a8e3ae84b1526820
SHA256	c323b9ebba3aabb01111f281f604ec0555c6030134ca18422ac7f6c73721d9c1
SHA512	f4e066679e9c34cb44cb459ba178fd43ef2e600f94f86ded21af1583f182050178a57271f2a15967c2caa87fb6eea1f5409edcb87b95775245db45af6506bb47

C:\Config.Msi\e5e9e05.rbf

MD5	4d4774a30da56119888490cdf3157b09
SHA1	360221725daa9b7a14460fe6939d54b2173fb8d1
SHA256	0ee427eaedbcd82bd07674c9793435443c5b1c0780092909cf791198f0ad85e7
SHA512	eca13baee14a633c3a193df85c28eb797c18063977cea410d6ca41d0aca87379d04e6d2850a032ae5264e536863186e96eb9dc8baf1440517d69e33d4de73130

C:\Config.Msi\e5e9e04.rbf

MD5	7a016cec8851a57b2f0376ae6d1fc837
SHA1	f161f9d8d7b073c1f17f55719c37124969bd7d2a
SHA256	19e5e00b55a8b1fc36c33d0d4bd0fba24a03a0959e91f3ab59acb353fed9677b
SHA512	f646fcd298b7a5d7b451219544ede8dc7e09aa3ea6f9a4256d336373d63b475281020ac70e5e08024e2dd8b8c886ff8607ae3139ada650eb8a6293aa0a141456

C:\Config.Msi\e5e9e03.rbf

MD5	63a1e9cde10490008ba7ef47a12179d1
SHA1	5299af182b7cf08f95fcb3815149d7c54e73187d
SHA256	9b151503214ef428ece37af31d3d8345f1dc27fd26d17b59c52b718e8fd08bc4
SHA512	dc4074fd0614212d54dad0370bb99d53dbf9078cd3d4981d96f5ecebe36c82df0406cb2c232d07a1928a1ddddef74d832db3e7f479d5d3c1292481143c382efe

C:\Config.Msi\e5e9e02.rbf

MD5	bd3e2c28c647533a057b5cdf8bff2c5f
SHA1	d36c80e460c5dde615ab1c268bd89309225ecb82
SHA256	f2742a96cb0a290ab71e316c086db449e6262a4614c70956f69165df8f9a0d3b
SHA512	14aba74084828f9710a1880d8ab55d7c76532d90ef6c9b8b5aa4cf7c67cbae1892b909b35e9239afba181a09f5bb59bf2607862d16330cae09fdcee0248a18cc

C:\Config.Msi\e5e9e01.rbf

MD5	2a9b706d83be29f32a28f29be397e533
SHA1	31135de80dd7b7c4a27516806fbbb13d871548d9
SHA256	db47a4a99dc0cb5f558891ff552f75053122d04f4e4a2ff6165734cd456a0236
SHA512	cee9cf2576729b34f1352f63d9684695bd491586d31d3b3e81b11f2136b3843d513dbf59280b5aaa63b1cf085f0840040abcdd9d3d72dc15103987b2ad812e64

C:\Config.Msi\e5e9e00.rbf

MD5	775dac5f81248b14182c82013672c42e
SHA1	cef7bba712b25da04f60f597cb614c7e4b87f24e
SHA256	e95e6d348912c8bec21b006ba6ef77e52fe74287debea2864180c0511e68766f
SHA512	2d99dd61a4ede26a11e6f4c3569732c47911605543e7a72b0298ad25e0a573ba884bdd5719cb8b7cfae43b25f41ccb764c8a233d978346bd49bee1104e7cc97c

C:\Config.Msi\e5e9dff.rbf

MD5	96e0b0c5831816553b0f6c8836ecd85a
SHA1	33ed38ed6074d6a61fe089575a20e92c8c32cdc8
SHA256	6e4a5d6e205e40d85b42ebea110c68b965d5f1d1ad0800ea54287cadfa04438a
SHA512	f1007bcf0444453e8e974bd7dd35920b14e2f0b41f4a5c09bf7949b8853f26a6d84f5e269f848f0c528c47be83dc68a357378ef7a0f2dcb9913dd2b57d6d0b10

C:\Config.Msi\e5e9dfe.rbf

MD5	90089f83a29815c0ed34dfeebbe121ed
SHA1	871b035fec463c3ad89b1988ef9a7851ec55b83a
SHA256	7edc1aff8a08a08ecdd2c602d191745c8b9bd9924a0b899ad59c4b572f2b3031
SHA512	8b03bcaf6aa70211ca5ace9cc3fa314fc1b20c2a7999c8db0d3ed698bc0f2fcec937fd4ae47a42460307e46387a1512e0da53831af8f634388f0136421126a7a

C:\Config.Msi\e5e9dfd.rbf

MD5	e3c8239a97601bb203b9e9037eed89c2
SHA1	75f0e5f417477d4c491e8ad81f498faf761618a1
SHA256	27864727360196540664a55e1808db79f07303949156f843f0520106ebe047db
SHA512	71304187ca95a404d6d175d40be1dcf40d1744c644412e702a25fe7e9745977e3f826d7a9ba1f694c3da4382e8f97fcf41ec8dfdf40240dabee932619e26e7f2

C:\Config.Msi\e5e9dfa.rbf

MD5	2bef63ed9845d40911383e2f41639c7f
SHA1	f30d8a010a935fb0a0ee1949e1bbc82fcefe652f
SHA256	987ec24eccbeb59c366e37a0b955f4d2b22413db76bdeb2bd6741aa81fa64f1f
SHA512	04b90ca747b61f75387921988f6808960744c16d4ffc00aeb05fdd226ac3cb11a3c621a52d914e83d1db54d1b55c5c145a5ce3905d73fa9f57ee8672b7d05ed6

C:\Config.Msi\e5e9df9.rbf

MD5	0fa56f51e558fb3f28637b055fab0bc6
SHA1	5290d90a92a236df4f98aec83b16e7eb77722799
SHA256	1628454295d3ff90595b9d5ad2ccc48a8e20b1d71b16dee2d87bfb64f684c0a4
SHA512	0b06482e5dbed12d7e9bb94394c022f77a94fc13a2762af6a143a037b2cb5b8f78deac39bb4befe8e70994f92615ffaf4210b5b2e98ba8af8fdd758d1363dec3

C:\Config.Msi\e5e9dfc.rbf

MD5	f148286b321ed09c2d17e9e3637c807b
SHA1	b0928429f52028b512dad9c7e0996ee7ade315d3
SHA256	33fc291a41f38880549e72b23ec4598cb7404259a93775f59bf2be17f798a69a
SHA512	d175430df339ae9b0f46d00aac752697f95ced9f7407b2d15505645bce313536c065ccfe2260787d4f387ad548f02a94457e662c32174f36ee97a76fa8e59f0b

C:\Config.Msi\e5e9df8.rbf

MD5	c6ab504192aa105956813fb5c7139f3c
SHA1	42a04d994a47151fbede245d0551c87a77021cfc
SHA256	8baa2198ba1ded0780f60ac667f2ee812271f00b95cff009af528a44a81edc0b
SHA512	1e4a24443d874fdc86cc194ead5b5489141cc2115092137674a1c04111801cda7bca756573e3c63712960326f2cdeda6388f318805d56c0fad805fc7dffbb945

C:\Config.Msi\e5e9df7.rbf

MD5	a686f3e4d6551ba64b1a2f9468f80dd3
SHA1	d78e4107cd6e828356b8025f10190070bd04cdc8
SHA256	4debdb76c94e412f544ff7b9de2423d29cbd452301c6b58b599a662b5c249ed0
SHA512	33b75762a364afb74501f4c9340cce456f243a8f3a34ead31f016fb699f650b4be84b3c063def8ba212dadd259fdc09a2b232ddfb4ccfa20fe732e63ae4edcd1

C:\Config.Msi\e5e9dfb.rbf

MD5	be4a2ab7f9e83fbfa5e1102e0dd65365
SHA1	2899796291a9a042c71c6afcd7da75e34c9ef16e
SHA256	d85103f091ec8f30c80049bb04ff6ddec4327e19150f627f138f1cf90d3db79f
SHA512	d5a7a9db33a0aecbda4a0cfce516734fb4c1b07330f44cb54f556fa1278cacfeb8ef1eb6cd925db661b7c932313fa7974e1d8555e6046f63751ddddaee35f2fd

C:\Config.Msi\e5e9df3.rbf

MD5	3da3d41f6064e44de01e11c706d09b6c
SHA1	06faf291eaf2ce2df692296af7b9f4719792fce0
SHA256	15aebcdcb52a52c3368ca800e059b625c7a947d3d54f8e95997b0cae3e6bf823
SHA512	2b9542e61e04a1fcd26430df5fd5ef7dd925d963d80ee7207de730d1f7bc945c9bf83e4db33fe7251d8511b2a66440e0a7e1ad7242170be85c45e9cc30693302

C:\Config.Msi\e5e9def.rbf

MD5	d87310699e3baac5ecc0f64673fe3485
SHA1	34460b0eb74977b98d9d3e683d5ffa2aec11059c
SHA256	4f9a3c48edbef17a0984c473d0d100e5541a26a92ed4ca3b336974c5eaabb4eb
SHA512	096196d3ff876b7cc5173e0d30125174e6fd1bb60432aa9cf64c3b22fd5ed2fa5a8bf35824e5840ab248b1015907eea0eddd964b4191f52454b03edf583e0b38

C:\Config.Msi\e5e9dee.rbf

MD5	6083b2909a6c1ab52ce84da1b435e7cf
SHA1	e851ccddf1fcb0c2fd9cfb4a357f72633452f240
SHA256	0ef563502d57298ab0962de24692931a32327fc1338cbd80b6b0b2cab067c956
SHA512	53b8aad68d574e57f88fb3663b41455859b2c84ddbd152aa1f0973df15ad1ea1e72b57b54a0984ff8e4abbd1e4606833fb2e132d1d49d428f2e0ea4e7c4568f1

C:\Config.Msi\e5e9dea.rbf

MD5	91ceea551937cb5da627f33ef7995ee8
SHA1	4e7483605c4027381e4796345f0a0e6aa9342a5b
SHA256	4256104f1e0eb69836f00b38813ae62f79abed1724e0b07f8aca908e7bb74806
SHA512	2d720c8a331278707913fc064d7a0c2727ef13b3f8cd46aa4e4a2936aab2b1228d78c1662856739964a87a33c312be2d3f65170f38d65545f3a3184c0ad635f9

C:\Config.Msi\e5e9df6.rbf

MD5	04dd790f9c64ae24391dd408697ba798
SHA1	26fcb0502543d854d78b7bf13147acdfb9c25164
SHA256	cba52dd00d2517db1cc0d96181fc75259fabde56d414298cd858961c6e46ff7d
SHA512	8a50f1f0a0bedfbb87ee3b89cf65a22e0f2e6288ddcc0c7bf103e74402cd0ee226d3439879812165590633097faa4d96ffde3583c364642c365240988dac0f1e

C:\Config.Msi\e5e9df5.rbf

MD5	d68368708be2b6dac797743e23dbf655
SHA1	e843b858d72359ecf6fcdfca328ed19a7f23210b
SHA256	dff2dd57e4892ce613b160c935e2d0215d3357edb7791ceaaf880b5995c98361
SHA512	2542ce485c0c630b09be44a4faa841a3ebf2e1b7bd794e0b3fda4e866d97361b014eb3895c70c6b7acee4e29dcfd46b76697a1602666d1febf9cfa62988ea86e

C:\Config.Msi\e5e9df4.rbf

MD5	c8b0181f816e8d515566f2b685acb6de
SHA1	6a6bef81b45760b55df86f2cddcba1c432d5e164
SHA256	c579b73f79c3c301f8f9eaa016498ff076f09cee3f6706159a6b2a9d053746eb
SHA512	e472517b005184cfc11d13e3bc2f70341a370172999a3e9b06fc9ab024ebd034fa56e81347a00c8f685eb6977e31bef4f0e69440f0ed243960abe52a8e55020c

C:\Config.Msi\e5e9df2.rbf

MD5	df1ba314ee4b1383abd3b770913525e7
SHA1	422bc51cd41dfb73d61142313dcb05d151a19acd
SHA256	2a534bd43a4c43b7b9c77fd15806a61ef431b2e1aec16fa044c571e43e2836b8
SHA512	50f088fd787b6415b8c409e6e836b3dc241a2b663be099802404f09891e4abf08edcb29baa33576acbe6ee084dbdb068cdcf91222c841cc9d0a38e6ec70aa42f

C:\Config.Msi\e5e9df1.rbf

MD5	cee6e7c7a1c0b4d2ed88b333ff2ea980
SHA1	0acc76444a0d85208c32a5cb17d92dd7b208f8bc
SHA256	7ce0ed146976e33285995566151e83f6ccbe89ab209a55fc1de127636e86e3ab
SHA512	8c7727d7d560a7db4698f451c84614ff53f6dffefae1f9a9a2c6e6ab5428d4178ee2c77cc12048bcb96732b3dcfd1c32dc3fc8635def2870da18c9cfaff63b63

C:\Config.Msi\e5e9df0.rbf

MD5	048f37c8ef7706515a79a3b0c4733d78
SHA1	3c3ccdc38657b25db1934c71e53bf8f1cabba3d1
SHA256	30e2efa4bcc3d7a911bc3ebfb7b91169f6b3d96dce265f6858e6df1fa484c316
SHA512	14c96c8f20300133792fa7ff68bb08acb4900bc0af9341d344f01a2599fecb6337966deeb8b9796a26efc7ebaa65ae63f2ea63bd25164d13a2023ac255515dd3

C:\Config.Msi\e5e9ded.rbf

MD5	86a1d818b679edbe94ab51b963ba79a1
SHA1	2b9ee6b54aa2f709442e7e514335e2548c933318
SHA256	b36b011818770bafe044bd83826f38eb81093f529872a0b83e341f6863b3cfaa
SHA512	ee1ee27bc740b4e4e29a11f4a428b5ccf7ef545444db972b64a8f4b7884462b8c589b5911d7d33e3f2a7b0d97dcea0b5d610a99a00b04d8b3099e695f9acf5b9

C:\Config.Msi\e5e9dec.rbf

MD5	da7787ae5278031ef79441d29599dcff
SHA1	4e2a4c70035808dd8bffaeb6ded8fe2980566e0f
SHA256	06afbd06123031d3198a25ed0cbb7cfb08c1184cb58ecd7d12f42c235ebb5b39
SHA512	2c1ac894e778aea4515be33b9e894f89a527a5106734a8ea6d6693557aff8417a7f7b340834dd1d207e85e250e718c1d0365332e77ffece2f9e1e81b0082bd7e

C:\Config.Msi\e5e9deb.rbf

MD5	7173d17aa9ff4cda07fbfff21a584a67
SHA1	37b04626e282aa6ae2a2dc96117dfc5b0b1f25cc
SHA256	972595aefda400197282647fa6d6e40b58ac15591443213682a87d1ac80cb867
SHA512	b583058ce0a7bac48042d63142342a430701f96bb8c8c0f00e2bdb168cf431e2f98a58bcb889623f6e6775195a9d4bae8f37686a48a2cd0034e426d6089a4167

C:\Config.Msi\e5e9de9.rbf

MD5	bc959a160882b0de0583047b1b5b93a6
SHA1	78bda837a0fcc25623b54e95f3eff76c3bd79332
SHA256	b9ffa79403a9c57e5a36d6632bf8ebf8da0f6256c0b71fe4dba50390df17702e
SHA512	7cd370afe9903daf36543a2d57ffc869f2ab324fc4ef363119d4923eb3b6079485d6f1a0304b94b928aace18900d034d74ffa0d1cf8382301f6e22f4daf4f0cd

C:\Windows\Installer\MSI2ABA.tmp

MD5	973712941278640cf6b0ad143e9b3538
SHA1	28fed2f564277d640f9813731aeaa531693fda68
SHA256	ad7d5b9f9689cfc4a4845dd955b695c6ed15dcbcd4429c33561b0325d49e839f
SHA512	aee754dc6d229141fb92bcd8f05d5e2402335de8b51ec3b0397e6b3a18ca29b8adf0570a01348ff32312187358a1e489bd84fab71a30a254a06786d95d9ff142

C:\Windows\Installer\MSI2ACC.tmp

MD5	3a740ab405a6773ca4ddfd73b4d5bb98
SHA1	c130d625f24dac62e10951fe1616838ac23e18df
SHA256	97bf9da481e020841e870bc7848b6340192aea918f70443fb987397369f1d484
SHA512	1e9115276b383d4fc6e28fda743f569f67bf0524ea8d54ef545ff4875f3adc76152209c472a7df4db90f253451fe4fbb3065f09a142d58e55c5475842a32e822

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Excel.dll

MD5	1f07cd0029eeba9bebeb342cc93dfa58
SHA1	28f93408537b3c50b073daaed910ece26579a159
SHA256	ddac7b3a2563d194e8f6fb20c1b869d5659553f141a6355a78d6da7f052327b2
SHA512	7adceafe738d65f9a0c4a2b1b20c71b75ba53545bf78ccd63832832e85520c63114a200691765d504db35e4fe9c67076f7f9ac1e50e22676ef787ff279cdf9e8

C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll

MD5	41e6c1674e319814cdf8d476eb570896
SHA1	01ba5eff3e0dc28b0e188614ea21c970a37fee52
SHA256	530b300a7434890414f0378bdc6c7c2296089f7537d99a9f63c97f6288e42797
SHA512	1e3b36b56b751de1eab9076a84690cdf0c2b59ba3645b46e494af665e8d1972911937dc28246f60958f3136477646b09abd29cfc74d1ccf999aac199d9e13a81

C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Blueprints.dll

MD5	7fb052fbcccd1af42706ff011af4ae7e
SHA1	31e42812dc7f28cf325db3da75d807c0d8ae9e4d
SHA256	3280294f95bf19e85cf161382c04e70c3d2fa77f89d7005ba428985c053c97d0
SHA512	93277dec5f4aa4cdc6fa8e5e812e8e8f2202d172c140947e1661351f682e472a732947d7263cea82f2ccd9bdb32389f5ae985aa449782e575eb500ab17f2b40b

C:\Program Files\Microsoft Office\Office14\Bibliography\Sort\AUTHOR.XSL

MD5	d3a8ce040dd1527444d3235727ac68b9
SHA1	45294d0e441b1ad85c7f01d53e32effb8ee3d33f
SHA256	3448741c5998362d1d5c7ec08a6d80eb56802012ddcb21f84fb5bc9bae836a95
SHA512	2f337f88f028c83f5114c9eac094ad1c4df2d2fd35da806d5118d0822163c9cf9ce7906cb9dbc7c571b87ff6473169c7542c3ef159e3cf12dec299c2bcf1f798

C:\Program Files\Microsoft Office\Office14\OLKIRMV.XML

MD5	547ff5d314e4f668d4581088c2478c4d
SHA1	191e9efed357719ab2936bd02b04fb7232b6f58c
SHA256	5acb2ada6a589c2f06eeb41a1271e24842196c053d78de3c641d2b0b441f27ab
SHA512	0a7bc0cf4cdfcadda1973fcdf6761a5f0434d0af8bcd61a34b1af2446a10592ece61d8e6f0271cb651e37f4f5478d331838d8660f9b8453734ba3b3d71c507bf

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\VxExtensibilitylib2.tlb

MD5	12a4bbb40a4d3404205421bb566c7c41
SHA1	95f6e4b27f7a5875b8943d606d61e6a36572f274
SHA256	18bd215cc77701284dccffac18dbeea3a47218edeec95603a274ffccc708ee00
SHA512	af9bb33b3c51f862bb3a0244bd77009d0106f89076ab3ac4fafe9f6fba867ac9f2819213f380cb588a7c161d78d138998c0aa1644ae6527983233ad2b5f68ff7

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\VSLauncher.exe.manifest

MD5	3898b8f9b521e8af2b6c194637004d55
SHA1	d5b19731c24dd4065152157e929f200086b12535
SHA256	a40b94527551fd604f4d548bbb61aa7ab76525209b22f9d27f35701c25e188e4
SHA512	3a2dfbf92b16e248a482d442e16af79c721723be93c8220bd5142444b07e38ceab21ae38fb6434cd1039567ac8d0e58f06338c5fec63123a833b210d8feca4af

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\HTML\XMLLinks\def_ctx.xml

MD5	71ce684279b8a241d5f1a21ef3c9d1f3
SHA1	2e3f220e9cc19b8cb8d261c7e3ef8fcc24338e03
SHA256	2188c01cc5b8168d6dd56e47bad5d0c89f390247e12ee21457447f49f9fdaf38
SHA512	2d76d840ce03e7473c78d57781ba844714ab65a3a7cb8af62f250963d2206cdd38f01af9c25f6f51aee9e645d24a4f5202178de16289824971530ec38f5722ca

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\vsext.olb

MD5	0503b7488382fc7d7fdc365c29660661
SHA1	3dc6e62eafa269f8916dfd8e70a73002b82b08f6
SHA256	41af0ada20c81057b19d0683ff8d98915093ced1086c9c1a3cba413407295d2f
SHA512	7d0dd117aee76ef1e33a6b64f0b8f0df8b6a2d11501ee414ff4c7f3fb3d54e98c21ff1c1e4c02706a4e6be28677ec357fed824c89d3891a8fa43c4226af87ad2

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\Hierarchy.js

MD5	0ed80e3be708098bf6b970b4d4e18bc1
SHA1	0c710a30463702128883c81b927e71f2443b8ae8
SHA256	04dd1846eafb4645531ffa3b4e652c2fc73cab748d16584cc31023762d0e97c9
SHA512	62bb6c172ec632c323e0974f5cb28de5a1c2fe04c4c5420a925b81fba55deb159b6a26cced125ac04da1f7e2b82ae68d06e5191fafd5ca4fa41b75f63410c195

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Adobe.css

MD5	765e2bc5004404d7db14b90e93e0247d
SHA1	eeb4dfb775deb2f2ecdcaf50d5d8c3b381a5d4ea
SHA256	0460b0dd4b1469c19e8940cdcc3e82afc0b85fd6bfb23b5666bc9ae734e659d2
SHA512	2ab15e75ec018522c3ad772610c9d1c3d566f237f7e68282ea9896599e046c5e7ee9b51ddce26e81e9698285d44d414cda8cb3df2048c0af6a4b68bb1742940b

C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE

MD5	6ae3164f2a8d424f190acb080c6a2f59
SHA1	ae1b579bb13e8805f0a812821cfd8abaee6c3dff
SHA256	0e6c7d678e9fe1a58f8486e2a8eae2b7aff6a28d9f40aff5dd26d9f2e1e169aa
SHA512	2db6929cd93463ec8343169b72c8491015fc2092fa740cbd0054ca478fcf8d504297c18da115be087e11c13e86c44639594b393f4d1e73e31e1ebad39ed9824b

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql2000.xsl

MD5	aba95da790365671e709dcbd907034f9
SHA1	79ae29b7667ead07b333dc2e09a1d24f9bc83eec
SHA256	05499f600bdd5e7c380797085775665e7a021933890fb0d86853b021a481a974
SHA512	25ffa1b3af6cef60439bcd1a3bb5c8c5a5b1055e4ce1a93629a3d316b2059d316c5237ee261cf088875ff43b563999f9acb9b24ab679cd853b353ff32c75b0c8

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll

MD5	de473a4bafd68e2007072d9eab16ffe7
SHA1	c08dd3e218df21ac117349e2b6082450b4b713a0
SHA256	ede44dd0ef75a019ab2e8bddae5aff41a6e53660cd05f9b59af02883631417eb
SHA512	5ba8ce788cea9dade31ad2ea2c20c65d3fa6730110a8de5c77963b5995da855bc225acd859f0e89e37c01dd74084c5a188583d6c31ced1fa0ff1a5d528e97a7d

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll

MD5	a092f7844b8db40da887d36f12ded39b
SHA1	c482b56e0c7957a4155e850864af8fb48ff45334
SHA256	6de329e8105aa6f0128cf52ffc95d6707678d65a8ff1d8887cbdffb3c57f3e29
SHA512	4a1b8a8c9fc62b3a6300c1d72ef1297eb36b8a3ba63d1821412939fadb47e24c3f26ca8ddee9a045b223439525e12087d66cd4120ab908b8036c6dc6caebd889

C:\Program Files\Microsoft Office\Office14\EXLIRMV.XML

MD5	4ab3152e20de891e9abe5d420383b4ff
SHA1	35ff4d6c2e40f5d7d3122546a62b51bb5a5f45a8
SHA256	0a09c7ca7a86bb902fefc8baa6c2b8d02f5ae48bbd371d4f41c5eb0787af4667
SHA512	64118c557fd6c609a47880a73a75d2ba188f7e6efe3ac8d467fee1ae8060858e708cc79682b99993034bfaf5b21668d6c1860032179fd8286530701ebcaf1160

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll

MD5	307c1b66032b9a4538410c2cbca32580
SHA1	3defc8e2fa2b05117361d8fc9d3f2e7faf48a6a7
SHA256	05ae4a9cd8ff2d5ee6ed148d2d0b0746cf3d9a495cb4673e3e0d78ce96bc9f31
SHA512	ff01f2d86bd0fefdfc55b7e8dd318a54f96fe1ef766ac531600ca2a281614e47ccd3a8f2ba4ced44ad85cf44515ffdc8889ab051464d5928bf4a3bcab98c174b

C:\Program Files\Microsoft Office\Office14\AccessWeb\CLNTWRAP.HTM

MD5	e3e3eca06a3fddd2b81435c1bc1de1ce
SHA1	773cd09d709876de7bae2f919c58467cda22a60f
SHA256	d51c8fc7a4d272893548d2714710682aa4ba26b464f3b96a2214194bb9e1738c
SHA512	e56074b704c8663ccb5b27a226735651f8542ec2a864a3d72b2b181c3e449169a7e440d546a6422336724469db69e5d2fafa775248e6cdc82471918a8ae59d0c

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apex.xml

MD5	ccf09a5af3b4d3a8557e477b05d05d6e
SHA1	4793c3c3889e747c52c13d2a067b94f1d1b71d34
SHA256	5f2187e8a8a22960e439706a597e34371a1cccfb9cf9d9fe26fcb75e798654ca
SHA512	7055e604d4de7db4ee20aa2f75acaddc15a09f8f5d1b27ab8aa4ac40780b967815e6c53d5c0d3047368635a5049163e39a837a42b306ac79acb1f7b2d70cb271

C:\Program Files (x86)\Common Files\Microsoft Shared\Help\Hx.HxC

MD5	fc6f9e1fd2cd944dffd548bae8ab2fc3
SHA1	18ea2e4bde2874472efcc16a43c8c9774acd37fa
SHA256	24f3d1d585a06151ddacbfb1ee9512f554348d1e2bd8f8e3bd1bce3f0501f919
SHA512	62ea85c4e984742c1b33ee274787f4982a6f1845c9728bf1386a4c1412141745084b4aa3a59e38f94ac657165ba208964c2bb2b46fb5d3e0f6045003d8264387

C:\Program Files\Microsoft Office\Office14\ASCIIENG.LNG

MD5	c0282a3bc48b8149361c3c677297f704
SHA1	5b997f0d93bb83fdd9dc5ce52773584db7c869c8
SHA256	03df12af2abba8a2f43854e2bc08c434d450a2966c7339fb90010091184d6506
SHA512	ad8030c7eb4b81369aa5e7a1ce6302567bb4ab37145d66c89d0b2fec6eaa041c4e6928650376efbad6d75d44d4e0ef9a7321246589732049bb5dcec4300ba6ce

C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL

MD5	e51ff1b62f45b7243c26ae8019df4f29
SHA1	b1560c044758649b4f2769f9fc70686f5a36efdc
SHA256	2234eae61a66a2580a637a1a3f8e63c25eb6715f86b1795c746fd5db8960302b
SHA512	2c3f42b82c0e9979b953a9a63d1fc700ad493df6f994b70b1d3bd567d572a74620a25379ebbe26157b0742fb07d7397b3fe0579b981a2d02fb05fbd8a5532021

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll

MD5	239db9c01b11b84a4c49a6a1904a643d
SHA1	7309b369fc7e039df44ce0ab8998aa60871f9601
SHA256	052eb2d05ac79bdd0067d0b4f0bb20d2ef010f6e0d2e531ab842d3be83cc50d5
SHA512	cac58a465a0a2b0a89b2193052f82aba93253a0d7bb0db518b97d0d4fb0af8c9e907823a3454bab5c761dc6de8e1eeb261fe7a52a8b6b8987320039ef61d985c

C:\Windows\Installer\MSI2F73.tmp

MD5	785caf7a3a59572c2516ab8e2fe74c37
SHA1	d7e2d8d58e3371d49c7a5dd3d208205efea1460a
SHA256	cc6fcc45324e65595ab3facfdb533f0e3493fe2f3b859d7adfe95e8a16bb5ecc
SHA512	3b0a5b54e509126ca4f4bc60b04ea9e7dba07f74f6e05f359c1400122079df4f5989fa429ecb865a5088930a8d288afe00b23a6d343b9790b9c19a0e0fb70fee

C:\Program Files\Microsoft Office\Office14\NAME.DLL

MD5	7c5c999fae32d6ad3c1d4f5b30a3331e
SHA1	21bde6e11204cd5c9b537ad0d052a24ea8aa9371
SHA256	0d2fd3a021d8fb925bbb3321ae4e7449e7971cbfcf6e3058bf43a8e4837f6dd3
SHA512	7cc5ae519707eb2b948338e981de998dcbf17de240a4e21c90a552153c4b8ddb184b4b3ebcdcfa24f2604627d087e8be11001fc937403d9267b3c487326fc23d

C:\Program Files\Microsoft Office\Office14\OUTLACCT.DLL

MD5	312ec0fd0b25bd8de5b6e1a5e8392a8e
SHA1	373cf2ed414bc0a767d4c65dbe4dc4adaa1fd86f
SHA256	998ee1f6d930a8c3480d029aa879c119d8ed30dc09850b7892e10e8bee1fd184
SHA512	4360a5cef9995c942988c829875c0704df81dfca48b6bc98b7886c8f812de9c75ebb637b9aa03099aef07ef0785c1e6d44829ac41bdc81c0d58d52f82804c9f0

C:\Program Files\Microsoft Office\Office14\WORDICON.EXE

MD5	bb9fc4a8be3ff161cd7b3bc737c7acc4
SHA1	37b7e8d3587ccc9042d7af64a85e3a63b568f59e
SHA256	eabdbe4715cca93a89316f380731e57b786f7ec51ad8b85dfcd64dba0c52afd8
SHA512	3c309026c1fac16d69dde4488e240f870cae3c94d06550f49d0a7ba3a0e8a5017f236b273d646ec21dbd415d189986e5512f205e20864656e99b5b5133fa782d

C:\Program Files\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE

MD5	1ecda76cbe4c9eda973faf2f9055ef25
SHA1	009c2353e801827126899ff67de4013577f9ce82
SHA256	84b10a556a6597a4c6a75f1156bfbcbb1e69fe7b336e0119db8ca97dfa4ebb40
SHA512	0e297b2c2bbe6ba396749c1722b6950926cb904d0dd74240fdd20179dc118af924621b7f29f5517da44f574fc98806b60a5172dc152985f22fa28c6329a68334

C:\Program Files\Common Files\microsoft shared\OFFICE14\RICHED20.DLL

MD5	568708d04ee64b4194b72fe0871b7072
SHA1	e35aa8d2f07c688162b8c0cce6d2c630881472dd
SHA256	9d86abb47dc35fa4f18120085a58fe60d8fecc1f053df739fd0fa8891c712ca6
SHA512	799816a7ade1c6611cdfca3bae4eb2c8094ec4adc06846de6bd69cb398686ca5f1db58ef89ea85480281a328b4d8a5e63dbaa53137f2dbc05c376711605c08bb

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACETXT.DLL

MD5	f9be57fbb0724cb607013cbb44fa96c2
SHA1	ff0634494b6b0e6d76eac4a2b11043aec4b85840
SHA256	cc6387043a8b4ccc86ce9ccbc0ee7824dc99fd532856a573cd0b9397e5dccf87
SHA512	5f02d893b2565c38ae06d3ebe2b2ed06f9b082750de8b0c2b8133d0320727bd359fecdfda0ed821d13477b764b142538dc6eb88fa7c7a0e3b5a3b65221eb487c

C:\Program Files\Microsoft Office\Office14\MSTORDB.EXE

MD5	c57ca1eee527a6028a23e279c4c7a07a
SHA1	a818a2e888a5bb572aca09519e71344073e93c5d
SHA256	eb54fcb9f1147bfc1fe75f7a9d32ea2df52df82589fa6552ab038b4f64c10a7f
SHA512	24e06c777035d220d1c48237915cd549862fd3f468b4c444542e0a73eb1854927e096fa490c74a7d522d63594bb7b9835d8e26e4211dc37a81e7f11b8ad210f5

C:\Program Files\Microsoft Office\Office14\MSOCF.DLL

MD5	eaf16762c6401fa777196a3ecd7233cb
SHA1	2dc96daa5ad31c6fa0737f1803baa1a33d37a09d
SHA256	547f1d250481f4672ff2db5c1aa56a5880f1c24aa5f5f8760d78fb0aab4aaadb
SHA512	02f4d78bce295ae36efeb059995d2844d27838c34aac7eb360e7b7d54c0237ae20c073d092415361cfd1609a3ac91a50753a593a94fae201471cec3b3a8cc4ac

C:\Program Files\Microsoft Office\Office14\OIS.EXE

MD5	0cf4e52b3324e04a8aea817dbba556aa
SHA1	0782de6f46497376468d5f29a42637d76a2cf7fe
SHA256	deea95124804cf8091e4e5cd3327ae0d8d83f7c65d7ed65ff0f206741d0c3fcd
SHA512	5847574c10e73d9e60003398cd7ecfbd30663c998caf09a688b1198c1c5d2e6f6510b7850e85e86107b8887565c66b778911f5979d8d81780c9d97dcd5c04384

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\VBE7.DLL

MD5	29a5bf018c7a55ef2ed1b2837ebd6cbe
SHA1	68127b45a22dbeda121d82430871ec48a86eff69
SHA256	283b5e51764e8d28e780946f7394b7eceaf614f3e9e851a8ff81105f54ee3641
SHA512	a731fe2563ad9e95c8c0ad3f9b764bd632576eb74ec0d0d5221fada11a9b4f784542aab0f1d621938cf40b2c6f96c8ca655de71c6de0e0a7539eb1dbdbd5e278

C:\Program Files\Common Files\microsoft shared\TextConv\MSCONV97.DLL

MD5	ad18eccc1f514dd106ca290ed76b9341
SHA1	c8332ea44e7e5391dfd198ebdc9afcc901d02c21
SHA256	132401a8fd01cf7afbfbead181d95ed6f290f85567ba0647fd9d9f905eaa9c42
SHA512	ca27df819f8e0699f4e888f67239e19589e6cbab5a317bb4b86343a7da29b326a1ef1eaa3d548d267c721a68ac8c2f23c94a2497241da39d62c767b2aa782729

C:\Program Files\Microsoft Office\Office14\OISGRAPH.DLL

MD5	444de298be82dbf3b0144478e816d352
SHA1	7c75b50168111c5c1204f64c16a6d64e3f14232b
SHA256	3c148b216a029bea59bc114915ef2656eb1fd0686488b1ce9dbf1ebf2b33413b
SHA512	c536159c0d460ddb99ae416eebd3fcc92e936aafc47dc47e37983b4c5c43a36f0f613f0e5ab3fb12a9a5c31a7ff3500cb9d15b527ce4e0cef93eb6fbe29d980c

C:\Program Files\Common Files\microsoft shared\DW\DW20.EXE

MD5	0cd04d6578a07bdf18c068ef0a7252cb
SHA1	e17812cff11e78b9fbdaeb43a8ad24ddc1382452
SHA256	795b676707f2c95cc905e75282fe8a759b44d64f3a0b45541ccd32991235277d
SHA512	d6510c9b054e463ff58d04fd48eb0fdc30b63b5577506afe81a2a53e8f6df7c57e513b71f9dc92976b0c503ca1fb14d6d8ece8366c4b09254b548c8ce7bc1bcf

C:\Program Files\Microsoft Office\Office14\MSODCW.DLL

MD5	8fe36e7f73fe49d95c472e6fef516ba8
SHA1	d497aae4f9a4eaa9bd8b2a4fe19b214ac843f0ad
SHA256	561838585d236b2cc3130524a26c3f06916be7aec227a9b38cd7a8bbaaaaa9b8
SHA512	71652f3a2d98554474d880f90730e8943e5b0b4cd78d1331e4a6894aba2f5974d4b6a19e92bab9870e2f55c9c2b71cb5d76e85925bf3fddf74292e9aedafea06

C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA6\VBE6EXT.OLB

MD5	ac18d4d2553bdafe381180a00c4b0053
SHA1	74fd75767a5b5270c1ffe065a99c5d3a2a8da785
SHA256	d74bef84364a1fefa10cfe241219c73bd5fc5c2f8ebe392fbf2ab6526ecc560e
SHA512	8663a7062d016afbb5627e3ba071f21ee98acffe59d890ba8af8511a9cabe7422b89ee8ff59cae022add1c0df5d82184654f2e19d88d9084ea2caeca910e86a8

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml

MD5	bb0fc21617a86fb1bf8d3063925c25e3
SHA1	386676eb7f85f9d317801186036786d36727775c
SHA256	6a7919136ffb394585effd008b7a6f88cfea589df23971c7b276a99b9a3103ab
SHA512	0ac34232dc84577303e94bf8ca0b74f42bded2f866cdc65e80e8d23ff8cb7dc9bdaf34e297b57fc28da3604460e9459f5a56c0fefcd12a207df120f83614888a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml

MD5	1737930a7bd593c8747bddca6afa3318
SHA1	eec7b808fec50f9d9dc9ab8b8611f5f99cc5bb0b
SHA256	833c83e7dca13225be989e23933ed6bbae51f012f07a81618542c70f8979db23
SHA512	9b6410048fcbb7822bb88f2e2cc95b9b1639f2abd6e58ae4b9d6ac3bfabbf25a69e170e05826f0bd15c44068280a93c1d0f11b35852d55589879e7d1ec01936f

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Thatch.eftx

MD5	39d4f59ef90908bdba17f5e1e2e29f99
SHA1	2519ab7b9a7b192b938f28fb638197385586756d
SHA256	bca4fc03174d098831ad1de39b2451da2386ad5dedf7d0e85bfb8b330b8b8692
SHA512	8e82a3f7d237e101783be5ed7ee85b0d47605af7285907406d4a512c72cca81d3c232980080341e475aebabbd4935e190a3296a760216bd45f294cddba3fa273

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Technic.xml

MD5	6524e4a8b2dfa871d5af7baf1ac665be
SHA1	34df8a1d425ed051935f53879eaa81e5fad982f8
SHA256	96eddae5c431a85dd9c9b92915e74f6b52141df77edd3f755d0ba2d3a1084bfb
SHA512	9decd79d3ab2d2dda364b4e0afc3d0e0dd6b8eeaf079810360be5be25d08dde54eb3b9feaebbb9c8c9b1129d067f858593557e3e3ec312d9abae8a56e34bdbe6

C:\Program Files\Microsoft Office\Office14\SELFCERT.EXE

MD5	6203f001acbc8949f0b3387bffa049a8
SHA1	135a87d3c655e6ee5fa31bee863e5aca30414c65
SHA256	71088c5069739de13db9ab6030f851e254ffc61533b74ea23b2ddc8df4c05dcb
SHA512	d0c287c563c322fe112a17b361b1339d5e0e675082284aaa4678d1d88164cd0238a28448bc58e879dbd911f8e32b8818f02ca9acb1108e4b2db2601948d2cab6

C:\Program Files\Microsoft Office\Office14\BCSRuntime.dll

MD5	cbf3e52b283dbe29261f7e2ab2a4e952
SHA1	ae9da13db2ffcd56e3f75d1099c1770caedeccac
SHA256	a5c18a0bf841f338eee80e5f2d11123dc8b97b429770ded4eb986b49d48aa798
SHA512	5437de07d9f1bc3db0d8526266f96a318ef13a8d9c6a9c7e2e06ef57e6ff88be802b498a07ee3ad5979243258088de14a02cdc6f5c8105bf0c483fba80c8ff2c

C:\Program Files\Microsoft Office\Office14\ADDINS\ACCESSDE.DLL

MD5	0b78565ca0ddf03d79f6ce0cb551b1d4
SHA1	c57a9c92f244f94bbca021ded68a25ec865d1e6e
SHA256	348ac66aa0f090d7652d35a77ea6d95f33fb6d05566ff8d9e486276451a3c518
SHA512	84da6b57ca7b9b354f0c786acd681b9911c4fb71cb342cf3929e49fc7d81338603e92434493bab55930f0dda78285f039c976c0d20a834f36fa4da4b745ae435

C:\Program Files\Common Files\microsoft shared\Filters\offfiltx.dll

MD5	f9ebbadb57429964b5be13a9adab0ac4
SHA1	d1f6858044f9078b00eb682517a0c7d2486688b0
SHA256	91d545b3d2be39d9289ae1881b18b0846bf136021f1b7eb6e98144a02c556421
SHA512	134a75a6898ffc4c08313bf6b9fa61605860ad92104b12ba6737b790ef09f72dcfaf8864573c40fc4ed472e0ce0bebfbed844a0ced09757dd67fb1a8792f2292

C:\Program Files\Microsoft Office\Office14\GROOVEMN.EXE

MD5	91c022c32fbc6791f9a2a3b3fc186b4d
SHA1	e98f6903e4313033dcc4201eb860626025cd2634
SHA256	8a61032e05d5aa76bfbef039443c37ccec59ecbdd14b8daf5b60ada325486708
SHA512	ea8122839fece7533ccc0269da1588877c068ab1a101a748a19aed24e84675305b42c8a6e36b6d684f419c2bbc66ae7992a98114f572c92bd2a1bcccf0b683b6

C:\Program Files\Microsoft Office\Office14\IPOLK.DLL

MD5	8aa4dd21d62a6b24f5ee0479c6c28c82
SHA1	5743be0ea553285fc2c69609811bc232b75caaa4
SHA256	e79d69f495ae7454601ad26f2cc97c7779fa7ccd81c662698721a4d5dc887b32
SHA512	aa6d1ea56ad085d7ebd743ef75e4dcd23cff597c712e7bf26ee8ef70dc14fe80c64d16ef60eaccc3656f3cf0a3d6fea6f4847f9b47faf6bc1e247df7abd52f5d

C:\Program Files\Microsoft Office\Office14\IPDESIGN.DLL

MD5	ee6b52b8d95e09a460266d88e0feeb9d
SHA1	4e127bc47ad1a4d746a364135775feb87f546ba6
SHA256	dac504de2325ba98dafad1e979ddc70b1947f7410f95d60afadc235772698e2a
SHA512	49dab8f48ed3bb6501cd1734bbe3cd3e9eed6324456a21c08acd4162d3330aa91017a08b779364aa07304652e61e00879d8715126a42345aa3064abdbe7cc3c6

C:\Program Files\Microsoft Office\Office14\INFOPATH.EXE

MD5	b2aa28c74ecad7eff2c9121597296aaf
SHA1	72b5833b6215146742f7807ff4765523dfc46c97
SHA256	c9de39c40377319631fa86afbf2f5f1f0d30b2e86450bbd593541d0075a658d9
SHA512	a6d84901e1eb2e22ff62c47aa2b0fcea5fe7cdd8be6716bfd4f8712c25320932b78c1927af8a2c4108e092ce81b0b385577f60c7c13ef871070b2c4962937a90

C:\Program Files\Common Files\microsoft shared\Filters\odffilt.dll

MD5	ff60f937a921edecfea7ee73fe6e9fa0
SHA1	b9f0f5fbb50f75403e9db04678fa230812174e9f
SHA256	a378ed5d9b3e1c31bc35e2c591ec720c9e71ea1958757081ae61e8f2f076e053
SHA512	26414892f3e3237b2d24c623aae0cacebdc63c1c2892a52d15580053b614cb4b16cdc875eb714ed4d28cbfc57639a4507fb78d332fc56b96036b906ad21b3660

C:\Program Files\Microsoft Office\Office14\GKExcel.dll

MD5	60472448087c585edf09ac3b79d41323
SHA1	cb20a2568f1f7954bbb75fa88fe451b368142dc1
SHA256	29205c73a06cfdd68fcc2b8b1be2aa6e06daf77d3bc35e5a1ad3194ffd059256
SHA512	5e856e3cf6d79c3e5c32eddd583f9a100b936788c1bdc1d26e136e4a045d0a42e3333367c88c32fab85861cc4b171c49a349bbe0f95df3cbe512000b94148b91

C:\Program Files\Microsoft Office\Office14\OFFXML.DLL

MD5	dd26ceeecb46a29f03dfdba359147e98
SHA1	ff20785d35da049cbdd608afe2eb03004c252e56
SHA256	af947c270f0f47ef7e2a53ecb06651660efb3ef392013c9b39d177d5766eb693
SHA512	b7118fbef6a7d69bc88b815dd438918fb040330f1aaef04aa11e9e730d81c6f15a77aec0c11c4621f1a9d3a64b3ec1dd19e1f9753644913c962ab948e5e2abb6

C:\Program Files\Microsoft Office\Office14\IPEDITOR.DLL

MD5	54c84ac3c4f67f615d23d69758548381
SHA1	575e4b4cbc4b8867762888609d699b4b7406f3b5
SHA256	c08bee922732271af9d3e61172af4fe62fd575ec2000f355dae4416e11264a20
SHA512	3a08b3aa408736dd9dbb48cb0014ba2b5a285bd0389c6bcd3b0d7b76d98730763e9c241c1a704c8591864ccc553cc47df0a5d8f773d17bff690643abcf325562

C:\Program Files\Common Files\microsoft shared\OFFICE14\IACOM2.DLL

MD5	40d0842514afeebf07d72013640f98be
SHA1	97f72721a5c60031b521293f45b10d007d3872c6
SHA256	cc69ca2b6014756a17b03fec714364edf7d8444f30e7fee0a294682707fabbe7
SHA512	65c6a8e8ec9d57fd62c61473b9a51ef58a4bc90eb7ac8fbaba2d55530d66a71c2b17a4ff6ab809ab407ac056aaf15a1d77f20ee1eb8f0632f3286dcd2e3c6e7b

C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

MD5	24a9d81464e8d13f5bb238a0c1cc955b
SHA1	82d9913e445852b8450dd96ef7393ad7e712249e
SHA256	e704015db66c7f03fec552877b1f280fbd3d9010e9c5b1846d8a0b31c82e595c
SHA512	a22eeab7c62f10a121d52cbae8584948ac27d367c7a884fac592c719f16cb24eb860277bbde154dc3ed3cd75e2bb5efe2d2155380d6f1029b7d0075b3c0c143a

C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll

MD5	8b9c65021acfebe23779b580de2d1134
SHA1	d8a761e9e61297cf823f619239391632a4e4462a
SHA256	56489624903f9942850cf24cfd534aa4118f846a148259a3313de99dd83c8633
SHA512	d0469a105b0e57e09b01a6aa240561ac00905727799c5be2366cdcec69635082bb3b10698767fd8037b1fca81b2b14721f455e9c00c9891d62160a316892a7a7

C:\Program Files\Microsoft Office\Office14\OLMAPI32.DLL

MD5	8259bdeaf011daeb13c30dc771bc02c5
SHA1	f70908bb3ad614c77bcf465879824a4c07fce6ee
SHA256	6f9be603c4e61067c837b126e601756bf21ca3d14f940977487fc87cc8154a5d
SHA512	6d18096f7fad48951953a4f74b046cf236f6c3f85beedc3b1bb62780b52800bec6677672b708d2def2a430d5c38b534260e8a2a19e61a04ea3592cb24eab83f7

