Malware Analysis Report

2024-10-19 10:42

Sample ID 241013-wn94qazelh
Target 414d06a8dca67540149d09179683c4f8_JaffaCakes118
SHA256 43694a890d49248ef9336363dad7c2eb1ff1acba24a8f25cb4cc4181213a0495
Tags
xorist discovery persistence ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

43694a890d49248ef9336363dad7c2eb1ff1acba24a8f25cb4cc4181213a0495

Threat Level: Known bad

The file 414d06a8dca67540149d09179683c4f8_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer upx

Detected Xorist Ransomware

Xorist Ransomware

Renames multiple (6091) files with added filename extension

Renames multiple (6359) files with added filename extension

Drops file in Drivers directory

Manipulates Digital Signatures

Loads dropped DLL

Drops startup file

Reads user/profile data of web browsers

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Drops autorun.inf file

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: GetForegroundWindowSpam

Checks processor information in registry

Suspicious behavior: RenamesItself

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-13 18:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-13 18:05

Reported

2024-10-13 18:07

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Renames multiple (6359) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\wintrust.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gX3l02hO2C0d6Y9.exe" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.19041.1_none_3802d0d85b60df4c\autorun.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\UcmUcsiAcpiClient.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\MsSpellCheckingFacility.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\opengl32.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\PortableDeviceConnectApi.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\qdv.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_fsreplication.inf_amd64_cadbd20a667cf903\c_fsreplication.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\Speech_OneCore\Common\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_e1498a974ab95ea7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_3acec385f5d67bdf\mdmcpq.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\mdmgl009.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\F12\Timeline.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\msvproc.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_apo.inf_amd64_a261b6effa32e5a2\c_apo.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_a08737ea39f5790b\1394.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\circlass.inf_amd64_9f3f831d13d3df1f\circlass.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\msclmd.inf_amd64_d677afecc5e43162\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDRU1.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100esn.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\mfmp4srcsnk.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\dmdskmgr.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\rpcnsh.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\RpcNs4.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_161e1375bcff85d9\mdmtdkj7.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\pmem.inf_amd64_acec109593aed940\pmem.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\wintrust.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_9321d33f1997dbfd\idtsec.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\drvsetup.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\fdeploy.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\hidbatt.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ialpssi_gpio.inf_amd64_62ffa3c95446bcfc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgsm.inf_amd64_d7b1959484ec8228\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\hmkd.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\oemlicense.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-com-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\c_smartcard.inf_amd64_bf5afc5892966e30\c_smartcard.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmgsm.inf_amd64_d7b1959484ec8228\mdmgsm.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\prnms011.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_6a68abcc31aaa333\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\f3ahvoas.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\AppResolver.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_e09ac82d497a19c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\htui.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.Networking.Vpn.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-shlwapi-obsolete-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\downlevel\API-MS-Win-core-string-l2-1-0.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\hidvhf.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\hh.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\miutils.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\MuiUnattend.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\tcmsetup.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.UI.Xaml.Controls.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\Dism\AssocProvider.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\FrameServerClient.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\imagehlp.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMJKAPI.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.Devices.Perception.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d4.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\questfallback.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Skull.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\Microsoft.VisualBasic.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\vscroll-thumb.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.AuditItems.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcp110.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.Excel.Amo.Core.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Microsoft.Office.Interop.Excel.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-72_contrast-white.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\mso98imm.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppSettingsCppCX.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\Microsoft.VisualBasic.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\AgentPlaceholder.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd2.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200_contrast-high.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render_smallest.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Common Files\Oracle\Java\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare.scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\swscale-5_ms.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxAccountsStoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Timer.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemDrawing.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\VCCORLIB140_APP.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\amd64_microsoft-analog-h2-hydrogenrt_31bf3856ad364e35_10.0.19041.1288_none_6a70c7f973424381\f\HologramWorld.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..input-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c51c2008839feaec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\ImmersiveControlPanel\images\splashscreen.scale-400.