C:\Program Files\Microsoft Office\Office14\CONTAB32.DLL

MD5	90828ca85cd5353c803830168728d20f
SHA1	36caa9849140d4a96b5b2839b7c05ea809dde178
SHA256	f4678715572b61ecfbc2c6a340b63f5591145323bbf20f35b261fe1e297c090d
SHA512	90a85f220a5ae5821970d9ac0417c80b018e91500a9cb8362d8319991e089bb9eee1c2f57a57b7c48f2291c3e7a40065df6bcb9aa20e6077f70b6db644ba74c9

C:\Program Files\Microsoft Office\Office14\NL7Lexicons0011.DLL

MD5	f5e350394fc6bcd27802bba673af30ca
SHA1	8cbd544de6aff190eabce8b765b06b1516dc417b
SHA256	49dab0668263fc3cf351c206160124620209428f7abcab0a0f7f9fdb6fd585b5
SHA512	232f7f21d38fa27e52968a5d37f5c90dee59e343b5df5c525b99e7cb8b106d898807659c49e3abb73344c36d7ce8c3d38fe52678f79e2dab051f890b0073cfa2

C:\Program Files\Microsoft Office\Office14\OARTCONV.DLL

MD5	5b6abbff3fa9090de61d19369a6adae1
SHA1	115bb457a8f8ef9253150d2fc4907765ecbd8929
SHA256	f97de2ecfa61f2f3f9fe93bdc59caa907986e7294f42737400ccea8421c20c33
SHA512	d83e3c2fc62a8f6e30d2c1c1ab7e6d248c4fa965566dae4e4c1ab02efdaa643a081bbeb715442c173c72c5de3acebac2f817893d444edcca6ab555a601340b02

C:\Program Files\Microsoft Office\Office14\GKPowerPoint.dll

MD5	e7681f5bf73797b27c324858d604c8f1
SHA1	d1fe779deff7fbf5db19b062fa1b729d1ae70343
SHA256	344d183c848541633612fab66e88b09a7deb46a0faf64000d0ce131ded79a463
SHA512	1d133dd0c272e8cfd6124a59df34d75c02857b604fb151d88567e214cb20a212e3dfd02293c155693ce4dc31968917a865ccdd9aa969e3e108f34b57204b1176

C:\Program Files\Microsoft Office\Office14\PRTF9.DLL

MD5	a7f80348639b49bea130e1358a03264d
SHA1	39cb67f5a24c40bccf4029acc57915e41ed81156
SHA256	daaf9b809aee18a2d755fe87c086b59583777f081617e5b7a1e5fbaabaa16987
SHA512	64381a2dd28c8747fb38fc2d7512a4fcc9e5caf151985ac3d0c3b98fbca39ea6ee4151770f4d0c857b8d5fcf62e950b8ade081429bd8a046f89d56e6a166b241

C:\Program Files\Microsoft Office\Office14\WWLIB.DLL

MD5	45d87bd0eeb8b72ef1661826467e7845
SHA1	08296aef1d34bb2081ada9099ef272727df830ac
SHA256	81173dc3e4dd9c11326188c927182417c17e0119f82352a2cf8aa77f3ba096bd
SHA512	2f2c9f40e44d6c0c2cce752b5ae7261d8016f80220b62427b5fcc05588d427526b981ca55a01d8535220c49183a80f1091f02d5c16c0fac50a41303131a56b20

C:\Program Files (x86)\Microsoft Office\Office14\VVIEWDWG.DLL

MD5	1d83c25306b9c1f3396f9866fca9af4f
SHA1	ee93f96e2842edd4065bd332ad84ab354862ec3f
SHA256	73ddd8f5922a7254036dbd69d7eeb71b6135b9173cb0a9910578f072d0b8ba19
SHA512	1452b64c63fd89ab967578705a89213c458ca22ad4c8c62e6c1a49e54fb4b20c9b603ce02ddf37c9084dde778167ff22e02dbc5c6d1705d980762ec580cbe27f

C:\Program Files\Microsoft Office\Office14\VVIEWDWG.DLL

MD5	0769dc1b7bb073dd4719590d8a1605e9
SHA1	1945d4fdaf378777462cb0b0fefa0d846316d88d
SHA256	9139c70038c22553a8d07fd5aa9fbf9f4d0594b2ed824fdfe9ac97fbe10f6287
SHA512	072d8a8add1eef60d76a420b2399476a7636404f9aee8ce3d2828d1bc212ca491d2b204b15adadf674238530cb0dec0e0aee92718a5922dea5c83d2f1f30e110

C:\Program Files\Microsoft Office\Office14\VPREVIEW.EXE

MD5	8ff2b39c3a3b639f214849713dd5bed3
SHA1	74811526654333c154dd3ebff220b2e64282f0b9
SHA256	2af96010212c055d9cd046c81f00da61ac448d51a4178aee477d5fb7a005796f
SHA512	0e97def621152230bf03ec506d2d005164d4480427d208c9c66761c1db7719e61a2f193cd776cbcf621fed8206d7e04fe08e857d151b86d61fbc875d9aaf169f

C:\Program Files\Microsoft Office\Office14\PTXT9.DLL

MD5	00805eb1cb27deb6091845e40decf4a7
SHA1	274844b314cc75b0db92a7efa892d4f4f1442e1c
SHA256	5da6730cf4ff59f9f399cdf6a7edd23252f8ab952cc0249649e3aed2a527777c
SHA512	0bc3ad8ade6eefb84477934ef8572deb885149ce6bc40375d35be9684c7d5b468ce12cafdb477303b05df7b035440fedc6c53ac0a9a5787c6366d017d0ac7dd8

C:\Program Files\Microsoft Office\Office14\GKWord.dll

MD5	d01dd085e9b4eb2bbce4ecdf180a8412
SHA1	55a0be74cfc238fd632fcee857803aaf0d126b7b
SHA256	8db712682cc14a5cc584da56db229f247b34f773362d4b66fbaff963f504f05f
SHA512	2b58cc7613832bfa2986f7413089361d1e6854050d99e37e0858a3057c740ff41ff5aaba78cf7561e0a526e2e575d97ffab6dc038005f1bb872650f9c7236306

C:\Program Files\Microsoft Office\Office14\Wordcnv.dll

MD5	0d16889881ca3d646dca6cf2cb297d2a
SHA1	cc3a02d3bc9dd9636549307975059b4f2d81854d
SHA256	3df79fd9463ad31dc6186139508503db7f6c83c268922ef7cf06b38cf48f7b16
SHA512	aefc60a58fc504f927748c03a59d9d621f8224f10d4f3569c23e351d5daf6b058238ce1c87dc5a991bc5cbfebd1aaa6d5209e22856aed65d784fdca5ded931d1

C:\Program Files\Microsoft Office\Office14\excelcnv.exe

MD5	fd73f2ccd669cf8560726bf117b8db61
SHA1	cacc650d73a6f64bd2d70bfc79f56fd3a0dfe0c8
SHA256	93c02246d5d0bf0add93afcff97bbd182f0b6b7b3af0d570606471035fb9704c
SHA512	962b9b563e1b92e3c040881ed00553a29d826b290ed98841a6b98eb48d7fd6d4f1c0dad294bf979b64edc1549fac3bc0fec55eb8fac1701532c9ec4c8dc3082a

C:\Program Files\Microsoft Office\Office14\SHAREPOINTPROVIDER.DLL

MD5	d2e60496fd9b7fffb3144b7ed8f7bb93
SHA1	ee8c25319c3f677ade53a9447b050091578c642c
SHA256	e9d2047b2a46f4bde96f83b1a08ab19995dfcfdabcbeab95fd462f1f45d4f1f1
SHA512	abfbaf2fedb3a0d22acb062e166c5287e079a9e5a4a7b0a7b8549428a39c363b8e9ebb3761ca7a7d6ee6897663263b80b8c6f5427f8c036a2a553e603a6a65de

C:\Program Files\Microsoft Office\Office14\OUTLVBS.DLL

MD5	459b32d4a317e3b6b34d078d241a39aa
SHA1	3af6e3b558ef3287dc02b087476b4061ba164c4d
SHA256	9afcab341d3b3fce5060e32ed5279519278bbdac17bcdd7eff4455a9f8ac575e
SHA512	06d7810c13352f53793eb9ba1676f199e3e93211b7379921b8391c7e1cd277e9e290fd53cd1850b39ac7b5037381e895348b424a01f1bc863802d039a9e8ca5a

C:\Program Files\Microsoft Office\Office14\mset7jp.kic

MD5	15581cb61bb8629de89f865edd31996b
SHA1	32ffa03b1cbcebdd044c3d748dceca56ae242ea5
SHA256	f05d00c0284475a349f60d8d1bdb1068e52033b486686091eaaf42980d0eeaf8
SHA512	3d830ae57324e80285df518cb3e807072dc27f7c5a2d3ff8524cfe5e2e3a6778a64f3487d9689f3a4a7e6d3a2041a591aeaef46fb55f383a00c9e774567ab57b

C:\Program Files\Microsoft Office\Office14\mset7es.kic

MD5	852d672ee2622d72b05c74af8b1d0336
SHA1	ea980a06a0253c09240b26205d4330f642b1cec9
SHA256	c37fa4ea1d0a41761e3be21a767562eed5ff5f580fafbde9396628c9097bdde3
SHA512	546f31c735f21008f2b23910a228e8c1901da488a44497aea15c5cdaf4ad26db438b1229b72fb46a63ba371847207d7ef4e32db45e2342fa1d39fcacded20e2d

C:\Program Files\Microsoft Office\Office14\mset7fr.kic

MD5	64813bb7e2a67da018b182ed3fed8374
SHA1	28c0bdaae4b93c51afbafb77dd18c55948edc552
SHA256	bf6e6001e10620461899e5e4825d8f269ca746ac3f2fda67bf27d6465c507af0
SHA512	ccfa28cfd1ed69bd378354ca352dc8559c0229758b1da27b5abbc3bbbfcd419d3efc638c6b78a25e65c1e83bb8a6c180c6302e15ef1db53502482066354bfa46

C:\Program Files\Microsoft Office\Office14\mset7en.kic

MD5	7627f4a99ea01cd93b2a07634ba2c80a
SHA1	f23b8ce44807a1d1dd3fdcaddd34cd8368189017
SHA256	2637963729807e445e2fcdf7ed7bf46d6a1e433788ec994dbd06d00dae241dc4
SHA512	3a3c61f9266978aa3fbca98bb268942f7d543afc54ed8d1eaf3b3bf3190ed51cdb145e4524b01edbf7eeca387a1ffbd32578170cfd2b0daf4640ed34df64ea8c

C:\Program Files\Microsoft Office\Office14\mset7db.kic

MD5	24430de9f0a40d6feeae4c133d3fb5f7
SHA1	2c23c815ffcba56e470bf6c74b7e59cbb45105f4
SHA256	fd68c6a3c198816af1ebae9115f4fc49c598283fb18f8fc89896f8e621bd82b6
SHA512	73372fbeac5ba0d92c6d3d7983885fe30d315d2c17f7c21607041c674aceb5d6e4d1fec34fc4f4596bd2618f142c7db90a437df4cb4fbb7e67de3acfae667ad2

C:\Program Files\Microsoft Office\Office14\mset7tk.dll

MD5	0546dec1c22b633c09cf575108602418
SHA1	2a150703c74912b6dcf28871bd82561d70888244
SHA256	60a858e3639d0ad381cc4d0fdf6cf1d47f0a3004038e92c6a35c091315a232d9
SHA512	223292ec98d69eb4fddac82bc8df4a006e8e524533082320aef0d4d16cc803f5fd1ba90165ac6e6dc1bf438ef0e0728c4f8f7306a06ddb4c8bc5a622e89671c4

C:\Program Files\Microsoft Office\Office14\NL7Models0011.DLL

MD5	c96645dcfad7658306f30d6efc69c034
SHA1	f3f1ab5c9633765a6195d04192fed72cffe1eab9
SHA256	38f63cdfa4c678a9cd0e43f87b43c2c8c97194ef74cce78043362974ffaeb6bd
SHA512	dbd574cba15810d0b4998602ac139b33d2c1763c3bc459b5376adab46d30316ad1ab317e9dbc07fbeec157445df6e82739469478af83b35f1d620064c129a905

C:\Program Files\Microsoft Office\Office14\mset7tkjp.dll

MD5	89fe0311568725c5fce826878ae24065
SHA1	932d7d749ab8298ad24d00fc3b410426daf30fd8
SHA256	1faa4b85f14682f7d29ea0479088183172d06b065be8292db0d91761e4cf6af6
SHA512	5f3025bd7144f855402c081eb60e411f0a29f1026dc7d08889953b2352de6d810d831e96eb8e0a10d7cc0f587dbf12910616c9efb0e3df3c7b9aad75adf9e677

C:\Program Files\Microsoft Office\Office14\mset7ge.kic

MD5	a76f5f0232043ee1c41daafbb3b95659
SHA1	85b46b526d09c865dd7aec3a66c4cbdc5e66c41d
SHA256	74da63aa236ea18acb835514457bc33e45b3e87355f6260db2534f2196defad5
SHA512	ed0d1c757b84861e8940e0de532a9e53a11fdadf80f4d240f4ff195edbc635c276780c2ecbbc82a39af4c4c8efdc650294a946ffc3bf4692f874ae28a117edcc

C:\Program Files\Microsoft Office\Office14\NL7Data0011.DLL

MD5	e42a2c1c0aaaac92a63121e2d3872bb5
SHA1	0e7a6a360be431bb03a50c1938753fa5f7acbdfe
SHA256	aeba4c645e12aadf3c51a3b4b4abed75f6818501ffcd3ccae29207ca117545f5
SHA512	3ccc747755d3f5aec45a3258bc57e8083ee1458f2d8ea2683c0321a714947db0c68b73bf81116c824bfd5984db129cd2ff5d545a54ff7401464a9830fe75dcf8

C:\Program Files\Microsoft Office\Office14\mset7.dll

MD5	84562fa1faf7646cefd40124510e43d7
SHA1	1228b3ae46d5d19d769310da8ea68c11ed4fc5cd
SHA256	6dd2efc6969280ad1dc91e9b75fdd17569ea6609af07fb254d6ba2fe17705778
SHA512	69090cb4f471dff1c9607c9dcdafd801a88393f0c9bf0c3a75054f40dd8be3effe0784108dd58dfcd834e73f17e599fd47becabb2e730d7dc988274291430d04

C:\Program Files\Microsoft Office\Office14\EMABLT32.DLL

MD5	438923b6e3fa970cff689563a5f0dfa7
SHA1	05f7f1074dc064a3de2c36caf8a79ecbaa727d22
SHA256	4faae12f7fc0fd1f65a259ac991115b55176083d5514f0e30d79be673d236056
SHA512	c1d65627afcb2b845e605742dbab89971e850ae7e0a041cdd1c28f800613ad44a4db0dcea082136a96fc37e8cad51441fc5d3213d409e745f6a99cdd1a98509c

C:\Program Files\Microsoft Office\Office14\OMSXP32.DLL

MD5	87c9627d3af7721feb981155f595c2a8
SHA1	dbdbb9f40af19aa03e1e48ae24003b6de834ab66
SHA256	9434cd49a9793b1c0af5f2e1d6a8d45575b5db5fd30d67668ea9a086ad209759
SHA512	4adda3a6238e12fb6e991ee784d716966201e52ec2cef4f75ac67824475cbd71a0631b1c675900b2c0dc165c09b1659ffb49fb6724ec2068474a818aa0fd38fc

C:\Program Files\Microsoft Office\Office14\OMSMAIN.DLL

MD5	0de6d54470ecd92043b04442869a92b6
SHA1	da250a984bbf470a83aea079b19667144ad8cdc8
SHA256	eb1f39d7c7b576719ab73968c66414de3ab6102380a81fc93f486033f4bf9df7
SHA512	d0cc23d29118718f9a6fa12a61390a983af844e5339888f882723d55ebe68431f3c03b2104cfb1d9d510941916fefacf45e52b21d22d23b3e7c133c6de4bb035

C:\Windows\Installer\MSI3EEA.tmp

MD5	85221b3bcba8dbe4b4a46581aa49f760
SHA1	746645c92594bfc739f77812d67cfd85f4b92474
SHA256	f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
SHA512	060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

C:\Program Files\Microsoft Office\Office14\SOCIALPROVIDER.DLL

MD5	ab1f1f87892acb1c7a5203f2dd2a5294
SHA1	c5a73d1efc07a3c209b9ecc32d88ee990113c26e
SHA256	52fbd8ce4c9da6852bd301b549133f4289c198ce0841c2e9e4389d286ba675f5
SHA512	57d1123b927d9e859623d2b04bbea8bb26290ab7ff9016448fce3f947a72d971715f62a0e973a640550549b10246f42bd83295a46d95d324708dab33f802001a

C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL

MD5	4a0c96df3084700f22db9207ff11088a
SHA1	b6c7299c9783ff949ad2f549eec7ec8402efc1ac
SHA256	dff3e111a7702336550708f83f8675e4e24de918c27cfb7b06dfe51d193e644c
SHA512	65ab9260ed2b9fcd7811e5e7efc2005c69043e4729e889e4f1f8af164270cd0ea692e9c8d7706d5d49dec74fe9e37ae655f6fe164d4e2b67c55ed82dea14b695

C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL

MD5	23a9d684da1685000530b7652d391579
SHA1	631e9a9c940bef634a9c805275d54bbe88cfbbf5
SHA256	d26f122bee67d9e9c103eeb822b4f3c1b5d5a86871516b605cd503b2bd4a8bfe
SHA512	6263600ddbb8677da6258a43a36944e39fc5f8d44129a24294416e1704044270e6bcc7a0804e558d2f27a5e58c7099551ea1c25dfd5125a1651b135f2024f190

C:\Program Files\Microsoft Office\Office14\MAPIPH.DLL

MD5	3679528281429e24eddae62b319b2612
SHA1	c269c48b724214c0bcd9ec68440c3e4b077da28e
SHA256	2baffd6bcdb4d78915e46abeb26ba731a1dcacff7c0983e4ea74d8636acbab1c
SHA512	499bc431b809f0f26537a9f261104f4f53a5b8b1279cc96aa932685c23e4b0c374c5049836c7ef5f67fcc26f495951762122a61f9204194f9805f7449743f1ed

C:\Program Files\Microsoft Office\Office14\PSTPRX32.DLL

MD5	ef89433752e55ee27ff8b7d8d1bf2782
SHA1	c17432cf83ef5a2e71aa87777aac4d75c452afb5
SHA256	a9552c9c0dcee648e271fc319937bcb3e924ebafcedfb957d8242ba819c85129
SHA512	ae12e83c044e695be43f1d2e3a4cf020904727642a3515c16cf311a1ec786ecc600c7ef9da8bfe6c277cab396aa0bedf8ad9e329afd7675e95889c5063b6c9d9

C:\Program Files\Microsoft Office\Office14\MSPST32.DLL

MD5	0dc0ba5205fe20e6c4c0ddbfcae1e65d
SHA1	2c6612c57b7813d8e4d53ba5448dfc90a79a7333
SHA256	a7bb0a40033219910b65f4f399ea8bc08b9f41dd5650e0121570001fe7dbc609
SHA512	964c0ce405111a8a339e9c520c59063fb95949c38cdf4109670780130c2325d27e6a6be81362b810423840be8267a101359ac6ddf42a0aa35b1cbbd1d27bcbce

C:\Program Files\Microsoft Office\Office14\EMSMDB32.DLL

MD5	535738408b8fa7b659cd3c899935eedc
SHA1	b134c88323ba1c742bf58095db06b918c5b5103f
SHA256	79c4c1bf412ebb381b8d02603b3aefafaf22df23d3ada714749d9998f4d70591
SHA512	ea4c46a1c1217343b6b8b93399cdf66183b3db3332f4124b2c1f27447ed814b45864dbff061cdcfd35dbef75f75ab17b25173c60b37864e707a64f673d1e3cfb

C:\Program Files\Microsoft Office\Office14\SCNPST32.DLL

MD5	04e7cca4a26c33f89b8333d6c776d378
SHA1	56107ee14afb4a5e8383f16b8d873fa6ee7a02c1
SHA256	322d748953d51510b6e3c00ccfe044fc8867854a5983a2f4c824647b9fec66b6
SHA512	32aa0523ccb15b7fe0373da122373bc1a9f7dfc16c4ca623a8d5d69aadba640af57384b601c99bf2482b479a95ef4ff82e0b581c631b85afc7945e0773cb5665

C:\Program Files\Microsoft Office\Office14\SCNPST64.DLL

MD5	f9d1346ddc247c0f9203e3d34612715c
SHA1	71a071316c611b94a96cc21200b7a6a5c63c6485
SHA256	2d3c27c66f95869cba1497a8bf486ffe32d44ed25710bfbcaf85e8d4a8b66edf
SHA512	014798c28ffbf2aa5e32227cfa9cb89e155363deb91cd6c5a289139c8d98a5ea7281fcd0803ce0d968bdb78937e08b5f0e66da2aa399252146de35fd76f84998

C:\Program Files\Microsoft Office\Office14\SCANPST.EXE

MD5	b265ee9311fd98627c688c5322d7a34a
SHA1	410e7b63b22b51ac12faf58e8d0b1c55ce0807a1
SHA256	04bcaa386890ad4ca2bad0c85e3dff2b421f842b111522070c9fa0ab7dcd84c8
SHA512	cb0686c8dbd643f92d53988a85a76a02bf6bea54d8e234d2fe255702703f5f1d4dbdb41cb6c77c66a1c8492995e68c465e2d5f01c414e32ed78fe05930e8c5ab

C:\Program Files\Microsoft Office\Office14\RECALL.DLL

MD5	36e921c255a7b2138e81f63cd9582c06
SHA1	8feab3e0a74fd2a8d6c603169cea2dbd67d80f65
SHA256	22f596ff65f6ba3d824e3952a5fb5e8fca9b1fa16b751b60f6f9f52d9fdb59dd
SHA512	468124f0c6064c04912e0188b24a475a8a40dd06b8d7aacdacf73bef1d12004ae5fce454f3161cd26f1062d4c611b7f59b94712fa4398af8a91dc6ddbbec0f87

C:\Program Files\Microsoft Office\Office14\OUTLMIME.DLL

MD5	fa1332c09b1105f1d8c7f954282e1c5d
SHA1	c67da99a7a72ae8d54eaaff4f55ec6633af89a26
SHA256	52a3dc98ce075ba5a81aeac1a7f2c791e691085e594ed475af0a03054ce97c70
SHA512	95bfae61bf5dab60f4a2c8f06908f82cd4e20d35674d67e836a3e63ce6a18e0ef78dac2aa0c768e4921c8c7fe93399e43acdb1facad43d1c020680e12941a48f

C:\Program Files\Microsoft Office\Office14\MIMEDIR.DLL

MD5	35be0f66d02a1a81c9f9d3b15be41055
SHA1	01b5c52a58a656fccf7d93b034353fc57517a9fd
SHA256	e9692a514708c85d35527f92b5218644e6a88aa45ac30d7977853ced0992ee75
SHA512	01414d31922d042f2b657e6fe6909b662f9339690f82f10fa7957634e2ac1073bc488f2e0f337cd163a0ed4346275221cb51c1c13fd64d419c0df78b48c03517

C:\Program Files\Microsoft Office\Office14\IMPMAIL.DLL

MD5	6e8acfec2cd5181c6d518dd7d38a7689
SHA1	e17c50ec4ad36dfaadcd8d43f857adc8bb8c83c0
SHA256	d63d06495e86f3627df2cfe2a248d1356fc660a0af96e779814d8fc30c808230
SHA512	fd96e0c4a21e1c3536d5f3858372628bdd00db2c9b4220918396e7092f108913ab9e07449efeff4076dadeb146da5f3228068bfec16741886a6d068a5e9b090a

C:\Program Files\Microsoft Office\Office14\CONVERT\TRANSMGR.DLL

MD5	b2fbc32db911382699c963e0e41f9828
SHA1	7f6572d8729996ed85182253b7c876c801dc9282
SHA256	4b42cdc93b8f5dcd6c828cf04de644e4b65589b35f07355fbda49b6bd3e6d9fa
SHA512	7015b02778d3e692098989ce34c824679378082cf1fba1d0a242184549ed76e05b0b2f4ce6408ce60a135b65d7f11ac4973428309b5c5b79adec013db1fc8c27

C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL

MD5	684b6f3e1ac7d8a96ae8805acd2779e3
SHA1	383401fbca395670c9b106d3f3f8078b10b14e59
SHA256	da08242b2e35c37cc6170fa3d90407802052da34c185833da722632528a002f5
SHA512	01eaa0eaecac39a239926d2b324119b5811672bee37d19cf487c1f86113f71fb909067aa228d74ec52456548867f7536abc8455823f8a3ddf81cdbed55624d92

C:\Program Files\Microsoft Office\Office14\OUTLRPC.DLL

MD5	d2cb19cb4111834e788fc17d2c5ee36b
SHA1	d3d7d6f3d2e7f22a71a60e78d32ab3cfa6d9d363
SHA256	362fd80b32c34281eadd1bb69fa94fbcf3696175a85ad8cf288f211343d8a02f
SHA512	734eff748616dcf66f54ee9ad925e64937afa89f5ac09ca35b6e62d75e1ac501cc0de9979c5d21bd80407a88fa3e6d716b1a20eed18554911f69af884c0e2219

C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE

MD5	0beb877f14d08461821a01226dd4ea9a
SHA1	f0e9a99d346afe7782a70db3730c3a08c6b2fb05
SHA256	42057cbd17e218727c2c5886881497403583bf550864fd5131dded6469e2a049
SHA512	db749fdff3f11b055485f58c9f24c8884a836831f96a8d4f30d54c0a17ec4d723921471dbe6ffb84c2672005e78314db4e2726e6c19eadb2789e6ab68fa1a7dd

C:\Program Files\Microsoft Office\Office14\ONWordAddin.dll

MD5	92b9bf64506afd7ce3bd74de5af863c5
SHA1	b0b34e41e58bbff19586f10e9e1d36987eab100e
SHA256	c6bbd0db2e310fb0719ad290cf6ba0d71942ce13a19c396f0f8a283ae7041595
SHA512	4c579ff510c053d8714229e15fcc78ff8bd04c0cacea677c1c1ec7fb6f23b87788a7f67b850d4b53bc0dfc8ce8d5505dac8ce8ebd36310be94f65b0b9ab12be3

C:\Program Files\Microsoft Office\Office14\ONBttnWD.dll

MD5	1da03a3577bc2b3564750dfe60ea1da5
SHA1	68901c0e4dc11051f946c52de6eb0b4f8e01d709
SHA256	dc0651ef23e485150623a5541f977483e32e06ef00af7e932a1dcba1c5a2ec5c
SHA512	b176a7712c20a0e057223da1be7a233f27e6b87cff736b283d35da2e56d29a591fdfe2716e8f6e7f89e22eac4c06aa364d0739d57a134331e7af62c87d4b7e45

C:\Program Files\Microsoft Office\Office14\ONPPTAddin.dll

MD5	9bcf73246c3632c06475b79418177a8e
SHA1	98034adb43eed406d0b44efeb6a1f96d11e09941
SHA256	b6049864188e2886e7fd3edd9782fa2d7ed918fcb95d435ede756fcd05c03781
SHA512	4cd1a480f8fe43f70d101f9cfc156e4f0939adb30238fa556b645564b234382f64c20a74f03ae1e759c8705761d60f361d165b5ae1ed5c63e8afe3921f60f104

C:\Program Files\Microsoft Office\Office14\ONBttnPPT.dll

MD5	56e9aa29f8f70f88c06228e5135101fa
SHA1	33f2f65ffc05c2f6607426a55ec3fbbf9f1ea59c
SHA256	280feb637e827a2a0fec89358f040ff79f8eda3b59a760b9cef588213b30216f
SHA512	03b5e109102cbe8c8b0f9424fa77cbbab346a853dbb343737c8f5a44edab5487251a8166b3a21aaf0725f378c7da82fbf28202d95c83053d9b7343d8e169af9f

C:\Program Files\Microsoft Office\Office14\IEContentService.exe

MD5	b7e927d9560fcecdd70da580289f2431
SHA1	ae2bbc4bb9d545200f8f03555e646c2136f805d3
SHA256	950043951cc07711c8ace7e56a3af5e42a1d56d02204159365e3288cb0cc5d2d
SHA512	3b85c9b42133b05b0db5a501f7a0da73a6e99279dfa2edcad39873a30972edaddfd6aa2f658994ec473ce31e80be62927ad11f2ed617e13b63084a07d64c9540

C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL

MD5	d29d85ec58e3f1e58375a9b7300d9afc
SHA1	db671072ad4b3a58ab1807295e5e827e2589604d
SHA256	8ed719aafb763806864563cdb8b9b0ce24da4534299baf2eebba640319c987c4
SHA512	9061e4cb550b47ee5af5d167154d9b292fceefcc78986a7def4c20d4b38199d4367492695474a3f979d0911b90bc63c422772a1a38eff566dcf4ece42f9a7a85

C:\Program Files\Microsoft Office\Office14\ONFILTER.DLL

MD5	a9b66a6c956daabbfa3221fd20580058
SHA1	bd515df6a8f8a4d8a10427263e6f7a866da03cb4
SHA256	5612e768b395589967d354ef36c5d90ebb73a33caef723a4c32dc372a42b7217
SHA512	d36caa7e5189251e37f5bbc17402ba726af9d8bee82b940bdf66baaa7cdc6a2c4293844339f737110e5814161060c43508bfc1fb3d735198c2f2753f75572597

C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHLTS.DLL

MD5	530a9bb8cf30f822c50c53570cdf75bd
SHA1	eec11ea1758d3ec508aa91c49e0c1d9717cb5ec2
SHA256	fb1d487756d1db723446def9489154a6726b28319bb7217fb720e64eb0193452
SHA512	568776aa9b11f9786d5161e20c8ee41bf193870522cbd1bb5e88f828108146eaabc8d8cdcbe902179cceb674ccc477d2c5e3fe8d12dfd767609dc591e4528506

C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHSAPIFE.DLL

MD5	9365ef0eb1144069b78a2efc7fd15a20
SHA1	64b9fba0397cc000ff2af32c0e88584916f4c103
SHA256	27738be0fc4dda72731f25660c61117b40127e091bf7f15edf8799ef6bfd2edb
SHA512	3860c367d4f4eff0f034648b403dd0e3818774164c4ec0a3be48a29f8be9ad5516183fc727ea7cb9f6d62c831cb3ecc8ede2f5073b1afa4be87cdbde0e704364

C:\Program Files\Microsoft Office\Office14\AUDIOSEARCHMAIN.DLL

MD5	d2e11b1a7ad59cb809e1e14f5e88396e
SHA1	4ee3e16dd76715aa884e5c1fefbca206e1f0dc65
SHA256	69cc760d8fc31d1eee11f888261f4b2f3324bb32e92ce404b0b3393551f14873
SHA512	4501b95686b6751afab2fbad14f7b2d97c632fc9eeaa330111a6a1ab7eb22d74712de93fe77dcf31d5ab9393f62038304503ad1b8ae799e83e62e06fab80581f

C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll

MD5	0fd05bd21e3b1a5040bbf86ace5b9339
SHA1	63cfa9da98f8bb50102cd97c521b813d4410c76e
SHA256	846267da78590bb82ad6ed4cd707c06023cddf4a77ca52990107f9a4ac0d7be3
SHA512	20f4d81c73f53447c162d64f8d8eb1b8c9bef5c32c9ac914b1f9fbf8ba27a211dd38e8b0ad035c21f9ac58c89b53dd900c4adb8c6b33f29cf9ee6be020c2019c

C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

MD5	95e5f2cebd59427f655fd352579c2b1b
SHA1	323db186c4411cac04c0b455bb7010302831eec7
SHA256	38f0786ae6a989f046120f8b4ad618d5843b7fb1cc9e7deb42a995b6ee532137
SHA512	e2fa6d78e732fa595c0b26b00c99a1d33c7e0d88f903d28d4465f5aa8092f9170baf5bf5a4aea8a2b840fcd0c514a9d36ec2010d5e9b57300812388a1fce4a9c

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\Xml\Microsoft.XmlEditor.dll

MD5	069d63d314391e9c7123dedb4c475141
SHA1	b433e3ab23af5ac0f7c50bfdd5b0eee98c703f65
SHA256	e106df056908729cd7dff52921721e9601017a08d50b97714b83a9e96f696b85
SHA512	571b766d7ff298b14e8d7f7ee54ce004ede1709c5077feeab9b4f7081adc974aa1f3291d9c3f9333f15e8864a6050b0b38b520b72a95d50d19aa256a7b72804c

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEWSS.DLL

MD5	72b65582b5943d1b2d4866066db6273f
SHA1	acc281b1655ea3885ae2f53bfaea0cf0d28b400c
SHA256	b550cc114fd6cc78a51db5e4741211f11488f55c6db0436088eca827ab3bee00
SHA512	17274cf05c3eb0d2e68e78765d0e6dc39b7352ed5597ed2b0510bf115a4355c9deb88e7206778eb290676ee79c18ccee9a52bdeca59e7e6ca2f0f907cba73026

C:\Program Files\Microsoft Office\Office14\MSRTEDIT.DLL

MD5	ba27c385dced45ef27ffd518c549e17b
SHA1	9b4eb5a222e20c6736d4ed0a73019d53c1f64e50
SHA256	f7865bb94bd50acfac2bcf5c47eaf5afd738d857320ad65cbb22017e0786ec48
SHA512	9b7fc89c4f0102f9c2eb9a09a77af3e72d3906c7489d4f5196c979d82e15db4a18c81716add6d00a78d0d46a2658950c5bb23098d1e221b80ba9c3c742544d9b

C:\Program Files\Microsoft Office\Office14\MSACC.OLB

MD5	6eb3fdd9a1ec74e607e9227d4d2acb8f
SHA1	bf95ef10488ab883701a6cfad72a6c8127fd6b5a
SHA256	7f2774748743e1ff7fe6bcde51b5cd3f7393f2927dc76b8a8c95ea52a678e714
SHA512	b84ff7609499ad7327dcd392c9cd30aa47a0b734ea6b634f15b21e843d4b3c4e9242cc8a3e8756ae9a8bedd4286fe37748e95d83d8d6e1cc0f32246156fcc9a2

C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZDAT12.ACCDU

MD5	dc996b7d62105154a357eab35fae7296
SHA1	6e76463fc90c26ddf79d5e431d629812a4e654e0
SHA256	1877617d11dae55bd45c7c36d359f4cc603050d1f620aa036aab2d28746dacec
SHA512	8df6d56fafd5ada8987c8e24155383fd7b40c01c6d71e4df6cf0cd646992ea509b316124005c6e23455029f592bf56f1e2a98da384511f388efe025a3e92441a

C:\Program Files\Microsoft Office\Office14\ACCWIZ\UTILITY.ACCDA

MD5	eb0cd259d2bb61f87371bea0755dd5b3
SHA1	ce0337662e7f6ee7446eebcdaaa66a1004f1c553
SHA256	085736e36e5a3c141b89b0944ebe09d3e63bb83cec08b2488f084e7371b91f19
SHA512	0e2e1471a24c4bc6994e1e76d9e12d3403592c545bee3f82cc9592a5854f5d18cd7a5e081ef2dd77affbd58fc5eba5bcac8cf47a8f54e917a1a586dcca704a44

C:\Program Files\Microsoft Office\Office14\AccessWeb\RPT2HTM4.XSL

MD5	c9cba0cac12756cf95f0b9413a671ffb
SHA1	bea9d660756fc844ff7f88c40d13046b5f623a27
SHA256	7d4cdc84d7f63db34f9d7c673273b2516bbe706207111a86eac5ec60268eef9a
SHA512	090b6ab50162bf8565e93e70a87faec066af027bc5edbea40e43290c99b47afda2ccb8ca1c634c1f3f969d4cf47571be7cd248c8f4f0bbcbbd2c829a24aefeac

C:\Program Files\Microsoft Office\Office14\AccessWeb\SERVWRAP.ASP

MD5	51cbb9b52b70cdb1e44476beeb015001
SHA1	4bba5a148753b565d9895d91e320013f3e5b812d
SHA256	759257c3507b1deddb59b47d6b7709c5182db684e80b1610bd4077bb01e30281
SHA512	ee70514163ae2bb4c65ab86b1c3bbcf63587aec328d84047d3435a6db505f4d1a1b7944696c593f02f213ea06e68f5fd2fc63b398307f7c040bc6672057c058b

C:\Program Files\Microsoft Office\Office14\SOA.DLL

MD5	c49533aa064cce5e248cf80ec3cd7898
SHA1	af56883fe2b19fbecf9838d2575c894ef5ed4dc9
SHA256	1d94a46573829ef77cb6c515a5d9a5d3127b58f70599e12d87576aaef2bc37e9
SHA512	759eaa59c20b8c16ae3ca43a8f75fd1b7f9bde2372662d5ea726d3369075cd8ad735c4781249158df8eb5035d598dce94c79d6425b7af069aa19dbba4fefc369

C:\Program Files\Microsoft Office\Office14\ADDINS\ACCOLK.DLL

MD5	cf577e865a21eed2252c63b0bde2d0c0
SHA1	b81af3bb0003a234401f6c52067104cbded1b18a
SHA256	b18b78eb42f541b91807b4529db21c27896a51f5c697de0bce4197ea4adf7d0e
SHA512	378d7d758af32e39c8ea464f26d05326a929d0b0ca063440c86e019c768c135013988c5ca59efb8c6fe3a3d0438ca2ae3d20c77b6489e5040a8bb2c3c0fddde9

C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\WksConv\Wkconv.exe

MD5	046fd7a7ab54aec7664725789ca300ac
SHA1	60eeb00c3a583659e53eb15420bce8e7886f8084
SHA256	d1ec68fcc37750138fae78ebcb2fd9f50648ab3c0aa64d86f94a2ff292c1f5c9
SHA512	0e4e68e8e15db99fd59fd284a0354597a13748e1193fe5f76ccf530e9987f795d63ca9c4303e444834082557f38e133dd9b441811971278e077042243cc93156

C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

MD5	2ea9f6623fa880a7eb56a0d22de1fc5a
SHA1	3dc2f69c28a2b3c302c4fcbdeb66b5c6bcea8104
SHA256	e837e73c172253d67812e55a834717b8cf5bcc2fa8e48efc7623f090c3b07b85
SHA512	be52a8e9ec0005a73de0e4df5333c4567624956f4e2cb61d74e2ab7b8c6970b1d543d678a1830715a19ab42dfe15f3c836a6051b82869571de47d87a55e39df2

C:\Program Files\Microsoft Office\Office14\MSOUC.EXE

MD5	3424b0da11879c5ba04e9d0b1df9d9a4
SHA1	eecb9d93236f58d59a04585c945ba261e6cde372
SHA256	7f14ba0c016c6968a1e4eafe3ee88ab3db2c54918fe4c5613ec17b119b5bbad4
SHA512	8b80d4545efd1eafeb7ed4a00e345bcd6c6dc9ca6517e49989adcb49a5cb71f50371335636895b4642c81902198a7f65f4679e206261cd159c2325c0f0a3aaa2

C:\Program Files\Microsoft Office\Office14\msproof7.dll

MD5	a1ce7762be22eb594b743a4d62cf53f8
SHA1	cd8740069a2559bcefac8918a2abb7db9da3ebd7
SHA256	d92c55dccc03f76218316dfb553e725ad6c280be7144ce1479ae01e4b3ea7600
SHA512	e3f03033be97e5ed170f331c130fec828571790536cd1e7be24280d8f7fa79019e2458d30a360e2660e57c3b0059a83db068095e70c3f0c5959b38ce135a6a05

C:\Program Files\Microsoft Office\Document Themes 14\Couture.thmx

MD5	4a7fe0fbee645eb5ac6f89ec644d9366
SHA1	679028fcce387ead6fdc72c6ed97c9753c2a3078
SHA256	796cc32ed2631f583a4495672ac360dbf469d078d572b9c089873f1464955f85
SHA512	6c08a0df0b1bf2089fa3efa9c683f9998d5cd8c953987005196f680c2cf1c20247d3e24ea2b535a58e3e857829c12ef6b4ec29da38883ae384000dd1f68d5a98

C:\Program Files\Microsoft Office\Document Themes 14\Aspect.thmx

MD5	7186e07c7d7275d627204c8196d8ba24
SHA1	89c0f16630db089e1c8c1d899fbed639d03dd8e0
SHA256	bac4caf411ef66b29f02061b527b004c3d5fb092e3ef42872de02171e1a9be7c
SHA512	307d4b7ef6dc7b99c82661eb5846eae112345a90910959dc78828855566059b8f2fa6b80a7312df62ace2c10a46f5e647266dc55c30d4cac44486f7a7bd14303

C:\Program Files\Microsoft Office\Document Themes 14\Civic.thmx

MD5	21481d8c3aa411b400ce9bbdca9a9724
SHA1	27711c52bffcb82b9e7c7a791a7002359a83fbc0
SHA256	8711658687e9d896b570366f5fbe41a4b2f13936f08f0e35d6b9ef42cb45546b
SHA512	b8961335a71b6c4a98a8f304aca02f74f3fdeecb1ea12bd8ae76650c0794f20edae14592685b3030c3f094c499f414cac7fd69137a07534308d47b987da95c62

C:\Program Files\Microsoft Office\Document Themes 14\Perspective.thmx

MD5	e774413968837092699ff157a7178a70
SHA1	aa0c0e7bc86f55c18d0766d4a5a58b3cff98dcda
SHA256	8087293aa93ef6a98fd3d592187f06f17cfb698d732f3629b0eadce2d4252dc4
SHA512	3d6b957fad6d2c2eda80238bc7083b98ef6741bdc522be709f3b86f00a73d780eb87199ca47b8f561ffa8a0519fd97e45097360ab5ce429f7b02fde5f5eedb99

C:\Program Files\Microsoft Office\Document Themes 14\Oriel.thmx

MD5	9c112dcd10b1faa22d1e40c12d74db51
SHA1	3e3d623e7a0fa46336f49ec24660f00a2bb964e9
SHA256	9eded750cd6060ca610e8ab4d4a29b97a0bc72be407759ed5a448e1180ed91bb
SHA512	07b5a6f424ae009554976b74de1b3aac997a7159366e5d4e07a32d3036ec75b65d6b6352d8776cd73c885304081ef346d1f054e8182a83608881f51c66bf6725

C:\Program Files\Microsoft Office\Document Themes 14\Newsprint.thmx

MD5	5ff945199d0c5c4f49d35ac2acb70140
SHA1	f7f73befc72570cf447fbf8527ecb20bbe3849a7
SHA256	c531335d80b508e510918f876bfda3eef952d976518a275c1f2ba20a3f01e65a
SHA512	8e79b49bbe683a61768062574d47e6ac5ed8a5c4ef6089a4ec09cafc402a9c5be09e94ce097c9139ef83bb26910711b57758a2725470c0b588b6f0020b86f9cd

C:\Program Files\Microsoft Office\Document Themes 14\Verve.thmx

MD5	fbc67012fac3dc8ce613362ad8e1b6e2
SHA1	8076bfe86247c81bbc7e31e9726b740e6ff0293f
SHA256	15b330a51fd4051ad883f1a9e818960f10bf2d751f2260f1532dbd83eab2c8d8
SHA512	3c5552f29cb80755723dd2fc5a332ce276c4128f65da2d1938150852a4a656960183e0449546387023dbb50be09b39fe04abf2c6a5165791b01533ca47ded0c8

C:\Program Files\Microsoft Office\Document Themes 14\Waveform.thmx

MD5	c56cc88fb3883831d2030e537b196543
SHA1	e2aef8fe8ae269b236328351bb38cfd16d6cbbf8
SHA256	2dfe3e267645811e0fd5515cce2e483a1d5fe20c88757c79f820ceb4f268f9a0
SHA512	fe1443d9087a2d4abdd7ee564c90a63b5c7b3b3cb99fb7dd3d7e35fb4c6a0eb89dea6903d0bc9e4522204733bc4a819fd54c1c6171cd1823771bbe13fad20def

C:\Program Files\Microsoft Office\Document Themes 14\Black Tie.thmx

MD5	cb23c176134e4c4c517e142abd247d02
SHA1	2bf0de960948e34e190ed1265c18f6599a34ac1b
SHA256	e88363ff313b91035d69ff1e55b07d3e8b78411d42f682547c9d96b03c096a88
SHA512	3552adbca5902d0aa0032cdb2b45e6ad4085e8f6417cb0742bb6d031681a21552b6702ffff2cd082c63ed609f9c78a7255ea891879f6da96cdf13d1e6134b10b

C:\Program Files\Microsoft Office\Document Themes 14\Median.thmx

MD5	e9d8efd713631fbefb87429da82df9a0
SHA1	d332b346704c62f168feffd32d734b5815882d91
SHA256	a8b4db96c4f1edc615edf8fa08ee0fb82353cc42e49da2c677314936bcf937d5
SHA512	f1618542cd135ceb46784b10c713654b431b78bb70243638db5f9e2dc5a62ae241d937a50ada19ce79d5af9e50ddef1621ee2821f0e499bf9be16aff2f059242

C:\Program Files\Microsoft Office\Document Themes 14\Essential.thmx

MD5	09b2e85fbba32f4dd227a0a430255dd1
SHA1	bbc8b9110d94019c61d7bdab6cc40c0795bcb38b
SHA256	e3bfdb6afe561b9afd2dde39ee00c41e0b0592346bb202a9347f5e87172925f5
SHA512	d9b6652066dbd42ad72ba983d15feab1da25f0ac414ae3e158624bbc65a2ad027b6e93f70ebfbb078ff528639ccee7921f4673b6a7def1df7beb552a22a9642e

C:\Program Files\Microsoft Office\Document Themes 14\Executive.thmx

MD5	5527309ad2921eed1969e680bf2e5dd7
SHA1	1fc3713a8fe79b962dfbf1a249c6bbad8754847e
SHA256	b0b5f9d39d5f73dc86f886021a9ddb65e7f32d8cfa6db5b1b4e9271b81ada086
SHA512	3ac2973d95f693b3498ff6fb042c53fdb306fa66fb79711bc10b8c229e900113bccc8ce8dc20cc12eefb219c297d34a05880dd6df76cb307d679fae16e4fa25d

C:\Program Files\Microsoft Office\Document Themes 14\Trek.thmx

MD5	93d70c9b0dd61138973b851a943bf19e
SHA1	52e045c8f13e067309cc6a7d7f799b7263921aea
SHA256	1d618532af41d9471342a2ae00c450134f81a18c59fdc71456b7f16eec9e0e6e
SHA512	32e022a6d42a99d8a6decdb252498ecaa07484307f52a0664a6bb89fdf4645137ba0bbe4ff5dbfb3ec7b472c591a4f0dfb51c150908d527a6be56520e5455085

C:\Program Files\Microsoft Office\Document Themes 14\Hardcover.thmx

MD5	e10c4ee104fbac5c9311934d3a43926f
SHA1	aee879a1eb26326928930c4437afc4fe13950316
SHA256	2f1efc6b578e7aba965e1c4b4e064e0996252125f705988e930c94e0c1ac95bc
SHA512	8b6b81d3e08a1405201d153ef84853ff7f56fafe31f7c100f90e1e2340db9ae2fb2144881f2a821cee4aabd1dd11f79d8a59de2ad5a599708c2bc3fece6f1c2d

C:\Program Files\Microsoft Office\Document Themes 14\Clarity.thmx

MD5	1ac28250c91fde987f237422532e0f12
SHA1	962b29150ae198b534176060298ccca79a2d1bd9
SHA256	6e62c35d137ced8b99117189edfaaec99b7a22364dc9ad63370a693a59fd91e9
SHA512	e40f3408dc7d7fb9bcd34076fac07a6a735efd18845bea3d4a9f2277be0295a46b7b2e05be014467681e0d4aed1f234421f95fab6525bd2eee8be5c09b09836b