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\forbidframingedge.htm C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.UI.Shell\Images\PasswordExpiry.contrast-black_scale-150.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8ffe0868831c5fdd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-qedwipes_31bf3856ad364e35_10.0.19041.1_none_0d70663349a889b7\qedwipes.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.19041.1_none_d69cbb4282e4fe2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-installer_31bf3856ad364e35_10.0.19041.746_none_590aefff5f03d876\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\msil_datasvcutil.resources_b77a5c561934e089_10.0.19041.1_fr-fr_d050a8a129107891\DataSvcUtil.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..-messagingdatamodel_31bf3856ad364e35_10.0.19041.1_none_4ac2563867054b0e\MessagingDataModel2.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..dcredentialprovider_31bf3856ad364e35_10.0.19041.1202_none_c11f7bf5ac246af8\SmartcardCredentialProvider.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1_none_a239a51f957f6b65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_a6017688e5093466\dcdiag.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ce50872d244d15c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.19041.264_none_f62481abb9c79874\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_windows-staterepository_31bf3856ad364e35_10.0.19041.264_none_e4e6a1265c59e73b\r\Windows.StateRepositoryPS.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_windows-staterepository_31bf3856ad364e35_10.0.19041.844_none_e4fc4c625c499e43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.WindowsRuntime.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_dual_prnms002.inf_31bf3856ad364e35_10.0.19041.1023_none_625c42877ea35108\f\Amd64\FXSRES.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..pwindowmanager-udwm_31bf3856ad364e35_10.0.19041.1266_none_fd58f14475a94352\uDWM.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-geolocation-framework_31bf3856ad364e35_10.0.19041.1_none_c6f9e29ceb83dfe6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s...appxmain.resources_31bf3856ad364e35_10.0.19041.964_en-us_4b2b93dab62202e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-security-ngc-keyenum_31bf3856ad364e35_10.0.19041.1202_none_6ecd7c664a3c54ea\r\ngckeyenum.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\aspnet_rc.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ja\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmiv2-miutils-dll_31bf3856ad364e35_10.0.19041.1_none_2135df93bd1c37f3\miutils.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_system.servicemodel.web_31bf3856ad364e35_4.0.15805.0_none_7f2c9ed6201227d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_system.windows.controls.ribbon.resources_b77a5c561934e089_4.0.15805.0_de-de_dad0bf0aa07ef605\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d0f4f968ac9a2445\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..on-onlineid-runtime_31bf3856ad364e35_10.0.19041.264_none_30bf3c3e4f94840c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.19041.572_none_104ce2457a4ea0ee\f\gpapi.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\r\dciman32.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00010480_31bf3856ad364e35_10.0.19041.1_none_3fdf3869f67025bf\KBDUGHR1.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wia-automation_31bf3856ad364e35_10.0.19041.746_none_e36b9ead22ada5bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft.visualbas..activities.compiler_b03f5f7f11d50a3a_4.0.15805.0_none_8e81f622b328ec49\Microsoft.VisualBasic.Activities.Compiler.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_presentationcore_31bf3856ad364e35_4.0.15805.110_none_a78a1aa4c54fe308\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_presentationui.resources_31bf3856ad364e35_4.0.15805.0_ja-jp_4f617ead760c0a9a\PresentationUI.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mlang_31bf3856ad364e35_10.0.19041.746_none_3f2d4097772e54ff\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\sysglobl.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-defaultdevicemanager_31bf3856ad364e35_10.0.19041.1_none_16831bad73fad121\DefaultDeviceManager.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msvcrt_31bf3856ad364e35_10.0.19041.546_none_af4e7d20fdb56824\r\msvcrt.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-smbserver-netapi_31bf3856ad364e35_10.0.19041.546_none_1e9fba3daf5ad632\r\srvcli.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_4247919c34819e8e\@AppHelpToast.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-directx-direct3d11_31bf3856ad364e35_10.0.19041.1202_none_6ecd2612b74330f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-msvpxenc_31bf3856ad364e35_10.0.19041.1_none_1551fee2ba3a5e76\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_e45841894de6414b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Controls.Ribbon\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fsrm-common_31bf3856ad364e35_10.0.19041.746_none_a7a7f673bf9f2fad\r\srmscan.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_system.runtime.caching.resources_b03f5f7f11d50a3a_4.0.15805.0_es-es_4670b316cc7309ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.SmbSyncProvider.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-s..-universal-internal_31bf3856ad364e35_10.0.19041.264_none_660eadeb8dc39506\r\Windows.Internal.Devices.Sensors.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\System.Web.DynamicData.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-jkshared-roaming_31bf3856ad364e35_10.0.19041.1_none_fa09f84703cb02c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-media-streaming-dll_31bf3856ad364e35_10.0.19041.1266_none_c3362d14bc331f07\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_system.web.resources_b03f5f7f11d50a3a_4.0.15805.0_fr-fr_07fea98ca27ee604\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-u..access-userdataapis_31bf3856ad364e35_10.0.19041.746_none_f22bc9cc54629ea4\ChatApis.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..lers-onedrivebackup_31bf3856ad364e35_10.0.19041.746_none_85b0efb7891980d1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell\open C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gX3l02hO2C0d6Y9.exe,0" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell\open\command C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "FYKFBQZZCSUGDBT" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\DefaultIcon C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gX3l02hO2C0d6Y9.exe" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1772 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1772 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1772 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
PID 1772 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe
PID 1772 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe
PID 1772 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe
PID 3888 wrote to memory of 4028 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3888 wrote to memory of 4028 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 3888 wrote to memory of 4028 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 3764 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 4028 wrote to memory of 2156 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

Processes

C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\img826.pdf"

C:\Users\Admin\AppData\Local\Temp\killOS.exe

"C:\Users\Admin\AppData\Local\Temp\killOS.exe"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1E18F143166BEC1114009F8151EF5BF6 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AC9BD221ACBDCBC47006B29ACC8EDE1A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AC9BD221ACBDCBC47006B29ACC8EDE1A --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9CF842C499D104DEAEDEAA7ABABF6C7D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9CF842C499D104DEAEDEAA7ABABF6C7D --renderer-client-id=4 --mojo-platform-channel-handle=2296 --allow-no-sandbox-job /prefetch:1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F53C27E06BFA6941486BDF761BDDB750 --mojo-platform-channel-handle=2660 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=28078C821D4D1A98305455AF322DC523 --mojo-platform-channel-handle=1876 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=515A19A112D2DC7505F14D2C9A89E45E --mojo-platform-channel-handle=1908 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 132.4.17.2.in-addr.arpa udp
US 8.8.8.8:53 107.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 107.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\killOS.exe

MD5 3aecd251d296551ec8827008796244e5
SHA1 2b225bcd484f71b14e3c4792cb0c5965b26a830a
SHA256 9be38b91de4c97f277b1cf221e8a3e8b95141e617e82cfdd5341faba775dcfba
SHA512 ac2a5f2ab6173145e02c07e52a423a674ca9a1da309c3027e52dcd1c0302186f0d1d124c6d89302f011bd945dbd1f92b0e44a9bb7d2ccf081f7a58859f9fc975

memory/2364-11-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 7b7d352a7eaf1faa87385a24b34edf71
SHA1 d2d03c8c818f4abc41d4e25b9f98c4cd32e297f9
SHA256 b83e129ead7114bab33f15ddc0aa4939a588f120867304a95063adb8ae62ec88
SHA512 a1383cd45991a0e73fee095172ed3f024f1d98c1e0ce517da5aab2cbc376924741efe6df9909e2469336b1dd6a04c9f4e83d7f3b7f196c016cbf14fc6f0c7753

C:\Users\Admin\AppData\Local\Temp\img826.pdf

MD5 421d272c6219e99e448057941cf73f26
SHA1 1ec8c0a01a3d6dbf453b511b5f1775374729fc62
SHA256 91b02198b439c0f2f91bb799823f6515ab1c2d679e46731b2cb61b9d8d9565be
SHA512 5a64436e82192be1b365cf40d34cded2c34952ab90c970af045d4962c89bca3dc605a0fe2d4e38ce9c9dc2ac6df806fe9ba616ad288bca4305b6fd553daa0ed3

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

MD5 2a24074f52ad6906256e9d73d757d4e6
SHA1 e538aec0b42e3b6e33afcba138caccfafbe61554
SHA256 fda026e67372a0080631adc2434835aacdd91b71b68c7529cfa7bbc768067f0f
SHA512 04421f58f79270ac4b857cad0e9dd77ad48664768f271c61bfe82e0f764fa083782bb0bd85add84bc6822766a1bf5671fa9c6a6331ead9919a168a8948d503cc