C:\Windows\Installer\MSI49DD.tmp

MD5	399075975c41f7e85b12bc6668f59cf3
SHA1	04f5140a93f4fd7721cd305d12cdb80d75b36a16
SHA256	b5129d385ac5d296142ba97faf663ffbb6c50761fc414d4528d8b8a26bc31ac3
SHA512	1266087db1d06405ccdb4e3cfc8f086b361da2a276a62dcbd2ecfa4532571cf57fdc568b07493fb5d0d9171c1eac8b9d371cd3e35600ee08b108b2688c0c95bf

C:\Program Files\Microsoft Office\Document Themes 14\Slipstream.thmx

MD5	16f0ef8c57c5f3d4e8550c50e63e7c9c
SHA1	b73fa1772fb652f3129dc36fc437e257e402dd21
SHA256	a366a9ad4974a5e581abf6305c9e0d7321738c69685d399e23ee93d9b612fb3a
SHA512	2791effbb1b7636e836babd65aeef873e78946e37d570d905eee0076d9104481ff885b5dab79f70145466978c983245a17b74990a61f2c748e6d1bd1770943b4

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.config

MD5	6e5e053ba637800ecbbccdbb3c046104
SHA1	b30c798977b42c335935ecded781177592c4888a
SHA256	6aa6c64ec0f7e620fa4173ae5b1e130f724028396de4c38ea650c57480a290be
SHA512	ceb9fdb562c03aa1c40aa5a5fe34bda9b5aacc31ba46e488017cee7e4875961e9b263ccc188c9c20f717758602f339bbd947f2861822c8478b8a61413f32c64d

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.config

MD5	3b7b0d23927e9331354bfd0dfa09910f
SHA1	c5e42d09e31cb2bfaa1d2ef41d5ef052660324b7
SHA256	17b7f2cb81091f079e8d16215cd5fdee8ba27a7fe49c79e0ab4dd1dd3ab9d1ac
SHA512	e2ee72975921f72304f27892663436b29b8e56726d15b865d486dacd9432e9352207f3b9d168461b59fb5703bed019dfefb329e160d37d512ea32b13c7ed9228

C:\Program Files\Microsoft Office\Document Themes 14\Angles.thmx

MD5	7691591daf91d45ea91eaace4cd2f759
SHA1	56eb245cf5f310baa6fbd56255276852761563e8
SHA256	af665d3b95efb855fa828c5bc36c1739c9cda8ded5c060318dec5da7b9c4139a
SHA512	b7e537ae7d02dc9ef9101dfe5c563cadd7dd39db3facde071cb46c9ac67a9ab8516380f0c2ccbdc75633353d4b4602b320196d1cae220e4bcb97b3458116bf93

C:\Program Files\Microsoft Office\Document Themes 14\Equity.thmx

MD5	854d6c984e4ab8f51ca151448fe08fc9
SHA1	eb919be2598c24e1014af3cb365e73c34748f922
SHA256	14543c386f1608f5a182640724bb29d7f179989b5622066e5be9463bee28b213
SHA512	65871a23ecb632666564c859f7abf15b7437423997cfd294ad91d9c211557c4262d3bfc102da98b6852c6e3e5e62bb5ecb609a7f8b527e7cb0784372695e7b5d

C:\Program Files\Microsoft Office\Document Themes 14\Origin.thmx

MD5	a83022f806634e89af0cfaecd9a368e8
SHA1	165b753e949a94401c66b6d59ecd1dcd5614d23a
SHA256	0707f10e0fa2b39aa88246a0549073f8ff2b40de3aaa085675b04004d7646ba8
SHA512	ae01bc9658648655f2235ad15d9e4589835a5e2a4d8fc793e314db78556878e08a9964797e2a73da4723300ac917aee4dc50afef93ae6be6a3d8a56dfb823b23

C:\Program Files\Microsoft Office\Document Themes 14\Grid.thmx

MD5	f92469775ef59f11fd416f4b1f358c58
SHA1	ac64b2f97919c7ccc209638bd4120792b877eb51
SHA256	2fb9db92794b64b5d40839907c3b56837111754ea55fbc9e0d1965445156e1cb
SHA512	14d2b6aaa36bb98758c1b42fac8252cdaa1ed353fe111ff846a46e9fb9a9d9e3de583862512968e2651fff8637c749b7cfb1f91c82aa0b7c2549ecfe04cfdcf5

C:\Program Files\Microsoft Office\Document Themes 14\Module.thmx

MD5	5545c8dfda95b7b46db01698fdd5c4d4
SHA1	42b10dcbf685e3fcb2786dbbf328fb0ae14c4aa8
SHA256	37d03bc90546351c4022bf0fb7784a312c4674de0923e8a1278060c13e3b29da
SHA512	ba25675af6665e9c19f942fdc156c21fbe3a5874c6738c8f6866f472b9041177c8c3491be25d06690f07dca51a35cdbef6b160d070651c51659454b0954c58ab

C:\Program Files\Microsoft Office\Document Themes 14\Foundry.thmx

MD5	6f48816e8738957dd215f19d9b366e40
SHA1	4a8011ed8fff8379b6c3c7e9dbe43f7577e19a4b
SHA256	d0ef4267635cf9a335b2e4cef801699f5b0ecf864b574f37d393d2030969d90e
SHA512	4263af0193d373a3b27318a2cfc39dc3917bef0f84a5ad4f10918437f2e387862edbfdd4e6ac08ed14719fc6596d15cfdea68f3279c56a325134cce40ca111c3

C:\Program Files\Microsoft Office\Document Themes 14\Horizon.thmx

MD5	dc8871f6909d8f0f1d2b3b93d243635f
SHA1	5d374321010b7cd415d4d5c00847dde837b83535
SHA256	f175083003696a0fb99700411f9127f570da9d6c785bf474ec1821aec3627c1d
SHA512	6613a30a73e233d5b3bded530cf8f30ceb4e294cc7d1ea606b35d78689f07d784800e12b32033b52530b152c33645dfc686b70792ab4bc453d5a15ce9fd1e041

C:\Program Files\Microsoft Office\Document Themes 14\Austin.thmx

MD5	2843992efd8b04109f8d975051e18f2d
SHA1	389e904d991a68dbf017be5c50a17e84a4eb9d93
SHA256	eaed026a99b6817050b26298839970262ee6a0cd258e8db57ea721b9fb873286
SHA512	15d5930d5f823f1f78ef01ff6965a50e3e96c03b1442d6a76d10520aa28a20bbdb2e1c532ce266b3b4d4665f4df467efa85892a085a8fbf441d5b79e4888b634

C:\Program Files\Microsoft Office\Document Themes 14\Opulent.thmx

MD5	e1cee93c79ee9b9b114a0bc827ddae99
SHA1	8c879cea75df781f18b37a535cfd43f81b38f353
SHA256	25754cdf133eb75c9dcdf7baf8de0ad5df918f74614e4d5f0b23175f829b90e3
SHA512	e38c131ec430a7867bc362a4c1536f7e2e05b5476ec6611ebe69affdad80b16c78814390ed44f314dd24289bf86ae6630f838b42638fdffbccd28a4b3dafbe83

C:\Program Files\Microsoft Office\Document Themes 14\Composite.thmx

MD5	0a940ecb7d7eaf6e4a03d49fab456763
SHA1	f11a2c845208caa0d8c506c5f8d7dfd0157d2309
SHA256	09779fb2f6efea3b67f14a9476174639a710315b04bf75c32af83ea950d87f30
SHA512	80f2340530af5bb9e40b2e10d3639e147b754da303f8056e4e9da3d0062f3dcad4187f16c5f7c04f2fb127eb387f6756673d0ef7c79428b49b81c1e2c146eb6c

C:\Program Files\Microsoft Office\Document Themes 14\Pushpin.thmx

MD5	dc2ba6742bef7e33d5cf37023c08502e
SHA1	c0e451f1b106dcb27af09786545f8a3187633062
SHA256	23d24e5c2b6b087305bc11eb1df66a1ee9dd10a2865462303f2e15f9fdc28e78
SHA512	ea271452b18c7a6ee21023229021a24c72c1f563230bca1cbc4ab766811a9e5501283ff43b9ff25cbca46cf70edf5fa15caf242fc312faa3318ddf1902b04280

C:\Program Files\Microsoft Office\Document Themes 14\Metro.thmx

MD5	f60bf3f1017c7a4be8b2f8366541c3ef
SHA1	6c091f82bb7e149cae2976c4a2f59d3efbab088e
SHA256	62a75dca44efbb4d6c7154f64181c36a3dcf71a3ae0093d2c84a6210dd4e148d
SHA512	e9dc4b9fb3a5cb0337d27585afa3c68011dd52060dc917878bb220132f1389b5f4efcb6bdbfca5b365a08705a29616084a8f7d98dfa590ed5ea104529f22daf5

C:\Program Files\Microsoft Office\Document Themes 14\Thatch.thmx

MD5	103016f09b4caf5155f8773e5bbb6e18
SHA1	9950142b459b5cd89fbc7b869696889570cb5f4f
SHA256	7c49f128d7f71b195b1045be47fb81567769deccbf7a8344eac3edca0d33eb15
SHA512	260e4dee694a23782b9e35e3b9eb9d4e6458cc8aa30a8139775abb656972ab712c7e4c40b57ecac7b04080be402e2d54f2f479c2e3b51dcbcfa5b2341dab56e8

C:\Program Files\Microsoft Office\Document Themes 14\Urban.thmx

MD5	75c6fd6002729127404f7b8afefb2bdd
SHA1	884d587755b95ab30ea1b46f8f79b5f9b04eb362
SHA256	8d07c769fad07302e7b1d1b3c7c783611cbd2ddc8dc34283f1fd3cc260a26d47
SHA512	a128a2dbfc927a74e00c217cf63de8e6d8a3702884a472110d8efbdee59670f2f703325b8b5829da6d030e4643bc532579d7a89e3361be6f5c4e67c5a0866985

C:\Program Files\Microsoft Office\Document Themes 14\Adjacency.thmx

MD5	e87b75aa318a65457e2fc7feaf086257
SHA1	ab858f5acb2975c9da3c71c841f92f6fb3b0ae90
SHA256	4881737a2602fbb7d3f2ba3be4f0996b4c26a9b63094f3e58228a27287f0e09d
SHA512	44d4f273ebb19f52b33836558699ae782db5db7223b7987598a59f7b4921f0b4701c7d227b62644770aa66a6eca63c0ae8b794781d21696f9bdbe070f54d09ad

C:\Program Files\Microsoft Office\Document Themes 14\Flow.thmx

MD5	1a8b31d99693aa7de207198ed3bb4334
SHA1	ad3bcfc8fa582acf93b26277c2c01c5956cf298a
SHA256	3eb948d8bb5ef2550792c9262bccbb057e1301fa19eeb71be3e5365e7593e53a
SHA512	0e5cd7d5aa466635a8f8d81af5db32be647b5d3f8c645b0c21f69bda1ec4c4efb1116ebc80d22eb5b3397f6ddc737c6feeec47642e19b7228791ef61f6876e03

C:\Program Files\Microsoft Office\Document Themes 14\Apothecary.thmx

MD5	7e70e29bd2b73965487d5b2e39fa2c36
SHA1	192018adabdb354d09198b260fed458cd0785d4a
SHA256	11773ba2b670d1192f5256323836f83f355d1d065f8a028999c792e5558c6484
SHA512	5052044339ad17705c3f373fe947d2f11b8eeb085c67f5e8c992793ee040189234a322bf5cd11c67e513a98e1e02f198e9c0fae351ee1315f28940d677c701d5

C:\Program Files\Microsoft Office\Document Themes 14\Concourse.thmx

MD5	bb0ed8a2de4c5cefac23f1784e77cfe9
SHA1	e233a1855c105fba0853e3aa0ee11c55828e6901
SHA256	8c75d77ac49418e00bb96a9152655f759cd4f55220ec397a881f86bc2123f178
SHA512	42ace09ed67737f4ec0f0b1cefc8d6bdcd237f1206c9452cdd2bacebd53f41a956c3e39c634edae21719990d0d6e342063015ea23a40c86c1ce974ea5a94c5b6

C:\Program Files\Microsoft Office\Document Themes 14\Paper.thmx

MD5	1e37108333ea02d63e7e1f6931d66231
SHA1	2712960fe693e1c73e7aa3f40991bb00f01bfb72
SHA256	5b75395d3fa47bb51508f3d8d7922df68a121b1ed7cb07fd9ed980ecde92a38a
SHA512	17c309ab338a425fd16d66cfabfaaad48bf47586f896250e3cccc191c8f01b50591c8a2f7ae80f371fc2dc1624223d0b7cadf1b480b32dc189a81f107992b4c3

C:\Program Files\Microsoft Office\Document Themes 14\Elemental.thmx

MD5	5435029277dfcfc44bdba19cd367c5ff
SHA1	b51c9d044b5e0412bb71159f11b35ef380852816
SHA256	5bf6a2da3d3f9eda02257a751736422ad1a2906c517e261a00d742261f92a45a
SHA512	74453ee459b258cc389a50921ac0a64878ccf0d429cc6ed2522d35ff550bf924b6c93bd77c6ff8583ed7a7ff0ccd16e5b06f8c98d0721ce86451f48c1f637561

C:\Program Files\Microsoft Office\Document Themes 14\Technic.thmx

MD5	d7bc17208e247bce54b58237dcbd0ed9
SHA1	b79394ada58bfaed17430630443326cee5a6f7a3
SHA256	59110e1d770ca3ed9214ab39937546c1806c010a03b9ad43fca40c8974cb05e3
SHA512	b83e0c967b530f5896fe3961f0cb848faedd141bca6dbae7420b4103361b617e7a1202a9147765b08f01549e70a9c33218705532ba5e35e55d3b1f124d6f6623

C:\Program Files\Microsoft Office\Document Themes 14\Solstice.thmx

MD5	15248261405ce8a560c4e3c77bc793fe
SHA1	bf11949b5c0f5f9e0faace661717274770df3721
SHA256	cc8d1d4a8d09c859608bb71b1c28a572d7e55dbb3161af41c77da84349b6fa43
SHA512	74639190d9b71c1d12c47df1ff6b8f1d8c581ec3616de3b14687386597a03e930cbb3a48a0fa5b190abbba289845eb0af8f9334352f261354e991efbe24ccd9a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Median.xml

MD5	14467703e05083f86fddabf6df7c73d8
SHA1	a92c6defb6f4128c5dae1a87fd50de0467a17bdb
SHA256	84ede03f6583615a646c9a05b8665b5bd6bc89ef8885df53cabe8963277bdd49
SHA512	e220cb50b70e077c75a1f906e9a8a3d3238e2ad87d3484e5108ad6dfdccfb5987cfeda2a50baa845fe829f87bde5d30c8c666c45144431b59e4f562141baf856

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Grid.xml

MD5	702215815daa37b487935c224d8d43f9
SHA1	7f2da1c1d8fb88f928b0aac9507fdd243db5c262
SHA256	1e785ec14dd2bfac49bb3a589d2a0f505eed8a0e22882db537c5bf0a88624dfc
SHA512	684280e94e7b96c06e2021936f3401dca5f7d9a3b8f1c8638e1d610d84fbd2f8f6f6cf61e6d674834b03357bf74bf99c9a9f0993eccd3b0eaf52842125941d67

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml

MD5	fd8ef77a8a4bfdb08334d9a6b2a63eb2
SHA1	2b8f96e616eb7567cf85bc799c6d7861e1b9d623
SHA256	0ce43b6965598a934af7e7a1b73a4629fe846210fe39c5e627275774bd83db5e
SHA512	d1f268cb9a70f193afb0b1d12babbbb795e357f08e664b1d6b06bab92afca84e3e974d688cea0af1b7bc4c9f824c29ef919ad5d4c0250196e57ca9a0ddc42b87

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Oriel.xml

MD5	e78b76a15d4c4e4cda80a8434cabeb9d
SHA1	772b29002268e54bd4d287c34e03549b7bf0871d
SHA256	634b4809cb16a7c7acda6777da2fbd7f30d2848abcc2ec62f5b02adc98e0a777
SHA512	f8bea74efad65a44698c16b7e0ebb6b2794b5397656fc750423d8aca36c55632778b60deb45568f81a21ff38acc1cbbb85ad9683ea8dec8b6946cdeaf3862a60

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Aspect.xml

MD5	42fb1e03006223e4781ac1ac76181614
SHA1	a51ab3ecb9e69007257cd67c4dc2da32a3b44c7f
SHA256	a84cd3d5edddc1b586739da5cf22a85e4365ec28b6dba21b964e0403136349fb
SHA512	db358e723ca8d50bfdf32d4a6da0ad95799968decb982fbf8d1542c63c495040e2e6d8c6d9556ca4317efecd5087dcfe13d4754130d5554d8933b230fe8e04bd

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Austin.xml

MD5	0c5a9b10800a0727c77adbb9f3718588
SHA1	5d0c2fd7c091732008967332cf0d0bc6d89c4e73
SHA256	0e0c6f4ae2f28bae24b3ce7a040d4c49212923776f43b0fd1d899636d8dabc6e
SHA512	2064eb589cb5c51f5165bd1186970492f59716b53ae29f390f62cff0de3ff58ae73bd7e40ec1081856e19366ed59e5da0d47ec61b1a96f7724250340056441aa

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Concourse.xml

MD5	b626c7539922eaae18a3a291235d762d
SHA1	92cd24140e2224a04a706b85367b2d4ecf68dadf
SHA256	e7531e1f247ad2f45e2ba5ae52de1d8708d5057765cc2c5a448e6e425b55d13a
SHA512	2ca9c5a2e31d1fa55a9efca48ba1c0fdc85ce29d7bc6c6f3f95df10866aac3c78b2de707fbc69c5516d2a590126c365316008094849e635acabcf7f5bce0acce

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Origin.xml

MD5	18715e0dacac212c6123bf3d48157fed
SHA1	41ca81f267851094850fb59902a2c34d004302c6
SHA256	0b4c9f966ffb8f59682ebc0891147a8ef74942ea9a81644117c1bb060fad3014
SHA512	68ba6be198783764784d11d53193457438b5abaf05b09f72cf73807afd26252823dac8887ebf2a1e7e93d63d1ff02a22bfd59cbec1d919ecacf3352710afcab4

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Elemental.xml

MD5	7186669346f88034f3240116cb0c9495
SHA1	2ecaa84132a85050e9b5370950e9480c87ba7d87
SHA256	8fbb0c142d2940d4f2b62f25acd08c470caa6e0a0031dfe175c1b16e9eddb2de
SHA512	7b24281ea5980708f39a2ec8e5e749f41299cc384eea025eb6d4e024844dcbe1c893496b261174146e648230937266cc87509430c83159fc09e8328ce17ef5b9

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Hardcover.xml

MD5	93381ad02b087f580edb816da50d8473
SHA1	3526bd8706aabb542cfebb3a6b0e7c9da716d72f
SHA256	d57432731c1330646a9b6904f556b92aa70a14275d9ecf1f59be77152c306852
SHA512	5827d37bdda128199622d8fbbcdb5d252b5e76cd59220e488cf77d292c8ee7922b598a494a6a78f32940970a7eb17c364bf0c63e0985397d60352cbe259947e0

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apothecary.xml

MD5	bd1fae01dc6c3235eec694c830dd0d0a
SHA1	abe21a9fcce4647654ec6e9e2065ad8a82029986
SHA256	2e7118af487d776cfd33421840b01c86fabff71039d57736e392363b90ac880a
SHA512	760dbbb260e4e5e0af475d74d37bc71063076b6bcc34e224fe4c7ad9626033456992bb05fba24487c92954ceef19f49258d08d93354a0228220767569dd53817

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Thatch.xml

MD5	3df86ce844f7ebaaf0fbae124c06afa4
SHA1	257947930df57b2135c9ea65d392603892c3fcf6
SHA256	94e685f2e9658b0c95ad2833d768e73c6143e2e16d42b94c084d7f3244adb3e9
SHA512	513163b91b634f43a5da1749d2bd60da0ed32bcd512b50dd4e380fcbec67c4fe333747eaf61b92d5b809b3a9b7576a6ea059c7c2b4f4df0ce3d831367f8e787a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic.xml

MD5	07c271994fe8975fd6d82b79c21e0e0d
SHA1	ac37485419a96d376bc4b9de3c1dadcc3c5f703d
SHA256	bc9ba5fb034ad664c1ad5abc0abae21d114b3c54f1c9f091459ea1180f00bce2
SHA512	783c636929453d93321488b8fca5bdc5c296e35b5604a16ad923ba575ba65d4657311640b3cdd744d08b12b2db3702a0caeefb5dc059de2c65d96339a6af0894

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Couture.xml

MD5	af8658b1121b9c5714ed64108273b769
SHA1	c9b5e5e6993a76863ae6eb2162da6519bbbdccd2
SHA256	fcde233c771862a98a0319afb5c6a646bbef4fe93fa0eabc0a00917cc0520083
SHA512	1b29ff0870a4d00beeb6ef40f5b07f45839e65672ac241fef6b7c687dff4684da59a444ed30d3b2383c6e627358753108403dede4e390a7f353d0d3312c01c91

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Paper.xml

MD5	e18509a8c1393e6399094f32f18f264f
SHA1	437e28850cc725e78b81333efe35c5de7268c989
SHA256	47b75db05d8300d90fc1c86ee751372d195a497d3c2e07aaf8b1307db9483953
SHA512	fd79f45d2e24ef924b9a5a2952cc734dc6a94a88bbb9b599489d39b3cb2fc28ce2a667e33cb513b9f1c9f65271b4b7a07625c577916de3b90e9b384ce3ab43fd

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml

MD5	c8457bb565f94dc1b7ccdbda2770bcfe
SHA1	9a5bbff58237ac4734337999c29a1d2c65f7a305
SHA256	e33d95483ad0df5fc1e44dc77aae43f85bd1579345d16644cc9fb753b4d94179
SHA512	dff1dee11bbd97a3046393e340c6a7023814e65c31d392262d7117e741baf7054954289e50ed0893b9b3d794298d81224998b0d85fc766b7697b13ae8a3dadeb

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml

MD5	fc9d651043f8cf7f1f79c1bd5b7c191a
SHA1	29791ca5c3c5930e563a3b4739ffbfb34dfc04f8
SHA256	4d63966e2c9fff2c738ee29adb6593569515a6c7887ae3f4eb0d4933fc93efc2
SHA512	819b0ce155951eead6732bcc15191d651ee24762f350b6986bdb896695a630701a9ecab37de6ab1475634ef9a91af11f617b6b8d8e5da399dce8e5c9486691dd

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml

MD5	c0cac11c6cbaca69a8456df24464d932
SHA1	582f493aee9236098bd0824d269b7e6d9b66ecc9
SHA256	d9b4471cfc5035f75f9dd13317373104b7cdbdf0c0d1032684a43480e8d1098e
SHA512	9be6d086e83f7e2f8d9c5ca35b73f77c12b7eddc87eabb272566aef5eef60175f38e2ac22124a73f5ba4086d0dd30a14995f61bf97efcceed07875077a66e009

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml

MD5	a8728defa17107b58e7e62ac48984d18
SHA1	51263506d46e08108138c78f94d680ec906cd17a
SHA256	1fd1232836c3ebc4976e9d0d8110818e1c8fb1df060239313a2553ffe1fba4ba
SHA512	725ab11d20e03c977d9d891854f6302c5f1cdf68d792c74c2e013467bde578d06090a5a84fd542586cc007a8fbbeb6f69d19bbc3e9cb8e91a2cbb75c89273983

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Flow.xml

MD5	ffe0e75796c966546ca7f3917955ee25
SHA1	6cefec46d0f60af24044b2afcb6bbf4250e32314
SHA256	f25770f2d803bad60469832ad93b01ba9ff033a38c9f1161cc2f9188327ddb40
SHA512	10df7bb9c56fed6fb4cd2191f772404ffd61769d7f759455ec267c8727ddff29c7750a636a3efdc3e67c918f9e7bd16ec42ea7707cfe6e03507441fe3dfbc3cd

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Angles.xml

MD5	ec91389fc3c765d546a26a16be3541c5
SHA1	0a50420e0440c8300fe6e091c0faef82b84d3c00
SHA256	328d93d3b7d68e70a2c257f7a006f214372ca89495356da1fd78adab587f74a2
SHA512	81910890458b362af1e20a0079bd2ea09bb2f53527cdbe03734499cc7e4656f3836d10741aa8c3652814d18084023b40900e2555f7b8ee497239c96439d872e1

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Composite.xml

MD5	bac4d740f561fbe8ab9044cb2b14ed47
SHA1	eeee63dcd30e5de9521370930c1c47cd6a54bc93
SHA256	406117f1093287e8b4959d3d0d0f4cdbe85c6424f9503448efc2a75ca56f8969
SHA512	aaac0c6fa21df53d0a57054e7a6e23ad61c2cb345affbde62409f1b27e15bebecf870b7eafe453d4d73fd7913ca11ab5595132d1e140f3ce1111c9288b925c1a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Essential.xml

MD5	e9570a459e355839c2de6f944bcc2444
SHA1	efea3e0ef3a0dca2e56c320e27d10edeaf3a8aba
SHA256	6f1fdd94755abfcb8b4af0fb7cf84a6b6c7fc44c0258570101373bcff0be8ccb
SHA512	86e8e327e62cf849d5fa7eb6a7da867cd06e33a266226da9aab3f1df565028a0c11f2750a4a0fce0bfc2b8fe9dc7e7dee31a69a3e376a9b1fdd014ff6062113d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Solstice.xml

MD5	7d02f8d32ae28a466d6336a0cbf807df
SHA1	722a70820ede741f2d9340a456e31a8af3a13626
SHA256	a8ae891cb009112d2a3777f18e411c4c1357c857e3536174dbcda48aad5082d5
SHA512	2464dc5b52d593726a77e82513aa29ece51283ac563793b79dee5d82ed0417bcfa7da63670d2279d46d1ac2593ca3d95a7676d4aa1950cb7e18a3770d1f6e27d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml

MD5	1f9b1bdaf427771626b3d894a58e7064
SHA1	53ac1e37bbf4cad1fbb3dfbd6568f4878be10ef7
SHA256	f2889e60bf853d80f08cd17509a7ce7276e0914155aaaee01554fbdb158fb753
SHA512	92bbede18ff828754edb22490737200254a2f8acb172007138efe80d1a41a259b72eb530bd788ae23f7bd651314c141cb72d59dd638c95e2d005810048153aeb

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml

MD5	dfc326c1ab4cf06cec3dd5428a5dd722
SHA1	aaa13aa7da6fd923923cc7071925aaaa852ed988
SHA256	383f4287504bdfa9767a5ca7f7cf890a719a8a809046f222cea0b524e100039a
SHA512	7dadc2bcc3ae0a92effef955efd746daf3b0a1933c744cc732e8d1d52b9e29f0e01caa0336ee24a87d4ffc4b6c877dfd01d5ffd81181285b8cfab531aed731b5

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml

MD5	9a1c60f45e071fe48b6499131c8b90e3
SHA1	675155fe20c28b402d566d8b6e80b2f069fee266
SHA256	b521c96d80c9ac8371d400178e853f6b8ebb7948bdc705e5fd717f16f4ec3a4d
SHA512	36bd2cbba93415cee308aedba95dca8d03845adf7c00be7365642c3c624aceee0c4b3a94bb5ba90e43416cde30d0dec7ccda91588934527ee8199e8de29cb767

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Adjacency.xml

MD5	b655299a1a8b596a4e20f722180bb638
SHA1	27146dd41535ff2803566a00f03d0157067660fe
SHA256	6d3701e72507f993f0affc5ccdd380ea08e37cb6f15f0d9d072355d4f7df9863
SHA512	0156ffa0de7e725e74d4e1e8a64b26a88168e17d5cab51ab2a26da3b0c39d69362a93d57d5c0a68f46e01e708d52c5099d7859ae9940bad7f90c69c2b5ea0baa

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml

MD5	0b2ff8a6fc970f9913ab819ffc2a5d77
SHA1	682f6bb436e13c167eff0653eb0544344ff6e1df
SHA256	edc325f0182bcc8fa5828a93a157871de528a9763a5d2f59b93d7b67b5344b51
SHA512	e2bf7ef98f950f91ae59a88411b46ed204d5fa15075db3048ebb01234883dd090f4de5e83c67ebcc35705b315985e0adb6b6b53399bbbf890d5a77735966a981

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Newsprint.xml

MD5	c413dc940fcd541e9cfdeb71fe0bbeed
SHA1	35a8592dd856dff1f79d57c6325ccd149d1bac0a
SHA256	499624b6dfb3a971bb02b1b9657b077f5dc6a0cff1d2afd95fd4b3c297fda1af
SHA512	dc999266d02eaa37f52dd5e2eea25a4a1f1f047eb240f07d7e7fe22e0348ad8ee651a5d6963413aa9d651c7084ca36a700da22b396046c7169cb26cac2181b3a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office Classic 2.xml

MD5	a9909ffe1677e1fcd48541b54a353625
SHA1	df52456969a582dfd41662003be3b01de45cb8d0
SHA256	02d045f4f6ce6eb298be39f8247021a709f3deb8ad985ab815f3a7a66d896e81
SHA512	cfc4bd828cd20c7566eb52294bd88e88e98e5b8e6c05358c2a350890a148a60e851407ebfbbda9eaa71074cd4e87e308d7166e66f855cd7d01ec0e010b9f7417

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Metro.xml

MD5	3a7e08f834f607314d200f6f460f3e01
SHA1	38ddd9d379631a688e29c97d70001ae7f7c7dff3
SHA256	db87ed593124333fe189bbccbdd98441b342659e0d0f43dfd4c933880b7f74d6
SHA512	7ac9e93c436b71eb4d3575dead6e3be355afb9410aff93b9acba3f2d79fc6acfec7d63ec6a7ff03cf4eaa86dad8a011189c59d194acaeb66236208f76c5fb588

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml

MD5	63983acc571389e8789edbd434c69bf7
SHA1	bae96435eea1ed8382c30a92ad4fbac038400019
SHA256	d3217c67d5429ab0c7764c842a88f2c7ea226a3922f66340962f9e6a26c9d2f5
SHA512	8be42c6dd7ee801a3d637b0e3d87d1b69c6cf1533ee8fb78dc89d24a082433d29486939d3013f66de014b7332c1b9408f9c9b7d85ce92db2849bc178b0dbce70

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Clarity.xml

MD5	f3b00561ce907717ef0d4d415623f3a9
SHA1	ae1a00c6b884e0a5cb03f520ee8a40fea45a458a
SHA256	9d98104a81571b1555a92f909eee11165eeb3aff16cb5fd6982717098074007b
SHA512	9d1a1355af889eddfed04a5445daf855490b7f56e2ffdb010e0c761d797a9c7ed7f800d23c8593a097d84018774d84e5903134fdcfc5745845c0982920cb281e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml

MD5	4c010a75212538f49e0378c0e8c6bd7d
SHA1	a3fb1353b4e06f67b4a5a64dd8a8f2ecac477158
SHA256	4510540e7389d7cccf708eb3966fea5aea4da5bb5140f69837368a72125d51ec
SHA512	8c100d7ad9d1bcb4c43ef4d0b8625de3d4a9334d8acbedf7db6b5717f84f1dda7e6c2d79d504f559513f37a99ae4d65b6595c6aea376bf42e61ba6965eba4b79

C:\Windows\Installer\MSI55C7.tmp

MD5	4e063b1a78bafd4d3a3d088355abf6bd
SHA1	dbeb05f93dfa98eca01ea461445f1bc24579bdd4
SHA256	8824bdbc668e9d523c0fbd6c5caca182cc71164f64abc350fe9aec8a406d5a0c
SHA512	35ee826aef1f13cd0f36dee47dc7db4431ac4db69f5188b315eb070dbb3d921950d2839f00ddba9e6d157274ce69b6d3023a3742b999070bed870fe0c8c913e9

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml

MD5	9dc0519c42b3616ae97eb99b0a75429a
SHA1	ff872d32cddb0db24c0396288a019aaaef52de3d
SHA256	5995cac4da95f5dbae6009e190bd9ab703df0383615b2b800f6f316b4bd8e302
SHA512	e1029f4937e250e823ff5da1ef2a5d37ae3fbcc6b539ea50ea246b3c22e9773039370227fe252986e3654ae3916763c66ff501c701dca2584dffcf02a136f00b

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Black Tie.xml

MD5	64b6e173e31a5bee16280689874a006c
SHA1	6449cc15081e9b86ba3aa20a3f6a8e6f1dce1a5a
SHA256	f91bf1f442851f04243e7b3948e793ea39ef6af3e86329541d1f8eb7a2e2fc3c
SHA512	780c18fc5ac71ccc210eff5b74edb458cbc55c01339885a32c3cdd35a0aacdaa8c3877c17e266f05018d5d767958d2156af36beee75c085d500c3cbf1416c46f

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Executive.xml

MD5	d2fbd6e1871788aca86b1057d00584b1
SHA1	c909b1d9284256fc583519a1b819be3c9367062f
SHA256	9e86cab19068f550bebad9587cddb6849936e39a6c71cdfaa6721412bed1d4bc
SHA512	a975da15532e8cf3d76cdd6f5bba7e008d5af9feb416d1430693346cc271fc4cfe536dbd2de5e47508058eaea382601bfdf42e181f438032a39182821d7d34b9

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Verve.xml

MD5	fe201f16322074abf5a47ac387629edf
SHA1	f3f1af3397d7028ba9e7fbccdf101bc5b4bc9c3c
SHA256	3d780a56096b16e26514a7723ff47dbb70fb3b14265aebf95f2770712714c4c5
SHA512	ddfbe2347f74611d47f9278ead4e1d0f254d568496cf9c1a70af97a65860d86b5304c1f6663ba67f629c4c1f60d1b925d8a858edb6d790a3111ad6a39ee53f27

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Essential.eftx

MD5	1f327ce673822d23e1aa26858934ef28
SHA1	e4d4d8a3324fcc8dba98e2558ddb724afca97f18
SHA256	b5f2762795d13f6877d548a3057ce544c0fe01e1c528e09f9f564885d53caf9b
SHA512	a62a8bb905ff2cae7722cdf098b8c7d1416b9850f5ff4d871ec073ee2279ae4cc4abb4aaf9c92a5ef579e624cb98c40e651213be8e421c7d621cceaf33c6af0e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Equity.eftx

MD5	fbba08230164c4a32919a79fed5eab58
SHA1	66d16000a8c3cc3caad0ac5267ab73b2f58b75a4
SHA256	ed8923512f79535d8f98a9e946af5561ed260468f3ca3565137ccee3240d4fbd
SHA512	9992e461491a266bf3a1c47a1fe2bfd872387aa51eaba8bae4cab35c82d45c3acbf3e32ec0c9ba21266b39550bdaf1a68650d9dd37325b7771f7f4a8d580aaea

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Pushpin.eftx

MD5	ca9e53d265c28ec4fa2f133d4c354a74
SHA1	c51e5b1deed5631ca872872eb42097eac809dad2
SHA256	214345f4931adbf2d15067d6826ad6f469fcee20dc473a415dcc6bbf74de01bf
SHA512	4aa11c342637bec6e13b1a3899f6dfd1c9a641c2d95da28579e151ec978c190541e356e8bde393638ae1ae25aa190029a12e1d5fbb4e36472a7046cf0840a9ba

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx

MD5	a72aef9c02b6cc364fed9bbc72b56fc8
SHA1	8ef8d55b4eb96bf6134dcc4b9c8e5130d15e1839
SHA256	feab103b5fc8e96aede46b8bfaf29a7fdb360efdbed65d9e9a74fe1736dc09bb
SHA512	8402b67ec704ed44bab06ccc1f9d230671a768f5d50fdd8ed4258527786ce6991c2a04f252fc891457c033ef891e3ef7ed8e354b936fcab2448dd92810c70f1d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Opulent.eftx

MD5	d426c8dfd5a422681d2a8dae4e643587
SHA1	e8259a6f4f49af4de6c19872a03f1c47f7a94c98
SHA256	222184ace2426e68b5ce77824ef8508e53b636b2a29053ed13fe430695ab64bb
SHA512	83e4bc7dcf1cd545a6af1081a35c7415d365415ed9ae024d8b2d1e57ce3ef8f73cbe09e45a934af04250da110e969433ce51378fada3313cde697325cf5f38da

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx

MD5	439a7e9dc2eca9276963dd7afcbcc323
SHA1	d251acf8befff0dbe853e611691faf64204051f5
SHA256	ffd92108b753fa6649812e6a960a8a420aa60bbf3e6ec93aff7d6bd655b5a621
SHA512	30f5763b4ce0b756f78cf5493da81f15660d8d825a3f869b5c350eb1df8df299883b49e036305bd7c04109eeb98d2a70c6de78a3f3b3084924fdcd5dda4aa42e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Perspective.eftx

MD5	f686b68d7a902967c630a722a44abdc1
SHA1	da4df64db12495859555b5383f74ead4749c8919
SHA256	768c1ec15d3b32c07c2dc3e067d61ffb435f7ab2a64028e73a250b22e58651d4
SHA512	adc9aa6d41046fe315ba8bcd3a8b3c1c7591ad4b94f6e16bf43828773a4aa2b61fda49bb6e3a355305eee7959a065eef7023c8a6581e2b7d574ca909f6e708ff

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx

MD5	08c9e5409e626a940a0f5a689a80a2fe
SHA1	f3d1a3d354562513886101b1fbf37fc2cd290938
SHA256	467fca243312d013ef7fb025fd18b53e9b6939a30790360e954e1b1c291a20b9
SHA512	714ca1c3c61b81c9926926202b1afa47f0be1abe11c23da16d661d635648f7d1411e1eac8c4e5e34841b82cb890725d291cd4b3125dfbe3a7dcd591f18462926

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Apothecary.eftx

MD5	08ea3c1f8e1ce7b9191db4657eff9935
SHA1	5745a384d75de5bee81a0c2bc02b9ba3143fc256
SHA256	a6b9f11f61f2c9ea19621bbb1b40b343557c99a36d396271b37e74210ccf178c
SHA512	1358f4106d482403d264c36eb9f8256bfc69a22f7b9645ec2c43233f19b5247e4bfac83518b8a8d6b0b24efa41606541f3a00efeab264d9d14eba4ff175e21e7

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Slipstream.eftx

MD5	e9030f658efdcf13c7a3d1b5e8dac134
SHA1	e3792d18e397af63f956e0809028826a235aca6e
SHA256	ba5a084d2633525f4134c868d28a8afa539fb543036444ff5d89155926e33b09
SHA512	18ad5dcb231ed2f4a1cbeaad80737bca59e43ca17075e9cae692e5448a33bda2e1f929006aa832cd67b5cbe5740f1dcdec6772949aec307a9bc34eebd4f18dbf

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Urban.eftx

MD5	41ea46879aa53c45234d6c40f6af1ad5
SHA1	a04f8d80b07e9b2f4cea5cc9d9d0d77653c6466a
SHA256	54d6dd3f8e33df5c9fed552c15ab010ae56a213ea4325086f1142e48d618789b
SHA512	28d41fe2c69cbddd17c0b992a4022468621acd5a04f2113a436006f9044b01a577615d3629e663ff0275841fab9b5b7d8bf75ba6ef3c77246224cd6d78ed4385

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Newsprint.eftx

MD5	3dfbc0eb25737134b63854d0120ad0c9
SHA1	5667b51539c9c2e98bfa4a7a8815122937e5c294
SHA256	cc4758a238819f6c0e27a1aa48c0fa7b5d0d2b33fa820484cbf29f967246e948
SHA512	fe5ea8d9c79bdf4a66ae8ccfd999f17d0787f758173074fe5a689e9a41b1eaf8f3dcbe520898534ddfefab3f1697d78a3cd543275e6dfe75f0bd9af6c3c76566

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Horizon.eftx

MD5	5209bcbad5d42c7f8172a8b4ac61aa41
SHA1	fbad279e7eb196a0146e9544ec721f4be8367688
SHA256	047ad241204653f2763e3e457dedeefeddcc4c853e3424d7935f6557349acd5f
SHA512	5e135803e41830ab84b3ae59955da95b00f946494705e4badb4ef0a5835f2f4b14c33639b7a1bb266917e637011c414d6704edce63c05ba6aba1edc19b829bf9

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Grid.eftx

MD5	bec6f1ff0bf0e117cb23c3d4b5aa915b
SHA1	8a1e10850454b61bb985f906fcbe3f88dee26fc1
SHA256	5fdbc5273408da5941c72aee8e23e5946d09d0d0e513a51ab9c9aed5ddf4a72f
SHA512	ca7aa947c8d86e178b7f1ef953738bf8602428031235fd70bfaf4def0d339aeba88fe880e8a736e945c61cae7c17fad050fc1c6ae627e9f187c6a419257fbb41

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Hardcover.eftx

MD5	643f63b92576ba4c1eb6281b13bd2459
SHA1	8cd8ed4995884365e605d8bf88fe5ce5bbfa3639
SHA256	6da5efeb895ab76c5cbb442d1cc3e7366e4757b788b4a522d9d151cd2b53ae27
SHA512	6def1ce2fc812b6592161d32e3f036faf872ea460d79250d381786bce8febdfad4313f0ca0385e28b2211dc2fc0f366826bee007331e8a0ef85a6ddce58cd790

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Flow.eftx

MD5	c4dc0df3d384ea01d2fdac76d6b2a1af
SHA1	6f7465f78cec69cfb08528c54c0daab4dcc098e4
SHA256	ec3a83a16324b214b76a4115a2ad8833d39f0a908421a0b89a0150f625492341
SHA512	32aa18e0b8aa4930a2e1a7916c3be67bab27b021454a9ae0920a4e2cea35375332fc1e6fb907d04c4dcefce1ab49edd2f2d0bb3d680ee120ad7be51817dbaf20

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Executive.eftx

MD5	c0d43b21c0e3208a29b14076ead45f11
SHA1	8d096539dcac51bca92cca99f29a1efdb49d0a5c
SHA256	37d1ef8637b00cc92eeb29dfb6f58869c347014f211130984aeb100384ffb382
SHA512	5740c3a8e32fd89afd7eed864e20fc7a7400c087e6e8b69ad777b84f3d3f6f37fa7e03af9167803a1921cab1ea0ef67397149dd46a6cbf5a31e9dbf5573d6a3d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Civic.eftx

MD5	d8c87dcb58a246df790ad1f1f36729e5
SHA1	dd50fc05058a7f6b324edef0c72161f6c3726c23
SHA256	c499eed854d29dbec8bf45a239057010c1d52275d69cd4293d07fc912a023aa2
SHA512	3773e5710054049659ab5464d57cf2af4ad01bdc8a3adf30d78c1d6036f6fffef37bc4cc2741f3fd250e5f6b16482f64d7c9c14a12f5fe1c6a342785ed8e1347

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Technic.eftx

MD5	13793cb087aaeaf1a0862d4f829e3784
SHA1	d25ce7d811f101c690a0eed3b61efa6d52c6698f
SHA256	738405e885392aaab4facfc488099cf53a7a6ee5cea520e57c8a8581a9829110
SHA512	44afe9b3568cc3c911f8574e3f77376ecc728e49fce20c7f0ccbd46e5490ffa7d368455e6803a36dacc58f69f3646711681a6a5b96d3a0684b16e607161f82bf

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Composite.eftx

MD5	922b79c45518045fa9c43aaa2e095fc1
SHA1	495525064d68854764c05542e90c3e05a9417baa
SHA256	579babe2dadae58d4da502f7237682e2d48d9f39d36d86026c7296e12f98608f
SHA512	981000b8574327cb5fc18580361065d2b623d2a11d44870c16781b473d4bb0c629c2fc3f090aa18199c58f78880f7ca2300207c17ff5f687d04bcfaaa7e7fb54

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx

MD5	d3675a06bedd4d34dda76aa08019129d
SHA1	ddf5816c5b9ff70c684fa9fc772993214bc5444c
SHA256	58721bd106c413845e4c2e7672463c8eda10c72c9f4f792898940f785b17a640
SHA512	ce1d65e904d397c6e9efbac610916eb43f897e6535ba0a1fe03af1a0c31295b2750237a19d3dcf0774be3463b60ef61c5fe2d2b952ead4197ad377c238ef4cf8

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Aspect.eftx

MD5	e2ebf83234190fb97b44a3f9b8e63e5e
SHA1	c3c775a89ed75d3d23da13d2a91c5ab9710473e6
SHA256	648dbdb5e3d3f840c463c6518f35cc0b737ae89042d33511ad2a5cb923d139ad
SHA512	d6abd9394fc8d908d1ec61090f36a20e9cd13b3d316b1bf2b2d2dfd00d4c1351f53b5d869abb0a7d5fc46b14e09879027567015e6de9599f98e40f7a256eb7ce

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Austin.eftx

MD5	d82ea7dc8bad16e18102f3ec44517097
SHA1	c9c70494725e369eaf21a306fece40caf9df571a
SHA256	6f5dd25b77c24267b56ba88811c990392420e94068c6835eba6b5d7d4981e146
SHA512	51fd175f22a1f0446daa158720da05f71d276a18c08abfd81f4dae3a6f5e6d07efe6359ae7c675ccd9ce8e6606525e45f66c56df1dd2fad253188a07d21a6f45

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx

MD5	b4837d229d345442410b79a6dece90bd
SHA1	97d09ebf9ac91839b62937732b425590f8fa8c26
SHA256	e893999ee4ab9ff0185fe93a23f56a98353811ae9478c2bb69beeed4a9b9657d
SHA512	ab3ff4e5e821df2cdbc5c821b653f8ddd526f87d9b4526d505a6731d21c717a38a348159825cc35cbc7fc6bc0144b0123d203d1b395257965a98bd79c96f4099

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx

MD5	60280f742229bbf0f23a3a927f9ff571
SHA1	33494a01291f9012e9a866ef813771563cabb939
SHA256	4f61ad19d70a027bb5501aa831312760b9d7b6524b820d51acf76eb4ac6db058
SHA512	e9bbf0bd063b5b408c911e75f4e06982ad2bc7de517d14f3f6f3cdd8ea288e6b2a9a455001d52b6a5aa0d74c8d7f6043a9dfe8b7a38913b6a0aa57308fe3396e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Adjacency.eftx

MD5	253edc91564ca4a09caae955a3d94679
SHA1	2ef5f03413e496ab4281f5c1cee5978b3da48b2e
SHA256	8a3ab6a430af98ad18e7b8ac46366b7fc7fe88e8fa210cc913ea89dc3325d33f
SHA512	bd26e28cbb046f14aaaf16607ede77fb694319f2066c7117451d530475454777bb5e1fbf61979f4312e601b67dc112f21a539910688e9eba11214362f627e34f

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Black Tie.eftx

MD5	7b5bdfa6f2749faaa5648d8202808d94
SHA1	fc6b120ce68606918164f44d2c9cb844bdedfa4b
SHA256	6344fbcd4139c109a9f809b07b96760792ea5a733e67bbd9df4ffedfcedf258b
SHA512	d726ec72cc1e32d7840d8a0fab49ed52accc1520f500d6048f76aa52522d3c31f110ca29c629a994b10104038c1a9ae1b037b1f49eb6eef9b6352563de74dd44

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Module.eftx

MD5	46a25d6bc9deaad5f8b7a486c645dd5c
SHA1	b68254732713ef23374334c31d7ea4db3da416a2
SHA256	a705de699c79aca822c19e4c19bca5451b1164513b865172c02e8640a05e9ba4
SHA512	254439eaa204d27fefae6a8ce46591a3521bab95c35ea299e97e28911256039876277172c54dcdeec1d98afb21219c94ec5fd3039573cfb59c57889ef0b0b262

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Oriel.eftx

MD5	b085c908ca1c8ac2709205701ae7c609
SHA1	d24158a193d6f3082a49a22dd5b4ac711f9282fd
SHA256	f54124c0b4a3a4a7910ad4c75cfe8e48f6119d16c9e0da406430725fbfba176f
SHA512	970e82e22d49b059f7b4461fed184f21e3a2e0a9c6a322f8d0437b8d1ef03c45f162482bf979f0a4338c5759102b564a904ab5ca223d646434e283174be5da60