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

MD5 e29a98e3111b7e157ec7a4901b740f45
SHA1 dbdcccc05e6e6fef1281b1931f34dfea93cc802c
SHA256 a13ca8c9a4609cc47b909148bc9faed4a1e9eaa5f5c504d79653b359c40d4134
SHA512 d58eaf4cdb672a15fe06d9e27df0c5603148f4c1970c227f5ae6c19eacabaecedbd8c55039b35723adde4332e7e9c4335371690f64b11c49889f3c464faca654

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

MD5 73eb32fb1693e6b009441292e96adb64
SHA1 d9d84bc64503958057cc61f132838794a3115f24
SHA256 0632ad6b50cd17eff1ba82b32bbdcab2268f2266ec5f9207cf908fb6c9d5c78f
SHA512 f2ca331bba8d2934e387a534a9b17c40bdf8f41301cfd435718bb1ddace0ede0aa09e9eb7d7d577f3fd62bea15222b956a9f0f55e4fa7ced56b3aa0893e7c3f8

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

MD5 9cb23f7a97b5f4d9ee53e918f1eab342
SHA1 6ba02a34890b0eb7ffeaab64a14ad20e48bea4d1
SHA256 b16b282aabab4e246380c8bc91da1d1014d63854186898f196e6d57580a0f788
SHA512 3283346770c9155c5c344e146cb7c9b4abc777e7a2e46d2ea8e1f209d5e28ae5aca9d8f047dc4687093da29f212c55710429941353ba5c44257558094a5301d0

C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll

MD5 9d031e302d4459a6bba2f94f0746055b
SHA1 93482dd83600b94287158c6d017247592d60dafa
SHA256 8f60753cfe301539a7243290d3b1a4a3ba4e3700bc8c8cfa136c39eced51bb53
SHA512 c6a19fcb0889aa85c16549e1da215071ac5fedd71577f09bcd5b56f6b2b98f3e193a639b0f0bda636dd6179ac284a82a0432fb18204a5ac55bf5cd5e0c2840bc

C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll

MD5 a8349e4dd90028ee382eb9e5eaf44942
SHA1 d61c663724fe0d8c80c4db51045d64da27beda58
SHA256 a79364603ceb4b7579b9b83c7906c0e4c9342179c314d65b21976f0b04f82f9f
SHA512 680413ad68387a0d10c55ee1cbaaf0811c2586dc441254ae291223e38a90616a4c8273d6d005aac9a4bf3fceed53cd47374c95849197c1800762dc6feec72980

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 3797e72f022ec08e7f4a33e1e1d14962
SHA1 a46948a11e241102426a541cc8a5580097cab213
SHA256 61304a304d3fd32aa781eb96691240fc5a49ae05cf9ec6f2e78fec13fd812a2d
SHA512 5f75fdd63da242d3db8580dc7984959a7001da75e33eb7f67fcb24619cf6655390384c75754e5951910c9561e5aeff4dac7dafefdceaef6338ead5ea0b5284f7

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

MD5 ad212bb0901566df12bb3015fc64c2b2
SHA1 3cf8af215c73657c0318c396fbe5f05e69380fb7
SHA256 8b9fbb648d05c1be2305fe2bbb3850a3005982289c3f27e357b7d678a391baa7
SHA512 a7b96655acb65ed35aad79c10b5769d3cd96a9656ac1366772442cf8910b53e2c91c1d23b13ec8a8056eb9293270e753398be7b26ae75bba65fb33a9549911af

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

MD5 45e741ce87942bfdee7d703e29ee4a2d
SHA1 2d8341d7f586d793dfaed667c3366cdcaded4f0e
SHA256 311da3604d5953aea33ba8a021e874d758e7845c1f377ba53af572253b561e70
SHA512 caff2a98df34626b49d895d213914e30ee4c27c8877e52773cda31ff5b80e8f83c884008a5cdf42235676f7561887502ff00506c1a4ba76933bf3c7d0472009a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

MD5 0828faa274bcfeb8ed7a01e983a9c285
SHA1 90e6f1990f3eec722bb7caa075583480708ffd08
SHA256 3a88a8a7c58d488a83105c5eded1202125e16c857019a4a9fd076aff810234d0
SHA512 1d24b6b0357c8fc1da6da068ce6fa962ff13fb0dda750158b79dc551f8b8cbe97b604a2238967043d6f40759d9a05a7f35ff5c1ea9753c0e1e2dc23d29e13aee

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

MD5 cb26fb70535e06b273aa4e89b02a900d
SHA1 7ec8e9bef3c358533b5bc098fd8ead0ec0f7e8c0
SHA256 77c20e43c21b3a46ab0b9d8f92fa264335f16dad116f2df2faddc4395a1139c4
SHA512 bc7b6cfd0a865b32b1e9ff7eca708bc572385fb425d6519bfb20972acab4a54000c384c039be2ee23111bfa3c671f4495f38c24ea571cf3c207461ebdf0648ad

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

MD5 84abfa0fa2ad0fc53d08bfde8926adc2
SHA1 62ae7e31306b64721241dbdab5b884a1a87d243b
SHA256 aac036995bf1d5393e2b5ae4d6dd364043696883cab38f9f08472738a14fa0db
SHA512 b37e5c0929d4919fbe6131a09233c093afa93f7f4fae6dbba3f34eaa4ad3be1f73d3a374b93d049864a69d389d50596c7cbbe786261c70406e4ea8db8bc1dabb

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

MD5 f17bd4b05146f17b2a92b8a61a214308
SHA1 54c665573763cda90b555e722e0cd061a60888c5
SHA256 6d3ccd284deaad5dc358ea471c165b5a3259e43fb3d161b3f0edc8a3657e328d
SHA512 333de24098b05e7bfc818b3426bde078cf47e4b4a621f79734469adc904d1aea9fdf9a29a2538cf870f0399bc35852104b437833c9a03a53cf0102d2e9935130

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

MD5 e136eed8632bb42f4900c7be3e353aad
SHA1 b79d44843553e88751941dc13e5a66fb499fae9c
SHA256 07b4368552173a8b7daaecbf3b8c2c75032c101b654ea836aebb904c3ad0d581
SHA512 3d9689b676024acfa81e1beae18fb29bc39b9b65b8b2cb74c657b987688f5a11d66d5772bace931a9f747cb16dfc4f40dd2882711e976065c54146e2bd433049

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

MD5 d181643fe4a9a87a4c8bd71ebbee3361
SHA1 c3925049499a5c614758ceb991ed8799e8b3a295
SHA256 57e76ec5c4451eaf3c1e8574fbe617469e343057438c3ff00b11444b63cbb199
SHA512 f3f6d0938d91d929351b134cd551ea674a96276b57f56209bc51740e78ab3341704f9cbf449d3f67c8b2a3a1f2915f25f3774bb3ffa6ebec259b8d5f5e206116

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

MD5 3af14dff108fe82ee1c7da0461ba335f
SHA1 7894e3e07fcb87e1ffc61d283407053b430fcb53
SHA256 71aa291b3ae020d594a846fb95f0f076e05cc5238875b2d0a4d8c0ace8d2ad2e
SHA512 b8855f5e685191f6e1eb2622185e754c91b2aeb1de235411e3dbee1a8aa5401aba9bda37e0a587312af646b46575a8b5245dc746e18a3b1daa4acd58a80d1930

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 da47446132f235734824db886e66558b
SHA1 83b9288f273336a2cabecb0034720032fb48e26b
SHA256 69e89c82a775c4e52b5cf0ffe6083b1f4a110f5f3315ce6e89d9d7fd1f95a177
SHA512 32062e95cb5ccc9cb166f8b60b7691bff5d4ae80580d059fba8bcf1e1edc07092fe9137b43350bbc267504492709f261f9c3ef89f1c361c42034f3d54159101c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

MD5 99f5c00391d93b08ca82ddc9d46f4436
SHA1 13db84f8e5b68c4886a161ed6cbde601c7d1775c
SHA256 6af467029cdf57d20164f63fb447e1ab6cb15ff2b205d7e273533ce76de63465
SHA512 c80f4df6ca4c4ba51e57e8405e179b397ff97085f41915685d8d188b0f254d0a01345b54e83d2be970b100d6b865e9f061b6b43bfd82b84a00b802e8c71a7a4d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