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Metro.eftx

MD5	0cf0408d2e9ae348b4e6a4fdb7243251
SHA1	27acd0aea3ebbd0e16c581e04e2f4a5121b50884
SHA256	7a0a143dc8fdf43c4cd42c3ba2fd431577577fd4bc032f3394f46cc4c014cebb
SHA512	d9eabbb4ed67bc506fc67abf0231cb6e0aa837734ef93297d7f03aa96a8e733786bfb88e56dd9c9167944d4c971dd5af41b669482095c467e0582af2c68e7d32

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Trek.eftx

MD5	fb8c38e17357930ad170278454bdcc17
SHA1	a50bf89cad030a8792cb1428d4d01a46ddc0894a
SHA256	88c134538744dc156fe1c932eeea4496a01092eedc4acdc1d5dd7757b77b9648
SHA512	aa0f72f16f7b2c7df1f036516dcbf52b64e626ba2b9e7b65c9c55018c2b0401d88c06002fcb008417375736b45b246309d9ed2e35d917c3bd51bc1a50dc97a9e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Paper.eftx

MD5	a7a4be271f6a82a3740637acaacb3e4e
SHA1	3183cc47ec0fc3b5cfbdabfed8c5bec4b396a263
SHA256	d7801201ed5cf6e7f6792132d1ebde5bbb2722019985c94fe1546785e1ec54ec
SHA512	9801951a1d8adf25cee1e69436a7bd7b1bbd0b1578b3db9b97cad38c45889d17e21156b007c6349af82ae76529bdfb141fc26180d6d0500c3874492c77dcc97b

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Solstice.eftx

MD5	dca7ee78418766dfb7810e969f117cee
SHA1	1e7704c4b30a4d09060f7f97ed96d8a2836be7af
SHA256	021097e900843ca17049e4134acce117529a3be464eddceb69e868f220c2c8aa
SHA512	6b1454b7aaddf283dde23ab5dcff6ba76301523092a2a91375deccb05c4ce2b2d0defa10d79f78a581c52b6a7de7d94abca4b5d386b4c5122c30fcab0226bac1

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Origin.eftx

MD5	a876d9a444534c5914d73accad245903
SHA1	e0420312367e2e12dec7fbc6b0e09219e880a8a4
SHA256	3a4fc15a966ce82edf6655cf0005c9fe6cb7a592aeb86fc17915dc6ad38ac654
SHA512	a246d5a803932173abc10d5d6d85ac97ddc98d73c15b977e64690542518a3496d8646a894197580f0e633f7e082999cbfc1bd203ce7fc825695189be6cd3c48b

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Trek.xml

MD5	9b2915f8b38f97228a0b2e7977b4086a
SHA1	d48dac6fb197fcab188074340f29c010b8ae759e
SHA256	39d744aabbf1a94cded7f492218cea5dfff914d61df1273a03cd58bfdf65889a
SHA512	88f4ee3f6e72af98be0909a23bcd84c257996fa40553c2700b15d15a20d7bca89a8caa5580301dc9b437b76b5fd638072f4d3b02634fd32b513f51285ff002ab

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Median.xml

MD5	2b6902cfa6e51b231c661ee70d316461
SHA1	2eb9a1aa5408185ab485ed9116fae474ac6e2421
SHA256	9f82fa879d0ced497271a0cb2826cb9eb36dcfc4ac47233d8747575441eb7bf5
SHA512	8a4f83610cedbc171c1244a6fd01101ff6e1dad909ee541d71265e6645a2433a4abb758163764f4dd162214700960e98ffa774e096a59267cf497894ca894ce6

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Paper.xml

MD5	35eee65efaef1581266d6c706c09374b
SHA1	5d46133230de9ab3585efd390b808f43e6b4b3f5
SHA256	db29fa3078dcb2dc1e486397fc92f9377a07181e579db16413411263f041fc2d
SHA512	c2381ba796d4e8d324097f2bae3dedffef9c8ba0a089cb2349aff2e88cac8fa50ecdb49ecbd39bd2825a91347dc34a316984854291a9be2841391097d88712fb

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grid.xml

MD5	6720a835a80c95940a63e774ace80ce1
SHA1	8d900e556fabac046279c2b6acb02bc10f2c0666
SHA256	2dbeb40939137567c2b8456420064bfc03fab6a63d0d62c6fd829edbb977f950
SHA512	24bd661834a27ea69676445f921b8d0421e9290e235cfafae785de7113175389e4f5c596f4e10fe5fd28ae5075dbc8efcdb983c4b78b887ea576237c54d8757d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Oriel.xml

MD5	ca64c9e38b9dcec26433cc170817be9b
SHA1	14cad5d1cc6068a198cfa1bfe6953328f15ed203
SHA256	f3db548269f402248904e57017f021cba09812351ff12cbcabcdc862b9c7ae4e
SHA512	d57d753845049a40be19a3413762e2252f1e1627f57f41f569b3a9c5d1a471bf65f40cc2937545c60c0ff18da8cdc7b479a0455828abfe362de6bd2fcab9f44f

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Foundry.xml

MD5	716953b321f1c65538549623cedd98d6
SHA1	357f036e7247e80f7f0a507066b541b3b5ded9b5
SHA256	01bc229897239f20b52cb2c8c27a71e5f4e57027c145d2afd7ecdb27e47a40b7
SHA512	f2d6a5fc21e16e344ac422a6681aa1a4638d1dce1025b45569fa2d003f68b5b9a2a4ab667153189183863dcd1f26fad997ce58a9ab37ccce171214c7200eb51a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Solstice.xml

MD5	1654677136a9cfdfd0cf4b54bc65e951
SHA1	6d65b62c6c7891f0f93f402cabbfab9eee6073ce
SHA256	4c7f962feb5003fe9977a37e0eadc4bab44ef382c7431d3ae5014e212da0eb35
SHA512	d955568540208613a4cdc6551a96da26251e7d74c75c531d08f4366124b42d51a1efdd1c15ab994bddad076a5be313ac814d0f24aa4eb03da9eba16936300488

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Horizon.xml

MD5	2dd3e80394e53e7440e2ec0173d48bfb
SHA1	717c7a9cae24a3012c70acee7ec35cd1d175cb94
SHA256	ce72d50c886992e7a82f79c90ae4ded8a2d40038156ca771eddf15368d385fb0
SHA512	447eed1fcffd01e78521c5b55f8c86e6848a992db0ff347d5c914295783741168493efc5bc724e37c6a0a23619b4405784c36064a078a133f6fdd4be32a58ceb

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml

MD5	230fd35fa718ef39dd83d022d06869a5
SHA1	f97d4c17a31d525e0413ebd81c62af849da1b814
SHA256	ff4dc036a5f6f0ecf2451b484a952038ddb929812c1ce05a3bdb345464198e0b
SHA512	2d1dfaf474b3161cc96f04bd222f92b5154e2d69833c72a4d32f443bee617cf46d3b9f1715c475da5e3160d1a937199c843155eec0ab771665e079bcc479c76d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Perspective.xml

MD5	7b67829b50fd917f51e4d321c46aad6a
SHA1	b240b1257a74929e99f0f381d535bac10697f4de
SHA256	9a25deed8943e6f3ae1833492250b752779e91e51c39afd428cd89ea72775909
SHA512	e6c38f764379260c1e91cf922366e655360c9e8b4e76f63177f80522ce1131808c2e673f58eb6e3bd00a0fa67d59f17adb01d45d0412bd2c27d31ddddf4d0d5c

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml

MD5	f1290bfefd5ddb74433bb79ea3d64db7
SHA1	91d83035233d8e608aa75ce68a4bc6d69586d615
SHA256	5a0dd45c35d353409ade6ad27c0c927d04da6e8d2d685dc8239d1120d676676a
SHA512	48aebdc6775e82d42f767bcd28fbf6b1451aaccc3789dbb4f9c5eb53b035d75a957caa13bb92259f466f5a5ff6ea53b87a82afbc0b90f8eea24815ca91566844

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Civic.xml

MD5	29153508f17d45e4f9d1f60e101ecad5
SHA1	060fa9f86ae8df27761c8f99216197a983a83af3
SHA256	fe3af0943742402ab1c8034c15dcad1a2ee45dd040e5dcb68625c45d2ce47140
SHA512	5e12402751eb97cea9c03da85695a42e33cb60a6e8595d0714ea0d7acc82d99faed2abac5c0fa85efc1122b7e6259e1ec82b4ac00b5a2e81f84568eae4d6a669

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Angles.eftx

MD5	fc73d230517a0375b794004d34f4234a
SHA1	3253bbad2d999dfe7feae0aa7f362812149ac1e4
SHA256	8f233d196a50516eb0da8c9d6b0838b6e6ca94d8fef4c74e4b791231e2901285
SHA512	66b67a9afddb7a23fc086ff01137aac6aac084823ceb7eee27e14b28e8314fd75ceabcc18d7a96bc75e24a931400cb4dcca92d9da95159473e20bfdd82ca7e4a

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Thatch.xml

MD5	553b3637ab30e25a3eafcc383452dbad
SHA1	28115c66368c18d6f4ce01c45cc98373832d50ad
SHA256	3858d79e9b80c2b78b5820059a3567ccd49e5efa073c4318f06308767408dd71
SHA512	35a3cbd5767159e3c6d4791f7faebd5dabab4d503abfae9bac4478f518989ff31d2cec552b074a614a97105071c7579eab4245551e28db8919b642b16374a584

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Metro.xml

MD5	d6f4823e22065afa7556bae0880ea3a1
SHA1	886f836d5775c3e341046b0b3a6de316a075e54e
SHA256	278370213eb9aec535ab3aceb0c56d6bb9c6ec4c8985b272330c4e5a83e2bf13
SHA512	2b913c0f61d95420d5fcdc7acfabb82b6bfa6fafce7b477bcb63a1ac670cc30fd70f0e949aed942ef895cf8cb8bfcb2d79f596ef74b4fccd2e445f80797af83e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Hardcover.xml

MD5	afaa7cd85ac3da13f70e0f1fec3abb90
SHA1	0538f800487abc4e71fbb8ff801f2927d3eb3fff
SHA256	c5e0f003120c404ff5b5fdc944dd3a589e082cfd708becdf54c20160f49093d2
SHA512	2c0a1abbfdd18d5cccd11a03499b7846c6d1a3b92824bb0e7ed507818691a7ff3ec0cd60ea6e8cfdf8b557c9d2cfaa566f96cfa0053a7135f46d7af92438c488

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Equity.xml

MD5	9e344074c3670acef7191b335d4ea941
SHA1	d8b76ad8efaf21c9babd1cbdcb8c008310817c22
SHA256	53ed0e39f283e6255bc42205efa63f3edff5cbef80fcd56e4d320afbf0b481d2
SHA512	202bcbc1059aa27a30834807ee327600710f498bc9c2ba36b6bff2ff15dfe1808bf868f2f93543d3bb3d86e06d7d56449ee3b608e4d1cb7346711f8684e78949

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Module.xml

MD5	0d3438e2c9c23345087ab8dcd83d16cb
SHA1	30d7000abe60daac91c7448877ea4396a97885a7
SHA256	66dfdafde32aed86ba5c78c0fd7a85a36f073afbfb7d27d1528ddc5db7299910
SHA512	67a297411930e246c7e735fb9b0cc142d1c4b1629d7ccc715ebd3e7da05c2e6c4705cc2680346cf5261b500d5c6fe2e490368e9ff81f6ffebabeebc1d09e8105

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Adjacency.xml

MD5	3a62840b28df18914753ea0dcf0e7d47
SHA1	0bfc954265915223733122fd314a400cf17dad22
SHA256	a90f31894264066185d56974953776bf403a6759c84275a32f67bd157ef36467
SHA512	4f80ac592f6cf7c8beef344ba9fa387c6fc2eb2d964fb78ebd670b43411411a6360de54c8f261b6cdbc59a013e8ffc3f74bab571932155d745f548a57a6bf880

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Opulent.xml

MD5	103a01bb0e54e496175843b04aaff061
SHA1	62ffee1292d0390a0d2284399728895da9730c2a
SHA256	0486495a73d6d347ea40ab7b46a167b657d07698e6e989ea90ac51f9f3a642d3
SHA512	d89b36d3d79a6192a8341fd562b35a19d2397924a569a186f9c49b4056b15fe9b8596f799fa5c7096f5fbcc6ed05c0ea915ba2ebef69a1f96db3e2a2105618cc

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Waveform.xml

MD5	c206658578b3f6b65830265d5f93dd8d
SHA1	bd1eda412088ac918f47a69dcf8237db52afa60a
SHA256	ff3658d1c2d860ea589d425ec6e36d5c36d70d95284f7396bc60eb2a85d749de
SHA512	0afc3558bd1b5a06552a7f2a8aad8a17f16cb4c017f181060f129f6033e964b43e3a53f16af995f814322311ff36d184bfca0a07af2688ff7f212754a7a57b51

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Composite.xml

MD5	3cbd54c548a2d360bceee309f685317b
SHA1	8a8c3629038bc0d3a90b64f03b645036c952bc5b
SHA256	3de7b0ffe247086f2510b12ca19e0864f2cc1aa71ad92221052fb966ee28d43e
SHA512	793f0804b81b92fcd1d4b1a0040c4db9ffd698dc8112e4b385c5f9d8bc688e5f598747d0ed4f0cbc42c1ba75532de98319608d6e36e799068ba1a4a497318031

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml

MD5	5f62e383ca6f17fd423f3bbde1c52779
SHA1	dd83266d9ec0d2da4db4a66a377e913de2d16ac6
SHA256	8c028ddfc0b066232c50af70494fc01d9af2cd32c7114da349d24be2505adbe1
SHA512	b9dfbfd038b7404032157e40e3b7c0ef051656ec52f64f9ea5a370a456d04252f2c61b5bb209a8ad3f30ee81047bf9645362664d2cfc9240d861ccea9f11ed62

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Clarity.xml

MD5	a64ca07e99187d49a11d40bc9b945dd5
SHA1	8ef5d6ab574513075d0262b93ed13d90487a50b1
SHA256	1d0c794db6ab4e09c949bcf3f9a2d7a11703dcea25727760eda86a54a7855465
SHA512	42366075c284f81708a0fcc3f1d53db4fe12113ee897384faec475bb49735695b4357df25dd7ee0eb863607fa1dee7d8c533837aa04d3f378f32a828f0c9f0fc

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Couture.xml

MD5	6b69a217a0b110f875d19e9740d0879d
SHA1	81c0344de9531a86e195757a8d880ec916a0e77e
SHA256	4438a9d3f43f69b7c94d152c190a5a72d56585759073443ada4f3c03549c822e
SHA512	b9f3dc4ae24e5530c44c53ac3eae53d6d98b37d210176513ceaf792ba96df9bd3761ed4994262daa686d44b9f5cf44a7f1b2d2cbc858314d8f97dd6ab469bf48

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml

MD5	96da8f32e708863492f44245845e1a23
SHA1	efa892cbbbd6d2fd431f1df4537bb422aeaa09d6
SHA256	c7caf25d3d26076f6bb8e6e45ea7a4d80d8173175d6ff8643c39c8f89c1116cf
SHA512	9614aa5ac720ac093f7d441fb93fc87689ffdb2fdaf2caad83db660353da00a5475973bd4e9c752de0d6f2aaee50c678045f51f2711a132dd1e74c1fe59ff8ea

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Concourse.xml

MD5	a74d882e414cd08ca8d786d441b8879d
SHA1	b0f1abf8e0acc6951c27d5332a2b556cb2089a9b
SHA256	af04476a5055ab056828d17472581840dbeae4ff9698548aef4e49e005c53aa9
SHA512	4b635d2b84a12183714bc530e4c0d4f6511e23d32fb0ce40052eaec53e6faf1f7d06853b9eb299bbcf8af4efcc5dc7f72eea086be329a0fe4aee4f94e890025e

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Flow.xml

MD5	423c28d4ffe0c989fb46de8886e1b664
SHA1	8479bc92714a9d4da95a33e016900f9d1f10317a
SHA256	e8f391715d5db66b5f99d9a8fbdaf93358c98851c9bec57bae79ffba93b35c45
SHA512	afc353834ecc207f2a3586cac1938f3cc77b3ae3d01333efc77d4320a3b437c4a02004b70baaaa8fc471ceb5c21d6353716539437b207c7b1d1b4b1be111418d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Black Tie.xml

MD5	6c8ed6bc0c8497749ec68022e3752cdf
SHA1	0b94f66f908ffe4ff968c03ba3ed5133afde7588
SHA256	dddc68c460dfd958ff92bb25c592b5feda45124442951a87c9bb464ac756216e
SHA512	8bcce9362e6717a2c9f496cc4c710a4b344c678b56a94330b6f574b0567d0e1cc2bf13b63d5afccd0c108526e570e0543185a6f77f3bd8734739dbb33b768f4d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Origin.xml

MD5	4ed6f7a4614ad46d57c614e38dfa114c
SHA1	0fc6c3fdab0f6e69e87eb615e9f8d0c71385ceb0
SHA256	2917d031f28a9bdbd4579fce3f1b537d3307306d935d5f69e48d85e76f2d0c5e
SHA512	162505e02a0be536a14c7c88f5a5f04560edcd67e71f9b3ca2a6372a6dfa254c4842e58ac164d173ff7437dfb9ccb5ef3ff7f3c54fa3de6474f7a83ec0cfb93d

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Apothecary.xml

MD5	5eed580b637a2d8547fb45dbd7b34bd8
SHA1	e66383afe8191ce7ab3615358d3ec501929d160c
SHA256	d12eb0b7d9114fd978ca299f417ba9b3a9208e8814c5adce547af612a23a28a1
SHA512	c8d32208f02511686e962d8b1357bd34099afe30f281c5e32fcd9c731081bc839315262d4b6e821781253cf3d126bebeb82235f759096836cd50e963d4dbcb55

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Technic.xml

MD5	4d2117349c899809119de6b956fb43dc
SHA1	f65af88c9cdb4f0ad6edff96c8172c2bda8a98a5
SHA256	0f9d4493f376b0d7f6740e2831ce34ead3b4d56b92be8bf7399d951f1ff57919
SHA512	7921c31c55e6dbf8033bdda95caa6c21ae4d435d94c79196a6e86c2f488acea091da2f598430f1881fc2eb0ccbf5aa5a59d15fbd4b22c179f0924b8fe0cd35d9

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Essential.xml

MD5	13bbcfae1dd2b419e00e5196ef97dd3b
SHA1	cf686197866d3a5e20794c95d558e5e448593429
SHA256	75ce9fe2ce0eb2c53ba590e71cb418397256a51c18aecc4c757e8353f987ae52
SHA512	e990e0d1093e47a8186a4cd349a7fa8d7ac103b47e38b8a88f4caf2366dedf686ae5bb2e4947f3d8a1eaed65ee883e6a5fbb327925e9c3c1637a6451ea2c3a85

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Angles.xml

MD5	05b71d6d542658d65c4d1ac999e1803b
SHA1	af32cf35edf12eeb29bb942d4c39c10b935ba9b2
SHA256	c1078530d67714728bb84574a794fd935f4eba6baca4f4270cfc469c37b46cdd
SHA512	31769d47212cf64a5e9135bdb6a7aaa6eed7522359625643c9a757f241dcf67047eef41ac45277855d78d5876b84f8664f78ad17ec6f6512ec3ea0a4ba7d00ce

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Verve.xml

MD5	f0d4497ac27c689d1a952b84f9a5dd59
SHA1	995dab29687cadf4ab1dd337422825094521e087
SHA256	80ec0a572b0fd63630728b62b31216cf4a7a53b6cafc18f6ad965bd6250ca34f
SHA512	3139d1848fcdd315470b8251eb820b0a6c0c27322db159c5306b111f9a5643740b907c695a9495ecd21e58d76735ea37b0523551343d7e912e271ac92d6dd7d2

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Executive.xml

MD5	7ea7ebb2caa1476bbecc597d0074c885
SHA1	720426ada17b3b6bb0fc46e450e04f3df7bd9b9e
SHA256	048d479698ae6324a7388cb17f5c01479584ef1805aafe5a565486ead0037d2a
SHA512	823399cb671b2cfc89ea508b3393bcd4235c9fe0aaf4c41d0d9aabb99a720af9db9a3a4c6bb402e30c5945ff24ba3b240f78d4307b174edae93399dcbb900e36

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Elemental.xml

MD5	3879a65a35ffc410ebddafab222b5015
SHA1	e9e0108abae90019948eebb9a33795517ab2a688
SHA256	6d940551f8c720e75e549e91ba2c779b33b7de8326bd771cb1a2296fe5260bbd
SHA512	c1c837497e1dc79890b5d69f09e8f834d10269098be90837cf5ce3ba4f7da620d2421897ed01f77b29d4d5da83a3531b04632a3a85b657ce7197159a6b835cf7

C:\Program Files\Microsoft Office\Document Themes 14\Theme Colors\Slipstream.xml

MD5	3c452bb8080b8c5f38ec422a9d75a242
SHA1	4116743312903bf3a6f9b1fcfa92dd0dcd4ddf85
SHA256	663e68d1c6f1e2169bea4d87891010246fb7b8479a13261d207bc8dd74f24f6e
SHA512	cf645fed269c54c9e1a6fd487c611ff09c6bd4eec41bd9d4c2c4583da40d701f03540b8476088dfd39581a453680700bfa07679ea35a7fd30ebf26e5c1585257

C:\Program Files\Microsoft Office\Office14\IEAWSDC.DLL

MD5	d964264d1ec0c1284e86485f71b6e023
SHA1	aa01b451bc7c99c82e7aad60ec02462b27f15b1f
SHA256	8ffea04830e14b7690d70a397eaec7d3ebea8fdc5481aca65b9cf9290851c9de
SHA512	80ff27af86595f80eb2835e20db0e20a3253136cc2edebf1d660ab4cfc56a7c493e1084b291a8d5faa31ef18c1aa0252d0de4bd379ff9db26e4c90f7b8e841a3

C:\Program Files\Common Files\microsoft shared\OFFICE14\USP10.DLL

MD5	731faff7dbae6d46a01efdbe1dafc1f1
SHA1	52ac850418793255ff5b5031757cf414bf754a09
SHA256	5761648a001651b92275a6fa35be3a0bff8b5c0a41de9b499951e1fc56348c34
SHA512	5902167ac87e75b1af609c27ff6db195d06d997589177ff2cf8648508f65959d35dd2e4b2de5148d376692e34458445b275aaabd776837d1b6bb3506056a12b4

C:\Program Files\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL

MD5	db36fc1d912801c34d802fe95c760032
SHA1	dc89b5549c7c13424a4d675e70e1f2307058dcb3
SHA256	63a25976074ac940ec10cfe36a24ea90cb79ee472fdbca0752d085038acb67a2
SHA512	cb462181448c5ca2298e28f8140bfcb600903fe949a5f0ddd96d55f78b6344e242e87bdbd790a83f5d7285ca52a3c862c9b5efb8fdaf1e2383e03c9d3e6af675

C:\Program Files\Microsoft Office\Office14\INTLDATE.DLL

MD5	a0c8e4ce08139924977ec39bb13781c6
SHA1	502313f297be46d615f1efd3460b6d50e9d51889
SHA256	697b627ab9540fa15603de0e7a71cfb614ca51bf44bc91c202dea63cd6034ab4
SHA512	1845d0c2561244702b7107ee5700cf17fab06324a4789894d60e6fd4816a82b08451cc0c9c1391823525705cfa6e28c3ba2ab0ba5119adde8df4b38fcb0ecc51

C:\Program Files\Microsoft Office\Office14\OFFOWC.DLL

MD5	610fae1dbb030dcb0fb4b99eb1fee708
SHA1	122a008e23a442b7580fe923b5566312b1931065
SHA256	d81ec07bf692ac174b604cf9515d8525a2ee07b7f35d43706aaa89b550958d75
SHA512	46163c3f10c2d1c3ee70be92d2042a49c4a17153908e690e9d41da72d35cffe1c5c52d889f84ad7635c10bff960ebd0fa8646a0de03fe9cdfc52dbd4504dd3c3

C:\Program Files\Microsoft Office\Office14\PEOPLEDATAHANDLER.DLL

MD5	1461d82533c1d84b1ef8286a00da75c9
SHA1	a5e680e33c4dc9ce3c54e117498117468db071b2
SHA256	f946532d5e43af620727024336b27b3f8d2b0eede378c50009b68a290ea29d3b
SHA512	847dd5483d37ac99671432f422f488e2c1b219d81fe7fc9f615e061c09fba70c9ba2893516b26678176a3e72550df1e8beca953331784cf7e6004ccaaf5bd11e

C:\Program Files\Common Files\microsoft shared\OFFICE14\MUAUTH.CAB

MD5	0cad5e38027d03be44432ad456af98e9
SHA1	1d7616c16feed764ed162df8ca40065fe5ea6520
SHA256	8444cf814e1eddafbc0e64fe9416dc4ee541bad45d4285b2492c5f4b200fb468
SHA512	7884815dd145c5c8970f2a2d402b8d280b028e7cccd0d2f28a501b36b24a489da81550e32c2bc5c56c1b871d00b1cf6c9fa7d70b1bd1c9ea107eff23213c93d7

C:\Program Files\Common Files\microsoft shared\OFFICE14\OPTINPS.DLL

MD5	be91e2b19594ab24b08c5e3db0427f9c
SHA1	498aa2b639e5af0e970953835caefce599ed3151
SHA256	4a088eea2a077e5834d5dce41e32558e8038daf8c201ef7e1c5e6a775fb4c5f7
SHA512	0a4a543a7baffd85a983959a8254bbb56f57511cf35ba7f1decb73eeb9ad2309939be6edde41fe56302abcd3ee212158060aeee97bdc9ff44150c04c0c218114

C:\Program Files\Common Files\microsoft shared\OFFICE14\MUOPTIN.DLL

MD5	04d9a8f37131506892a9f35ddd4e6a33
SHA1	870d722467b940f3041a43dd6c23fe0e16526256
SHA256	877ee2e0441c6053c9d3021d21e2c38039bcc624147bcfd7f22cc3f40fb59a6b
SHA512	8a230173866347204ad93ace2dd1c1a593b8617f5dc8b44ffeaa4fcd8574a3d19808e15ee7d236513c07e8af8c18bcaee540ba8b510d85433ec44998f3d6f1ed

C:\Program Files\Common Files\microsoft shared\Smart Tag\IETAG.DLL

MD5	5c869a5d6c8e472ed816bead9c547fc6
SHA1	a6a4acea72626b8ceee782cc5c46df931e6872b2
SHA256	8e0b65eccca11e43b794ebe4333b30aa30f0585ca0762b62fcb27c3d68d13c08
SHA512	1626b39bd06b8828e3d01537686f2e115593d6a0eff79627f8d5fe4b70a26d9202074536e98feffb852f0b0ea0763b57677740ed13de7c116df883eed36aea77

C:\Program Files\Common Files\microsoft shared\DW\DWTRIG20.EXE

MD5	3126797713e2de91cfa2c4b2296fa411
SHA1	5878dd984e5ceb76e593091c91b470dd96cf9ffa
SHA256	13ded0e8081df89d9656e28024736bd315760f36d9b4cc7e8d7316cfdd3699da
SHA512	b1ed9ccb14b77549b3a6f4a3f659c275d5056ef8ceb64d042c52ff31247eae70f4a7e5fb091644cf44ce723e190f9e513fbd300ef1dfdcddfd7fa3e2ac2b23c5

C:\Program Files\Microsoft Office\Office14\OISAPP.DLL

MD5	300f370e6117a2c95938c776ec1f22ac
SHA1	879253f5849845ae5e2c0107da64b489e55d53b7
SHA256	6cb12fa2a44617a7613acb5afaa1f361d27db99eb8ce12cdb68593bb37e3de16
SHA512	f20ea5a0e49c4a42a8d7a3817cc643d525f436e81907fff47fc2b56e3aa3ff393f0feba5479df4afd5b7275adc514b1e60c4ba3fab7aa5dac14ef031855f089a

C:\Program Files\Microsoft Office\Office14\CDLMSO.DLL

MD5	c6c3bde2a483470a606bb22262e9bd0e
SHA1	4079c470a6e58f67ad11b48ae8476e8576970fe6
SHA256	13fb9be5d536d64944fa1c81a83cb28b7410e62bf29bfd2ea362c810e0eda67f
SHA512	5ca4d10da729e0bd124a1da392f2e0683da3bdaa8c4c1419dc201e97971d325889d8322a93ee3f95c1415078b944c0e593b2beff02e2f577e6b14adfd34e44d7

C:\Program Files\Microsoft Office\Office14\THOCRAPI.DLL

MD5	10aaab2c9b2d2c70e0d094239a8fdfcb
SHA1	dbac4ab9432dd89db12aeb226ed59ab418142027
SHA256	8b53b33355ff0f7231c1b7b5fde51a2db0d74a945bcd866cafcbee9349273aa5
SHA512	0b8236631e0b2ab76c5bba9adadde0286cbd5def81a91455f6e81b4c41d0f09b67f5bdd491cc9de1c1692b7cdefbfdc35a2904123cb34880aec76aaf4104aa45

C:\Program Files\Microsoft Office\Office14\TWCUTCHR.DLL

MD5	c17c9c02b73d5acd980d4ba05e7a1d01
SHA1	21a88f9d7ad3299f758dfa2b0b1d7ace31b79807
SHA256	2463d80dfdb7ba7c6cc62c38948c1d7542b33aa8450f20a6de6c17fdc4d8f280
SHA512	768e13f55a2939348b34049efe08b46524a35f936eab5e7546e54c77a845395208f89ae68192770cadc1a62f7752665bdc4517e97503a693c0094aaf6f03b5e6

C:\Program Files\Microsoft Office\Office14\MSOCFUIUTILITIESDLL.DLL

MD5	8521832dabd47cb1b54bcd580ad8eb72
SHA1	eb19cd1b66d10d0dc7a6efe27228137de1d1574b
SHA256	dd43407982014c0f1afecbfe34bbe7451eb80fd8c136c3417ea5bd2bf80faeb3
SHA512	0dc8e4084f9b581ef5c09cf6f1b72567f038fdb6da12ee118db32104cc57a6db5930d52c7aafddd257aa3171699c52bccd02264042dca1c9033dd53cf02f09a2

C:\Program Files\Microsoft Office\Office14\MSOCFU.DLL

MD5	8c8a943e3924be885dd816b0fad4eed2
SHA1	2ff063136ceaaffa3410169f74cf9ee280e5da56
SHA256	d1318b6c506a1a5b90d3809356582da42a26b603bc470ba05ec58ff41dca7492
SHA512	4813f9de576f7eb1a2726d95dabf071cd6d9542ae95ec3cd0a13be5b6411537d90787579d9d5538b72919101c76456da5fc040f8c8b7c8d0ffbd743d38258dc9

C:\Program Files\Microsoft Office\Office14\CLVIEW.EXE

MD5	35babaea08a220f557159bc872726a9d
SHA1	59d896c8c63ed0f5ef986f9888c58a6ea0ba6c0e
SHA256	29f56a5056ee3d6e77598f6835af72f14100e4c835183803fcd49b1e4d3ea902
SHA512	1d6325424f91dba27379ed44a2b436e91beb803f751cf67f9c25c921e43f00afa077dfa41914ae7fed2f05e5a29f80fbb5140d3851a75a51a530b62ef0543729

C:\Program Files\Microsoft Office\Office14\MEDCAT.DLL

MD5	cacdcddc2217f16adba9382b93d31734
SHA1	b6a41bef90ad6cd2d4010b3f48f70d7771daaa85
SHA256	e92e587e49b642b906e734e74c3b0309d2d27c8299371d3a2f941ba318fed593
SHA512	63bb1ebd254d3f817fa5f37075fa2feda39364d9d6cbac780b70a966a5f71864967890c03bce7c379f4edcbfd0283deb2f9c64616070f9ab3d6ebf0e7f56b485

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACERCLR.DLL

MD5	5acb6b0a029fb0f1710b568d9dd4b65b
SHA1	363c307dea2cd58d5d80be2344cd3c0e957cd07c
SHA256	4a27b5951fca2b4011817b8c937639d50e211f40c9578642f89456ef6093c832
SHA512	2a3b80728b2d78aa5123e9dfa1316f7d9fc6d3e96b24723412deff2f8d240f94a35c99d8639c322721f81c372d68cb14b4bafc483a2cbfb862dc4b0711279eb2

C:\Program Files\Common Files\microsoft shared\OFFICE14\VBAJET32.DLL

MD5	eaa3854d529c05c31257d8185e22796a
SHA1	cf8ccc08eb790ca6ea0b252586e61a2136302814
SHA256	f632f3d8e7bfaccb72db25a0c5fd5b3253123bbb33e53bd7a29d2c5e132a5806
SHA512	dd8c7841506f445b42f93ea11f4540b505097f744f810ba927e00e44251a192ebdfe62b72646e974b3913ed4e0ae2e057fd88df700f68649ef232ba52d3cd012

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEXBE.DLL

MD5	cd72b2693fb8a9537154681a065d9f2a
SHA1	e48bbe02352b16dd9868869dcc9f906d79fe5bc3
SHA256	cd328929ca87ab3cb6dd95266c8043ed4d3b93982e2b1128a67b21f42186ca96
SHA512	4a81debd181e495fd79516859f8eaeb3043667731156075ff82082488e752428fb91710de189778b0e113f5b64835aeda2777e606e60263f480ca37bf4145069

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEREP.DLL

MD5	28930abacb5a5669f21eec387b8da77c
SHA1	79c724588ba84bb782954e4d1a0f11d8a53b06e3
SHA256	bfa3299c25e5fad606d90d307703cda5a5351b92c99e4af1bd38afb6b1916051
SHA512	d0489a211a152daeaf5389dc117150b92b25ca47863211527c98bc93c7407b95e4b6673f06d11b4e6ecfefb01e206179bb0bc09caf2d85caf267872a1f06636c

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEEXCL.DLL

MD5	44886ecb1b938dc48f06ebfb5bd8df0f
SHA1	20f349ab2130277e3fe8f9b2414abe3d88b9eefd
SHA256	501d093b8c3ab36dff8631d246f30a606b1e401d71c064a36fb9f6eb838c2629
SHA512	f99a11ba3382ddef0364feea6040a66be449eeb543ab7de9f88aaf2d83e7e863d65e5ea854920b2764825ea4098b8470c5f85227c681e3bf321acf4dc525544b

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACER3X.DLL

MD5	3f87de98ef22d41918af56d680c1d1b0
SHA1	651291dcde380471e72001c19a6059699531b687
SHA256	23b2b3b1d4a3af40a417be3938a1ff7a37b07949ebd90df6a60fd780d64effb2
SHA512	88795fee536835bc6551c6423bc700e1a6d186a6d3e35fc9c588dceeba754372b69dae4af813b7baa66abc37278fcfe18dfc6c59f1fb97ecf194f2f8e4b5bc39

C:\Program Files\Common Files\microsoft shared\OFFICE14\EXPSRV.DLL

MD5	c1a8ae923670ddcce64bc6b99a145605
SHA1	815ee02f060f06dc5181e4facfc6c4e60de5962a
SHA256	2c3b5c1cb9d615b0147ae6f06e9820ccd3f34a55b70d4ef15e0c5c4ceda834be
SHA512	383cf4be6d806c9b12acb530e875976df3a89d999cabe5eddaba9542da2e6d393535e44a734b570f325a360e29af5cd69bb31697f7eb55a5bf48a36c601bd23d

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEEXCH.DLL

MD5	414e1b73905817b7c13043c3b9c2c066
SHA1	01d22450f1b3d6d8aad565c767576463028741e3
SHA256	7e8952918f95561a875f4592cb51e541c47e9fdb7f96da7a48b8bd57480ef45b
SHA512	22945439fadc07f734741918e9b42a6df20e8f37518b37b424f5bba0f1caeb0affb495b252b8b63d3c636e1646fee982e873b691ecb7b9e214ef6b0ab6fb9f62

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEES.DLL

MD5	1ea1dc9ce18f3a558af1f54bbd2b1c52
SHA1	30c4761f7f6536d92a37bfd7f81a61e62a8fdc19
SHA256	99009f399db6aea93556cf5f5bdee42347d8abab04d351e7352a9b1719168e95
SHA512	1360a329b03b45d4e941f22258d57f2dbad0c213a8d34db186ff06c2b5b7652ab5868705e9d756a24fac6afce80584bee2117869d2770531d33a13818958ec03

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEODBC.DLL

MD5	84ca4a492f733f6c96713cc68c410bd6
SHA1	745c6e35ab3a96f54df39b41a1afec2b68301602
SHA256	06eccbc939103541ce6a0199711b8da4b2f4998d9b1179ea7a2a1986cda19f69
SHA512	1970faf37bed1fdc4f7498a942933779a8acabbb76e126f72c5f92c8b0199b589664b553811d42d509f13a830839c9bffd07e2db4a0ce5445c21f652dcc18105

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEWDAT.DLL

MD5	92bab240c0d4cc18edeea564e9363f4c
SHA1	579ced07541972e01571f793e0edd3a8fc0203b6
SHA256	167049f7cd8a7f8a42fccfe3d962fdf353d0d155a2d0491c125528b7ad647191
SHA512	a7c0c647bd9326e46e4a6cd4171b027e01be2ff806e6181d83415d3c9497d0f7df5912f46704d53371856d87950aea5b143e531919058c4febe3521cb4d9298f

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACEOLEDB.DLL

MD5	7ef6b0853c60c4817b2cd1e3f8e56438
SHA1	e3fbc6c69ab91df03f9d30707c37e8171467fcf2
SHA256	6e6fe6bad922b249f5db3deeb1b485c2dd2e16956d7439c0f2b7f09427dfa6fb
SHA512	2377ee1fc4bed46e075423b3409d05237b39dfde20ff0826e71c54a03732a57ee252738320e029ed984ba62bfdd829aff15fa48c6713b51d0ee5262816f96120

C:\Program Files\Common Files\microsoft shared\OFFICE14\ACECORE.DLL

MD5	f86345392ea4396a595f8f6a8d4f424f
SHA1	9bad0cedc9392609ec8a31caf0e5354d5db00cd5
SHA256	faf18e12d7604ac6980109e83e9978fb1f82d8bd1849b3f913f52139f94c19e3
SHA512	07b9b450c07b8668f53db60af48090fdc8c54ffe7aaaf55e2dbfc551b63d20515e64d72d1af697762ddd2851371eedc079d44fb5a4b7b2cdf7bc950d97ab0da8

C:\Program Files\Microsoft Office\Office14\OIMG.DLL

MD5	7cd1a717089f8c798744a51c31ce4f54
SHA1	9ee631302495f02c762bb18809ab002a935cb340
SHA256	67d9507889323a857cff0acff291abb519760aa547f3a5eeec19d678fe4b95e7
SHA512	36ceb97a7e3f9c2dd56e665c95351e4c621e7ac13970ee4c42592fe395cb330ccfc8f2fe59153637d0ba4f4f3f258bed2741ec1fba8f72dd29b612b71b0d1741

C:\Program Files\Microsoft Office\Office14\GFX.DLL

MD5	82a09fbb8b3d96a52cb04544b39786fa
SHA1	c6f5fe7ca0dd7011cdaf449a18b9fc12697f5e2f
SHA256	6ab77abd9d4aed323132a80d49e69e098db6ed32a59a1a758636d0b0c9c7af07
SHA512	33da6890f09a8d0f0d590ac284074a6147360741ccaaf60566f3fe30cc419a22b67b0b2a47d3d27e63d89ba787e6257710c4619d304e554c92050e18d0118fe9

C:\Program Files\Microsoft Office\Office14\OART.DLL

MD5	482b6ec42c0f7d226a8cba049836a931
SHA1	f5026c9980d28541bb76c1f519689597bb87677a
SHA256	bb37d18d0e87f9bc57e9d5ecc4d69b11037ff98835483d5b02f300563c639a66
SHA512	7304ef6b64cccb460299fa2ef258f0d8ec3ed3e0eb26bfe68e627f87f22525c591651921348d5a5d654334a701e7a2289b7f876cd832668d28e11588cb31d88f

C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL

MD5	26c4d040ea4204ef18a2deb693ed6fc9
SHA1	e5ddaab0dbce4cad17b2b5f89b8017b2de7fa0aa
SHA256	0576fc1aed5a9623b78c476c61ac2a371c9029869088148732b7cb64f744af6f
SHA512	fe973cc0c019e21ac24963c6b3dea960f9cb54ee082d70a38d1a9fce509814224ce73d5a733093413a9f29a141e884603f99df52201b1df284cd4f9160a67c11

C:\Program Files\Common Files\microsoft shared\OFFICE14\CsiSoap.dll

MD5	f219aa78d399e6055d0788d27f3e8ec7
SHA1	36613acdcd9b4d3ed36c5ff1c2492e1ccd432886
SHA256	770de9cf566b742e72e17877850c0b4b2473f372d5833a88c8568fe887674220
SHA512	0698d3a70709ec714b69d6be35abdfef6d77f4439bf0654acf616699009fb475d3b07ec730705577cf6404cffc05702a56b6507e9bb54fb1fea6ac4bb0526ba7

C:\Program Files\Common Files\microsoft shared\OFFICE14\Csi.dll

MD5	f25dd2cda792f8bc948f9afe99c58c9b
SHA1	642c69d7aab65a23342786b294a08a1323178744
SHA256	4cefb6999f317a81e1c6548541b069bacb1406d569ac88b0de07aa4672285133
SHA512	84fce68798ce63174ecfd4574fc72ec31dae60772d0b3ef2bc4b5238d5f466679924848f867d804260ea45dc9e6cb6c6082eb269e7b7e0be1a3376ffe8e73993

C:\Windows\System32\FM20.DLL

MD5	2a7c5942af59d3da74c76b6a2292c5ba
SHA1	95536ac82ac085d52980d9653d12a2649e22669d
SHA256	392ea845963fce9b270431f3bd2ca51486d59a9da760a0727040b8342e5b793d
SHA512	afe5d11cf2d72bb52e7aa080fddc6b826b01df16048071250d7101186632fe982a7ac46ed7c864285df317777d4946da3b2c82f6ae35bf1f8c095893e8873ac3

C:\Program Files\Common Files\microsoft shared\OFFICE14\EXP_XPS.DLL

MD5	a51be7c3f9b45e3396d78e6dbf6bd212
SHA1	12b0dffd19be30d57d55b2169d4f65da58e302d3
SHA256	5de512e8cce118b2a5dfc317852dfab7779941993158ea63c83930629ccc35b0
SHA512	43c92f80f49142bc40f82f61671a13c8941b3cdc41f1e149015da3cc2644e37787858858d1f1793e41345395e02377235e4cf1c5a39e285314b2bcd647483bc9

C:\Program Files\Common Files\microsoft shared\OFFICE14\EXP_PDF.DLL

MD5	f1207dd7e4c84adac6ed1f8c17ddc70e
SHA1	45f26ec4eeed3169e38957fbbfe7948d17d0d860
SHA256	fa5c37090cad5384a7d22bd81f3cdafc438283f4905ba94305f1e7c45ee8f363
SHA512	b1911ffca635f065d50dd6794cc982c0885ba969e03396ed4b874dfce18b328f00a6a6157531c69e7b0ee101ff063d32c98e68c56a68c2d0f15e05b287d16308

C:\Program Files\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE

MD5	d2fb1e68f00598cda7ae42d6de99066c
SHA1	8a7333e262b184248db153ac2bc6e36ebb02dacf
SHA256	c7cc44031fe6ddf964cab66e48ea88e1f46ba8132ec8c2e2ee5cd424f54f6628
SHA512	796f1a8ad263dbade308ce9fe54eca4112d674fb646494e472f048ced41bc6ba33885f04940fd628c44a7fb58ea2c33f8f0305c6ba25ebfc368984f9486a1114

C:\Program Files\Common Files\microsoft shared\OFFICE14\Oarpmany.exe

MD5	b7a3b5112c73dd0c5c7e603377b13fb3
SHA1	55dfc8ddb228ca78b36104293346ca02a0c9f2f6
SHA256	aab2d9421b72fbc31cb79c11ea864c8284f5884f010dffdf47d58640338bc0ea
SHA512	9021058b382c969e3a6f89e4a0cadbaf5ef1c002b9217f36d4b77ab1352a40d9cd89c76e5afea103ad913f130d38ea6ecbb28c45ae2601dc6107549833a1d86b

C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe

MD5	c0a3ce06c381cc2d31daffac4444f51c
SHA1	443b437768443c14f073f9850094f4b5ea989fab
SHA256	4ae486b564b696edf38c45ce493f7b4ad9e6e4537f9d618bf0ca46f685aa430c
SHA512	3561865c6a40a8121390c7a19494998ea91b4dabc7c2221760031724b9217521dd315229d873b58c64848669c6a4f0194956f76212741d1e14f85f7af80ac485

C:\Program Files\Microsoft Office\Office14\PUBCONV.DLL

MD5	b9fe9dc10577e06114432c41646040a7
SHA1	e161504c88ca5758c8dd0609b50a337030d00b38
SHA256	9bfa64fdb851e1fa3afc2852fa2210132d743b1b606b103356c1a26fdeae930d
SHA512	5f9fda4f0a0dd367380a04d1c51145caca789291decb28fa4cd665bb73d1992ffd925b339b1c514284935df8ec7135c2e3a1b4405c59481282ba44e767cd44f5

C:\Program Files\Microsoft Office\Office14\PUBTRAP.DLL

MD5	b950129bbdb71c807a1a2138d5c40872
SHA1	c64dd352cb377db5861d6913e70fae3b8b4b565c
SHA256	b75bd66e2c60bf130d8b0e0520cb11bc383907cc19ebe03246532e7e85818196
SHA512	d92772f84f43049a6f6c3b946962c473feeb394859cca2d89f38b17a69c0a656a71fb5e23ef487c6e3922b6aa7b330daa18d25d0de21084e5eb0cf56740ff284

C:\Program Files\Microsoft Office\Office14\MORPH9.DLL

MD5	91492a215bef04b72a0075a83c590eb5
SHA1	2061c70bcedc44fd28a6e1a1fe64fd6da3ba7f9f
SHA256	1213bc8e67c48f4f6ebfa624dc3720b5a2835ab0d606a11be4037c8eeffce009
SHA512	341246653d7dc5938cc762e17a8fe54067aec56eba0d199995b7d5179761d6f0e125d529f94da4d1760ae90fc2ffae450372a5b8c377f00f19610ddd2f21bf00

C:\Program Files\Microsoft Office\Office14\PPCORE.DLL

MD5	00c194b93d2222be6e94f1c6cbf43b04
SHA1	98b70145834814ad5ecc8031819207ce0509ab35
SHA256	1daee1ff4a94e138eafb81368509f5f6e87350b654710963ab976c108d689640
SHA512	3a9541663b1c3d52927b7c6b5cebb8eb2d1b0c4d1dd3dcc1c552f5bb98c70680943bcfef339cc3635663ab9be0e74a5d4207dbbb275ed426eab2cc789e91d541

C:\Program Files\Microsoft Office\Office14\PPTICO.EXE

MD5	f2e9d0d983f31b8aac0e125adaac3fd3
SHA1	a2897ab23d2debe0720f0a5080aabe0963347c04
SHA256	395b90648ef135b17662984a1967fbeea4d6ae1abe30001020aaf92a3b6bf86c
SHA512	bf283d461be5a654be439f0f9efd8e46a0e1a46761872364a2a576df2c02b6b5638719c7039d7313a221cb3ad26dd6f8c54ba72dade563255042566d1883254a

C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

MD5	b0456496a9118aa4d3ab5cd545a0906f
SHA1	21048b1ae9d3790aa414a38837354bf91c65bae9
SHA256	5d436c7da545d92761ed7b6f6f260281513fd9c23064b03d01bf97fda65d2c1e
SHA512	4431f333a357e46cff0eae8dfdb0b6a6473b751de4c3e141744db93b8dc69e250496d42a6bb39d65b58cc82a1564c4cd192fc43b2c1ae17e73b8d1b4073a3376

C:\Program Files\Microsoft Office\Office14\CNFNOT32.EXE

MD5	bed9f5852521c1708be0e3c8835dafe9
SHA1	1026863cb3d07cde1191b9c857a74ed6b37259a0
SHA256	c65b45ec4a5e6cda039c6a5578a89db0471801fe219e3a2927514ef5b3d14088
SHA512	585ac38ff5506c811c67165f0164951a77b028ea679c07e6d125f7022efd8c8ade975a0ae5a2a86bc9ad9a3c33e5e486c66ff625d3933424e5923a1267b55fe7

C:\Program Files\Microsoft Office\Office14\OUTLCTL.DLL

MD5	9ae25c194fc1ca4c207cc15e008cb78f
SHA1	827970e5900cf21f35e1286b6217536a53c8a991
SHA256	e833a31e2565d2d0d09e9a638f7282fcf5e318a438575e11f789802d55f6d9aa
SHA512	d017da975ba7aac26d9d056a6292f2b5ccd333b3c385611c10447bbcfa23c4143b38cc7098c61e2f5b2c76e2666d64fce6e3f17aeda7b8a2cffcb2b02dd66048

C:\Program Files\Microsoft Office\Office14\ENVELOPE.DLL

MD5	f333989af02821233cbdcaaedd242694
SHA1	6dade83ed2bd03230235d52114f31b8898e8b8b5
SHA256	5265c91aefcb95e19b48877b7a9bad9502feff6018f7b7569347d03905aedb66
SHA512	f1e8bdd70c10b0380b85f6b352a6cea57f128b6d1876d04a087030fb3cee9b4fc3f970c18f8d95bc5b5965d7db43b946bf8c3b3fb6af5d26927c4968715f13cd

C:\Program Files\Microsoft Office\Office14\DLGSETP.DLL

MD5	7ccc042672b486eb64747f9f7a46add3
SHA1	a47335fb3e9de750527f4ff19a1882714c2335e2
SHA256	4e69b091ce82a74143635b044fffac0efc94e9f9408d084f0b597fe3c1dd2e16
SHA512	4e129eb76191595036c230537bbd5ee705f7696a733f562001e913d3ce13de58a15caf3c894a57d1c3fc26e2cc937ab75a02c6c1396c495cd1f1105ca8a061cc

C:\Program Files\Microsoft Office\Office14\RTFHTML.DLL

MD5	65af06050b76e8b5ff63172597524fa0
SHA1	27dbedc9e1c40e04fccb2319243c2e0b67961f57
SHA256	7cb6df7ee9ffb9d96be4f3fadc4ce06d093f291f8345be65674c7a09a2eec735
SHA512	826c0c91777f1cf9148d4b9d4497695534a8f3302f0d47d3e3e3aa4fb56838c2ca1553124316ddf68a770d291e2b41f6ecfa6a5b822f1bf72f386df011907d4b

C:\Program Files\Microsoft Office\Office14\EXSEC32.DLL

MD5	4f722cacc212244e67c346cbee3c28e8
SHA1	a17b1843a5dc483fd4eec93310faf5901a8e9192
SHA256	b094ffb99c2bfd57b1d2b2e1fd58d397ad4f9df8125863f35514e873efb3a0a0
SHA512	732ddcb867147d5f08fc205402473b5b17d271e2e181e5d5e3a60c96066298b36fbea0a248e9826130a4711c9f8bbbab593a98abf44881d1a2b697ddb8999ae7

C:\Program Files\Microsoft Office\Office14\OUTLPH.DLL

MD5	1ca077e33e5d91eaac5b7de4388296e0
SHA1	ac3ca69ee4131178c87ffbc913d47390e6505634
SHA256	691b66a63d45988f0dba39939699d4b1cd51a4864f08c7b683c27c9b2a84a377
SHA512	6c24a2af3fe8cc11954dff1e52fc5191bf6521537887472e89d358c18cf33dc523b1ac73c4523d8bbe0066f6793f5a21bff62dd525d72f03050dae979460c300

C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE

MD5	ac46bae522a8bd6104862aa3c4c46b6c
SHA1	d09f814b49242b2771cc37779f1641359201fc59
SHA256	703503c7e72f932c72c1f7e3e5cfe8e482ed19b14c1e10d090e3df1f8483177f
SHA512	b0f1e312e868311b5e2825bbce794ec36661d00759239e0fb72bb29b9ea6c02aadca2ea07046941215a8f7ab2e551bafdc43812a6edb04e2278e4d04872dfd1e

C:\Program Files\Microsoft Office\Office14\ONMAIN.DLL

MD5	9e56ed89174d7ba8fefc29c1d87e4371
SHA1	8a61c406e911294feffb286711a1eaa934604f3c
SHA256	45302c577a672ddb4db69ec71e69d902ce5ed600f416e35f4ca7807205d23554
SHA512	df1db3709f1930be5fb0a0bf0b16988b5d436fa68429b1b20f49e51d12610caf15d257e39c55eb7cb168898d71b79b9bca210c9d46a9ae479dd2374b2fc2e8c3

C:\Program Files\Microsoft Office\Office14\ONENOTEMANAGED.DLL

MD5	1c6eebfef49fe19a44dfd603474b9e4c
SHA1	19509acc2a8ab2cc4286e0c26c4c2f373ae0a44e
SHA256	f2802370ff0de496949c1f687b7474643a0a4ca2f12786953c139563cfff2c18
SHA512	d50d14c7aadfe50f4c6c9184fecb580e9001036e154fd9596bbb8fadd972c92ee6ffabb66bffddf6dc675dc39a383dae5dd454b942a60c5de8e077177fee3424

C:\Program Files\Microsoft Office\Office14\INLAUNCH.DLL

MD5	6bddefcfc8e081563f9910464f6c8f7b
SHA1	6a77d997dd6f4b1d4387355814698f5f48444ba7
SHA256	e8092811bd1f3d983c8deccc16e8b9bf729d65e0e1dfbf4392176f3779498189
SHA512	4ad78d56f38a46e26bf9708b7f5fdba4f36e8462377ef7143acb8a41905a47c1c42187d5460fe27c870536880ce2e0632c2ac87c265561c09d6567853e96d3a1

C:\Program Files\Microsoft Office\Office14\XLICONS.EXE

MD5	089cffc8375c3a6a87b2affb787753c7
SHA1	ffac31d9c65879f0f13de52b7b30abbd76f57bed
SHA256	25ab363ea3bbe0c08fbb1c42986a696fee8bc8aa5d32d5b714b87d51f991584b
SHA512	11b98323bc796878b4d9867d3c7f9d37ac38d68ab30793821c605eb8aa10a02fe61d54c475ea48411fa1e99b7f84477c8c69eb13e9998cff4b79c672faf5ade1

C:\Program Files\Microsoft Office\Office14\msaccess.exe.manifest

MD5	1204c97dfe06fd3e31bff00543d1e7fd
SHA1	37c2903898ee318dc8855e0e5cede876ca6e0dae
SHA256	ce52d020dba70c4218df29312887ea94ba8c88a0b7b4f8540840463157554401
SHA512	c765d3afe7e2045de2468d53135a380fb5bcaf6a3796a9ff4051e3e82d290b7db813990c7fb9692e7b642f43ea128bef5240397a5b2dd11e629079559dcd1458

C:\Program Files\Microsoft Office\Office14\ACCICONS.EXE

MD5	e5db607d73b05421706412d11271f8e8
SHA1	a0345660b2ed94b5df4eabef160083ea899307ef
SHA256	3fa9caffc46ee284172167c2eccd290c765593424182bee47c393d47b5a607f3
SHA512	ce38767688741dc7161774e77770da8e9c71519274cc0f0c4baa69b652aa150b5be4d51f069be4f5a4a408170800a3b29971293a92a368de364cb55831e9c653

C:\Program Files\Microsoft Office\Office14\ACCWIZ.DLL

MD5	7ba51fe0d22a2f40d8be7cc148b6364e
SHA1	198ee8b5b09e0c10d08454c16799980293153be6
SHA256	2aa155d4dff1e6e931b2039af8710815098a527ae75e3cb54545b07420fcd2de
SHA512	0e5e1bf95118a5e6aec3b81e91130632efdd181cc222f16d929f59eebb79e9a1b4422bb46b75b8679c575f4e72648dba82cdcbd07b6d909d7793c6595c9de0d7

C:\Program Files\Microsoft Office\Office14\MSAEXP30.DLL

MD5	cd22a3db70fe3fa84205c696b5d77eab
SHA1	2d96de836bea3fba1ded522f75ec84d623963e35
SHA256	9a71bf44f572e01163fb17b952781871bf55e3ad79c3e7458f25c4d177e33c71
SHA512	22b8eaa14de7a09651325a04622dcd17fe7d7e9ed1f742e5830b8b9061830de2e8b5b64d8b5422252b9eb0ab6886b0f078a2659ba494d68ac85003f4d6ce96a6

C:\Program Files\Microsoft Office\Office14\MSACCESS.EXE

MD5	5f54b44d066c73c11819d8d43aaca0e3
SHA1	98a04825975726cebeda441335f62f0a8c3ccbb7
SHA256	1e78a78dcc4522bd251ea5d938ddfde2e9b06fa3bd6013ef30dc2ccaa8ca3e23
SHA512	81ab35e547f29e19853a740010220db6fb47bc6e9e0d5d9cf10ecf55bc71325e6081c4f7fa5058f75819c98f3ae49f569422f5881cc50bb4898882b91b6f2642

C:\Program Files\Microsoft Office\Office14\STSLIST.DLL

MD5	8f6b808cffec31fabae6efd4f03a9bd7
SHA1	73bce54e722d077c4be73efce315ec12a2c407b4
SHA256	9420f3abf87c81bf04f3a840a8b9868a740a7d9c13935c28fa815d7b00cdcaf1
SHA512	1c11ffa0b259dfb4f14590ca76e0ff349c06603711770a3b56b1715e27d465e01107348c2a9382bb647fffedff3c05c1ab2d9a3ee48a850741007c87d88bfa63

C:\Program Files\Microsoft Office\Office14\GRAPH.EXE

MD5	89427d6727fd13fe8aab490677796eab
SHA1	80230898876e00992a5f11976172d9055683bc76
SHA256	b33bb15d6836dbbc268634f3ddbf748ff6137e88e8636618807e07252ed19d78
SHA512	6140ec906452403b818920f16d72cc600398b5478e1ea9008abd30102b10fb7e364bea8173feeffd55c64544c9c21dea5cf0bea02b6e8a1767346ef889d4377d

C:\Program Files\Common Files\microsoft shared\OFFICE14\MSO.DLL

MD5	3ec7db1b6784f78d6382bfca29b744be
SHA1	3dc1992c4ac83a2a67ef36b68817ebd03f2fb982
SHA256	63db41721f9741efd948ef95b129e741298983e01c86cfd83f583565071391fd
SHA512	e3020bdd8dbb65c3ec671a926495aeaa4338bcedf90a6c2bf3161c74ac3894ae26ab74c54b96a4801a78c315e44cf264f1d578245fc7aae3657fabb039329196

C:\Program Files\Microsoft Office\Office14\BCSSync.exe

MD5	a0a6e787bf8873662284912bc545a684
SHA1	ff6c965e5bcb2fb50561fdcbf2152ae331d1fd79
SHA256	7fdd7b545ffc373bd6827e178cc5c7937f3f8150419322434e474c625c19f6e1
SHA512	35f49e2ac9d5c8364c7facc4b5b37f8397e7cda7674103b641f31a020e22a474379ce7677d169769479d8b4addbbdd864f7ec676e7cfb201f4e780dbdafd108b

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll

MD5	823d3b810c5deb899d432ed012f73cf8
SHA1	615ae42094f21d2d392c1d01e1549e874104de3d
SHA256	efa466a843cc531d9f3c38d578316acf83a587ddaab2d9c3dcf60313274e2c87
SHA512	4c3f1c7f9d97ee69458df5d079003459f30018a7f871ec0e09159cb5dde1691ab3f18d19c910db885d58ac7f556aa4338caeb1654b253d1654298a5bd04efd04

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll

MD5	cfed6fbf1cf82c60bc525d043052bc4e
SHA1	93474f1814e361311aa4db453c8f9883807967fb
SHA256	87bb90f1f8a16e586234b4ef233811ce5f6b4db492ee6c327323d5ee51408312
SHA512	83dcb90aa8ee65f31ba3f91ac1e644594ba6018d090ac263664cabba487545484c7a6813c9cdd168c136e5542e817e704018022e5f666746a4b0a0c4299fab37

C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msolui100.dll

MD5	7909971ad3b8ade70be5b394f06e6699
SHA1	0513855f0ad503fa775ddb4d03824a2b552d3cf3
SHA256	2b29d3219ecf2a89f9994fedea384caf86efdb0415bfcd411f5209a52b1bc15c
SHA512	5aeb4a712af426abc3909799c31de28f5ba440eb6a9256af89c635bb817b4f8567ea249a35a1b4afceb9e8681b901d0c3a2f6e1bfad608c0dcda126909d88fef

C:\ProgramData\Microsoft\Office\MySharePoints.ico

MD5	56bca814dbfc0e1aa6e09aba42908cbb
SHA1	49a5abc1b236cf52feec036718268eaa62774b5c
SHA256	ce407eda29eaf0fe5824e0b22d598096896360a3a456dca5db2b8682b46ff14c
SHA512	1560dbcaa883cd4215f2c7ae6460bad76c9cb57c3f7842e50324d1f757542a84c9ed09f31ba99d1a9280f90e8f6d04fcafe0bbb2c9333774f092ef5d25578a3a

C:\Program Files\Microsoft Office\Office14\ENGDIC.DAT

MD5	4142f1bd8b9d8ed08f93f5156c1a0790
SHA1	ceebf7fd244fc787a7bc383fa4d6adf4f70319ad
SHA256	7f068948a4ec23602ccdd5d732f24371776f0a7e1033b13378b56b212fc188e0
SHA512	cd78799d2008d8fb4f69212319fe1a7e067b085d7f2032949d9f273a245f1a037e704ceb570d52b5018a7a778c6d195bbaccf074a52cb57eddc00ef73ddf87b6

C:\Program Files\Microsoft Office\Office14\CharSetTable.chr

MD5	a1fb93a9a43495e5a63ede3b312a6c70
SHA1	0bd70cfcd6a986eb07944b6df412df7d32f2db22
SHA256	37d9205cda49c4acbc4fc94f5e9a8f7d2875a2c951a0ccd3277727468bacb73b
SHA512	6fd2d16a9c867b169416e67799ca395fc76855f88d455581179c0874ed2249ef7686c1ba431f9312483bf6e9638ba61d42c5f4aa5f5f6fa7a4d74b774d597bff

C:\Program Files (x86)\Common Files\Microsoft Shared\Help\Hx.HxT

MD5	868dec059e20c7f28ba2805e6b047e44
SHA1	ed0f824a2319e2009dd8cd66cb3bfdb4035177e4
SHA256	137bf5ec736bd430929690afc8fc92e999c8cfe08a4235d599cd1fdec9075762
SHA512	39e6d7513c9c4b5131b46dfdd58876e3769a637bf0fa6738d510385be0d7c11be345b489594f9ca7b45b6ed01af4f6c1757f1c591a2aa3c544b1305734b2e4fe

C:\Program Files (x86)\Common Files\Microsoft Shared\Help\HxRuntime.HxS

MD5	e1f4527f67caac50cc2eacd5d96d7e1a
SHA1	b7b03de6dc2608211e4d3e4cdcd851f2d1bbc8d2
SHA256	be39c846263d6d4d758c5c946976ca4e0cc0f8a61168fec1d8ad17e86237cb8b
SHA512	a31fae29382519bf94e16b703a3ed6292daa9cdd49e1f63b6ada9a3694a1b247082fea4ff62030094cbaf009da8643ff59ed9c365329ecc2bb0eb2ddb8e0db82

C:\Program Files (x86)\Common Files\Microsoft Shared\Help\Keywords.HxK

MD5	9543c1e9a5d5f39bcfbebe1a07b76826
SHA1	dc38edfb5a39e3ac7e6d42810656ec888a24146e
SHA256	ecaa81ff698af2f4d795128d0d218b4171a69cc0c6a9bdcf52c92e0fc2454ad0
SHA512	54b238f4a08ec7475117eb3a2c9c4b073e6ae1d66bce7b87470eb5ed6145131b7a601bbb7cc1f8196354dc52d9815db443c9c6467ef27b64a886c0d0da54ada0

C:\Program Files (x86)\Common Files\Microsoft Shared\Help\NamedURLs.HxK

MD5	67d7183cf742812fe8f2466eebdb114c
SHA1	465770f3be0a5a578e0a1776f4c4e7238caceeac
SHA256	7ac8ae8fbf69e7dcba2dfc3b74c7f1ea9ca1fe85b73d0c096b8cf5d80e036931
SHA512	86f9efec0a63539e6349a93536f2d880a64d80e015d166fa26c4627bf63764bc5d13033f21732fe7df009484743a6ba0c77cfbe3132ec4f562474b8764b97ba7

C:\Program Files\Common Files\microsoft shared\Smart Tag\MSTAG.TLB

MD5	b9846b89b94c7c101585c2736e96a28f
SHA1	a6b6e7768faf1997ced12f77765f8f4f0e20a98d
SHA256	7667b5293e4ed1c458145618c3b4584659a7bf583dd86cb993733ee2669ec291
SHA512	536624837a333f93e3451775b8c03246e40f9a69b79a3353e84813abfc731fb1480afadc4981b3f2e3893395e1cbfbe31b56a8fb2bf33a1762b3a4fcd6332299

C:\Program Files\Microsoft Office\Office14\DBGHELP.DLL

MD5	61e562a10e185384fd74684607e748cd
SHA1	359970736cf8ddfef5df17a0b42fd2302b25571f
SHA256	f168ea4a9afdd120acd8da091a010a447adb96d6d99a99791e62405c7b173aa1
SHA512	20d84b16a9c7e855cf10d08abace94c9cd84863a24be4780c2f40a3c4f865d1b3491cb208dbb79899866ee2a486b94510d4a8c3618d1af18efe9020326b002a7

C:\Program Files\Microsoft Office\Document Themes 14\Theme Effects\Apex.eftx

MD5	d97bd9a48bf8d984e473d59b9204b8d1
SHA1	c7c28c085f0149f735f4842cf2021735ce16debd
SHA256	7fe1bd8a9bdb052e9e984088fdced02ed461bcbbb57a71c5360c523f89523d1c
SHA512	3839c14b7147cd34235e6b63c9592f81888d51e2346f71e4810ac60e9407c1f64dc0d59d954f1f7cec5cfc441e3923468dc20271dad2fb80871bf17f47f5714b

C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Apex.xml

MD5	d395cf1c14fac7b6f01b8c53e5858005
SHA1	d5304d83979c91b744a15acdd1295cc907381160
SHA256	f54a1ea94efe814223f460ab0323f32b85d3b0466e08b8a3bf63c967696432e0
SHA512	2d721dc9f29c82761a1df1edfe0675ef683f8d38290bd83821da709b3ed479d0d15aecc95d7f68a571263a0688a78169cc131e0d4ffb8e2c860eb41588d5f6ee

C:\Program Files\Microsoft Office\Document Themes 14\Apex.thmx

MD5	5bb6577ffdc13badd9780232db4a2d91
SHA1	f850a03133ce36975117454f47feb2f3b3d4d286
SHA256	a32f72ce830777ca869ca13fe473d2879138e00164e00fa63d572854fee4f1fc
SHA512	dadb1c34a3ec5dba19288abb60df29cd30270a79887c6c053d5c0ae9ccadc75b92d172c4c43de6fd5ba07f613fb04f6a8ab031520f5c714f3e56c0932ef21007

C:\Program Files\Microsoft Office\Office14\bdcmetadataresource.xsd

MD5	aa473d09b6825c0507ff378ea1a7ebe5
SHA1	fe31d3ecf9a7828f3993831737459c80e59308d8
SHA256	05c7ab0f5aee2cc58d03eb8b986ca34ed54fa94026d4605253caa6089d74531b
SHA512	af33bb409acc87cc292ab675cd6d1f3f547ba7230770c2f9d7235f71992b8a1e3f9f3865c792f44d8f7015387f41043bd1d348b98b39bdb835c09b312ef25086

C:\Program Files\Microsoft Office\Office14\Microsoft.BusinessData.xml

MD5	e726860aa1f24aaf672927b66c4b1510
SHA1	7144a63f667de35211c678309fe3645e6cf92dbc
SHA256	88e28c578dd73d0997902bc3f917cb2ea609bb4253edc9c4ba71402a8410f55b
SHA512	15fa0b4a94088c7bec0f4b88abd51ce96967e98221e78a044c2c0808dd2260519976f20f029f82421b69537a83521ec81e165996a7dad5de1622c4c3c3c1613f

C:\Program Files\Microsoft Office\Office14\subscription.xsd

MD5	847d9c1f0359640cc6ff16c105622785
SHA1	95bfb259523eb98c6d3f255b18d7ec336e411815
SHA256	e7ebe9eab52e7fc1bf33342e4e1ae0417a83b98b0b2b4a86a4869f5a3cfbe8f0
SHA512	757f0aeed0b59b6cdbffac3c39178861c5eabc8a28fe4dd7e721bfc0c012abf0434ae151b2e23099c654cbd50bca019c8cec6afb23e44d19a1c6d6e88bc3de42

C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.config

MD5	9d8338d2cc8324cd2cb0e3bd56599adf
SHA1	dc12d6cfc8a336c212dae7371908fae4fa51421a
SHA256	16b7ca460c49efa6cd9e3ee031bb5dadbf04129ad8c75dd8ad3894311e3f82cf
SHA512	e01d7b17b0c0846ebc31cd09d1856eab0006c8220b6671155a666597c571b3ae825ff7e2cc0f560f5177b9f9a80c4fda40902f7f4933a3a93ce68c272934450a

C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZLIB.ACCDE

MD5	e15059689b09faaea27dc4ac35a696b7
SHA1	51bda699b42b3425f5fa25e2a0fa0cba03b8caa3
SHA256	d91df61492a4757b2299b6ed902c9138f5b849465338d15cd8c5a12c4059e57d
SHA512	2536fde31bdfa4408a64d9c8f319628092e317fa723a94b39ae4fb76dff9ec5245e3cccbcb2202b103761de4b00382534569f1f977be62fe614e571304f79c4f

C:\Program Files\Microsoft Office\Office14\ACEDAO.DLL

MD5	79abee600666dab34bfc5a64ef2e09c6
SHA1	6ffbe6035a7baefc20b389c1886f3612942abed5
SHA256	69d742dd1916f716690ae2e9208df6285b728fe737503cc9770aeea29f612ae9
SHA512	6180064d74b14474f4acb9774006c998d7bdbe1d98acf6967b0a1999975743791b2805deb563791216b292183f08ca42d12332c99e8836726bf349e962ae16ed

C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZMAIN.ACCDE

MD5	f98906290a8358b549dca0fb157a025e
SHA1	96ba20d18d92410925c6dd7741f80a9771a777b1
SHA256	1f661e8166c8c47a22d126c4c8d932c5bfb5a2b63b3c40e38a54950518ea24ab
SHA512	fcb32ddd69ecf895bf1c2c15833efbddc6ca22aca61bcc6fdf77e9014dc6c7b7ee3b6e29b5b3a844fbbf84ff5e2c691c9f2718609d3658b0f7c74fb906347cff

C:\Program Files\Microsoft Office\Office14\ACCWIZ\ACWZUSR12.ACCDU

MD5	863295854539b95bff4970f3f791d408
SHA1	f7327310688908718fa21561f75dd3ca1a487647
SHA256	fdafbf20ecda3079b81ff983877770204fcaafaa083fbecae4d5a67f90f909e5
SHA512	f34fd9c47f0e8a0afa086e5ac44dc3d53594964ebdbd085606a38116ca9102150353b3bf740aa3edac5a3c70cec42f9af964c559827ae1f84a8bc817108fae47

C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll

MD5	17dacab6e79cdec19cef2a5dc811c4ae
SHA1	f6395772a7dfd27a82e938257f405bd4f68a17ca
SHA256	719650cd9f0d2f351e38cc02aaadc1ed4431fd03566ed66283d55af57c45d224
SHA512	8dc1cb9c82d4139842923569a8714b9b1020608df2f9795a56659d874408af4cfa86901ee3061533735d3313954560db29784e67b4435bab7430bc15935c7365

C:\Program Files\Microsoft Office\Office14\ADDINS\otkloadr_x64.dll

MD5	0e6c462aa0306c90cb1f2e6c5260e6e1
SHA1	9eebcb4f3e20afa0485b22b6a9be3032614a19b5
SHA256	8901656cfb055cab34133d450b819ffcbcefb602a5343b4a1b50ebe7f587e462
SHA512	5d97daad1e902aa3bb27f69bfd511616d72ebca9009e4b4f02cf71b929262ce00cbf71b77207edbe8a2a8236ae6d35e73f4c2a7f7ff1a57e07695fe8222d9ab7

C:\Program Files\Microsoft Office\Office14\ADDINS\MSOSEC.XML

MD5	2f78fa500ea5f9d68ba461c145be0dda
SHA1	9c16c6abaaf430d950c223119713cc6c8939fe17
SHA256	a437e34cc4ba5da43483ce5c80ecc1959d3614654d6bd953fd167889da588789
SHA512	b271d81b087e3d399d0a7422fb8ef55f5a7bf3fef2500b8c8ac38277b51e889e9f6a8d44c9a53f203a21bf7faafdcb50cdda2497ba8a937798ac493eb307fedd

C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer

MD5	e9ba33d1a8be3056ebbfe3dd29c9cc8c
SHA1	4262dcb14552d303123d36a60a9662e524a7d7db
SHA256	f977d427023c65b8e42b7675e0087a6aedb54d2e063c3a55844f9695b3ca8296
SHA512	e22d6ea5f42c01afd927d4a9e3cf7d5b13b903ed7648333fa7cd4b04a9376d17968d28816dabcaa9ef71723dbc6a9cfc57d2e7d36bf7a3f4611eba66a0cdf949

C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer

MD5	92626a5b99491081ff4659c73cb318c2
SHA1	5eae3d04e0163bdfef635a540d1c5f72efdf57c2
SHA256	bfebb06d9a102f66d45a55a696eb2e00711dffd3b7ed295dde8a99c29b216765
SHA512	2b061bb98d1a14e703c529b040c9aec74cb1da6b09071e7ff3f3bbc547a10538c3f1c8abd3e3a45bc75fb966bccee3b79cd04b30da3bc28af4b363d70ecece91

C:\Program Files\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer

MD5	f4eaa5bfa584b5573282341ac088c5de
SHA1	c3bc604a5925e90f3030e702010dc95b34b81a4c
SHA256	1cd9433ec433b0e9ba812e20c5017220a001a9e463222e971b7696e49b3b4ed0
SHA512	21076be0366c01e9983d08a2a09445e77da2703a19cc2f35505135a69d161249e6104eae4a5c40560217f874408fe4a3ccdebd72985a0dc84bc2720e860f8600

C:\Program Files\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Code_Signing_2001-4_CA.cer

MD5	3490443c9bbe68dc5d350e6d106103ec
SHA1	1b7d5786e3718fc6bf9bc7102b3831ca6d19faf0
SHA256	4f28225a86da4d1fd8d5bfdb0d60bc30f418458fbc5a44ebb126e89f7f418286
SHA512	b3f74b41ecd2289a63d6de61008db9f8e5b9e9954b12f45b7687e03d3791ebbc1306f9d926940a9ecc8615d0e49ebd32a9eb94f4601df9e6a59e19df332d7a75

C:\Program Files\Microsoft Office\Office14\Installed_resources14.xss

MD5	7cf7c6bbd20984d89893012549831e3e
SHA1	4bcef9540355fdb0527fbaf0de1f5c4bb0689d8a
SHA256	6582e45c4d2eae66b2144e857d74b4f3647d9466d03460c0ad89d6d6424bc21d
SHA512	abe643c43a97ae39b43858a8e525954d77787c2354a856ca7355809a32f4bf7fe34503f86cca34ea43b10f7d535689ca974f59fc49ba2e1c859a183cb0a54f97

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg

MD5	66b5a911130ac30c6f4a9bde65c92090
SHA1	30d37abdf4cfbc268453e948c5eefb5e8dd18ade
SHA256	a250bd4aa41ea732026062ff4e204db0cc4f33884b81c2f9af8222e44c460c4c
SHA512	c95c26c7af7147f14e01b25fe786dff835a2ed0348847db69b47b6f93cdae6e8ca022ecaec30771366bcf654340d25ad2b627cbea46021b55dedc8ddc41a85c1

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Adobe.css

MD5	8ddc4bee0bf85ea8f0cbe5d6649bdca7
SHA1	c8c72eb67b06096c98e83fe4299a670e71979fcb
SHA256	49e3e0a44c0a307b54456cc89255a9133706fb6175565bec0f1fc23d4bd22260
SHA512	e7e6fb6450702b896fbaf3d26d0d0e73dc622d757ba2836750e2915bb484e31b4991aed5fd5d5d7adaf37945656673e2a302711865ee53c572a17f69b9e1e221

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5	c1eded2dc01c9b015a30fac60cfac4ae
SHA1	c8aa0a99dc5d3522dceefdb5c42fc1deadf0c9d7
SHA256	3cebc446b554c6fb6a94a798bdc248f0ee936d35580489063bf14bbd2e5ef7c6
SHA512	442ede70ddce7e5d3c8abf58ae70dccfa85e37cb6f8eb922678016509a032925d60007706edc2c54ecf07c094a2b2793dc47eac0f53857460aa41fd63afc2acd

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5	07d528352a8bb73b52d43ce0dabeb604
SHA1	10544ff162f94b52b9fb46528923d8da789ce3d3
SHA256	25329e65414318bf3f99e74e0357d9dd88518a0f3a59c65e40a3c6f774e1cc72
SHA512	eee4823e5e3eaae072f762319030aacaeee926109ea87c1aecb3ab24b390a43f9d31f2b2047e280e9c59e79226ae710c7d305c9f07c8895e7745e0ef6a20f00e

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5	7ef31a877156df523fb1c99fac300aa2
SHA1	fc25066d23210570e7b71466b22f636a46c3c890
SHA256	b9da844a7b2381b0d6018712636fc7d2d5e7d2a29ae2cbdc02af8a0e48e4c73f
SHA512	97b9cfca1d80f9e7a572deb3810db75ecab845b367756bd06fd391b89946c2a87be27b99b96db588b54f9bef25905d11a7fc77397d5151f86aada8290c73cf67

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5	397d490a4ecd8abd71d3f9df95e2afea
SHA1	3bed750f854ca8ad75561fd34b0736bb152438f0
SHA256	7df2f137905e10b06f584443533c660da0496532099745df29262330771ec0a9
SHA512	bdc957046a5e6decf42e2429e9c74a7ba53fb4e15bfaf1153f775ab0349549b3e360e26171b1c27c5c55247184fc4d7e76f55785925922ead60084fa48855c74

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5	6bb90be5c6e08ee7f0da770c2a670786
SHA1	a266982b1998d0763b81f6042dc563174a727c97
SHA256	2334b031774406a8149d36e911f3e72ac7e509217e81ae99cb608d3d21b7119d
SHA512	615d14b55654c41c74f7c9198511f05bb2de165622c546c373e258a8da4f4fb01edeac6449edfd962ced04ae7138d6de202fa779e3fe87c9b02ed72ef9dbf1ab

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5	65e1f0e787d4cd4b92ea4fc6ea5cd826
SHA1	725dc35fa591466da5a36d480653b2f27d56a808
SHA256	04eab76971b1c3d9c849179893b9ba36f5ee09de529a38b9c9313dceed81f710
SHA512	3161a5c3409e09ec6193df99a3289726132d8becc3fd312ae5692ec223d143de537ea5e2dbf0cb276995f953ee49645e50da95b68f1d3a14574ca080bda1ea66

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5	cf2a0d492e792be7de119bae7c409c9f
SHA1	370c16feb05ef743ea60c126f1823e927ec77877
SHA256	b5488b1a192a7b003f892d689989332b9ed4b1b8adaf88527ac3cda156210ab2
SHA512	ba1f53987f90e0e57f0afe32adff06eec5071fedc5eb14f1bd7dd0863ca3c807c682b7379410595e13f152ee0cc73df4c3d1dd15b1236e3405d3b075590c4c33

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5	efc5a10333fea245b784dac240e8a98e
SHA1	b3d5065f84285c9e30006b3f3a6383d00569fd14
SHA256	eeb345bc22e0d2585afdf84e806010bf7c0485572422329c216eea929554529f
SHA512	e885055ff7c633cbd724194a1525c63b446adfcdc6bf6a3f360348849d3f89a03fdb61eaa42f1ff2c748e56f2b047412948032eb7e1cc0db1301c9dceac2f634

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5	d8f4146d52efd10b3ff36c3d859e587b
SHA1	316a2f23debbcde4cd64a31562823455ebce2247
SHA256	689648b03bd106f624fe0cf78efd192cca73fbc775386005c0ba19a079219731
SHA512	3f7e7189594e70b5a0659b63e958f97e44fad0114fa6cbba03f4367548f882b8aa737e61cbd953ff7da4c9629b7be7c73851ad51f0e95eec1ca72758d0032963

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5	8dec757344e8e01250b42ac2e851953e
SHA1	68ee40db088c895ed55cd043c2b97810873477ee
SHA256	77dbae65602b0da6c8cdd2a3955cc1fe10a9de9225667bdf533a30af83f9662c
SHA512	c50f765a01994e0070007b6922c6b3ce8cba641af602fe23eef4444c5026be8492379221936ec6062ece8ceeb899211717933b41a8a0779547ad202e24978fe1

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5	00ab7c8291f9c387b864b96cd80448f6
SHA1	1bf94e5826a717a7c48ce11b1642b0eb16b822e5
SHA256	8cfa40294e2dc8947c1ce5987d873f16caa653123c3c58e6eba917282c1c4255
SHA512	b1de9c23995cb190d9f010983fd551f1abb3868bc85dc224b29a29de2b3b1bc4b94168677501e94a5566b0f7a1f7d89c9d3079255a1c880d0755903ece33aed1

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\Attachments.jpg

MD5	bebc2d04397f516490086aacfcca1353
SHA1	d7351e6158f53dfed6525ebbc3ca497f30feb09b
SHA256	8ff6c845b7c6220666a926af75a4fef2a60554be7945df36baeb750bd2d489b1
SHA512	521613a514bd04b7fe1660b11dd1621ea98673e37d88dcaff8a836d3cf753aac3717832029a03f9a113f84fd68506dc23771a41de784a5212d5cb5dc1239efe0

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5	4cf479cf29390bee48fbb92f6543f41e
SHA1	9cffff5c882adcac4544800a82470c61970d2ad4
SHA256	c4d28583dc3b23a6ad428c39e1bc4f1ceec063955a270bbfc6391673578c886c
SHA512	56ce125e201ba67f36b9d5360ad58e22207848ef3c6023491ce61c14bbdd96ef442b0cd160daad9d70fb99978a59ae459827964aa3ae2a51b57e78781adbe5c8

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt

MD5	44080bae4f3463d6bf7d8228db3c6a21
SHA1	c2c8050a4c49619c17ae8b35c2b07d3935053da5
SHA256	ffa3b5bf3b4d2191ea20522d1d50813914874708aa9cc2222b6402babf2cf805
SHA512	b52b63bb636e5de1f57d89efd4481f110baae31ab9dec652c658a03c01a0e01d0cbe9ec3dcc005a710e5d4c5cee23f24515fa50404097d630fcc4b3411a3dbc0

C:\Program Files\Microsoft Office\Office14\SplashScreen.bmp

MD5	699ce0e44fea1343a8319b7a435b52eb
SHA1	b16fc560faf94bc93bbb6a0e67fd1ff66cda2c55
SHA256	16bbf6b3f6cb7c54fa7ca76b81de9bc23740654381d4864785a63abcb7225339
SHA512	df265778a4006cc705bf93c81bf295e548c0289a0d85168da6483889a8920d2f0c8ef7829b5496e3c1536475d34e44a04d4ad65f0346a6f91d12b447cdcf1901

C:\Program Files\Microsoft Office\Office14\Groove\XML Files\builtincontrolsschema.xsd

MD5	c18c257db7e89c692485a84797d33466
SHA1	73dbfe9ee4979d7468cbca224e88080744ac0a5f
SHA256	a9a8ff3925749b143de281ddf5b93e853cfc74074f61eb0dc26993f547172c87
SHA512	c26328685ae439eb746c6e7db46b19cc4f958dc1a28372cdf366ce7727a24206c97c2e3035109e7463f8b5d6fb129bb85c3090fb0df20d490832ed89e3324e33

C:\Program Files\Microsoft Office\Office14\Groove\Sounds\People\COUGH.WAV

MD5	1521b4f94cb4b414f21298e1843ff5a8
SHA1	371c868583fe9c54a7f9bb8a2267a2a0b46d6a34
SHA256	e0607922cb6e62fbeee661f53f358c014a72db3bf0d90e68a5750efb95d2ec0e
SHA512	cbef9712cc6ec5ab7b8555bbc1e6582aa799015529c90cc5b2d5fa6d0fd75711f419a0cce435d02a08ed241aad32247262287fbc01dfa537285f9f75f60f1d27

C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Places\ALARM.WAV

MD5	df8c43dbf9ea3e876d72de21a9826d01
SHA1	4ed1e9486bef9bf09464060fecf2a1f0bce9d2cc
SHA256	17e172eea0932b57adab127332d8b6812d81f5d2162abdcdb6dede869e331155
SHA512	fc83665f809a9eefe4982327437724bcda243c38ba6d9133f36cc74482bf1dbfb877322022f043debaf43eca044bc8e599aa6ccd9fc23ea028562fc3f10e93e5

C:\Program Files\Microsoft Office\Office14\Groove\Sounds\Things\CAN.WAV

MD5	76b87b86eb416a0e65958e03c72f6abe
SHA1	f6e99f67b89a1bbdcff0dac44bb06cfa5dd12f45
SHA256	cbbe17bfd5ac4cd94498bb7f78788d0622b1b18a3d447fca18310fcb4429d8c5
SHA512	9c0d82bd546c5ab951b1320946a204bd82d721cdde058c198c6bf4102e5a30c53e0f6e4420c06208739fe2d48db359e55c7dc0d6fedb001c8a013735b2d13a8c

C:\Program Files\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg

MD5	c03a95ace8d2029cbeae3c7d9578d295
SHA1	babd5fab334103412ccb107324ef7a1fec252118
SHA256	5d61d0676593912ec82159db95f0c9d987100ea5ec3e378de71d35a9329a2701
SHA512	b6fa8585b2670c5a4dfb6c39c9383feefdb32e0dda93eb69bdd47f03ab9a1807d733723298c7eb2aae7f3a2bc3f699eda311f7310f67b511d6db254a6babfc91

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarToolIconImages.jpg

MD5	1d34c6f7ee9ccdb5cc2ae030bfc6cdb8
SHA1	30815a6ca2298c5690d39013d2e4e0cb727f3da0
SHA256	6f755702d75170d25c06bc6690b1414e9e8547e95b44a6b30815a28e9cd1a556
SHA512	e4fca8723c4aaa2956b2e4d0144da9fabfd98d273410344a5189744655087145eb65a8bcc45d54ffa2c23a1ec689c94d591e9d7401a898b8155a82db558a4f5f

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Auto.jpg

MD5	14d64e0e44c38dd60efc3e9e4d7d30d2
SHA1	42e077c9529993a9043734eb914d0421c41fcee6
SHA256	64c79cf46d01b247190a3493e2a906dca59aa3849a939400bb577b1ad1c8aaee
SHA512	dd9ced9cddecd70dd3c52dfc18f3bf18b7a34ced820638b2a27a00b23482ec43b81bc737bdaf7121d105f44e313e420a0c35ac18c7f40be421fb52dcfa7a60eb

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg

MD5	5048c38b8a896dc6bb210ac3ad2179ab
SHA1	e15da1869dbad1c423dd4e9734b5f08157ad31c5
SHA256	eb56e8aa078140a3a6876c1f7442964b51a8d5fa027a63cbab3673359e20fe08
SHA512	d3454e0918c55ad4ae4a918d4353a16f1502f96193be183277746c51830fd2f73bf197a3bc111b8d9cfcfeb13b2342bf820a621f5b2769f4f065fa7c8561a411

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\DiscussionToolIconImages.jpg

MD5	8de1c8e2c8a88363edf0c2eda4d04999
SHA1	81156a12d5157a955791772d15908d45139b1148
SHA256	fbd7fdfa125afc7629d5333410a5f5af83ce55f66081540bf1f0df861563d566
SHA512	db8274bac4d8a9e2df01cfacfddaed553f763026742dc1af1816f2344bc413f81f7ac599c21920e83f8eb614ed3232f500b33323cbbb91aee3489f44b49cbf9c

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImage.jpg

MD5	c569038013bf09e75bb06e74e6909c8d
SHA1	57662edb54e6ea66893ed9beb325cfd44ae892ae
SHA256	c3983f614b9ce09529c5a3dae35ad3d29c531802edb1a4eca1d866af3c564e5f
SHA512	032a73cf3a78be972ad66dda8572bc87382fa979ad449bfe0f28f77683285e7bd232c5b44933093b2a7a4d3cd06f4328af1f79b0beeef1e01ac886ffa6fa8fc2

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\WSSFilesToolHomePageBackground.jpg

MD5	3239e3b76d7b387a439f769466e96ae8
SHA1	954bc398f5733024093fca6ff40786033313bf2d
SHA256	76a6600cea85ade641ff2c6f1487520a1f0f7e7a61d57cf5df51cfbb570ae52f
SHA512	313bd9cf18693f03133ec281c26ca177dd2a7c5b6e4a1b7688572f7f535ee9b2850d18ee10cd5e446634c6e46320c06edc7fe82386d077e15ded01594060fd54

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\SplashImage.jpg

MD5	ef5dc57d8433885d9dbb0604e0451a64
SHA1	895848f6bde312f010a040abc3846cbf7d742c83
SHA256	3a29e77fa2130bf9072833933c26bdd5321a58b42b9da4316550dacbf7d567af
SHA512	0b93ddfee7be05690e8c7fe7b09a40d7cd34e4ee08dcaa36b8e3c39db2b85dfb51fdaa3e3bb67b24defb024ce9ee67a3b1c724d4a11690d2ec5c17f56784512e

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\DEFAULT.XSL

MD5	13fc81660e10dec32128c03f974818d1
SHA1	eabfd14bc97ddf0a0590904a83c2f148c92896bf
SHA256	ee7683079535557a541d7a21c4f8ea252e117f4219130ccec7714ed4bfe077d4
SHA512	89ee4fb3c734f6fe8c4a3b8c37017fba5275984dfe189ffacba9c7cb3aab9ee1e16ec684c18ac2c7f4e00137716e02372a4d9d9c11b1739f60e07aa524905a11

C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImages.jpg

MD5	c094d562ad9e08097884f714cd12310e
SHA1	2a0cf9f379e5bb406aa2973ad1a78c72d0a56857
SHA256	509f1e529cf2de8ba895320bd3c8b6da2bc3a81fd2843f721515b77a522d8580
SHA512	26415dd775d1f0ed9748a0452a5325577707a5264de67f61a04282d5a6d7465f31cad51c781a75ea9b57bc7a141ede94622a482410d79988382e25e57d46904d

C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\ALERT.ICO

MD5	4e5faccff0fe9f1d5e157a5833d9c67c
SHA1	be5d1dfce613ad785c36a627ca72abee2d1fc097
SHA256	9a8feb3585ec00d8425971761790750603ec1b3bc56397f80b622efa3da89c8b
SHA512	74f3809aaaac73d325bd1f08593135af16498a7ffc27b16998cb19cc5c56d9f232a995805d962c3c54debeb318d65e686c93807f2715d54f5ebe01b01c3e4b4c

C:\Program Files\Microsoft Office\Office14\Groove\XML Files\Messenger.xml

MD5	13a2dcedb0921fc36af47f8d1a5ebaba
SHA1	f06b80d4c90c32ed00388957607b0986ffd9c4a2
SHA256	4e47e540926c17bdb85285f94fb328ebcafb18c993c4e359187767d8bee0d3dd
SHA512	249a7b5d0dfb1b8c26128cf208e882ab5ced6b6f037515b5a6a897f00039fbc4fbf211adc509f33643325db546d7b39216137a65d195a534580983a910d50d98

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\8.0\VSTARemotingServer.tlb

MD5	ac6058274b04cb1338bef3b1bcfff7a0
SHA1	0338196f6a5f8cc803ef278f61267d71391af7b7
SHA256	9f883b538e4a082a98fb8fa6614e9ddeea5a1eb1c2d2a56b6a5f9a662107e053
SHA512	24a05611e5c23316593d615564e5a6c3c911d13919a3061d83d21a50f4d2f674a1acb08a50a4550ed1d029bb7128cc76b42d2a0540883cc8e14ad95d43be7133

C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets

MD5	4cfd1b41b24e1bc1e92d243c5b876570
SHA1	57d2ff7b258d419255af320945d3ef6c5026fc3f
SHA256	8c4bb07bab42fbbe470b67d458b1a0c73b4dfb51f63f6924b95c6b41b5a07cce
SHA512	91b6a1da86952893bd85559a08af625d911c020632a52cf9303d132beed0da7aa842ab5b1f11f8ad848da9b4c0ea86eb412c64cf0cbe91baebd10b0e4477659c

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\8.0\VSTADTEProvider.tlb

MD5	b75ebd1329674b504f1c5d0b72e02c1e
SHA1	735c7067dddcea4387940a17a15763c8a54205f4
SHA256	8a64ab3a5e845f530376b67824a8445c5d9ae2dad2b352d6cba52b914aac5757
SHA512	05cf0caeb33a8298a7df3cbb78652f67036d637f719f107b3c065d0d33523f38d093b7507f2a4c7939fc18a04f03be486ef8932f02a030d1ee70c43cdd3dfa5f

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\vsta.exe.config

MD5	77c455e59d51a8cb493da96a9d601689
SHA1	fcdf3e2c00cb3116eb792488eb5869f0cc0b35fb
SHA256	6cc9705bb073dba6f64565d577d78a51243136be825243ad7e5231d5235a200a
SHA512	2916073a0927e488b120b560aa977e539b55b0df33b52961061af0a3bef8107a292f36c4e75c579e317d0a2e2b76bd911f1cef6208b63fd1ccfcf906e323459b

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\vsta.exe.manifest

MD5	eb6268bb68d8e8ce00b96ad0dbc1511a
SHA1	63f5bbc990787f5ad0a952a3d196bb3636494394
SHA256	35396e63e619d7711e51776897601e9ee5b138799f31e4aca293195348563ed4
SHA512	7171b7abffa0ac9a32286f9a6a223956684a9170de78c7ab57ef8f9da90aed2caf7ff0c9b67f13c9671e3ae784e2d8d1e9802a228d541586a64770b057de2c8e

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\vsta.prf

MD5	43752fb4c4d21da52472634dc41843e1
SHA1	fbcbe8cd461f4cf6f1d4e4e9f4631bc89b3913fd
SHA256	4f64c93a2123a662bb80f1c78bf8d2824a823df034bcf2234d10d6ac6d78c489
SHA512	e115fb4e656a451984bb2576b56cf284835bf763a5852097fd7158435e66843473de3556afad321656232a7aaa55d1f406dbfe318dd2486f46367df65db7cef2

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\Profiles\VSTA.vssettings

MD5	ad5747f9b90c24748f4b73c13457eb31
SHA1	e892ab33b91f39dbe92f91caa5475bbecc0a1c0b
SHA256	fe22ffe807d88927c3c05b0990982c07ea3d6259752aa13f8357f26341a5e3fa
SHA512	474a8f7d63d0722157204117b3a776e820c0b3e42c8db946dae1daf35a01919f5c5de8736fcc78a2ee996c540213e066439def35aba5cfc15f7513f962c682b4