MD5 d4f1c8929da41bb9417929f73199b604
SHA1 919082982318ff260500eb6ccca33b47e6bf966f
SHA256 0c601f54796f43f20655203a483564e47f6dd7371bc0de83026eaa1aa05b247f
SHA512 dba33e5c609cf7005fa8007d92212066ac45981d4005d5fee2c8b026d71c31f5d02bff61a30efba1ab91973b74cf99e2a83632b0536e9463a54f09f021d8327a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

MD5 ec564978ed4ae68001c1bde1d703f813
SHA1 a6de022996f7cf86d877ba9bb7ff283ab898961b
SHA256 3022f629d88c1f0d1e57da715af012d693f7ef169b5154b4631c5e91db63adc3
SHA512 59c8a5933ab2e5f74070ca1255424e682e61159261e1d4400339dfbecf66346c27fa11b59b8064ddb0082a5bf0589c5e3d3524097a528479aa641a78e33a1ec5

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

MD5 87679654a0e5d6c98ef80e5c1a7b7b1c
SHA1 3db52f0e3675d760e473232218192ec88116ded0
SHA256 7537d0609366686c956274d05ee5601b59ca7dbde4acb51c6dfad166101fb652
SHA512 efd77c0df410458e56b3bcd49d2be836def72294d7a21d8f08f91ae80ebcd8da39bd3d022f0acc9c8d57a515790caf7e8138e2146f909c2bb52cc99e09e18778

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

MD5 677dc5fccf02c26757973301f0e4286e
SHA1 6d2dc13e9fc0febed4a2c67e05309b2c869331e2
SHA256 d95999726d7150a3f4a14b700747e406ff0bbbb6377db606db9bec7a6ec8ea49
SHA512 75b7e0008afe11e828f34974bd98666f42b874898b9b0e62a9c037a6eb02981229149f37bc10532505032d2a129552f31fd1d0c2ebd6bc4c3cfaa83e20452ee4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

MD5 3f1ddb1fa6ab7994bc3a9473713ca467
SHA1 4f9ab03d63af1df4c9e7c15da9f7e49a4392f645
SHA256 3d77548a55c3cc1ad3b117469034730b5a83d424e8f8883dde535c5e81c2357e
SHA512 bbd83e93c4b286d0306b4b2360e960a5d437182596197f69e680cf753c21c8d2f971ce1089374cbee98f79f4cf7a14c7a6e372c7eedfe702d2942b7211a144f4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

MD5 a799abe9ecd802f7dd85c3101676ed3e
SHA1 e62829cc45aae390af022115972a811f7d6fb305
SHA256 bb6a20b1528c856c86e0360cf26b76034de2c0b2e825a22626ab1f2aaed7fe56
SHA512 5bef711bf4be06f74e1220cc697a6727534f788a5861677ef434a7c16f8c9387b4ea3b6f750cccaf55c9892b057f891a17626baaa0676bf8387599e3e7c76fea

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 7fb338e55ea23ccb8624157e2084ca6c
SHA1 4ba54b324546f92b291527f254cdbe7cc07d0c47
SHA256 83007ced054fcaa02cb24fecea922220860b29409e0ec3652be0d2bead08bcd8
SHA512 d1cdfc23795688763ca69dcd63696b6bdabaebfe946cf4f0497f9194af056dd624f6121f50a3134a6a2cb8781d6de68b4d4d6b4ecb2711bfa48f4419846af200

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

MD5 5a0a2b32808c1f151af1c8758335d3cd
SHA1 5dce1469d27f7623e914543ac3a88a6b87957191
SHA256 653daf2b246524b2d67c1a6e78a6b5ef67ce0361a8fe7891b0930ec74a2e9a3c
SHA512 12cbfc653f7eea217aeab68734839faaf7dbacfb2c9189acd20f06b6eb05607659ce0241d6ffaf49c3161263bc6f1492ec0d10b0120d5a177ea6fce5952746ea

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

MD5 a7f584160411eae501117653bc1a4eb3
SHA1 7f023fb317fb1fb9ca8257c8dad9804634f83450
SHA256 42512323bea5d230b0eccae0e2b9648e99b20b51b0c7eb081e8fb3e84476caa8
SHA512 15eaf9c3c4bd34db8340e54c59fa51ae489eed7cef77eca32ba5fe72d9c8c8234b0a6b4c89a939a6e6dd7f1add9c46ffffb3cb39ed822f3d5688f8b2590c5e75