C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Setup\vsta.ico

MD5	50567f896d5f591e319c46881b24e0b3
SHA1	6b028a02cf3d94d03c915c6707372684dc31040b
SHA256	96c9cb735d0e75c2163e9e3b877982109af04440be2b20b8d15eb422460ecbd9
SHA512	35b5d4a7d9a55282ee553b8abb6ad8eb13a5ced48175e8a5d0f3e38f4c27df9d92a5f01c399d22be0177ca1495f97c24fc5f55d9988ce686132b7ee585907ab4

C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\8.0\x64\vsta_epx64.exe.config

MD5	a0c0e330290eae4ee0bfc4ec7e7720c5
SHA1	5e0b626386ada6793f98582dfe93f11cf90136cf
SHA256	4006c7388f75e8028cd1e6efa0e95f72efe2c226ee339cc5e3e45f69bb4a82ad
SHA512	5f314a11fd06badd59dcc27a44ede0ae5477a57307d079d1f3994eb7749e0fcdbc4d21e5ce513d57e9cbdc46afa8838f0838e499517ee43fd7ff5380b9e03b93

C:\Windows\Microsoft.NET\Framework\v2.0.50727\al.exe.config

MD5	12c8c3f33e65f2f0bfe9d4cc566dcd52
SHA1	0b0d371740dd544178ea5d1313ca695a7bd150b5
SHA256	2676edf40299f52f249ce15ea1da621c8019364b85647c54b9fea2abdba85565
SHA512	ed3f6f91ed74d122af931eb1e060c3c2a31a74c71d5c2f23e3284ff1e51c83bfc64ab5659562cb5b869fc7a47577db23f13c9d64a66124b49f48280f307b3722

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\Debugger\Visualizers\Original\autoexp.cs

MD5	fb8eb15bcc81d0544a3e1bb48df5b862
SHA1	ea860881b09b9bac22cb14aa53e8143aac9c41ed
SHA256	c925b9dee22f719124a6aaeb2aacffaeef47463c94b97f5ea3a67a0b0b6d963e
SHA512	87a352d3c7d039edd20db9f1badee385f507395fcba1397da0da44e64bebcd01bb58adb46e5db0f1ef6929829e77427925b87694845db5d48060e9fb7a133643

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\VSContentInstaller.exe

MD5	c2c95045d23db686365531779ef2eaa4
SHA1	4a6b39ec07f7a5f69ed10db7a8be7c49856a1ec7
SHA256	db19bbe8ce51ff86d6c6260eec2170dd723b730e3f00924a4ea462a8fbf15720
SHA512	e08f23d784a1051e24ea5983f23acb1cb45eab5818ab3390dd9c887c013f9ec2ce4532b4e989a0b14f5a9fbda54a0261b6c9b0ce10ff4efc6a8a48a508227b02

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\Packages\topband.jpg

MD5	98ac4510fa2dc17a1624ee6f2dfb6a88
SHA1	570d4fb0ab9f11b5ce2da25b0b2a410a3eb3b675
SHA256	f39eaa74cd32fe22199143c053827747fdd095aac25ebfc8161a5a6a5226fe10
SHA512	8df9a256c4c59b24fbf53d9e02fe370ade484b19131429c3d3b099a5a66a8df5714c7dd1e47501f4427280748108f03a9d10f39a9dd7f0f96a7b3d8a712fcdb5

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\vshelp.tlb

MD5	2600f661237a4e3529a3adc33450d087
SHA1	11c4ba582226026abf10ddf05e84d104771bcdd2
SHA256	1992503271e868d0effce1dd0278a80c24028359a64024b030b57fd7d8eeea42
SHA512	f0221b7fb3e4219b210ab59ae6a5c21b54d9a8f4f5dd050ee359a31d209be8c1cc0d97377391c2277bc06dfe91dc1073d87cab9285603700e465ad5493cff220

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\Visualui.TTF

MD5	e01785d523a24d97100c4a8d8f9f188a
SHA1	f6980a7e8d4ba6e7bdfef11331ea14666ed6fd9a
SHA256	14a555f64403a849328d171fb0dc3312ca987251955a39c992a51420bc80fd43
SHA512	6b92678e43bd97f8b25ff06506fada77f710235b8fac1f733ab54da8ba67a8400d5b39ea6ccdbface316651743ae65c596eefc893f6c3cdc139eacce14f0d929

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\msenv.dll

MD5	b215b602df27e9b507d6f4d337c65a7b
SHA1	234274132df2211951cda2cbe1217265abf0810a
SHA256	4956aec68731c825063bcc91ef60d739a93b897d470047a368583ad9fadcc81f
SHA512	8a7bbcb648b516c50322c6f520d82879cd534e90788c6b7edcde9312dca522dedb4c27569e310886ab597bd8ea7390f308f689c473443f2388bf3bf8de8b3465

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\cmddef.dll

MD5	84a0a9a184f1c447c41cfbcb650379c9
SHA1	f47eb55fab503c1d0da2a92f165d98276e03822a
SHA256	eca8078c5b1dfcdcde29c370781c93cd6f8ecada34aa3fb7b944a9f4aa8d4db9
SHA512	7ece1a0976233de78896c003a6805747b8a612864b76f0b160a1ba6996048e4866a9c4aa14fc6318084e3d2d7f10ecd32be919009b1b485c4b5d76f4537eacac

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\Microsoft.WizardFramework.dll

MD5	3bec6923d171c3a948b4764eaeb56b35
SHA1	1022f262f248098abd0ca6caff66ace4ef6689b5
SHA256	726d2be9602c12025179d95fa5bd49d9f13a866211620cb25f0555a29aca691c
SHA512	d7afc1d072f9ea007615fadac3470ddb288d5ad9396e08efde38e0cc02f52673e5d21f9961cace88fdb8569951ea07cf08e8b68f77b23936b122d78ef21b6c0a

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\Microsoft.WizardFrameworkVS.dll

MD5	cedb4c60abe2f74d3d1d055a97b38b62
SHA1	e164dd35507321d9b44855f807a6aa0034406828
SHA256	c6a6a1cbd7e88bf965858e88711e072ccf325e426c802dfb893a6ebe44791b13
SHA512	79aaa42868916e1eb4e7fd0f1d00a45c31f403bb8e9bd7d1ba790188e5269133f66e6130842e86217ffedd7c89e65b3b94ca7e1eb82a65d45c2a2738f97ed6e5

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\cscodemodelextensibility.tlb

MD5	a3dd669ed0e55c48dfa1f0b9f13456ae
SHA1	8293118c1e65a551ae7ccc0ef86faf5dec673c8e
SHA256	7fb7bab6406ed3e098af3cb01e6e53bb738f43b58a39d8ae4f1f958df460cc26
SHA512	fab10610025fb783070926c76b9b15065a969f9b7149e89c2fba9c6592a4e082f182ff53f1b5a0ace839e72f9c19a217d3d188cd37e6acbaa7e7c1423e4ff8e6

C:\Windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.xml

MD5	eb28e80dfb7f13077f4ba30cca1964f8
SHA1	60db4fcd9314009f021cd58c0a41a6029add104e
SHA256	d28d7233f195549e5252c3e4a98a19605781b8ec68600e9237dd8c0d880fb202
SHA512	d0b7e59cb7aceb07f50146e0904acae7492dbb4dfa063178a45283018c8619885dccb28d5d9de36d6f77640adea24bbde00df584efcd0c25a47b33128eb5d07c

C:\Program Files (x86)\Common Files\Microsoft Shared\Help 8\dexplore.prf

MD5	c23dbc06286eae6a7c0a19b6b40860db
SHA1	9a1653f421794498db6b217df5881f5bd9c27f0b
SHA256	cc69c8e96dabd1f7c6fefc32105038a40fd41b21c36e8901007b7f4028a126ea
SHA512	a3438339bcd5d1c5f2f7d3e6f24f6c15a7e15da7f74aad38ca2a5e34683bec23a1e2be5be1327fb0922de645ac81327cae2f7501e94b521e6a6081c9401e1dc0

C:\Program Files (x86)\Common Files\Microsoft Shared\Help 8\dexplore.exe.manifest

MD5	cde21a16f06e4da3c1c31b916ebc646d
SHA1	4860606a54c51bd188d3cdbc20abf9bfdf94b7c8
SHA256	d30d0002da892abe59b82852db194f4d2575d2b774415a5654bb284b2d825e47
SHA512	7a95bad294b1f667a9d299769f3b6cd3a974b29a32e259fb8bbccb740adada08cc2d7b79e9a33f3ca8b6b337dd52ebc0a68e2a6b0412ea0d29589a98c7c9c2c1

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\dteproperties.tlb

MD5	5ada5bc4de826429a08f2b77be323721
SHA1	d2365baae6bcb192819015239a0a7fec4ebaf55a
SHA256	faf0bcd36c9e7a188218b970369e1b8c0af5efc2cf8d7b61542a16a4495670bc
SHA512	c0428aabab88a0d0e393d1cd66fca04ec5fb37964ac0ebe61c56d89eb52c18e327209c29bafc65371a5bc7870f00b3476d7fce4b0bda9a283d0dad7d830ddeb1

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\NewFileItems\restempl.rct

MD5	3348278cc417c29d2962d5262316af7f
SHA1	491185aff48374e188bd6af89db5048ccae45818
SHA256	3dc3672a0579a138753161989828ba5017e51ef4021fbc64b0019819a0b211b9
SHA512	094c0ce6f1b74a69e6165da2a0929c2867b718eecb95e1d7a51c73668be410780fbb6a7e52d39c321f3554fe075e25cc72eb676ac1a0e9ff979965ec59be5207

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\VBCodeModelExtensibility.tlb

MD5	e0983a4fa12a918dddd58df36e712b07
SHA1	5b4408646a3716d9cffbbc90b4e4b7b7a19ddce8
SHA256	1ab3f2ddb1b916a4777d994a3dda1b63350a4f0548b0e45a57177fe2f4d97181
SHA512	9032927c982b345c61cc0089ed0eced08e058f0864653f62d38f3d807b95f595b103291f2fb8b62ca6cb0f93fad9e512f899a24a3eca26376170fb050cf65267

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\csiface.tlb

MD5	5cac5324243bb0610ad2c10223bdae5e
SHA1	4290f65205728cf63df2e192762e51e824c6a387
SHA256	87f1cc88e5c8f3d1cc2cdb1114ca4445d58112a28ff1225067d0c390cc9a2727
SHA512	ca4e352c18c077b54736bc2eec2bb0dd17ce91466b296b2f9580fb3d9b74670191b9f4bd8c4438eefe95342c7152793742a5d8d1e8f9bb853ccedc489327c8e6

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\vcsharpextensibilitylib.tlb

MD5	0689e30947361774caac9f1e86f133f6
SHA1	e70e44934e1a04b753ff80b88f9bc1f4e6a2dc19
SHA256	5cf5ae3cfa3ac678e35c521d5f99a121984a861b0e2504beef21d3211b2278a5
SHA512	7619f7d46884641f38f68cdb4536e47828fa79b0acc195f6fcdf92bfd708fda8d3ff4d54295ec846b8cc8526d736e079d8a5efa0c7dc9b407bb5537e52d72e5e

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\custsat.dll

MD5	8e293787986ad3d113f0f8ea1b4351ed
SHA1	ca954d25be5cb79c3a577ab7423652bcdf85328e
SHA256	6b335807f480149d14a1197cfe37c9ac3d1820aab5465723c45c28848833ac37
SHA512	3db9ca5b5ea5e13261ee96edb5379b836d009adb3f223a344b8079a431750111e1fd92f2fab67607a902a518a5fdad776d1e987ba3bc8638f91ded2c52b27c60

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\vslog.dll

MD5	cb22a44f4ab2a7fb50dd107a53fd4316
SHA1	20622acc3e65aef47b7c4681f3cb77684433fba1
SHA256	9619013a16ec49fc6062bf36a6bc2f720479e5acc916674f10d12fc9f4b645a1
SHA512	c8421d41185c8783d154059e98f897a73d79c281f0ae66356dfa871a0debe751f04025b8c09809e6af813f2c7068379165d1775edd4ca87508802c0af6cc5522

C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\VxExtensibilitylib.tlb

MD5	0aeb164f49f6590d5fd8214995e8ac22
SHA1	2a5b536f89d5dd59448c8d841284376b780cbc8f
SHA256	60a6d94860b37b8c921574fcf2f3f4df7bc56aafaed4ac45f8e1714ef81e1535
SHA512	897371c6a578ff00b73cf5ac36929228e22e56d42ba19d55b22b35aa1eaccfc6133afc5675256b76c5436f2d247e55d9dc5895df844eff7025dc7bb63efe6a02

C:\Program Files (x86)\Microsoft Visual Studio 8\Xml\SnippetsIndex.xml

MD5	a01ca3bcf7409b9b30ad97ff63a1276b
SHA1	9f991ba84610b601251216234879e1680b4b5589
SHA256	19112b8df00aec81cbcb93e454f191fac52a086fe35a5669d45883a079927ee7
SHA512	4b992191d0050d77dfe00eefa752414f6b3cd8bb6f67dc32439ce1e093a1a3907fa0cc6a29de62fe92a19a82cb95e6733dc29ea89c72e47d83bf87ee7e744bb8

C:\Program Files (x86)\Microsoft Visual Studio 8\Xml\Schemas\catalog.xsd

MD5	8c26c3f8fbbdd7514d6b2e551298a4ec
SHA1	35a65a87cc7dfe8d68d6cf99dec74937a5986365
SHA256	482c4ee0505a145541e4d6d0facc5e3dd34fdc41275c11dda7276fb27249b6a3
SHA512	f4302dd482ad4edbf297b719f3bb24e0b340c6faf808dadbe375f056cfcc950299b2581461d088cc596eb9d8e6bcec19887e6a0341cb5e39bae6f0081b27566e

C:\Program Files\Microsoft Office\Office14\MSO0127.ACL

MD5	fba057f57ddc9f0b2e21249ed6356e53
SHA1	8ba230bfc82d80eefe78405355b0dc5703e3b688
SHA256	87b5c8609acca098ceaf8d1849b0371e4a49a294026d459c74854d8968e257dc
SHA512	978965b450914f0b4711a1ebbd93fafb8677af7b85a560219f7c6da24223cf200832658cc9c86ebd99cef5ebabd5d04a4834efc7a2950c88327fccf5f4c3c95f

C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\AMERITECH.NET.XML

MD5	db8f644908e1ae52c9c51544b3e84093
SHA1	030ea49724c850dde36d5d7f09db48f60df122e3
SHA256	6d0c439a131e82df17ffb0633057ba402d5d5be33a73b97494be77e8b5c8a4a4
SHA512	dc06143ea1470fa02c85a5de18d944d8fd29234e8f8e611313c65e99fd94297edc3f9e92c44d951a733d632de437920cc2508693252a7e8fb4a809327b296617

C:\Program Files\Microsoft Office\Office14\MYSL.ICO

MD5	c1288de97a9f40bb939b7ad7f4c4fa2f
SHA1	bf4d00e8417c7aa6d26eaf92bb976c03712e7348
SHA256	dc059a36248d33679c51031727b5d58595b439e41c891e9891a6810410469e65
SHA512	14e05e4ffee66ecaf58c04f1e1ffcca4e4a459cf10cce428bb0b3095df303807cd6c96540196d649917deb078626f35aac3d26aaf4eb25ca59d872eee627fb21

C:\Program Files\Microsoft Office\Office14\MSPUB.TLB

MD5	83950181ab31537578a7ff50d6afe42d
SHA1	95833abb11fabef7627b65a5da6a77414a0358be
SHA256	1d2d603bb49666fc42e1320b90f233f46a8e00dcb6112f85877bed79ffe454b9
SHA512	e03edca359b96d2828495c3991422351b5e291d6ee19f8601e17a330e1f6a77b07804043848c9ce170d1fbc1226fa830288435a7a630505ad7109df0f5797fdb

C:\Program Files\Microsoft Office\Office14\PAGESIZE\PG_INDEX.XML

MD5	65da17b1743bf34274955c81ef6ece84
SHA1	0ed258833650dd4b1c3462f655adf13d76768bcf
SHA256	2ce15d32e7c1e98dfd8c79c7811f9bb055b5961895475a1e7845e5f47d3b64c6
SHA512	3950692f984df89babbc6cdc136ca1f66fcbb2ba0b26d20c7ee641c317b05cac5bbac2621b7ec1b96722e6a4251cff1b17f208cfb8b1a546fc68c50e00912ac9

C:\Program Files\Microsoft Office\Office14\Bibliography\Author2String.XSL

MD5	c344fe5b97285305bef4a74f159f3509
SHA1	c82c3ad1dc79ecf616142c81b4770db2bb004f68
SHA256	9d265bce639f775b5d393d21760acd601afba4c1ea2e26b98810d6bf612bacb2
SHA512	00f461d913f2a6913ee83685723fdb123284bfffb9f04c622cc31fff0e1e15fcdae8e05ec84201e326637d490825e22ecd1e6596ac5c798a3574faa9bfaa5cb8

C:\Program Files\Microsoft Office\Office14\Bibliography\Style\APA.XSL

MD5	6479e3c264197bb098ac5db5bdf3ec4b
SHA1	3be1b38bdf3231bb2fb507e1aa9816c4f87398d7
SHA256	d18d71ae94d4a2f71c4443fd3f629903597488c65a5aea0e4b4fbe9e32f1e26b
SHA512	68b8b49a6db8b955d9c7da45924583ad39a1d2829b0be97434cf47ac7925e1102229e8540b7211439135a988eba2c06170f888249d914ce4911a86af9e7a736f

C:\Program Files\Microsoft Office\Office14\XML2WORD.XSL

MD5	2d76556591dcd7820c177d551eb8afa3
SHA1	03c69329935610ea9266c21f1ced2b947e31f9bc
SHA256	a08e7cb1088976ff6738f0784ed79cb2abd5cef9aa1a15d1ef3c3a6574c7fd71
SHA512	c5a762c47fdd5a6d88e2b247370b130ccdf723de3eff15bbbbef0ba9b142a8d23de321d1e72f20de5b2c7784f7c8d60fe1fce72132fcb93bec86744c523ea5b7

C:\Program Files\Microsoft Office\Office14\MML2OMML.XSL

MD5	21533b7b6f32cc637a4186e14dec4b11
SHA1	545b8d247147a2bded14f0409ac311690ba7bee1
SHA256	76038fb2d1354e38aab5fa98cc646a51597f4504d59a018be79258005a142801
SHA512	f84ea244a2403057bb78f7b8d53b03181b07e501e7c52c7162c28da33410d50872be2619ea94139416e4edf2901a0c7359ccf0ac958a973f89a7ebd1fbce55fc

C:\Program Files\Microsoft Office\Office14\OMML2MML.XSL

MD5	1cad8a5797841ff6addb747553de11ed
SHA1	b2ae4d8982a8b194c3292d16e5a3af950ed0f87d
SHA256	f0421d778094be00cec6fdcc938a7267fe1907849f145474e534f343a15c9a8d
SHA512	b1b0e6da2f324f114cc46e4acf72d38885a3ff76a990df8d2498ca09610deab68e48f8b3ae7d66c2fe64887e6c725b27f90b191ad51dcd1ef64d3cd05dd792f2

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Graph\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll

MD5	533331cdbd5870e0822daee4f3b8bec7
SHA1	6a38cab5f537508b1bae689c37a8eaced3e4758b
SHA256	2a134d8b115c1b3ea2177e979332438f45b6d3db337252e35aa59628487070fd
SHA512	4b76b09d0c7467f07042f5886213be5fc1b428ba9ef649dbe7b465a8a17e0b4402327794c7728848e3e58b3107855fe4f928c8e4f8e6af9a40a9ce12a27568aa

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Access.dll

MD5	138c95d956836e063096f0e654e4f755
SHA1	22a0b0ab364656da2f006950311a36e89660e009
SHA256	725b8cc2209aad5ed6b744c9761f09074b1f72585ee4c84c4234726abc5a073c
SHA512	0dc221890f17bd5f0b8752e918b49480ec13793e4ea5176a70f9e8c6e9ea5477b5a54ce330f2fa0dc2d0aea4bb66e193489de225d2f83081c5094b33b780ed05

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll

MD5	b60f6becf164c106a95177d2717ed02c
SHA1	62a0e883577b7d2b360fb1a01b53db0a42222b96
SHA256	517cd1fda7a1b57fc8c6e7d687b744f3d3c0bac9dd9ba771767d26dcb2255073
SHA512	b5aed0a40bac3f166bf765576dac67d103f6d687c3b395700f604e2f7da3ac0a73152beed6088da73c3ed857b0d86223253258e6dc8d42602a93e733907aa8f1

C:\Windows\assembly\GAC_64\Microsoft.Office.Access.BusinessDataCatalog\14.0.0.0__71e9bce111e9429c\Microsoft.Office.Access.BusinessDataCatalog.DLL

MD5	67dcaf73b31c01d3d6f93ae258883f20
SHA1	897c022b2f897e157b928def82f3474ba09b8ffa
SHA256	603b9b2305b737263fbfd5424bed81693729c55d75b61f76eb461583c37beaa3
SHA512	fb196d50f9fcf693c89c2d18c4d814a63587a13ba36439a8f607f9878015d8b1a9d9b179db54843aa1267d0aec208ee8808bb81a29d13e6fbde809b36e9f02ed

C:\Windows\assembly\GAC_MSIL\System.Data.SqlServerCe.Entity\3.5.1.0__89845dcd8080cc91\System.Data.SqlServerCe.Entity.dll

MD5	838348f817c17c4fd740348cf8c16420
SHA1	bef20cea89bca8ebd0e7d7601817c6982f79ccf9
SHA256	d99d89da530390a20215591f648d87bea410f4ed29e62ec7e2a1fbc931c776ad
SHA512	030a3fd02a73589277b5ab95863c8ba8cf269ffb2623fcc243c653f9d37b025bea43e27186ec7569fe75cd2d62abc94fdcf7cfa4767de511081773749fb6f48b

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.Intl.dll

MD5	28610c90be1bd4cd455a813d13fb5f16
SHA1	5b9c8a79fd27ee5f0d4403e276fdf247834e946a
SHA256	0007586dc33664aea4d07d45a0c5cd89590d5dab1752e3cc1bcf55717c9dc0e3
SHA512	c909e67e621597f8339a1ca9b1ed988918478a80b26bbb697047b43ef26bbc64036228b5d2785e29d9dbabc60b49d16e52e07769274931eda8ebb252852e0fb6

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.dll

MD5	6b4b3a72f40360842797995043ac7b1d
SHA1	b3b26e3c14a52a8a4d62c2ced688dc03c32d617e
SHA256	54df56ff71e95f823f2d1fb098a3a28a9a99558d302be39a6baf3dc3b05d4f5f
SHA512	8d6c20c25fb3a86cf6ff9a47dbddc1439285e70c3a0fd73185507a7a95044c52e2cea32c14a6742f644c44b5ce2428e18f44c12714000b0ed71487970320cffd

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\microsoft.office.businessdata.intl.dll

MD5	b653345f0b86d246e970f82265e05952
SHA1	50cb563982554639839848c31043a479b9a177bf
SHA256	f3842e4fd920d8018b7de025a4579b819cec95f30fbaa0a0d4fe5e4f841e29be
SHA512	34a5775e0e3d907d2722a5428742a750b3066e63ddb1433bfa0081623b9c56125774c5fe598081ba336ceaaf618a16fbbb29cafcb1c3aa0c459c4ff7df6d4876

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.RuntimeUi.Intl.dll

MD5	00f37bf349221fec9469f665bc53666a
SHA1	6a0f8af037e879b34df2be4c7f7c04a4c762ec90
SHA256	bea46ad90718e18fc37410b5abaf23b50b626f1fc40b32b5c4fc41ab35981f95
SHA512	7d224d074c213720b7b5b421b68edddbc864509f041de4aee087cbe8791a30565b0fde73f4a35fff9e24e586ae282b46e08ac93f623f2868a8858b594d35abc9

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Runtime.Intl\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Runtime.Intl.dll

MD5	3e473bf3bba2b5a7ee19d47bd7e1bc80
SHA1	555585e367de2a6016721fcc66ff887a770f9699
SHA256	832a2ca4abe3e7f7bd3a62baa28103abba5b10112569b039d84c6c171a760fc2
SHA512	cbcaf43b1316dc2ce1ca2189a794c0152ae65356965cf8dfc3c8387a6ed0880e8a4f56c2cc479dc2ae5f30b2d202c0e485290ca3628f5688aed62a9ce2203c1c

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Tools.AutoGen\14.0.0.0__71e9bce111e9429c\Microsoft.Office.BusinessApplications.Tools.AutoGen.dll

MD5	e60068937f2f8dfdad8474c2058a28c7
SHA1	3a7f9d95a5190bac5c4ec6eec51e44de6384bd00
SHA256	981d23e6144a6adce684635c36606addb170259efc0e27e7c6d006cb208481b8
SHA512	89eeb510b3365c5cdff940fc8390a996b84a0094dc6590f4cb0fed734148f4ef8def4b8188a446ee2b5dd5a29f8ba9f5c638db43a84645d213f78be3dd6ac7d6

C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\14.0.0.0__71e9bce111e9429c\Microsoft.Office.interop.access.dao.dll

MD5	dc036e7ce4f62cf27d915c3ff3f7df52
SHA1	6704d7971ec85d7ae157f66fde7f4fdb4200b886
SHA256	d8268d9e7d5c2b820728754075fb94a65a1009f3dcbf84af3f7bf69dbb186ecc
SHA512	d7b08edfca4b24541055dd1bdda0817994ee5cbff4be31a13a0a86e5f1d8a878d8caa2d6fef97fdb4fdaa32ed812f3e2f4ebf98cebd79026345ed03f3f05b3fd

C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll

MD5	a8873670cf41b61641920860e49ee328
SHA1	5b2d3a3dceb71c3e066fce9318553aa065cadb09
SHA256	f581aa4813c50add2ad53ef27cab31bce6609f86d822c3aa3ef4aebb07d11834
SHA512	8020af5ada72a8e04e9a7a2eb6ad6b662956c285028500d7aa54740617cc666942b0278e45b8e91abcdad905500222ce43ebd43691b302d40d84258f22a33dc0

C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\OFFICE.DLL

MD5	6384cd019ea11db324667fae4a54b0dc
SHA1	5a1dce31a55ae24d25ec0464e7a0c98c71f02694
SHA256	12a97a306fb315791fd04729e898fde7769b6b4db952d3889d8be685e0bcfd91
SHA512	2aa9c9b2bc94c73436e385f2622a8abd37b0f33f2caaf2fb1351d949455a893370dc276eb407ffc0362e0e4e2ff2c836af083f510388b510a204c79e4078f1de

C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Vbe.Interop.config

MD5	c96c6f48979a5f9f131aa9fcb228b0d1
SHA1	f80426aa685835ca41e5283f5081d2c27fa05c25
SHA256	df1f022638807a228d7f5eed00cd9c4d4c8bfebe74fa6dfc899d12ba062b52a4
SHA512	0b13e38012393ec9d46b370a33eafe174754579aed9f1f03250b8baab0995b06669fa4aeaf85697e00337ae2e91a10d463dffd9a5903a620ef34d2c6285b98e0

C:\Config.Msi\e5e9e58.rbf

MD5	4de6b0cd0387c92046f54f1d6027390a
SHA1	afc2764c1be4af183bbfe0b5d9c265419a098d34
SHA256	97b7420d3c9e9d6a31d6f0728afc1b90aa1a9289c9887c5ff6a91d8fa524c91e
SHA512	21c08955d6ed87390bc8b508e1720ffc4e40d8810ce5f00b663227aa4a5546c99d8903b0e15f717e4e76a0c3201ce1a446db1e1b0e12461a38ef207da6005e7b

C:\Config.Msi\e5e9e54.rbf

MD5	39a88e038773448957f84f423f4c8cfe
SHA1	6e1339dc36b0281446a86ddd60d7d23640463c8d
SHA256	89a7d1892eb3662153271740ee777d5930feb27ac654f3ba20106b2335c9cbbc
SHA512	6ffb01ca767154f0b5116f4167f72178a3735d2f59332692ff77d12392d09808ddeeb7d139364de9d5ac38ff13a3a3608e3b975384e57d4c93ae934c540de269

C:\Config.Msi\e5e9e68.rbf

MD5	907114fe32f4dfb0c5eda360be0740c7
SHA1	c2043eecfe170ef23ac0b73257e8081518759e52
SHA256	846ce65637fde180fd5f4e3efb1c64efaa7e4d55a8c279d926e27d7378bc705a
SHA512	fbaa519fda0735cfa9a1414c234fc29f6fd7f12b48e5580f2f0b6a54f95d50857854cba73520442015e0cb2f4303bee34cd2b97b327e0246448d0bfc4e336556

C:\Config.Msi\e5e9e51.rbf

MD5	88801b38de40d2120afd2af2bb5add94
SHA1	5ecd7db405a1082580d8070e533e6824c247c7ed
SHA256	4e66283772a446968773a90e8c7d4ce34d583dd996454301e5566e7cab574ada
SHA512	00abe8496a112f6d0faba8e92524f56b7a92160b972618701f09881748b361a3882091ce9239be9e70bf1dc37c4d2e7381968a2954e82b004a4b66ea4e433cf8

C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.config

MD5	6cf29bfdc5fa7b2fe06ae04fa0ddb1b2
SHA1	31549d036925f8ec4759557662b6548cb27b5010
SHA256	ebd2f73c1409820488338f3192a6d909c643e21f95ce80f5a8343979e7d1db29
SHA512	fc51f24600617093ec115ddd7c3098a664c12e705cf7b3573bed09904347ece3a1a55c69a360e28f21ebb01dd58eb09d9d7c5f32ae4f6313314d656a2aee665f

C:\Windows\assembly\GAC_MSIL\Policy.12.0.office\14.0.0.0__71e9bce111e9429c\Policy.12.0.office.config

MD5	e387aff00a5e533338760d8e78ed8afb
SHA1	0f2534f4946ecbd44c1866212dbd083f25428b4a
SHA256	b79d99b833e6b45e972ac63fd552058470993e7b615ff372c17560037002d8a4
SHA512	595fbf1a3f5288dfb195063263b50bc6d55e91bff5bbfa942b623a728de75e1d68b3cecfe5e1d818f9d655d245258dd9015d622796f060d11cee14ca59393b77

C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\Policy.11.0.office.config

MD5	8e5e41526b4bf8d28a10c54d04d04866
SHA1	1a15fbb7f98e66524afcf71b85e7fffacb48eff2
SHA256	c9782bbbb1aa9c6789053965defc30639258582291236c8274d326b02ca13fc9
SHA512	04336e04d82161d3c909f1b159f084f5f4c131f8a6c3e13dfb0a9bf4d4f95f21389dad6d786e833afcf5e822aef20354582b5208ea0ebf838f3b0e922e8db5a6

C:\Windows\Installer\$PatchCache$\Managed\00004109110000000100000000F01FEC\14.0.4763\GRAPH.ICO

MD5	58f5ac079150eece385c296ffb565a16
SHA1	b9550b07713b4cdb771df6e649d3c9ff92569da9
SHA256	69c12cb174ccbbf92b9c39532b576703bc058c7fd3e58f28bb723621f64d687d
SHA512	b7443678d295d575763854a0d87b9fa23916293f39107c2c4a63700116a29d3261c76d990332b782d17d4e82a5bef2a0decf749065b41378362010c30ec77b33

C:\Config.Msi\e5e9fbc.rbf

MD5	724af6acba5d37c0bd91818adc271da8
SHA1	c2cb45a19d1a62cf10f56f217edac6d833be7510
SHA256	c0b4d22c119bc22862b0537401cf8944f6868a332653f90b1a67ed69cc6aac3d
SHA512	8f729802b38aa43c392a0e4bfd846bb6f95992676d70105ff29ce9580e27f6e9ae99adce8573d6f5be328bc375f80b9171571118de277885e9b664d35876f0ce

C:\Config.Msi\e5e9fbb.rbf

MD5	947e74459197090af68891916c0f19f9
SHA1	70fdd929b805bf2908a2f1f73c2cb40c8f7a6671
SHA256	a1d29b645edea4ffd7a50e90cc097740e2db4e612896563a8fc3777464f0bee6
SHA512	6ea04839240fbfb593f39eb073ff0b234e3f5151157c88d4e58d3203d2f92b8428e77b059055e0b5c134773e4112b38ba5bf134b40cf29db29818bd41f91997a

C:\Config.Msi\e5e9fba.rbf

MD5	644426ad2a423bb1f9fc4f4dd5f00da5
SHA1	687c06958f8a9e2a14c45f61e1b19623c8dcca8c
SHA256	8b387bb1d347e935766b35f641f8c1b2e4280c0d50345228eb6c109640f6b1e5
SHA512	d38571946cdbdc8d9cfb23e5bd5bed66e16f504cd40298280229c130f519e779447d769d3b83f4940b61513a0021b428b9ad9d079909577312881dd98fec4b44

C:\Config.Msi\e5e9fb9.rbf

MD5	d583e1fa2d881ea90bdc005ea2a8cc5c
SHA1	c277c5d8603edf13c882788960cd568d06b12545
SHA256	6b790c5672186ff3044e8cdfd4092859f1ad2c508f7f2189739a287e85a2e38f
SHA512	977b91ee578f3cd961d664b5b405bedb5cbdb0f48273f6d3599d870f026489f3ec2229d4a1add03370ab3e7f661906d2c5d9600f2ea5de3d61bc95873551334c

C:\Config.Msi\e5e9fb7.rbf

MD5	3617031eda53ac988f0a34cecc842e25
SHA1	86aa6b160d84214d8bcd0096437afd2fe0ec00d3
SHA256	752cbe58f5fa9427dd47f862137f663a317e35cf934ccef4d74f33de618acc7e
SHA512	0535456466584f6bd14db0f8d07ee9cbe2b4c1369901449594ba06e2269801934afde0cdfc9d498e3d12aa162b9a5bf4bfd4ff0156808ca807e1c3d54b8e0a6f

C:\Config.Msi\e5e9fb6.rbf

MD5	41a225ca2e0794c57db65f4e188162f0
SHA1	764821f576bdd09e9fb4f257058f6f253819a41f
SHA256	72314dd3cb509ba5a3d473e4a2f042d04c50d72035945961f154a784265522c3
SHA512	f651eaef33e1bef5bc1682c834349edbd93aa4eb974153c37d68306bf8a13733908f20b9975a5b1c4c7312382cdefa21675c1dc91602b56bcc8688a71ad61e8a

C:\Config.Msi\e5e9fb5.rbf

MD5	30ba61e8a09c91be7a7c725cbfaeddca
SHA1	61a8670d96fd07538563e87cdf582b949f7eaa52
SHA256	6e39b25cbdeff8d63cb0df4112ab2478ad63054c887691f086515c70a4dd7e4c
SHA512	59a5a5fc2c8070f92ffba663908562738f77d994f4dcbf12ffa0531f8d5a764922440e7d35675f85499a271292a539f9b5420298c95423704a8c40e569b09c2b

C:\Config.Msi\e5e9fb3.rbf

MD5	eca1d1dfa35712e8f89696ff02b1fcd3
SHA1	28d3e60b8c840532ae30b9ef45c06fcae420822f
SHA256	33af9935e01b414e26dbd1267bd43f75851d1ed78e846bb640488a20810f787e
SHA512	c0aa1c44d4f51bce895ffc5ca719da9beafb4c5993d67bbf2e1ae268cababb12009b9c69e1c0feec6b5578acbb8fe954d1bb842f43249a012a94fb8bbfcc9f53

C:\Windows\assembly\tmp\K8HFUMAO\Microsoft.Office.BusinessApplications.Runtime.dll

MD5	9e3c7d8d871a4f173acda1a8f006827a
SHA1	e8718c9514f5335075fb2128418a45ad5361912c
SHA256	b0d0b65b5411b7e6e4113112c35bd9c4f185947bca8eddc4d8b900707a7d190d
SHA512	6c14e77261be2760ebe1b9ff1fcc806e629febd3efe46b2e9e03ab08c5d1b114ea35c88e55394975427974ea4049f404092d0cffb6dca37459a89688def869ae

C:\Windows\assembly\tmp\L0EUYTE4\Microsoft.Office.BusinessApplications.SyncServices.dll

MD5	bc038cec521844ffba955f385f198ef5
SHA1	48ccf19608533574b4d06b46c9c63d361d5f0483
SHA256	b5c1d0737f435ea7a7166880f7b2c4d30543ed5000283e8ced62547a5ae04e5c
SHA512	526fb4adfd5d002be07a16be4fb8652ea8e6e4dce2fc30a7ca1762250a6348a6aca1bd2cc04c3937a7e89c64eab2b7c20fd3112018571a2e7cc233db4740d595

C:\Windows\assembly\tmp\PX9PYDYF\Microsoft.Office.BusinessApplications.Tools.Intl.dll

MD5	a85a9166c97405e227cb0dc0862246ca
SHA1	e8ce8995689934875f6e9c1e8e5aeaf403be33dd
SHA256	e0e774b03def1df22211436355ed030f83160564a1fdcbaaf08b5b284714d4dc
SHA512	37adea50f5fb1a6232d6cdae78685086dc9529de7fe955db7713922f032a8dc794415195ed863f8e79b4bad2e80c303ed6ee5f1c4bb668aa402a50c8e50ccef9

C:\Windows\assembly\tmp\IHTSULDF\Microsoft.Office.BusinessApplications.Tools.dll

MD5	028629cc08b23757eca21e2b0cbdbbdb
SHA1	7396408385ed07581703560ef3f053e1f19ca74d
SHA256	e48b1fdbdf236d46536171536831de74507dcab2784e10dc556798e55318661a
SHA512	65bc529987806145c4143eeeb614b62702d0a40315078bb02b5e489c39a595c3a8e209e3406d79ebff0b58c771c5da2d51ecbb198f29784ba7cb514261a67246

C:\Windows\assembly\tmp\LTQAGSHN\Microsoft.Office.Interop.Access.dll

MD5	37eabecdcf9cef2a6ed2967a9bb2e220
SHA1	1533068391b3cc210ba2c597e1351f887661521a
SHA256	9de0604df1cc59cb36e99c450416f28d181058c8204829fdbe31a6069779ca64
SHA512	282991c95e3fec89cd89a6a2c471a73d136f2914177d37f83f4338fffcabf2da730998a506beb5c0625f591d136f3eeae0ad30ecc33b653c18edc99c0b77c5ae

C:\Windows\assembly\tmp\4TX4Y91B\Policy.12.0.Microsoft.Office.Interop.Access.dll

MD5	69d1a96679bcc7a6239082d63f79945f
SHA1	19eea5868d5cde7b3411b82cfcba1ac0cec75c3e
SHA256	a27e582bcdff4745673d4beff3957c3cc93a180e8c959105083823eb6082ac70
SHA512	6b1937c0794e5eb89059e8e2fdf5fd35a45152902fc1f753b8724d4cd90523e8e895131c8375986266f305a6f05b012b4a2a0f408edd2b2895c893c39342c88b

C:\Windows\assembly\tmp\NGT2S78E\Policy.11.0.Microsoft.Office.Interop.Access.dll

MD5	a89739dc19202e0af2319f3e5dd49fd9
SHA1	2f41c2abdf591955f4de63f6c2196ac71b9a2890
SHA256	fa9590ef1b9c6c3d7d8602d2a59e2db1f79ac3af1e9ab3a9f32282802fb02c88
SHA512	d528998a4a533516dcfb5c8fae159a9db6ddc2f7a7aaf235a4d1c74c9e66e0e1752e421d331a2f8457aafa9f1a3734ab978b8a5260485ea55782122a61f4d70a

C:\Windows\assembly\tmp\IX9W7GH8\microsoft.office.businessdata.dll

MD5	c7d3bfaa7dc172b4cf4250abd7a73cf0
SHA1	3b52b5a41122a9615074e0b05b77d40f80d47fa6
SHA256	9fb7282e03c7d4606a41ec78d867f2572653aba4be9c117da5ee618244095aba
SHA512	5415f4cc6b5e6b966b025fe55bf7e489a27c3bb115dcde09b5e2c1b2a855d137d2a47f87c0cf4f33b746cddb5c3ee298878d1284debe348052a885c746344768

C:\Windows\assembly\tmp\ARNYH2PZ\Microsoft.SharePoint.BusinessData.Administration.Client.dll

MD5	0a71fbb05b4fb60451cadc65013308ce
SHA1	b7ca51cfe3006762638942f1341f784e91d0ecb4
SHA256	63b76691dddccd9cc3eac19dbf270d9bc5b6ecb48a45ac4e971ee18a0a9aaebf
SHA512	3dd40f4db15797ca6d5a53b1887d0fa63b43ab30be497f24392f60f47b3e2e9e2661e0a7000eec485083d014815a7649d238fb791aeab37eb67760587f509938

C:\Windows\assembly\tmp\WZKZ6AI3\Microsoft.BusinessData.dll

MD5	291df9d7b333cbc79131028cfc9f538c
SHA1	c552eca13a18e4ab3384074d0621db9862c3d66a
SHA256	0e4c73dbd2b9a4d9b3ef750a24e979cbd6253b2030dcedcc69d55c09449bdc98
SHA512	8a636f79cd74a804a9f5da40394264a1ed1779b23d3c6400119a7430c4a816106e63590f7a1328484bf9f802d693fffb5453569d6b9eaa5733d14c8396a05d15

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.BusinessD#\d0bcbd58995aa8ed67818a7c53549312\Microsoft.BusinessData.ni.dll

MD5	9a708379b51f98162466078a0f11666d
SHA1	65e03874e233934a40a19a740400620453dfcbe6
SHA256	628cc7b3e366e22ce1c29fb0df647bee33af71076173a60e9278dc979b6eef24
SHA512	2b660a49319ee942b4517fa6dc9a32b580aa58e9cde9ef88efa34f5272f661337891ae5564914a33f73f92ca521ff1f2a0048ebaa433607cd7d94b4a0efdb958

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\2a3197a63134aa19e4dd62179d9f847b\Microsoft.Office.BusinessApplications.Runtime.ni.dll

MD5	d5018e7f4ce2bd468fe235a3b56d1f94
SHA1	e6f1aa014e6757b55a2dcdd55ff481f0bcf05f61
SHA256	ad684f74b67293d0ea5bbf943c31aa512e0959bb36a799d928fd4dd6e960ea80
SHA512	76bf9f488c698a7c855ec653c5d8880c79b60cb55cbdf7a2fda3b538df3b41865c0660066aa77551a1adc04b9bb8e2e1d626cd489d0273751465236752991d80

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\68bd94083b983a39e7e9e939aa0f82e3\Microsoft.Office.BusinessData.ni.dll

MD5	0b15a8bb549bc70341279ca0158db26a
SHA1	26b9a7d1121f5474a73a835fdbd1c402f6a1b6d0
SHA256	81345f12ae6ff1bef9d19ce5f6fa22b13b1c4d3831ec3938bd4293bfb8adde08
SHA512	e1251278609fd58adffd69e4681aac26553314bd5db33d269b034e88d2f5cf20e6979eb25bfa17a25863972df5a964be17d2fcb2399e17f7a04ad7c9e5b9f03e

C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.Bu#\d45acacd99d72ec2828776577a22e0fc\Microsoft.Office.BusinessApplications.SyncServices.ni.dll

MD5	62fa932085f370b3b8bac1e62c229a68
SHA1	94efcf9d14ccef82d321f8df82744393bc9123de
SHA256	6ae147f968f893d6d6132e12edb85daa0da8e284ff114c47748479bf6efa0526
SHA512	0dc41434d9d47ad6449429adc292a9748f51067cd9b1c749a4750dbef8ac626efec1f8b4cd9f1a41dfd7a6698490e69be2fc3110c45e9be5bbbf66c5103afeb0

C:\Config.Msi\e5e9ea1.rbf

MD5	8391f3e2da9480b7bc6a6ac53c4347b1
SHA1	70f01edd020986e431715ef19ff77ba63689e886
SHA256	66cd50c59eae246652512e3fbd78c63e12b452a8261e4150796b3dda346d0b4f
SHA512	d1f2faf992d1d70bc268d4839454cf296a56439ed96a429c731b1ebf3bc94498ff83f350445872999512a9e361af87217628d3ea42e2e9ef78e719cc5fdbe4b1

C:\Config.Msi\e5e9ea0.rbf

MD5	5b28ee078df7b442c8ed955c7c67936d
SHA1	0b3700a35be217fe1b4224c056eb974dd9320101
SHA256	6020d1c76c3459f0964d6ff139029d880b60c0fcd02c465ed3899d73d1d16cae
SHA512	c7df0963912df9d1b09a476b3817a89793d86cc3078382f488b08eef5343b3513366993f47bf6171eee7497755836695e1ea87ee65c840bdb08e76c55868e556

C:\Config.Msi\e5e9e9f.rbf

MD5	5f197c2f2c3a145e7fbcae4aab1d6327
SHA1	af8030d91287f5b7c5a0b538be8251805f83a08d
SHA256	d844739d177c4581574aaf7875bcc30ce03361d4700ceb701a6b98bca1cf2d7b
SHA512	0e8c987f401ad545d213893f03f99f4a3ec7c04e6848399868053efe2362340837c3483867d70b87d93d7c4575d49344dd1a99f495f39222c16b6b6f90ecdbf6

C:\Config.Msi\e5e9e9e.rbf

MD5	6ff16dcd6983849fabde6a73cc6af847
SHA1	1e3ababce5fb39147e43bea2809fed3f466eaff2
SHA256	e88b2423ba9a9a61cefbc0e62b22b07edecf4be4ab776abfeb0958fa8d276936
SHA512	f2ffa2ea427d05d89f5d95db6bb44a476d8f9b69b840324906ca01660dfa8c15a5f3826797c8ecb8ada1e82db5fcbd2ca628a2e1050f43c81d303f521df51ffe

C:\Config.Msi\e5e9e9d.rbf

MD5	7bc8ffe742db76d39e04dea53d364577
SHA1	f7408e5647098a75e651eecc9f173968bce5729e
SHA256	f176028d2e70bff8e48ca20f37486fe30efd5a9edd8bad98f0ee8d7718a3ea2c
SHA512	a127848d5343b3cb9d3ec037c0093d8d0b6b2c55ed654fe2e97424b4b9547aaa71abed9b805899c0006010533a72319f38aa3bcdbf638fe965877dbd31bfb455

C:\Config.Msi\e5e9e9c.rbf

MD5	9a584c9e1f22632a92f3ac080d366630
SHA1	26de025632b1a567bbee6115f5d4bfba7067012f
SHA256	d2b714f9cbc35a6f1db28d50b4a5150f690e2d7ca47ace9b9ad8e89a6ba95581
SHA512	e11e009c6feed4abfbe7384ffa6209145122fa01e9c036596fe60d58e5ef7b27401f88a11f77f595ffc0bbb938f07b05d013b69c02bcdd200a283139796ea146

C:\Config.Msi\e5e9e9b.rbf

MD5	1c6ba35d28e527f59da905e4d7373d1c
SHA1	50bec6e6a6652aa1679cb91fd0bca55b2e2e9313
SHA256	af58c1ba92c3eba8bd50992776d5e78b492c7a8c77a41112793cae5ca5fc573e
SHA512	266ebbad22bead61138cbd7ae85de0695c8a77df45347560225f45c3c005815e33a4838a5793256f1bdba08ba43922a811921ed9edf9c4a1b07ea36970a11276

C:\Config.Msi\e5e9fbe.rbs

MD5	e52b99f91db90110d44c97c8813c371a
SHA1	485a13ee08c0d86c0819ddf520e8ae4918642a18
SHA256	4a2828b3a503a3ad063e7c38e136ad9d1481d477f8d847ed6972ea18249df70a
SHA512	a06756dc0df4182ea7fc4aa73972efef5c85e361ca735547b115886425177c5027fc08148e5e15a2a3110a9e1cfccb8e6c60957bf160a696f8eafcfd4fb2957a

C:\Config.Msi\e5e9e1a.rbs

MD5	2a886298e97622e4f671e65bd25d308f
SHA1	52812f9e6242763a503aaaac273b82db23f38b2e
SHA256	257fad707d068ed01a6c5b13828abdc42b7406d486fe31431b7f2fa6c65ca6d8
SHA512	11d9cf306e0f3dfc64820c14e71cea89f97d967f47c0ea67499f06a02c7f1e2473aedd7981d144195ad8f4a25b654e85e14c6436a4941cceecfeb85d1514a316

C:\Config.Msi\e5e9e9a.rbf

MD5	c517484ea1f95eff5b8b7ea3b2ec94b5
SHA1	ec3d3bf95599348ceef42b13bf79cd7e722eb6f8
SHA256	ae9f0423faf4f0b79e6a663ad43118cc92a792037aa403f903fe8f76a6b9ec2c
SHA512	5209788bfe5b58b3d6e7d19ac5a2f2c5889692ae9ee10caa02524f097c7be59e1d625feda15ad268fe249aeb8746eb53046c69860d330ff51522691a49bc097c

C:\Config.Msi\e5e9e99.rbf

MD5	abaa01c6c53c230e6ac0a2649150f13c
SHA1	e1d3a5c4a0098f62be9cf0c28e0f237cc49ef8a1
SHA256	8649d54553e0d6fe2420427bdff9685d6878f1d78b29ed62c95a3381e340243d
SHA512	1af5501fa293655d0071bc31b99adf1e76190fe45c9bd9fa182ba9fc8c2852affaa3242e482c14a4c9fe99f0da2bb9162b8b733f0a26d8da275f47bb211f2f76

C:\Config.Msi\e5e9e98.rbf

MD5	62faa6fe395c5810fe4fceffcba62966
SHA1	ed830d3d1156c3a5ea6502148f4347af0c4a8051
SHA256	1db349e42e9c57afdefc29f18886a98290099b74210cb396ac5485247bcee099
SHA512	4e876c4afdce30b29275eda6ecbb14aaf56bdaef4a1951e6ad09bbe2af5a37667d18f4358c895843010336f467e0bac3a7f8449a907011124d4e374c7b0c1e54

C:\Config.Msi\e5e9e97.rbf

MD5	683fc126a13b915b3ff36735ea5ca5fc
SHA1	d1ccfdf78919f51b09fbde02c2cf0f332601bd74
SHA256	b8361411d7b7b0094669b0f74ce8afb488cfad61e2c26f76473db9ddae702929
SHA512	4d88cbe5c42815940595b1c7d466ec84a9e753977fa234591c0b14d2d826423c5bef13aaf93e4f3637a669c56e040da53529dbc31339f18b0587b0c1270c14d9

C:\Config.Msi\e5e9e96.rbf

MD5	facce237d5cc5e89d8e92a36289f588b
SHA1	5b91fe97781b107df2754a5d38807a597f1d99a2
SHA256	ed9b46fd9f3275639988cb71eccb7c3f31b48282ed78e4abc9ae303cab219bf9
SHA512	f0363e0c7414157dabf929fa9c4b49b74d86a0997481b48d29ec3f0708221d9fc4954f4ba93f4299e9ef0c31d38dd8a691b908cc6557864c1a4baf3f448286f0

C:\Config.Msi\e5e9e95.rbf

MD5	cb6d85cd1953ecc272f7b1c5898844f4
SHA1	bdaf9f8207d3b4ef6445d25b32770691b187007d
SHA256	f29a7a68c3e6cc8e502ffb18983c281c304ef7a70274525e8601e31174f191bb
SHA512	3088c059f18333272362d418d4231f9ae2a6fe291112b048c57f98136a8cc82f9f98cc346126d6366a8f26c0ba98c114dc0069033fa4c6f7bda758969b63025a

C:\Config.Msi\e5e9e94.rbf

MD5	20badd46b7ef4c60cfe1c6e3cdbbbae0
SHA1	d3002aac721f2afeb707f72fc373cbff63ebcf10
SHA256	5c2cfea597384566296d96212e89053a96f46de897f73e93af5b4149f0483aa8
SHA512	4225494f4943a721462b35c0122f94cfd9f1a8ad82b83d35f3029f5789b7c1faa8b80e3f9c968982ed4e0773c6928cc32d9e1ec20503305c99205723c3726542

C:\Windows\Installer\MSI3D0C.tmp

MD5	db2067fd8a47d0e9c0061279253dfcd7
SHA1	aa81b481d8c35619f09d42a05f3fc0f396040560
SHA256	165115725cbdcad303ff74573a66c9461059179b41afc595221aaf3d375360fe
SHA512	41ae26d983aa41bf8a52a6f627d54362b55391fc6fe268832c71636717700ccd7f6bd0d53132dac19aec2da8eeae693c39b968cb23806149902a920a152d4723

C:\Program Files\Microsoft Office\Office14\1033\ACCDEI.DLL

MD5	2c29dc23c8e36ca927c0fd88bfb066af
SHA1	4de48105c84ef4302d26ae273f122fe78e0d4d5c
SHA256	5a2b506b4632cd6a654f51c10c5d7423eff75d39052ddd78754511845416e682
SHA512	0e8c9a4095f090c0c576a86f7c2a7547dd05e53ef21c87c3302d3587af8204ddb0246dd2361b8a2ab6be06b43c0920fadbac0d211f97fb5e2b4d59803b3858b9

C:\Program Files\Microsoft Office\Templates\1033\Access\Charitable Contributions.accdt

MD5	201a343befba76a786432e8b1b220683
SHA1	64b0b9f2bdb2ba13018e9ac556d600b1b804be4a
SHA256	b3a813d1a3e107329320cb1f2dd3dacedb18f65b8deb4c8e4f1736d5d3a8f3f9
SHA512	e5ec42eda1e2dc008f9c841fd19057cdc22c0906919330d57b40b12b9848268edc1ef409c2c675b56c0e61e4327dd13dea88e864001422ad3b2666bf32328828

C:\Program Files\Microsoft Office\Templates\1033\Access\Contacts.accdt

MD5	88ce5c239921c2607c466c9846edd3d9
SHA1	b0ca318321d8922773ad95408515f5ecc33099fa
SHA256	442a5a2a0cbaf020ba110e6e7ebbd247c89a7f41876245c06b5080f83d452164
SHA512	b5c122ddecb7c879e9b5fe44fdb34af4cd2ca119a1648a96dfb546b7a79f88b7b72925957d043273c285eb118cd7bb32315d7166e4d747e3a2f37a9ae54570e1

C:\Program Files\Microsoft Office\Office14\1033\ACCOLKI.DLL

MD5	4e478abbbf41a3cf7ccfea6ca1fe371f
SHA1	85d96f978be7e8c14cb3ed2442aa1de7c3be0903
SHA256	f60efac79ce8fbaa037f45339e36e88aca7ee7270ad664c6cd3ba53ce70a1ed0
SHA512	ee5cac5449b5ba3b5345b0f02873634916115ae0fd1f01ef66f60f9b6245d9bedc89c45bec2c535f6aede0f7ad87d8a92521ad23a43c4de7662ac8e669cbf8f2

C:\Program Files\Microsoft Office\Office14\1033\MSAIN.DLL

MD5	e7893054e220a8c5dd9ed92d242865d8
SHA1	b6fb9f0ea10394c8e6eceae19cfb74b5e3488aa0
SHA256	8940b5c4c98d01d8edb4e36082e39279500650cfd19a6df566fb7bd72bec199f
SHA512	9ae0ecca9edc678ac9c38a2f2d12bced6ca36ab3c8527799937512b20713ccb091be9241daee51e9954dfdfdf62790c8d1befb2a1cf8a2a9f80bf54d814de600

C:\Config.Msi\e5e9e93.rbf

MD5	93030b5af327ece3ddc3518410e1af59
SHA1	4be27729a906169d2afcf025e10f308fce35056c
SHA256	ea82d8bd8289e5892cad2443c1d586c0a311ddee52a8fda0f75072ef2317b650
SHA512	247e2d5e63e6bb12dd826e452ce7a1e086152a170e7f15c0d7794a1588838c2b6dd4038f07dac42844356795b72b5aa357e01039e419c6c5d90b05ebfd74da4d

C:\Config.Msi\e5e9e92.rbf

MD5	007a365dc130c5f9dea3cb28a335cff9
SHA1	f60cca8462f9136753abe293d5015ae091270d77
SHA256	4599521c8d4332f938e30a8f70bde8bfa4d476c23e062da724926fe25d5fa079
SHA512	ff2f9f24e2391c61d543bb2b199c9017455412135b162b0e94e8435b6ae1797c8e8be2a87510fa43280eb174ce1bb57d17987c218674651b3b93e6e625d0c7d8

C:\Config.Msi\e5e9fca.rbs

MD5	294fb3f997d0ac2703829c944921358c
SHA1	1ff7f099dc44c236b119183224de5c3f2b625d41
SHA256	b61ebfcd6bbc859b1c2191333307c09fa1168069f8c99ca644829e716ed8431d
SHA512	eab61f642b69576841928a2c36ab60880357c132d8127b5c444c6de380646014f17d774ab8fdbcc594f748748a52abae891a0ddb47e88035a832fbc28d961765

C:\Config.Msi\e5e9fc2.rbs

MD5	dc81038440ef73b058c6d86af4864d1c
SHA1	cab19b3e00d6dac8a0e74b447b0bad3c28db4e01
SHA256	61722db8ac4f09655c5f25884907d5b163165835d024d26c0bd76ca4c40edb78
SHA512	df0883b6a81477106e8d1d89cd53d7a667b4b4de0946e557a030349cb7a9fdb3149e189ca1552bfec65877d502f4a9afb5888e355cd87c8ad3deff7cad9b23fd

C:\Windows\Installer\e5e9fc9.msp

MD5	8d9879f8d7dca73dbe14cb2407d54348
SHA1	562934db0bc11da7a13d3eb4f67586ca46f8ac58
SHA256	791345c735554d9ca1382b16f2982c46fe4a465a126348b95430058b48e5f729
SHA512	9b5205465a59af6867aabf3cce3497d1b0812efc626a65f13012d980cfe1553edfea425e792a0cc6907177c14cf3d10a58466794ad24ad479842ec1f9c235874

C:\Program Files\Microsoft Office\Office14\Library\Analysis\PROCDB.XLAM

MD5	716bbb2206948f9270409b697560ee45
SHA1	cde43a211998cff4b1890c962478663959e7b14f
SHA256	6bbdaad4f54787c926defdab887410449d145d6c23bee0b10555e6df1cfd8e39
SHA512	0d6c4524455eb587f4b229fb48a80840f2cb45ab2a47d43b0c6e3292d290cad8e769177b30c3cac87170ea129318cdeff83001d0804f262f8805c1f72649510c

C:\Program Files\Microsoft Office\Office14\Library\Analysis\FUNCRES.XLAM

MD5	91902dadcfcf4057dc1e794e73c8f6b8
SHA1	b7e430e31132a4d13e8c0d048022d1f6a2f8fa7d
SHA256	82d5ee9872e17b979bc7ea0ed387080d005ddf606c48ffea0691fcf77bf628c4
SHA512	c365ed4b1de9dbdd0b584b39dad9cd5bc61034d6b47f3fef1f0abb3d8d9519e3fac4d3beee336fd8f8780f064db047413beea47a06059114d8c2510de1be63ae

C:\Config.Msi\e5e9fd1.rbs

MD5	2f6fe10bd5aa23a2c5e288a8068ed521
SHA1	a05d43c39a3a0a9353b56992ec0eef44b5100ad5
SHA256	3c4b40a3589ba3f4fc475801859babd7f84d9dfe38febf27de51f59b039b3bd5
SHA512	b5f50ac0a794e7db3c3e2b3cb2ffa54ce3ca4d83f5f4ccd878b459ff0b1ae0cd8a2b39c8db13595718dad0fed68f22fcf25ec18c72d1021b965b036a6a913a11

C:\Program Files\Microsoft Office\Office14\1033\PPINTL.DLL

MD5	8ca9664768d23a919c9a9e43cb740b56
SHA1	b1a1ac50b0723533d0fc97968e6d2f1f36f2c35e
SHA256	54a2c987c696bb1df6aab647ebe69d38c9bb94385d12e5d4a40600de3ba36507
SHA512	1f3d71a9168c1d8cb499cfa854010fa99ab480d5d7eea69a2e3352e1e25ecc91ca4de32639346aafcd56448aecc9ea59f22ee6675f8dc946163419b6156a209a

C:\Config.Msi\e5e9fce.rbs

MD5	2ab8d05d7865b0b2a36effaa41726d15
SHA1	fe0adc05e51c9e0a87935cfdfed1bb522e23ad16
SHA256	a949a8eb495649d318bf21887e28e01688a2fb2ae8fb9e338bd09112f4b0253a
SHA512	a01909cb9ff588442cb04389addc8c76f211faf6b761c964121ffef87f5f56746f4b500ec0e24d44ac25b383fbf95879e5cc44736c3038d3efd99e10e94e7876

C:\Config.Msi\e5e9fd8.rbs

MD5	acc95d1519b25f58521465208ec40845
SHA1	afb944b500bb12eca6d0ef0fc0721dc733c1a5ba
SHA256	ac64a1f17b07d5ce253bbc611f001dbf9d7b434054d8926b199d68e2d5c7549e
SHA512	750ad4e0dd880b4a0983fcb886b75dde882f42d2f51e5ebd9bb3844c9642be17bb3d750ca60d43edc7df87801ddbbc32aaf2bb42187255db55187f40ddf47c58

C:\Windows\Installer\$PatchCache$\Managed\00004109110000000100000000F01FEC\CacheSize.txt

MD5	1366a900135ebefd5c0a6a73c7545594
SHA1	1125a033512b98bee5d326569ce7eb44beeba49c
SHA256	6a12915871e437ee3c82a6e0b262084a1fc3992e749a6ea28b89d059d95717ed
SHA512	e95c78e6e9228bc568b8f620f4bc1a737693198edb889b358f85d986a2ce85fdba9113f02b22aaa99f31f12e21b17a179acddfa7beb449f649226a0dbd87be25

C:\Config.Msi\e5e9fd5.rbs

MD5	bada030513eb7b7ca399c73a8cc1335e
SHA1	38e9a08c1ba20b2cfe0cdda7353c6b3971f1df0f
SHA256	398a3147b7ac7aaab6ea1deb37ad9467b8584c5f24192c33c1d20feaf045020b
SHA512	03a437b6c5bdf908396f8eada6545a8d3715fdd44fc105c43e16218be7d240a784b3adc86b643f815208c008491c28ec59418ae685b921bc1e55d1430229854c

C:\Config.Msi\e5e9fdd.rbs

MD5	7bd9e53f8c72e5d672f03b479048d39b
SHA1	75bfd233f787be2b3f07a7838efb52e65e5a24cc
SHA256	ad07775e93ce3a197ea1591dd58ee86c9fde8f974be2512ae2186ef896f57bfe
SHA512	c1a9ad3b1d72ee9a3065144f860acd4d68304d7ce0f6659c4a6d2a922fd09d6e8ddd012c4ffe7fdbd0387c4a4faf1524e1a3da9b65ceab173fcbb9a66e068f81

C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL

MD5	2a32dc873e7d96cf5996f86cdbd95488
SHA1	4aa7cbdd3bbcd4327ff47c53046e4cb7a61e8d83
SHA256	f16969cdc35bca027bf11640ee2a40a7dfb17300700456e69aad107aab5319c1
SHA512	0aa02a0950ee2db32da2411bd02550985490df25836a6823af930bbe9467a0cfc66d53bebc92dbcf3384de6a3fe9102deabe285b965725ea1f54142dc4420c9b

C:\Windows\Installer\$PatchCache$\Managed\00004109510090400100000000F01FEC\CacheSize.txt

MD5	88e3867c3211f7891001a65b0787d7a5
SHA1	6c30a970fa8c8411e2694f7f14546c0cf8b37784
SHA256	efc9f848cb2d2868645f933594f5ce8f3e6a15ec6a51a3a7b305df0bae144cb1
SHA512	84e3563cd847e8c4822480e00e31ed92c9b634832ed7cb4f6399659a7231202329dff242551f341c8f894042730862f313a3605059b97ad9d5da29063367a673

C:\Program Files\Microsoft Office\Office14\1033\MAPIR.DLL

MD5	1829a6ba1d19a6e4a9a90268aa1106c3
SHA1	d7b3b56772f5bbdfac34240cf86d4393f342aa37
SHA256	199b36561becdf94716b34e69cf5c502ff9d0c7676ec6814f3b5d4724b435b28
SHA512	fef2ef5f1141f1a380a2957b643ff0e5e6f38ec0a7f58b7592ff19f11c47aaae436e70878d58eb409b1b5c40b6a3d8a59fc995e355f10775cdd4e1b9aebbf223

C:\Program Files\Microsoft Office\Office14\1033\SOCIALCONNECTORRES.DLL

MD5	a14aa1d36c62180977e31cf269362687
SHA1	cc8517c78f5dabc43db4631cb6801a6eb456764f
SHA256	1f165ba6b3b21ca9d1e937757da423d3f7ca740598a1afb87ed7684547911e22
SHA512	70b35ed598e11e4f0bef44a348f2714576b1d3e2d18d839bb62d6f9cbb35e10222c4d73b4fd589a95ae6d8e7834cc24b3c1e543b411ca685e8bf437147d74e25

C:\Program Files\Microsoft Office\Office14\1033\OUTLLIBR.DLL

MD5	c4919121070132b1c8f54ae88d0bde98
SHA1	b234a002cbeb0be1ed50cd273ce288f8c44ad0a0
SHA256	6bf66afa4b41d78d634be478befc4c8db918df453f7f11e821dc56d4ccc78fa2
SHA512	4679a9d7b0178b3f6476b1c306ff85476b9053d1bae0f64c9733d7c3323f248db11e5ce4914fafd930dd6e68be4a522317a24be192c9aed91caead87b63c06e8

C:\Program Files\Microsoft Office\Office14\1033\OUTLOOK.HOL

MD5	a43330f20e14cef52ce89ba98fa22054
SHA1	9c2352575602cb2cbda8e1ee899526fad839cf66
SHA256	0c92ef2cf15aab7f460e7920f8533957710ab64d847e083395bb15f6e4278166
SHA512	c5469e780630d380703dd23026ac445702218fd22d0b449b1cef5b5cbebf24901dfa08036705e116ecb2292ab50163248d586a7ecb91f16a9290e3cb49883a17

C:\Config.Msi\e5e9fdc.rbs

MD5	5e646abe32b5195bcba057e6ed575058
SHA1	ff6fae7750a3761b5f521b1cf058851f902c66f0
SHA256	4555682e8eea43db8cce955cc893de1905265c8638609d6e5085e3f163fb6692
SHA512	dd03d5c9a5503fbb3590ed1f9e5daaec193cf197f07f67576662c73e1555d4063ea941d10f47ebb47705b1e3386e64ad1cfc25ed505255568e22d7510fd0727f

C:\Config.Msi\e5e9fe8.rbs

MD5	a40d93dab0ec970707ce803442bc3d41
SHA1	7a165dd4421b7d9684cc9201d8cedced46d3e23b
SHA256	c0fccd0f9f058301785e82aff67584426614c8ee210cf332636ebaac286bf303
SHA512	0dd2e2936ad4dfe023c15f221cd1d99b410c96cd665b4855901e76509682de782499abd5590d85f2cf81d307eb195224140ca5bb20dcdc0aeaee2720c616154c

C:\Windows\Installer\$PatchCache$\Managed\00004109610090400100000000F01FEC\CacheSize.txt

MD5	e2d1c8b180ba619dfdb659fc85d77305
SHA1	654e97ee93a471d9972ba98b6006f42b74c01a8c
SHA256	fef5c6fa891ab19ba9c4d7d84e0d21841c20362041f1811ad786211b68b24db5
SHA512	8c9891ca9ea61285a24dcdea1c807173c8241b31851004f2c82a3b7ec0f4064bcb92be61f7f1c79d8d30621265be2df00105d4b99be7c77b41245e09596923ef

C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx

MD5	d8dbf07efae5d0ba601486659f995a88
SHA1	15fea2ceac0fd707194fad708d9bd0096b3cad27
SHA256	f96f783df399fbe11f34a0b9fa083dcb50f4f09457f86377ef891fdd8ee1c119
SHA512	b438049465a178145db5a0c5b62ce6228e6afc55a4aa4587803ec67936bfaf0b9b9c61778253dc024ae02f5c991b58bcb4375283212e5e76623a585be008baf4

C:\Program Files\Microsoft Office\Office14\1033\QuickStyles\Newsprint.dotx

MD5	92b599767d7ba8f164ee56f1d296ba0e
SHA1	d496f0a7b49aef76ba2ecb5ce105fa15bc9b8e41
SHA256	828c85ba5c61dca98aa7a726425823778acf794c2703b702dec7daef8582ccd8
SHA512	ef4a2406b196dab121def76d54612044f13243976775e3ee94553b9c9c3e478c671be072568962eed04096ca330ea5ebb678de67091502c2f87dcf560eb08ee9

C:\Program Files\Microsoft Office\Office14\1033\Bibliography\BIBFORM.XML

MD5	c60f0769260d2aa566d0739a8b35195c
SHA1	f99c35ad90ec4d3d08a2c0961689a3a7f6adffe5
SHA256	79bc2f699746321f44f2eebd971b2046a21ac813a2f6387d3d89ab830d289d04
SHA512	e056c35371f1d03ab96002e0fede14e2f3c63485bb93a331eb484bd366a235cd297690a9bcc91f3a3fd4336ebba05c437219cdfc56adc2b323b2d1c2f2067abd

C:\Program Files\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll

MD5	cb675c3041babd3348e491741fc0bc82
SHA1	c86e74f3d784de2fd1e2e7aaea59a8bf1f59a697
SHA256	87c6a759738681cc19b3303b2f5b6b84f7dd8198396e6421351e43308a5aa17a
SHA512	6a43c1d563aacbdfd1c574bd54c02e02c0a26fd009702103876648a8521a9c6ebafac85cbc3798da9234cf6a443924a5d7ea40fdf049fb5840f19ee7d44d8b74

C:\Program Files\Microsoft Office\Office14\1033\WWINTL.DLL

MD5	5cc724fcf989ca354f366a83152eb9ed
SHA1	4a4fe58b0b5e3e6f2e295c76808ced215a14479f
SHA256	580a7dce236b6e3d03c0408352556a77239635a52c17c537e1a30b42664e65e1
SHA512	a3c9b160792a111f1c41153b3c17612725c86df6e05ea9f44dadc04c3c314619e830d23526d6b38429c48b2a7362be68e294d17b34f0795ceb96761469c4bac9

C:\Config.Msi\e5e9fe1.rbs

MD5	1342427026ba60fd55c955b404c7e474
SHA1	619c7d51b85ec7d56e01a3a0c31f7298e04e3a8c
SHA256	69b9757ca806409ec859fb9474f0d8900974cf6ea67abfa598f6b2a4c0777a41
SHA512	d94c60f20acbd18ae168de4603f824743200a84563dab313c4aba089acf8783b009974126ae47ace350934414830220ac6f3f36cbd8e3a219662d3a1a1e4ed9d

C:\Config.Msi\e5e9ff0.rbs

MD5	24259eb4f9f123b4ea7a4d5ed4228751
SHA1	8fbf42690410dca46ddd04db6fc5fd3e75999739
SHA256	fd8e2be48b275e54c187e782108122b21f1cb40dccda085240984ec4279baf73
SHA512	7631a565f4122154bd9387adcf1077ed5a38c8cf0f29c3fc782f23860381f6184df8c02fb622543a7903b368b2ebfde19f2f9fea32c55061d419c6d43392b5a9

C:\Config.Msi\e5e9fec.rbs

MD5	cd6c3442d96001ba58bcee2b40299618
SHA1	414b3d144e5368df2cf7bc8dc46e05b04bd1f596
SHA256	f0b4993e094f8ec97abdb4b5118a31539be12bdf013c4d6bdad1e902cd2bb42c
SHA512	d5cc512e07c9c04eb01ca74afaa4cd5d622c7230ef46c20b9fe43e84fe8891df74d031b954671df1195368075d2b5f054c23930a18a9725546cd6257d7dd1b6b

C:\Program Files\Microsoft Office\Office14\PROOF\1033\MSGR3EN.DLL

MD5	ca603193f876b98c1c7d9735df17d20d
SHA1	c486db3aac8fb3740f0525ff1ba4ccdf7967fd32
SHA256	2f32f0aae1d077017a2f1e77957f4b282335b4a324d758271756617419894b03
SHA512	807c5ee40dc9f015addade9c5b86cbe963b3a97953f14b54cfd334ba812544b970e91d240d7f13fbf30916bb98ec4e3eb8dfe12cf72f11a0abadee7d60e69369

C:\Windows\Installer\$PatchCache$\Managed\00004109810090400100000000F01FEC\CacheSize.txt

MD5	ab3d0d2b51bb95df151e7c4a1042fc55
SHA1	df17a401532c561696c959bd84129ec41888aeda
SHA256	e4549950cbe472b9ac616ed1dd45135c0bb6a8635cbde157ce769f83a3e45763
SHA512	e6c79651fc3a2e4151adf45d9713b5e541ee3501f630738b398038cd324bcdd8c41e5d605d232a250f5b23b144a8480fa214f8717635624737f375d29161508c

C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7EN.LEX

MD5	6f057dd0897601e6b0f6a53cdf361af4
SHA1	e1055fe6bc848304733b25cd6d41e333e104913c
SHA256	de196831d28d65b6b87968abc1d2b924d58b6ca1a8bac092c7a1eee7697c0291
SHA512	cadaa5b30b1f6dce76dea4e162d7cd992e9624ab0ce58db6a01ea9c6e551198f51cf5fc88c05ab600e16835a3e5f7d3e799648e53a0690497eedf8f354a1c59e

C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7EN.DLL

MD5	8c2badce8f64faf9ac55ab4abde29c1a
SHA1	df4f76fea85b9e45133ff1aed56c99ff5e3aec4b
SHA256	973897bc69899ef714b2c3db194fc7fee48bcc90548af13019765785e31f496c
SHA512	e6b5d56d2245797545eb0ba507c2e351f0fd6d82241e33d56851037f8b99fdd2ce77d1d0062f672fc3b0db4ac5d541dbcbb3f73e732f6e7b938700d5d590b3d6

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.dub

MD5	b6a2b0599b562acb207b192e9451825b
SHA1	517ad00d880dd100ce25b2058ab95e9ee645915b
SHA256	3bdb7f51d721dec4953c0b00c610ae34094400602df00423320038ad8c5b7bd1
SHA512	238b146c3bd5797274b29c1152e037e571dace9b3dc71ea5cceda913fab57667e67525e4f010f935f5a43124aa5fa3eb344ecd0db6b6dcb87d94c67895dbb563

C:\Program Files\Microsoft Office\Office14\NL7MODELS0009.dll

MD5	86f60330b7790eb6ee084bfbb5c7c5ba
SHA1	f83aeec42c952b38384d2d59baee0445bdc7621a
SHA256	ea664714c1db755bb0cd4eea60ad278a7e0c928d5fee44251b8a1c58e54dcd5b
SHA512	27f5e5520f0c7ca47d9f26b0a0dea8780f1b02bb39f865358bcca1b416e4bbc34571575b13f8d54a2e2c00176e123bff55ba4fc819b049263ef4916df2528a52

C:\Program Files\Microsoft Office\Office14\CSS7DATA0009.DLL

MD5	7016f9c6d5d3b8719e7b4349ade887f0
SHA1	1e1ae38320ca48e2764fbfcb8cedd24936090fe9
SHA256	acbbb185626c3a1ae33986c1396b4959f70a4b471b3083ea3208be661370bb1e
SHA512	def01f83e75d425f0dcd731206f329e701470610750613dcb3f0b952245bb9d8d16c3abe1175d32f7500ca16b80c1191ce6786c3e4c682fd786d4250872d40a4

C:\Program Files\Microsoft Office\Office14\mscss7wre_en.dub

MD5	3b2053fdba45ecc4344088761c5947b4
SHA1	9c6c6ef293d01499c81532a09e8cfd6efff57288
SHA256	615097ac8729e54c24dbf23ec7263c59e46ff1aa1771f7487c22d1d3118062d5
SHA512	e2ddb493136e5389f488b721f5912220e6a571f83d826e518df7ddf9f474c08e794109c740fe8c6e0a9644f29b6fc371ca9b4200b487a8f757a2470e52d7b116

C:\Config.Msi\e5ea002.rbs

MD5	67ce185ed10bf7f6625d5f63eac54022
SHA1	d127b37c0ad756d0a471f9e2d675f86ffb417db5
SHA256	40a6b674d864bded443b8000ed859773e612ad5dc3f2d8278a51e19635d2d424
SHA512	7838fe6d98615d45951b086198e789405271513a159559b30e30346c6f620289015ebd8331510b2a8eb12ffbf7efb374eb1a19d371f87b28632a5d395cc83bc7

C:\Program Files\Microsoft Office\Office14\CSS7DATA000C.DLL

MD5	a90922d3b354be74ac0ab2302324c33e
SHA1	68cd5ee013f72498710828eefc542838764eb01f
SHA256	e04ce2ee3581885cd974001dba6477bd1d53d64046415c6529777c237319dcff
SHA512	abd7702a3cd38f734e882a65fdff6e31cadcfe788421e727c19eb7cd9c3c0d2d923c6645dfadb7ac889621163c884e24185dc04e7b48166a30da887ba2b76692

C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7FR.LEX

MD5	bf4e4b778dd7672a5f363ceee32802ab
SHA1	d5f64ecf309618cab627e3f722b8a7254ac1ec10
SHA256	3fe78f0a14753b8cf072c92f8d7489f8034e5e04c6aa694e23c338eca6a8e407
SHA512	77f1ee75a49a7b8a4808553aeeabc2810664c3aceae0dc16c58c6e5b27ba2499c8ea91f4c14e835ea941a336d82c056d9f7391dc27b390eb0f4bc113243cad9a

C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7FR.DLL

MD5	d55622891d7761b83b9b75a4bdda7ef8
SHA1	9fa54327ea6b6248b50131fedd02a7d5336a8d0a
SHA256	2f3e19a91547f221b7823b27cde72f2c55823eb68f010e78bfd06bdc959f8130
SHA512	06e45a32ba863f3d3209c4c430a79d69b867d33b1858a9fc633c42a018dbe2390c1a1969dfb487ed55e8603f2b2b50868b32167f9b0a499a9c1530a03cd2564a

C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7FR.LEX

MD5	e1cc34a96599ee5e9eee97391eca2501
SHA1	a8bba055d12ff08247e33da0117e72088cbee715
SHA256	98b51088ede6fdc233f239a91bf635be0bc297de9476f6725386f0dcd211e73a
SHA512	a246d4b32bca6bb42ab8d7adaccb5d329726a96c959f59d594ae6f0cf713510d3d1bc387b364010b2f691790e7ec8fb8eae4c2c191eb10ccce2f05ba4d18e97b

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.dub

MD5	de504021f3652c12a3399edeafeea3d7
SHA1	89e609ce26e7ee6ce92cfb948ec81fa25dfcd086
SHA256	fe252502b4a24dd9c39dc629bd5c2e17867ac95cd6c2180514b45e11e1f5f79a
SHA512	9e9e3781112bb6334a9204cf2b67f8736e27d11e8beb17f78b8d59b30c16ff8ab2117599b3714cc6d93d594645d360c6df6cb51ebddf016c10e6e3c59c5c88a1

C:\Program Files\Microsoft Office\Office14\PROOF\MSGR3FR.LEX

MD5	d71e28c3b25b05caa4af711b5758055e
SHA1	3f73ec40098fa870e90407b3065097e4865a9b7b
SHA256	69072832b8a76bacb4c06b24086fe501b9f4fe438480800d5546901fd2b999f3
SHA512	ee5ce2414c8f83f6b8f7e54da694ebfa0ebe88eac806c77bc962f4440f2ae80fc37da4d2ffd973434f95c6910436584f9e54c4d4d5751ce56d6442e0b3c61181

C:\Program Files\Microsoft Office\Office14\NL7MODELS000C.dll

MD5	088a09194c6edd89fefd89d9ed6c6c02
SHA1	a260b556f48175de69eedf4e726869f2666c0f24
SHA256	63310b2055b0d01f3404e2d6a28ef8da752644275a2889da0304d87069eddd9d
SHA512	8a8989c0e8c90c99a90640e0507637c002a4c0c19ca34c11c574c682401e2ed86dbb21abf723b5773c998aa36a62f838fdf75afd8b841e5eea456d37d2242ca1

C:\Program Files\Microsoft Office\Office14\mscss7wre_fr.dub

MD5	f1fea09e7d5da50d9ca4ca8540d4ce8d
SHA1	60dca508d44071c1813f9a1be58010075823ac85
SHA256	97e4fe75a9d8a8fbf2efa70fef73b9a820d9e1f5fcf839eac213e9403a67bb41
SHA512	4caa3d93f8df3215e69c71340aba694080212d73744807a504010fbccd19ce350ea81d64c5ad6ee13c0ab283b09049fab8147f63902405c86dfefa8b013d4c4e

C:\Program Files\Microsoft Office\Office14\mscss7cm_fr.dub

MD5	243a6535e903a338838f1b0c6ae5a321
SHA1	8368c0b25244cfb6471b62c52796bff6df060bb8
SHA256	79549529566e6d1a969185ff605616fb56ec5267324e376c9cee87621fed3570
SHA512	1b941ae9d14636892696541d824b6e2290ea9ef1ddd84cb5c3f85fa3de6628afc22a085fdf9f9e06862c52756c72ec275b7dbf7e6e3012cb048828d58547a890

C:\Program Files\Microsoft Office\Office14\mscss7fr.dll

MD5	e6164752c306b1b5c5d9c84a0cbf0f65
SHA1	9c4f8aac971223d1067c4ab8189beb4204caaca8
SHA256	f1e3b82e460d778e4ea7c2f31b1ed8d215472112385239bea72435c329606ac6
SHA512	3a6d5df8d86ef44475c930e4e0190866e2c46fcfa78ff04078ffb5ae117803fbe74a0ed19e4444ba204846f198261b1f9edcdc0c2a945ab6b0a7d8106f0e3f6e

C:\Config.Msi\e5ea016.rbs

MD5	823aaf248114f99d20857e77979c00f2
SHA1	0d613eeb73265d774249bfa836a297a5d8db2a8c
SHA256	4f7026b8671dd6b569e4b0f8942c8b4746fe9d846085d17898e8b28b11500865
SHA512	48ace21464e86c442f9526d78d96be927ae16fd6cd42fa2599a87492f92cd76506a0b38e1e877b707d39f3efa625f665eb914815868b6656e298cd99dee02e43

C:\Program Files\Microsoft Office\Office14\mscss7wre_es.dub

MD5	243fc0b7dd16b448ffb4d6260d8a74ce
SHA1	e857737498f4525adfa140a1f125aae790970d4c
SHA256	d389b69bfad6b0c68a632e8000fe378121494896f72e9a0a2aeb8ccb7c253a3c
SHA512	38d303caed9761d218b3b30d60531d2764bebb1aa4845ebe14eaff78bedfaacb9847987c763f661787cf0b5beb3d8685ff7f7da0768a10a917a0708e4688cd34

C:\Windows\Installer\$PatchCache$\Managed\00004109A10090400100000000F01FEC\CacheSize.txt

MD5	5001c075919ccad88e684deba452789c
SHA1	c3f18c97e8559a3f3fb7e3883f132db8bfbe3428
SHA256	24905b9eb0971c861a36ed86f690db8b6dc9caea9d74570bdbea33baf7a5b4ad
SHA512	e259f0a7473c21c7e3aece09b055247d1cd9210939300cbd203f57f5ec363b8623c02927d75fb983a26f9e1ced9479072492ef27eb6cfec1fa36cc7afb850a02

C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7ES.LEX

MD5	51cc5f7af499d6c0ae5855f9a488ec31
SHA1	e11af73e69edb1589ff3488d2678273d88ba44c7
SHA256	1c0fe831f75b6ae18c8eaa2e33566f4f9334ca371d2fe9e7bc304693062043c2
SHA512	0b1e1015f47ba6a7799a2021f640fa13a2a15b02cef2ce19e7bf20b19c2c599c2270b3e95ac3ee638010c785337f08fc3874afbccf05caf31e325d19f406b8c0

C:\Program Files\Microsoft Office\Office14\PROOF\MSTH7ES.DLL

MD5	7f65ad4d0ce29cd71378c888b11987a0
SHA1	8ae229fb204b4c5251eb49e91f853ad5ad512ef3
SHA256	deed405b72590d0df36815d22c4a155b79cada3b2034c0e10384eab3f5a74fd0
SHA512	b376e3597e5267224ef282deb53555dd270e5d6b15828b6e3d957f537c9d290ff53d6d86daf80279b263559496d0134a9fec39d1758dd061793cd2dfbbd33861

C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7ES.LEX

MD5	3037bafda2af5485688894e56475ddee
SHA1	63e0e5dd3f14c35f4e34fd887621941ede836263
SHA256	955d7586c93f2e2e5a8c34dc6fc618f979fcb5936a1f29d59745bc50a0b9c004
SHA512	459692f0899c2f6a1fc80b9fd14d29433bc15afd24fb1f0fa4d4b25d637828a05c505a1fe367586cccf28f648786cc220b95f73801161ecffc82a5edab067792

C:\Program Files\Microsoft Office\Office14\NL7MODELS000A.dll

MD5	41982943235baa3a70f4c6446303bab1
SHA1	a98c7af22389e8169e5289f011419aab3e6f1717
SHA256	948cc16207cf7c3aae39f3c3f66ec6aa9d6d9f568ca770f4b6c9afc2c12a770e
SHA512	6410cda2fcf2c878939deea452492d549075a11c0166a38e489c7a614fa7530677b511af9e04df47e18dad4312dae0755cb90a525ad584a5f6185cddd48921a5

C:\Windows\Installer\e5ea027.msp

MD5	e197da9034692e08feac89e56cb1b89d
SHA1	13045f2d24442101c2111fb215507a3bd05531b2
SHA256	5d4504b65bbdcc541fd64e53d94fb838e4f97821fb6a3793244cab633189498c
SHA512	e29bca8b8aba3512862292dcf3c9c3dc1a525fe1da2742a6323f07bae44caabb9c2cc69a081155f4afcfded490562b5cfe7392856ef11beaf5f1b1867047d0b3

C:\Windows\Installer\$PatchCache$\Managed\00004109B10090400100000000F01FEC\CacheSize.txt

MD5	1da74d2f1925159ec98ec8a4f0ba888a
SHA1	449bc065653421f88e08536c4fb1e7fca7bda25b
SHA256	ea39efbd30e5eba29d269913f872eccd5f2b3aa727233a790db46da6d6b7c363
SHA512	09bf7ebe598b0f77d7a06fb00574ba2b3f9663b23e99d5e52b1c56defbf7489f10726288cf410938b559180d5b312bfcf19f43303bae7d9dad41e5835cc4a97b

C:\Windows\Installer\e5ea02d.msp

MD5	5f580ee3dc548251fc4a4b5b7a2b68b7
SHA1	ab8c5049e6171a071f60943ec23df6f503921161
SHA256	8aac214005ef9a35147bc1433bbce572da9f6e7d6ebe5d1e1ad1a94c7f63441a
SHA512	5971345865402cb044ba2c507657b60ee6ccdedccd89c284d0fd597203b4c4e9f7cbda9470672cc7ca3341cbd8b9b6c8ce63c3cd471ce0455248feedff137b57

C:\Config.Msi\e5ea028.rbs

MD5	2785b6db0ba1d3af5e41b963d9a649ae
SHA1	eb9977c9d39f4b5aa12098161a82a1a97a537a2c
SHA256	279529c53f2ad5b73456c70b0bd107dd6657c162587732caf4d8bb58eaf635ae
SHA512	fa636d8658d11de6d0282ace409783808bbe361bd40f80822252fee673c2596388d2c13f4d266f40f9406d4b815a1e2818281c06a298e4c570cf97a9c456f500

C:\Config.Msi\e5ea02e.rbs

MD5	2efecc4e0f621c1e131dca3299090320
SHA1	abb2c8bf8475d5fbc4fac2778696968114159661
SHA256	35188c13901ca9fdf5e06f341817786bb25cac9476ed747e6360a47b0a4ad4d8
SHA512	af604e71fd624cae5a573a7349fef92f19a483e192f332ce5ff1886366fef54750a67139e83de3e63e946d9d4a276516035ea4550b46b7bcf4aaac2d50133093

C:\Config.Msi\e5ea02c.rbs

MD5	6c14f67af92333fe9493cf947e72ebda
SHA1	04408f9069b9c7d54298d3b85fa1f06efa6873a7
SHA256	a98ee6ab819e450f135446ef49e96722a1683b65bf9cf5593a280b477a4625b2
SHA512	07d7137ec00f324c999a4044710094592b1aff0199fb273470f2c84b13f64b7840b05b946730b1ea7a01cc9bdd0edbf2344e5d7233c49eccf14f5a8f70a6ed5e

C:\Config.Msi\e5ea01a.rbs

MD5	6b2982309dbdde3aa58740243d5b2657
SHA1	4b54f6847909785ff63bae3309225f7f6e7b014b
SHA256	4e8a206fa5bc65a9a0a447f0d283479502fdd4c53a649febacb40aaa2e3ce7d3
SHA512	b4b196a25e043cc97b4176d8b7a480b1d138047d7d6e19eb9d64bd0a0d872bd8189a48de1afa0c296d8d2333c5b5adb2e8f44bcec597af651d2d7a7ed46daf61

C:\Program Files\Microsoft Office\Office14\CSS7DATA000A.DLL

MD5	fe038e9fc6ab6ccd38c62517740ceb81
SHA1	7ebe8691e03323b1452b9674e56759040ce5587f
SHA256	0ebdc1e0c1e42f9daf195b9c6d05ba31a0b6eb0f22c0433e73e672c388134d7f
SHA512	39663a9e5ea1730bdfd9c7cb0a847bf9bed9b640de8170117ac93a415917480a5971479cf8baf02d96d31213494c987c5cb6faa1442b8ebd57c7a20bed657069

C:\Program Files\Microsoft Office\Office14\mscss7cm_es.dub

MD5	6221c561885991f72be7f7019ee54921
SHA1	b862cf73c70ed51c4062d26b7f3101cabb1c0544
SHA256	c670682499d2f0d197675c6482a50ee9fc0f509b93945098b9d0d2fcb379c77e
SHA512	9b9bf773c2330ba5cf83a437852fa034c710dbc670f0760a2cb8928995ec786153e3f9af2c3bc239bb9c3f857a997633f08d846276ebe8c74ea6f664b3a5d6d1

C:\Program Files\Microsoft Office\Office14\mscss7es.dll

MD5	f4e5f965b18a5948c9da11b68c8c02a6
SHA1	52b8aa51f0394ba40dd71f93083e90f58a32185c
SHA256	1c1ea6a51fa1a23fb2ca31d420a008362ae81c351d2ff4f2ed2bfbb84b58eddb
SHA512	84bc26f28d3bf38a9ef92646a1e3529338ae8b08bf945f1ce849a4ada9b4c962fce3679e09025bf93c4a18e86bee3fe9318befccb2e212b04ade5f2eb1affb0b

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.LEX

MD5	a4f31c730c4c1562857d91505c55408e
SHA1	59358f63e5786425a8d076aa50776c075f76c0a3
SHA256	7f3ec3657fe4c258006ca91200baf430a7df67a95aa4d7f844bad0618eabfd09
SHA512	d0435e03680e0587ec6a85f0b6ad034d638d4915dbe38f3a6ace18f322ef48c370b8a738e0efdb8aa352405aa60a6bfa727361425bb650bf8395c8863245b948

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7ES.DLL

MD5	ed179bcd22b2f2775521bc5301dd4865
SHA1	d153a6b014afa855bd67b715bc81db226c977fe0
SHA256	d1864c3e3e1a02267d6e3c9c899f5fdad91238bd4e2cb15b59c9f65d609ad301
SHA512	5e98eaabe2fd6362fe94d64c8773d44b954d503827259a93c321326dfbcf8573952de7f49b4de17fde140dc9cf101a4b49ffa9d27226d0dd53085045015d58c9

C:\Program Files\Microsoft Office\Office14\PROOF\3082\MSGR3ES.DLL

MD5	376da494fd366a64a310fa6afe0de1f5
SHA1	d204bb6909f229e54aa7ff968b2ee298359ac164
SHA256	1ce33938c3f2f9587a5cf85888e99977ff546ac445b8635d26bab50cfd4e8778
SHA512	81ec829d41cd17f0209aa4e1e4aba8c4b82264327565f733f6db6b74c174a67e297501f45cd53819e7ec8d1fc7b1d78c0d0c8085b8311c35c88d20de1db85b4f

C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7ES.DLL

MD5	768890b654df3782fe4e6c414524827d
SHA1	b5f23c187d7c7cde949699fc0fb38b0f25c8240b
SHA256	5c42e24dc63d516dd355b0ebbb069fdecd7c6abf651238fc848fef6002935a9e
SHA512	845fad42efcf7facb4767db980897d327c52468801f3af950f3ebd2786e2ce7b3a2ef0d27ce740ff3d5ef50b9b20cfda35035c3b9222bfd198883d735e47100b

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF

MD5	713dda39558b3ff92b34c465308d39a0
SHA1	b78792fc922e7d9ce0e1a2a9eece3a93e7db7e0c
SHA256	f0c4cb5a8ef7b4b3aeec53effcc88de28ec199058f50750529bbb6c42a267092
SHA512	cbbde90a93c7ebe775a6fd0a178da274c805b3fae0b86dd807bb27bea06d4231e501d8bd692a7d47a74dedbe7fc4bae4e5f61193a24ae83603157d92f09fabce

C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL

MD5	641a841490b65dec76f079f95b368e2d
SHA1	edfd1389cc8aafe2194e0d0ce18b28d6b71eecd2
SHA256	88223cd7ba45e1c4a5f9413a45240291c724219d21fbdd42b0b4274793565749
SHA512	59d8e4f695fa4db065bbe9175897b0ce500847682d0ad7cc28fe55ed67be4633912247b88c8db2786e806b7074838078b9d6c16d79bb90d7726799bc12e123cd

C:\Windows\Installer\$PatchCache$\Managed\00004109F10090400100000000F01FEC\CacheSize.txt

MD5	2de9798b4e4dcc3c5910f39e2085f4aa
SHA1	b25a6c156bf402ed7bf4affc0e26fe8a453f255d
SHA256	e7d31098f5a3ce6f6b9970e8a774d69483b16c543989142b95386299dcdfddb7
SHA512	6a23cb291976eca20ab70f2a1f75af634eaa14a47cac3a3cd0b8d1c57629a4b499cc5c58dff656e28f1ea5b97de53c3529737c1e44003ea6a7a0d30c0566d7a6

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\RICHED20.DLL

MD5	97851b3163a55652b44968893099d093
SHA1	f1fba8221d56ad43ba8ecfb344724511ee665069
SHA256	6538df68eb0682b6e73202098158736eaa57eb1cf5a020b7159b3091e62cf7b0
SHA512	1a44cadcced32ef1705fb9ff100712af982217e6444877b276c62263352952e363a84e62a78efee59a5e5f676ef0681d20e5eb58d949f94f32f1c873fcb6173f

C:\Program Files (x86)\Microsoft Office\Office14\OneNoteSyncPC.dll

MD5	6fd5a22d64b2130f8a91950f789b6279
SHA1	1c6565d446ff59d528fd9f94ef10ea8e9d26acad
SHA256	56e6607775806d1f676b1b98ad51392ff3f357a6af2bdf51da189f02bb6d33bd
SHA512	ce876eaf44708d5ba75ccdb71a08971aef9810ccaa93dd96b2b3ae210d8f34d215319db2404ad84f5da61c086b044f89719abeb0f613476a3ca7b671b67e89b3

C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

MD5	c9152a8edd391bb1bc35d8b554038e8c
SHA1	eca4dac07ff38fee72ceec3a2c64896519875efa
SHA256	2ed95a268cb3ec68931d1702f904589f6d5ef56a75164456754f74383ae409df
SHA512	a691512a6c6cff4da1ff1913bdefbb23f211fe894790d68b733b52e18604af05f0766284e1a896a348ad2dae5fcff753ff47150a42e5f9e2fd14969266da7dd5

C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll

MD5	fe25802296337fafc7c9396c2b8c7489
SHA1	39dbc1cbb9565ab9f199ef8e075cb0ddff949ac6
SHA256	7ae53580eb985cb497b2dec293ef08bb1e1c7f20a9494475e70020dc766007c3
SHA512	0db98f24c97dfd284dd3c3c77da7c5efdab1614bd7374f23c59a775cc28f55082ee6417f9ee1997160e51cf6caa4e1aeee9332164432d0561340759a69af2610

C:\Program Files (x86)\Microsoft Office\Office14\ONLNTCOMLIB.DLL

MD5	e7a5b76b921e7d6a913b32d4dea9cdde
SHA1	eb3714968b368f04550f4ac47d5060bc97857708
SHA256	75ffe4462cabc9889b9e3ffc7d58747cec42df12bd9c5e57e82598af61cf10ff
SHA512	294b4b717f80724a57c497efb8276cf1a0da6fa3c1cc77bad6c84dd85b0fe0a6f5766ccba5cf32e07f6176f0d6481ecb8d9b394dc4ff79f28bb0ba95bf49cbb3

C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL

MD5	193e6ba1224cc8a7fef73c4648283667
SHA1	bb602d14e3c2f6123c978ec92e4d0a3e0af46fd4
SHA256	0a1c259e090c91509796350a5db6486250b66918efac4c11372cb81471c38d6c
SHA512	d73b734fdba2a52fb410c39f81d3f7d2f52db0f5b8a0ac6c13cdbb4166b95e31992e79299e8d61320962be06933688703b393e3d82f6839fdf6d2eb001bbcac4

C:\Program Files (x86)\Common Files\Microsoft Shared\Portal\PortalConnectCore.dll

MD5	ae22b02bec5418143617b1f976362f58
SHA1	79a0099261c0e521883b06699a46a57fc5b8a329
SHA256	35dd842f3a175413962174a7b95a64f400714c32ecb4cb21be31dab04f915ae1
SHA512	a3e9d4bedc3555801733be84ca5e255bf2c01a680313b008b9939d919bddb65966d1e218379859e76fa670f74c181fb19c4b84b372feba628fa75628a77ba398

C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\FPWEC.DLL

MD5	8fa1ee967278f0d157f6c34d188febb4
SHA1	e028a7a850aac6eb158120fd8d069dfef6273b14
SHA256	cebb34b055e8549ac35f5eb654ab63bc8b9e9af87fcdc85dd6fa11ddb294278a
SHA512	521e0928148e8d2fa006b20f6b5f941bfbe256f49e582c0d55b7050ed1204b636323d16fdbf15a5e545c5136a35982ec26d63d65e86639f4155f2a3fd22d8800

C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL

MD5	86196e399b4f43d64f0c3abaddac5953
SHA1	f69c2cd7cf0a2cbf46e51d411390504ec738ae2b
SHA256	b753652ac7061ff6ef8946a53c3c5e2f29cae66266c8f2b00d9d02740d01f15b
SHA512	92ecc0e8dc1e69d276f5f924e45a9c180f5225de59b1b60aaec80d4dcf7eb609aecbf60eb30e4e5e7d717030741389d59ef6e6a547ba355f787c040dd77f964e

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll

MD5	465a0765e35c0d45fa1ff4b9c90e510a
SHA1	afe809eb7609141f49cf454d1e8918971176ba9e
SHA256	5d58699c0880b4b747aad3718bd2d8ff9300b85e6a0545fbd351608157c54af2
SHA512	528898118606902632ad641a4cba4c9d1b7dd606dd57f01107b852b1d0718455976e37ca65cc8c57e03dec088f4a322247879ff5cf252d3e60c829c277c96a9c

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Csi.dll

MD5	f3ce7b6a02d791ae7e7d94aabd4ae019
SHA1	a8d4381dde26852df75473e7d6b555e23416456c
SHA256	38931e561192bca1f15b42bf03d3609d1ac5f678da8f0ef8454b6f52538470b3
SHA512	2607cd6e8ca77139dddd27b668716d74f43f95e8471d1c94bc1e44e0ad911e694d82d804fd811ba635f455126db9487c760089ff7f9370db931cb06d4836d2b6

C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL

MD5	28f13f4245380be7b8f8e9daad015cac
SHA1	8f065a4239c705dcea924b81fded1797fa1f7a53
SHA256	27bbf6e71c4548b2256692d7336ba6c19fcac6dccd1f891fed828a89b95c6f9d
SHA512	963971b0b35675071edaac10a540e942a0b3f1b543a89540ff7cb9c8b841fe9b527ab1bb877e5054c3564e137e90aeb71a65654e8acaaee010716b7338801a06

C:\Program Files (x86)\Microsoft Office\Office14\INLAUNCH.DLL

MD5	a5b0da3a25bbcbd6785bac447100aaf1
SHA1	1fcbf35718bb4bb9f45031e2cd542acff90117cc
SHA256	8ca24ff75ee4d649c71c98ab4c17c158828529a7b93d0d7dd61b312a901c87d7
SHA512	9764210253ae1124aa8558fa1cae3b6304c0aef9c7db8272511285a9790993f4625452419eabd60ea4f39d49b4fe3f137ad8a5d4320f2e83176ef0b65549c3e7

C:\Program Files (x86)\Microsoft Office\Office14\NAME.DLL

MD5	3a682c46334995fd3acdaa1fc8a8b9ac
SHA1	ce89c078699acf12e04c15146667f11cf0809f28
SHA256	b5efbe69a86bf603777457e3d87be6e34da33188ff5fbeb1f262181c276a558a
SHA512	bf3a0f558df691d5f347d1876e65565f90da274319d3aa7357d3188ad489cc776d8465ccd3e954d153b0c933abe37f8cba5c915a2b65d96bd71c20f70826038b

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSO.DLL

MD5	4c299433589b747573da25b1ff3178d7
SHA1	a769cd4dfab9a3dc6df6864ab5af48cfd2bf9158
SHA256	d40ccef13233ac556b50424b099ddf3ad39ac4b5635c51a8cea20660fe0411b3
SHA512	95dac94af275d7fa024552cee9bd2b9edd3a317aafe2d51dc2be9969fefe4a1643ccb65e8000d4021e20ad67665739264f2fc14067f8f489ae65724cddd8fda2

C:\Config.Msi\e5ea006.rbs

MD5	b00d662931712981bde33e1064362f16
SHA1	14ad620de9de6a16a646b9747aee7f392ecbea32
SHA256	ee0066f84e5997217efd362c2e16ee416c765f19275eaed873877094f96909be
SHA512	5b364cab37363144afd4ac35d59c510f8e773c9cab65632152bb26efb3c9c25246e8b91ef23a76484eadbfa6306c4670d2b066b6e44b1ab2e27ae2fab4af7e1b

C:\Windows\Installer\e5ea015.msp

MD5	c06749f4e48cc1caa42466d701f821fa
SHA1	7ebd79857929692bcd34b4729185dc09bce05bd5
SHA256	02fbe2678de51b3edd6e83d536014f94ee27986d60d63cdb6602c648aae4e24c
SHA512	dd6334103f7563c6affb10a6e894605d680a00d567e65cae5666029c5a5b930e0a98acde8c967ebf7b61a61029de385a6713a0500ed1e4a3b95e7c02054aafc9

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.LEX

MD5	4163673f968c5cf608b3d639ab36fc3a
SHA1	bdc0454dab2a9f2c225acee39bb717c531577587
SHA256	76fff10bb2048bf2af658bb2aea230e332f25b1805aa905d3e9bdf3d5f53cd19
SHA512	e6846c2563deb4ec453e79510c17a7e4bddbe9c807098fbd55cd29f04063ad7638cb7ae0c8c5314a00192c85845b4f97fdfbd7ce085361789001065e4e17dc07

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7FR.DLL

MD5	2f31e36271dfafb58c291a2b2e665701
SHA1	0db0e908b59a8434f368551e52a7106d7ae21ee2
SHA256	51dfa0ac78931b068ba891f019e582f46266f7922116d9d3712be5894f83bf8d
SHA512	43584a9f97379a59f0322880ef7d0a08949dfdf2fc27684cf9793e82cab53671312d78e13b9650f0299d64cf5b6974019ea2a640c4da935dff2f15aaf9c4142b

C:\Program Files\Microsoft Office\Office14\PROOF\1036\MSGR3FR.DLL

MD5	b9016c9141481c8473e0d82b8e8c5dad
SHA1	0549888ba4eab5a1df96c9ddc72a141f9c763d13
SHA256	6aad337fb03895db80b034ed5ba9ada8e55332363e91a68f4456ba0730d02752
SHA512	6362455b9cb21021a6cf043bff98582db842308d1d6248767549317b7bb29160b39b17dc784018df589a9364b46c90ce3829dba1a7565170fe36849e46a5c8cf

C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7FR.DLL

MD5	7272592bd7df5ed9c0fa9211235f6489
SHA1	4932b679eee325a7c53a5510a7f3bcf0f12e9918
SHA256	718d6ad46b7795b825520106cbc2b31e3d54ebea9348031aeb5735851ba24a1e
SHA512	9748538b687c1215d5bb569090902a100b2e4d080c9cf73e5a18a3ac1d05c6edb9007f4b1d7ae5ec715ba4f372dee275f342ee1c8c2b9df4321dd0343dd7fc67

C:\Config.Msi\e5e9ff4.rbs

MD5	fad70ce6c82e546c8c66adafd474f158
SHA1	0a4bb8bbc62b9d1b9eafd2aa87cf1144d2510f29
SHA256	faebc187f30cdb65e2b547e630b70f062a139570b895bb65bf42e22d49af8872
SHA512	0e5d600b36bceb02d2d2663fd668c06c292ee90df5f0055d59f9ffa10888c37f3edddd2de5043fa765cd150819b77b5a34c153a50a8b038f105d9330024565c4

C:\Windows\Installer\e5ea001.msp

MD5	cd178c6d96a1ba88fb1edf37b3141421
SHA1	7012435fd710c86a2ff6159b602588fb485c7b6b
SHA256	10ad105cdaa93b10177c188db97c2f3758a7647c31ba97cbbecb074e0177501c
SHA512	e45eeeaaaf1016c5c22db736faf94f726f0482d555fbf9712486f911b6c4f9456fe1bd55f13fdb38695116ed708ff7b2e7d1585c4948a92c55e3d1fc40eecb9c

C:\Program Files\Microsoft Office\Office14\mscss7cm_en.dub

MD5	b36f827b21e7066195389a9a8c6bc88d
SHA1	167b89e2fba079dc7ae4e76a7220e38fc2611848
SHA256	2095cd4392630497dd489151ef5532a76490022ea3e01d7177391584b5620725
SHA512	18af54d13a155271019cbd16dfa3c8b0387833cd576eaaa56a6230e55923a673fd564eb55f9d3f45da39e406fb7f105e6bbe802ae05d3d2384037b045c7586bd

C:\Program Files\Microsoft Office\Office14\mscss7en.dll

MD5	e9ce69ce8ffaf68696b94c617a7f99c5
SHA1	9bda5c4779582da454ec26880ce0c4741aad21b2
SHA256	550cf814bb7d4ccd32c8f05f13e045fa28dd6b30d4164923c924a67281a2a964
SHA512	1fb868f11bfbd88192987a9273aecc28cb0b5212dc4a9359da7b02e6ce21c380fbafa1fc3c2741f93277df58ad31bf8775776c097ff0298789cf476c8eb54e30

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.LEX

MD5	b89b7d70033a7c915a6122d59fbfdabd
SHA1	b3864b2d433c9aa48d63582ac183ca56496b8ef2
SHA256	9e44739af4d645e45ed88710a6c8cd82362c7667dee015b0f715d7a527b27efa
SHA512	536d7f1d62d7a5de3f537e4ef90890657c2492818fe4816d45e4942a53f7904f6ef0b5ce737816d429af59f37f68eedd68e8ebea3bfe264b91748e97abcec48f

C:\Program Files\Microsoft Office\Office14\PROOF\MSSP7EN.DLL

MD5	0473121fff5cfd6b6b3659c79152349a
SHA1	4643499915f33d7452f6fdd656f9bf63b8e2a7cd
SHA256	3fbd01fb0ad263c83460d0dc8297f015a44d132f04dedcfbb16641dee2fdb3c8
SHA512	f9baded138348635790d973a0df1f27de255152e2aa44c9a5f71a285b2a1f60bd3bb678e0ef26960ff6d61bcd15075ca9ec267d1eeba9676137e4d70c1b228cd

C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7EN.LEX

MD5	1226ed8c726f8bbd2e934aedf7c0b0a2
SHA1	ea11a42131c1966bd67047e54d6207d58ee696dd
SHA256	73c53e2be29f13fd1be9c0a37801f4286f02817146b7ce58f877b32c490403ff
SHA512	32211e414043c4d4090518187687ef80a9079e822c66e58213a8167dbd1ef0590cf4e417119f2725dd75417a27b8bc6219137522a40f19b889d690f653cefe28

C:\Program Files\Microsoft Office\Office14\PROOF\MSHY7EN.DLL

MD5	5ba20d0a16a2f22af1a7311a93d526ba
SHA1	a532581a146821e0b6af5bd75a477029b4ef8cfb
SHA256	40615bad375b0adbfd4a2d7499104731967c8f8612096fdaf704d6b628f7e1c8
SHA512	317e4661bc1fdea6d7faa8f4f2085ff1eebcc885854d86ff6f72aa3c21fb0d642d76f3e6b1c4144989f2c693efac7c76134c3291c1da24530a12fae7fe9a0f05

C:\Windows\Installer\e5ea046.msp

MD5	3ca6a9c1a91c59ff45c3f6b65c79f4b2
SHA1	bd6d55e831a6e44d692a4ee0e5bd8dc491eec0b9
SHA256	1f381a0e497469222fae20aa466ee04f29a0079c0e19cb40bdefc24d0ad50f3d
SHA512	f8f5186b8dbc92e2e5da7ef1648a5542e5877bd6191e20fccad067fafe43db652a57f8a7ff06bfb0a6e2b8a7d5894714e637db734e634dab768e6b2af6211d29

C:\Config.Msi\e5ea047.rbs

MD5	7cc7a942ce7cca5067015fbb50736a6a
SHA1	1a000446390a3329149d850c4f78dabbccf87c51
SHA256	6ac084a6e6a28a4d119e2534725c93a5c0d7d669a940ffdf7ac311b40c15c42e
SHA512	731c2f08668ade34cfca428a2576e87609a43622b14c6e793d8038ab6a0ff539a6be291554818fc5861d13fe2fd343b14c9d94aa3e7c4810de7ad07ceb6ed28a

C:\Windows\Installer\$PatchCache$\Managed\00004109F100C0400100000000F01FEC\CacheSize.txt

MD5	6a19d1c8fba0f60a322a5ac578de2ab7
SHA1	57d24cadb45816d9505434161085ac7cd01221f6
SHA256	63a2fefacfb27ad6bdd347f0296d7191d1aba7b599982d7cdc2168340a039500
SHA512	6dc583aeb0e700fef7b4382169e851eda83fca901f6d588c64a2b4f7e20fcf4d671a5241037a3a3122f9d0938a70bd0e072e2db8d0763ce5a5869bff4b010024

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll

MD5	cb364c28403bd0c0f3fd4eba6b881521
SHA1	d65828808e5399bcecb0d4ef48aa460a703a88bf
SHA256	859c8eac0e6eeb18e8f36e876db46c975a09a25c14e36b5d6ca8f74cb061b647
SHA512	b887412cbdcb2b9f4ca03bb6a16114cb2c8f67aced4fd1c27e39884ae65c0f419e7ef0e1f6ae0f709167a61eda0335b9782cb60ca323e850add69e06a95e87d7

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\1033\MSOINTL.DLL

MD5	3e47cf2e9e575cab3bb460fede213799
SHA1	cd335db7e6998a203751cb88125f25e0a9cf6eca
SHA256	32761b9cb8f3f6be5d68bbcca52c6ce8fae4e0f5b9653c8272cf21d293ce7f34
SHA512	f1f3be738932c823a5b12e001ec42ed572a779f90fc267f7ddf062ca4b37b6bff4b89bf00e11b92d47435dc5f2dc868f52619d34f483bdd4a0bcaf88f24fb345

C:\Config.Msi\e5ea033.rbs

MD5	49fd0a7c41a5fdd89cc38db4edc611e2
SHA1	e0b7c152c3031c3ae1612b44012c452093c5aa49
SHA256	77eddb8187bfcf8875030127765529dfcbdb4d16207c7bb85b3865ada5ee834d
SHA512	6a629bca5e6b84f0a26c9dc22aa933c6f8e79316d7396ad8393a77407fe869e9d6d4b4db67ec79db5ba479f995cf8f92d07f646ef3de1111ea6b46c666c663de

C:\Windows\Installer\e5ea04e.msp

MD5	711a83d66076a1811ea04d80a5e193bc
SHA1	aa19506267e97fadf659fcc3ba6c0cba304d8aff
SHA256	63859d939c53aad50c843681dc40de7332db9eb125a4f160b6c49df00930aa74
SHA512	5aa1b29a9b9e788741c0be65b13f2fcb0285160c1edd2f4764ad21aa953aae1f39f50ed4f77d3c3302880e2398d5fb9a71f8bfc437463bdee3bea46adaa258bd

C:\Config.Msi\e5ea04f.rbs

MD5	5e2be0b6527bb07b10d218133726e8b2
SHA1	6ea3f4b5c7f705aae4ff73fdbd66051cd846a1f8
SHA256	78ace62b715eefdaff612434aeb371e182a7683615ee8bccb9940340a261bca8
SHA512	8a6f09f1ed4436f24c4f07e7f0bd32c2508d95f77548c7903d8eb0525ae49fef0f2a960015ca935785eefaddd8a1af25496d907572611b8e094d3e2ab45a1452

C:\Config.Msi\e5ea04b.rbs

MD5	104e5998eae5627857d82e9f16bf2970
SHA1	05b5f1f59fd6f88c71dd3eb8606d7ca84c8b9662
SHA256	5a09b463395988a57885b5ceeb7e94a98c4bfc6a29012800d4d09cfb23c3db50
SHA512	264d94b7874d7187411e4c81eeb387ebdc7d44b40b3f2555b4942641cbd9e88062bb6d6dad7698020d8437bc58cf169d04581372e1f5b1cf41688a9b02ae50ba

C:\Windows\Installer\$PatchCache$\Managed\00004109F100A0C00100000000F01FEC\CacheSize.txt

MD5	8213f5b242e129cd5982e7293d07b445
SHA1	aedf8c4433074b604390cedbadc199b97adab9bd
SHA256	2a47296ce9fdf1bd46a65784266cf8bdc984b1af38b97b05218733dd022318ec
SHA512	532de796e1a116a0dd7b108c82999c4283fff455805d9fdd2753996f0ba57d2366ce11f567d92e0cc2ba95736183bd9315828372a978987cabd879118337b078

C:\Config.Msi\e5ea054.rbs

MD5	0e7eb49df8f86765a0f9f0ca070dd1be
SHA1	04202eb27c9b08cad181d68e16757ac8ca7ee5a4
SHA256	ccdfd688becbaa0ffda8e044c0b1300c00dff3deede4421bc1c2940624b1cfa3
SHA512	324079ede17db8a5a865c4855d6ed1b204009ed434d9ca82427725c4796ea94b1b7d587ffaf99516bdb5d938245c75e04ca673d056f1f615c239a9423169fc0d

C:\Program Files\Common Files\microsoft shared\OFFICE14\1033\README.HTM

MD5	ee515d38f4a85373ff78bd26ddc2e762
SHA1	c6204657c991d968a301e7899551bf62afd917c3
SHA256	feba66dae6ae55e30fcc70a5513da641d2f18ad981187b1457a4ba4773d6aeff
SHA512	182458ad6d9fc98d2bae0c914acfef1f4605d3c3d873ee034cdbd78afa137d4864037906400151ccbe5b2288d9b9144459202428631e0e4ff0693b8d0faf854f

C:\Program Files\Common Files\microsoft shared\Smart Tag\FPLACE.DLL

MD5	8721edb09ce83d076c8f66ab8817dab6
SHA1	7d35f3567931bac21ac649871d1aa99845b85b97
SHA256	b467d20890f8e22e7e039fdb1cc50fe4372e96de52b7bb10a2a4a944a68d8764
SHA512	f72770c346ab6ed8ccd4886a1ce89a929141dbcdf471c42b1831ad03c0f135ab71755564d9ff3829a081dede414a3226caf2eaff3b0fbe29c178d87fbdacfe85

C:\Program Files\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL

MD5	ad5b43cbf1680b1f0a6bb3e2221c58f9
SHA1	de5ba76b2cdaa48e76ea149af016e1292124d087
SHA256	9127c03254e56f593f2287d4c1fa6d8fb13dee4db68857eab2f756b3c3bb4493
SHA512	9f95f0ea6fabae03e6d531722e87147e6666d2b631e6886ab92ee9fc8b6aa9dbc9272d80c4cf7cfd54235c950610612bb7e0d9408f3c2488c07a274301d172c5

C:\Program Files\Common Files\microsoft shared\VBA\VBA7\1033\VBE7INTL.DLL

MD5	b401166e91bf38f38ccde0d12891346b
SHA1	4b494eac1ef9c93001742fd49078a9f07e240472
SHA256	d01f8f6ccf065b75d6db45f56e98016550b938e065c8319494ffb913ec9bde30
SHA512	6a981b71ce11e067d6e719c75d690ee3bea33198e8bee4796296d23b9b7f44728ace324a073bd3f82708038202b9454522ebf6e0c51432010cdb61ade07915b8

C:\Program Files\Common Files\microsoft shared\TextConv\WPFT632.CNV

MD5	259d96a23323808860ccd39093d08f27
SHA1	d89d137b65571dae2bf4ad3af625d35831348b2f
SHA256	2f1597b75af95cd25e210bca74e301e2abd9a371ca92257f5ef7f243c07f6bd1
SHA512	ac0abde8e2ef171ff22bb6f9dca33d00e296506be4dcd07de4c8f41a0a8d4424163bf50eaeaa503d600eed1358c6df1ce6bfda0a93ccf3bb693fefe4322439b9

C:\Program Files\Common Files\microsoft shared\TextConv\WPFT532.CNV

MD5	140e6591bbc402ac14875acb8ee0517c
SHA1	4b81e752545b072e82f0b3e8e4786770265d5400
SHA256	2e7745f92a43eb23c11f70f04c5412e74b6ae99e89bdf72fbafff30e7f79436e
SHA512	e8450c587ce2599b0aae7028b6e31df1d5cd39aeef0a97af7e906eb4343900723db8395d86e273bf246ab5bc931111994c0dccc5eacfccc2b08d80ed269b707e

C:\Program Files\Common Files\microsoft shared\GRPHFLT\WPGIMP32.FLT

MD5	aabd4f29ccf02223cf25a5669bc0074c
SHA1	9ddcc8f8e7947d51e8c67b0975e273bb3e35dc15
SHA256	e2228e957b4058dadc73ab4f7dce1b06dedfbb38237547b46ae54a037ad4dabe
SHA512	3c96af4c45085543ec7f3e35b67a225dd8c4b770ab3717a83f28b880fd064876790d2ac7fdb06a17ed84a405c1ca7721c205000804c28032689becca2f8dc5cd

C:\Program Files\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FLT

MD5	99b7e066ebf97d1d0122c37d80a2deab
SHA1	aa59fa6649478ddbbcdc39da2ded4de23d40a5a3
SHA256	25c9fe8146824dbaea034e2e74974c213dfcda7088ca13e3397d41ce1c4f0af2
SHA512	4d07c675bb2c0f0fc2ee58ffd2f0802a993ccba5b49da0d9d60b463b86fd3b6b9f63ff1bd665ea9acce52f800e4c2500e79a822dcb9b7c8d603f578e0196300a

C:\Windows\Installer\{90140000-006E-0409-1000-0000000FF1CE}\misc.exe

MD5	4b64e94d7dd3c132416ead78c6ac45d3
SHA1	e3822d63ba43c52f5dc3f1ecf90f331da002580d
SHA256	4b6ea25ce1d15651c4a5255372c3a79bcf110535e42b474feae79621d77cd769
SHA512	c4f1b0540d1ec3941755911a740504181da8f4307c4360ecb37d247a005ac3091192e9c6895a09c9e26ae2c4dd738bbad768196eed1efbfc9472ac630527407e

C:\Windows\Installer\e5ea061.msp

MD5	ec6e4f83e72003cffec47e06d06ded06
SHA1	d369ffa1c882d96e617af83874b518dd94d8f77a
SHA256	b2bac7858b687b152a355b742f2fa5fab51a358288dc8f92353fd9cbc45dc8a9
SHA512	70cffd4ddec60ca953bc66e395375ea5afa948d831d1e7d6c0272860657ec3afbf857b5537055c45f07f7938692f72a56fa7a4c3e9677372de94fed23344e4df

C:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM

MD5	ee5090fbfb321094d50feb376c9e6861
SHA1	e5daae35a335609b3dd3ccf0662ddac1decc9b6f
SHA256	310bf5d94a3cb4c27d999c34e33a494fe871702990e1328dc2d80bce32cbccd0
SHA512	143fc4f7376fb69e136e061844c0bebc009b036e17c849adf90bc9773e2ec8ec28c26a900070172d77dd511dc3b8955f270271d34664db456db7fef27d7b789a

C:\Program Files\Microsoft Office\Office14\CGMIMP32.HLP

MD5	a6c2f6e5f56ea5dc5c756f1c5dcdb1c8
SHA1	87104d90ba64dbdad61adebf6c02e15d5e999192
SHA256	4a9aa24399f295788b7cd855eb3b42a4d2591c515d33b182fb7299f9cf95866f
SHA512	4b4c7f7f26228d5e4b0eb23bb628066b6b471ad31db2b9e9c920f62df48d0f558767382ef9ece75d243fe63f3884794677a94d17ba08469fdcf4bdcb48e07ef5

C:\Config.Msi\e5ea062.rbs

MD5	643316f631e5a89218c9cd4216ec1fef
SHA1	9d24660d8fb1d4a967dd5569dc21b2154b97d46f
SHA256	ea3f5edbc22798bf8ea9df0ea8db819c7548a825ba8d24b024329130b7a672ed
SHA512	3b553eb7399cf428704f6c0bdf8bd4cb2e58371419893e1e3c7354c1a038c8b46ef2f0a62cc6ea226d83ef552b39a26c16891eab733e1c2b37ad1d5b4ac45157

C:\Config.Msi\e5ea058.rbs

MD5	7b8a71acefc12191931ca65976c6d7ce
SHA1	759a1590c9cc4c7b09f31899788dffe3dc3c5ffd
SHA256	4a624df19562fb5c91930cb77f443591979968fd28101383e5a6adf50e4fadc0
SHA512	77270ca0b48335d5ed8515915ddd71f9be412cf1fd3191ebdcd541eaf6d5aeec2028b09c51650d4fb984961e049b5cafda3fe637ed802d4ce8aba9a1988e792f

C:\Config.Msi\e5ea053.rbs

MD5	7264443c7ab61c428fae50606c571eb2
SHA1	cde7c742d20f211f56037bb4d8fc605d22e80bc7
SHA256	e0e3e705420801e6374ee66d920a7ccf64668ea240f0cc9e3985b5f6d948f1f4
SHA512	4a97b7199084a987ce8b1c4aaa5077a7b54ff27d34a1192031f1caa3ad9462abf94aa791d2ba78068ee45b5432b74d6ea10ba03742735c32ff44babcf1e863a8

C:\Windows\Installer\$PatchCache$\Managed\00004109340000000100000000F01FEC\CacheSize.txt

MD5	93dc3ad79b6ebb5e4ee9532f252bc933
SHA1	2cdedcaf3a35a73985af4e03f78b848f001419db
SHA256	de1a302d90df32a293fc2063a2e1f2b890451c4197309039c2cb4f63823ef2b5
SHA512	fcfd5ed2116a81c3ceb3031a61d5ef3e96cf32f9e7a32745baba725108b4b670bf97bd6c7f46d0e94aa3d2d0722f3da0ddefcb442f2e50e513ff1c3208d2dbed

C:\Program Files\Microsoft Office\Office14\1033\ONELEV.EXE

MD5	7b5f028b55eb8919aedf283af3c1bbc0
SHA1	cedf45976913a52e81891f8dfd95c68780a50ee8
SHA256	038dafebb4a2bf8319673aee355a3cace91af10bacc1f9ee4543532a7434204d
SHA512	38aa03b090154079b30f2e97ebeb963577b52fad53c908751d2ffc93100fd7d5a1117ae32fc0b9b44e1dd90912c4e44e14bfb0eecb56730582868ae432560851

C:\Program Files\Microsoft Office\Office14\1033\ONINTL.DLL

MD5	50801ba3ae5fd872879d322e6c9bb492
SHA1	9f80332d5cc820f5f886d714200aa811cc4f2849
SHA256	e9a84c825210b9ee57a14c052ce896b3e89c621a7c76fc020240fb8b333c1261
SHA512	b0036f70572701485f8f4be8043d3e037ec96608bcb4e280469f600749f3c9eab2636dd91a7f454d0ff54aff486986ea3c383db1c84270dfc6c9c18400d3f49b

C:\Config.Msi\e5ea069.rbs

MD5	136b7c201dbd54034b2dcdc47287779c
SHA1	fd62d9d0cb2cd09791c0c5ed006cae0da4066cbd
SHA256	1ee3c017d1d698da98fd0f2cf0fbd373078718d8923c65be68fdf358c2ffb3a6
SHA512	1e897651720b3f89e55260061399a2e65d1e336aa70d9479cc237fd4b04877bac0ccca7a2ba60c7b63cca7bf298b7de44e8c1866efc790aa5ce9295e7158c763

C:\Config.Msi\e5ea066.rbs

MD5	673ff70e46cd53e8fff77fd201f3a91b
SHA1	87323d65b0769eb99c9e99e2f1e6a748e4d7dc7b
SHA256	3e3d56757e53b27936258d97ad96e420b778b1c5cc2c320721ce672252ee7c4f
SHA512	be60aed96d9217846c3568829a4061afb3dd82ce69165b372e744d0244a7f92a51700b9c086c3928ca232338a15745a834037ef0478a2699d5b991077add90c2

C:\Windows\Installer\$PatchCache$\Managed\00004109340090400100000000F01FEC\CacheSize.txt

MD5	353d28f034d015a63b84c5219a1318d1
SHA1	ebd732c67f36711e1209f9ba7d0dd9a01286045d
SHA256	9baad9569ca044d11702aeeebfcfc6e200960863406d4ac5f53a50fa2fb79fa8
SHA512	e00f99a0184bee6b2e8f7eb1a57368847bc8404506cdc523b7600622d0eac9d06474358c17bb3baa4e284d18f3ff61274b86c79823b643e65462942e3c115707

C:\Program Files\Microsoft Office\Office14\1033\GROOVE.HXS

MD5	f33895c0c17e99c7d79a1c7f5a90a0ed
SHA1	ba072757fea06867a04f9c2df97d26fc5d986696
SHA256	b3e8a97eaf88f2e3e8a126c56a31c31d7c42590d44aa3acc2bcc32cd7369085f
SHA512	f27028f83b410da5fe505c4cbad9de9d7cb47711f221914f183199ebeaa5b986a4793e95036b862b1ba750d6d8d943d6d13342cb949acc3294bc1fa0e9168a02

C:\Program Files\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF

MD5	f8cd7e5d9a3839903ddc41c919a5a6ad
SHA1	c46b774abb38d40289cc31140209eca9424de4bc
SHA256	8fc83ec234ca7b5633109baad97f52d7f2639732fd05763a8d86027f04872b80
SHA512	d549666c1bc626b5fb77479f6378cca161e8cad7d876ab56c31ced835b0a2a4f3578387d625fe5b73654128ce6fe825f1e8ccdca33316ec1915b080f034c4295

C:\Config.Msi\e5ea06f.rbs

MD5	a08795a48e436898811d3cbcc9846fa1
SHA1	a0b0e4404f4fba6f94e8fad697dc1545bcf841b5
SHA256	95978e4d5556558043565eca02d203650f98ef8f989b6d15fd2c5d75e33f5fc4
SHA512	22c69d2c28381fff842b8c968f3d28095899df3c2c9b74f952bd053351f9e0cfa2c452d74cdb7f7745929bb8ce0d17688b64679408ee59461e35e698ee364db0

C:\Config.Msi\e5ea06d.rbs

MD5	9a64f61470c4e455506fb12b2e8f678e
SHA1	daa5a440512e3d50a933857061d408eed855a2f3
SHA256	519fb0989c561b54d24062261130a8d8a01448123c142483538aa389e62cbc80
SHA512	73bc5ca1d3f2f0987f71b8760897f10321c9193aeb5ff2b2078f9bd00f58c68c8d8ae6a1e9581e4bb11fa8c7509e4c2d067c3220773a504b8b81b19c8ddea180

C:\Config.Msi\e5ea074.rbs

MD5	8084581ce3644b63594101e8b6d0c5dc
SHA1	838f8aa6b6db88648bae58e76caddb2b83b00a79
SHA256	1ce34090aa8e4e0daef9127dbf013ade037fe5cd3e93777fe21714c6d5bb1c56
SHA512	d0a2f620b81a975f85809bf15ed9a7264c5a10cc8e8163df6e22f1cdc0e9fdb5e63ee0b33ce722a2d537fa490298cff28ce2431df1868973d0c25464513e0e0c

C:\Windows\Installer\$PatchCache$\Managed\00004109E60090400100000000F01FEC\CacheSize.txt

MD5	ed62d605f00b8bb1b7615b5ecff8a4bf
SHA1	c057061dbda9a7912b1b23bbbabd7cd971dd1031
SHA256	185f6fc71ae20efbf052f0988c7828d62246097aeccc97ee49061a1e8bddcbce
SHA512	da0ad40d2d1b102be9876e8d184764c3d02a266815778e8c3f0b4f120a0ab55ea8b53429e71289c4b850875d2e29ac3bb8de39cd8c7b2f675c254493e1837ca7

C:\Config.Msi\e5ea079.rbs

MD5	1d01d949f99b655edc72bfba5163f16a
SHA1	68d1cc39ed12afbc9c70875c3eeed384ec5787e9
SHA256	a668ce6e37d2388f09d173d24977c3a46101c4e249a1dc8614219b71228ca8d6
SHA512	ba8dd3d9304e1fa82a21fcd9a68001695e45efbcd8f33189137499c2f8db1aac8d7f90330e6e7a5bfca48fccfe50faf32e4ec694e93051292f477aa8b6f09cf1

C:\Config.Msi\e5ea078.rbs

MD5	a03d53ded2020189679e683254393c8e
SHA1	1aa841e4d4ddf049c6300a2ee0b08c2020881ba1
SHA256	dc9da734c4bb84e28bb6bf85e950e692add66cc69d21d92d12f90ad7c85f7dbe
SHA512	0a4a5e46faa6eebca436900c67b819a8c7b4f2a430c6b771ff58bff3f1270333c780d379eb478f3fa17ddb5277086d115ccdf3d2180f4d91dc55a7494c79a57f

C:\Config.Msi\e5ea073.rbs

MD5	cf1da26f569f33bb23773a097f533ecd
SHA1	3b7fe5d805d182ab606e7e7ef23b88d8006e836f
SHA256	b66b73117fa94351c8dcedd4d36fe1d7c4a49e010cb90376484ac844d7012c07
SHA512	3c9cb78510bcab8b281623d9d1a2f71475c5d6f2b5e64c92994a686944089dd7b394f41ce0bf7b29d5c0caca1ccc2155e07023d547536c9cef06fc53f965a32d

C:\Users\Admin\AppData\Local\Temp\nsq9471.tmp\INetC.dll

MD5	31743360799562f14d8987aab431359b
SHA1	9352c616c29291be4a79675fc4d8816e67e84b53
SHA256	fdcb3727bc1920f94d80c2899634799ad5b509018cee395cb367da8352e5fd13
SHA512	1f094368c421bb740e7836f6825c2d26f0205607918ca29890c43cb5786e4a5e8bcd98fde20926d352d0863f66393f367f40042b61afa0b2f24a7e047bda3d74

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133624206165670744.txt

MD5	c1dffcf0e84142fade1afe4afcb629b6
SHA1	14be0664f66c413715e8ff930a43ae217a1c03b4
SHA256	2f6a67fb84919744e49f1df4c585df57f1b6bd1da0ae61997d6359c68c5770b2
SHA512	997dfa754d56a40f57c2ed389b893c31f3039e976752453ba71b10997f869455a0caf920997bf318352def3ce41869516d7b522488669dc5162376fe9385f6b2

C:\Windows\Revert8Plus\Office14Visio\Office.en-us\OfficeMUISet.xml

MD5	1499526cbb2075b26718f2e137b6c2a8
SHA1	8652692b1c0c4fd96ecae3b0cb4c9eb52e699644
SHA256	2c0ab677433a4e0bc0ab087e39beeb1555c5b7cb88a1f35113c46685cb64ccea
SHA512	15e2c7a4847365a1add166afd0bbcdc581c3a2d4c3d6865ac0e1016ed6f56f4fb9da3c0dd37475cc0509f1de281683a626945e2dfc920604d369efe92accffd6

C:\Windows\Revert8Plus\Office14Visio\Office.en-us\OfficeMUI.xml

MD5	4aacb335a806ab7c5c8f660782cb2a5d
SHA1	06f6e3688c608e6fec749f4e92265fb2a769ffe1
SHA256	60f5c4a3989bd5e3dccbb36f35ed71e3f2a78035e0c9b166ee377e6f3ed430bc
SHA512	dc14dcc572c657bfd200c2048fe1dc98aaedef75e51edeb5fb50b6fc78f8f6bcc70d77ae6bc01f0c4a3352585435d0ad034c2c3406e05f20def6ef432d63a98d

C:\Windows\Revert8Plus\Office14Visio\setup.exe

MD5	25843d2567f92c722d1dbe3997623e04
SHA1	0868115c7d37814f1a5323936ad5d09b332849e2
SHA256	1ac22ca1b90fd3e78e7b843346e218de10e7ad20ef3eeb5c56498cc4a2066c72
SHA512	3b82fc1205af01cf8afc59b990c60ea2f0732c714ee8c5d150659c925e0a1a96998e96029a1c9b9bd0ee2b264ef4229c360afeb916f9cd750045aed0985ef2c2

C:\Windows\Installer\$PatchCache$\Managed\000041091A0090400100000000F01FEC\CacheSize.txt

MD5	6e8774dd75905d93ffed768b92272053
SHA1	322655ee7447a1e070538182fa2f92f699916aea
SHA256	000f9dc7de816c5b470cd892f3396a4d855a111a05723c893d5340c2b3f2f0d6
SHA512	d9730902c5ec17729093845744b812c99716be79af3cdeba2ed71e081472dc971f72cd100f948e913b542abc9f7c90a35f05a44b8c6ccfab96f2c670e0bd7ea0

C:\Config.Msi\e5ea07c.rbs

MD5	6df09dfd54da62f4660ea5a8432795bb
SHA1	14eff4afb72e44b4609d85924e63b560a2148bb7
SHA256	a5b4d3259496ff49e32d4e627bfb9276280ee3939e9dd6c7fee46e0ee9fb4789
SHA512	0962dcda23417969ef50848050b88061348479b66db305ea8b669404dba3ad1d65e0a6fdb77160d7c301617e280cd852026843655bc310b42a21e5eca99cc706

C:\Windows\Installer\$PatchCache$\Managed\00004109AB0090400100000000F01FEC\CacheSize.txt

MD5	34fb75f16efa4b08533332ab6e40995d
SHA1	a952fec53b58827e39c58dfece2984fe6e9c871e
SHA256	7a6fb2d5df1b2cbc305bc06f9ed0c66482844c4b3466796e25ccb6e70de20e85
SHA512	d6cd64a6b117d929f62abd4d1c4c542ff33d911c07f9c6dd2b2f53196fd66a2cc5ac2695dc1946c05edf444d40f9f6b418fd50db665609780070649327d64117

C:\Config.Msi\e5ea07f.rbs

MD5	c14f9edc4cbb96022825a1834563005f
SHA1	c3debda24c3825149265b0064f18e5bcc8136bad
SHA256	412705cab27922aa99d120cc511f59198b5232ae48fbbc131ee91e680e13313f
SHA512	9bd24a419f344777eb505ac536f7297533fd514e24a63267e2e02aec702e509cd7d677e04fb8b463cf55e786f7598773daa8ff2f2007b1dd271c3e1a7a9b0d5b

C:\MSOCache\All Users\{90140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml

MD5	1c187b64b0bf8791c284b15a03b5777c
SHA1	bcc508fa93e7386566c1f8c5ad8565ddfae6860f
SHA256	f2332c24397c5064198ddc6366a173312bd6c73e55c3ce598d33f24c5ecc3e52
SHA512	b7c3817384085e05f50c0eabb14a9bdcfe97d7986604c0fe638af8d876968a83dc9f5bf230cb8f5d2ee927503364365542ac80311fced8d27f570edb7a3a487f

C:\Windows\Installer\e5ea084.msi

MD5	60341f82abf4a5ff3d1d89f685d9ff8d
SHA1	3854ba242d818072a2663815a0d58908dbcf9265
SHA256	0414fd74327791588477303a25b1b7b1c63d7cce175e9c1c6045c364127e4556
SHA512	dba1d27a09602bb1bc85f85f8c05a28378e5c73db661ff70c85ca120cc6505bbce1cd66cc1d13775944a1b61f04e1d4968023ff62b2661a8c459aafb07711f17

C:\Config.Msi\e5ea085.rbs

MD5	614a597af53c80f17c629ea766026d81
SHA1	9874501130c1354b9e515cbb21b1b206aba420f1
SHA256	7f08ed3ada961d6d030455acd3c8569d9ed5282b6849bf6e365ff1a65af27cf8
SHA512	0bfcc6b611f12ae65b53a2d04f7b3a8dd77758c0c5b6b13694b120fce516c80138a3551707dc55447551aebbe442b24ff92bda5d6cc5561767878a6ee36b96d8

C:\Config.Msi\e5ea083.rbs

MD5	4afab5068d302720f3636d4e40b279b5
SHA1	655eabae227933aac4f3ede0afd17ad30474ecd5
SHA256	78723db6ffb6658acede178eb67e66b1b6a2bc51972f76b14819838281773f00
SHA512	cd20302765ff4557d0885674a251a186e248e76ebc454733aa29bb782192acae9aece7640d23950b4c279f566dc1a7ed3573793995823e5de317e920844a8f45

C:\Config.Msi\e5ea088.rbs

MD5	aaffb1e70b5de580f9fb3f79760165ea
SHA1	375752f04c485e8a78a0e1acfed770450a1bc6fc
SHA256	fe5db12c0c3f922403c409461757cc44453ba0337ae2d224625808df2703edb7
SHA512	43220f63e7c8bd9d5808f8774ef378f294980cf63028d8d72e18f7fd73343f453d52e57ff33e6e023f4eb737379d435fee28c90f8c12475e6aed8ecb338d47ff

C:\Config.Msi\e5ea08b.rbs

MD5	93f1308e180cf647d58fb163a7e7f778
SHA1	bff43ea68058b54d6eb7da5f1e9e5a5875cee9b1
SHA256	e064bd8f7235d623499b23a3a629d25c9b3cdb812a4892ace00e12c6127deafc
SHA512	19c4a695a066a2ac6520bd8c35c8bc421a16ed0ce183377ceec22a25dd02c5c69cfae6eb8e798c78b4cf1e28b8a5a70caa568a09e974199de145231fd192cc77

C:\Config.Msi\e5ea08e.rbs

MD5	a5163cb1c2375240b009cd001322b938
SHA1	9c7a3e7f59b7f597337914c65dee4d2099e31bb9
SHA256	038394b553a28eb2afc64883b0dd0133d0360503f02158a82e75f22dccf82b98
SHA512	c3d1e15d5b5477ea9a408e7d96e1d4f4a2d3882f230dab341ce5a47124f7b6c7ec8caccd650c9d20762607355119bc4f49a90ce3e5416bd07980eab7b1b36f96

C:\Config.Msi\e5ea091.rbs

MD5	77ccd401d8d7882b81c858c7beea49c7
SHA1	3c96154cd2fd762de04f0249315011018a3fe7de
SHA256	1a6689910bbd57b826a3b7fb4a3cd254b2029ef56c80ca31a84f36e5e3ab7310
SHA512	9272288f756707c807e9b2cb8060898af5399d846298e10a6e2ea5bd5de15db99de902549199678a82cb6f1461e4273090ca10d078add948c526fdc4ba49ed4d

C:\Config.Msi\e5ea094.rbs

MD5	ef078a8ab2bd915096c030f8f5a3ce6c
SHA1	8fd2b6ab1d9e968ca53d169ab2ead0f00015a4a6
SHA256	8c2a62b42f5b4e80670010de717ceb0f9ed2d973b01193828ea57d9687b9a62f
SHA512	4c196307dc8352682d3ddf8f4499249075fd08e1bca890091289118e718748afe464fc41f32d9a96b1247f9ab0f41621e24227dc026371765230d1cc112dfba9

C:\MSOCache\All Users\{90140000-0057-0000-1000-0000000FF1CE}-C\PidGenX.dll

MD5	2efa469128a914951be8304f09a3ab2b
SHA1	ab3bab8ca3d4e26463404a23ee222a9c33a1916f
SHA256	e48aec1dca695071154ab2f24503ffc1edd1f5a3530ffefb5c674d94e875459c
SHA512	35dba19323e89576eecc0ad85d7001737aef217ce1460f110537596cc5472b4bc37b61ee2441d9c14878276aef310b6e7d53311a62164a3a2d2558bca6aeecc0

C:\MSOCache\All Users\{90140000-0057-0000-1000-0000000FF1CE}-C\pkeyconfig-office.xrm-ms

MD5	52f33d4193cdb033cadb3d394649a530
SHA1	dccc0fa642aa202cd81d2bd158cf8c58da6d2bfc
SHA256	11eb434264480f234b6be9c05dcf8f057b1d7205b56ae6a7bfff4ce3a48b9979
SHA512	2f04ff7e0d8b949882f23cc59b23c6ae95af0d6e3ef957ce0d7d22f288f8acb5ec656a2702e1024dc5502075ec90c337a5e8d5a5e3e88540a6d9181e41c29f38

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

148s

Max time network

150s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	14.160.190.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	17.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240426-en

Max time kernel

90s

Max time network

140s

Command Line

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	196.249.167.52.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	64.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	104.219.191.52.in-addr.arpa	udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-09 15:11

Reported

2024-06-09 15:20

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$WINDIR\System32\OpenTheme.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$WINDIR\System32\OpenTheme.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	171.39.242.20.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	32.251.17.2.in-addr.arpa	udp
US	8.8.8.8:53	144.107.17.2.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	5.173.189.20.in-addr.arpa	udp

Files

N/A

Sample ID	240609-skz8kabg9t
Target	r8p.exe
SHA256	3a84d12bad1426f87e3ef91772834be1a9d8f975b25c1840caec5b0bb85449bf
Tags	discovery execution exploit persistence

Malware Analysis Report

2024-09-11 05:55

Table of Contents