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

MD5 c2f350410b4497f57db63ca693a33d54
SHA1 0074a740b5ec217f17d39faeff35d42d39372f49
SHA256 7429cf08655aa09a1fd6d819b07189a5a25a1485d608a2a480cc41e58240bede
SHA512 ade367c6a747288d6d8036d2d30fa5f3c84f0ad65d6d084361f9f38c17818f76bf0807f0d4eea303e2614658e2d08c4ee98662a75e9ec81f4711f7f9c75a49e0

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 85f6fff60512877dc94da28a99de40b9
SHA1 7e74f0c49d53e04ca730c71d341530440e42255a
SHA256 02e3164eef7a7f5b109ac86bee94f416830d2eb16f9bba5a309b5e549ff6de4e
SHA512 7b7f95aef5b9764594989b6dbcddafe79928356161d16f3bfd4f7564a7d248c7d66f22e11866b03393ddde58579bc4f16e438aea5e170c11fbe84ac461a4744a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

MD5 b7d294ec1b8689ef327e7d1c2ad9de76
SHA1 96d145adade2a5108559626d3d7191295044659d
SHA256 e70fc4f5611133ce73a3a2b59dfbcde8bea7695384b5719835cdff9d4ddf37bd
SHA512 5bbcb47446e556abeab10e873eda64675bc36b6e6d47816f2a6f31baf94a04c63106f73ef5f7c7d18c0d02fa4d881e807098c4be175e8113e741a4dc222fbb35

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

MD5 45ee1e95d1300bb86195ef95318d957c
SHA1 0d23d59e882d9384c4626ac52f26ef3384b0c3a6
SHA256 05593a3d53255f02a7a946c4170102a21e12d26c3e1e4da292b045644b640470
SHA512 50ba6f6dd9e27781c323d8ed4e1d29cdf8898f69c2bb6e5885c53d8a06e40ecf84a157f72c372ce5c16b6cb50120c00626e2539a64bbd1bab17dbda3e460f8cd

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

MD5 0bd2045fd2eef522abbc66df43ce464e
SHA1 6aba353d593fe0ce390b9398611a7305eea7fd83
SHA256 6dc56420767f26d7d94136677ea3ab8fee0455afd9907743693c00278465a860
SHA512 5642ef133754e27a2f60cf89e9114eb93718212cd70e89b57f4ad238165f4c17dfcf123904b04e68d65ce46d14a63ca02900a97e4113f54fad26d980c0ab1298

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 f7b581134b967e7f3b516b5bba78dc28
SHA1 4c56524c0120de714004e44669555839edc7f83e
SHA256 7f19b3049a7777c9f8fbae724200db3130ce83d5cb7490c3943e24a872fdd9b4
SHA512 33f55840869c51c2753b3b4825a2c31984b9b659f0f6d1992e0474824802adeae42be994e5f5cba3e6b72005a080a4e8e451abcfc8f14471e18629d6848728c8

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 52b3d4371bd7004fb0cc25f8eb84deb1
SHA1 63636a5d7a0e110869d8015a7d69681317b537ea
SHA256 71752f91719af1e75b5032ef62fd37436d847a745fccf80b88949717680333ff
SHA512 bee237607d6c4ff3051374e88260e4d66468661e5ecf4de6b760bbbf623319ae3368f53993c58b1d6fb529a1cb253610ac6ba1b5b7a23c6e2cf7958a49123d49

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

MD5 0196f12ec8850cbafce46ec686a5c75f
SHA1 9100e24de91e868e6b962a2847be9a11317970b7
SHA256 2c97a9d0525d0257545023546e711dbde3705b3b0a34bf9090ccef90b2fad7b4
SHA512 961059676f1857829006e0c4e101d42407cf05351cbd70baa1360ce99e493ad6f89b7f30d74a15ec8d4fed8bb704d8de0d079caa8b8faf84d2faa627ddd19276

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

MD5 c8f7be98842820a259d6e7fc767da68b
SHA1 38a84710c3fdd3fe8bdf2cb6faead5fcc323c1a7
SHA256 1c18fdc645bc4592479d35c2f524a23600cb92af981b36e4d2b58dfd373e0867
SHA512 23458b65ace57d0e803da3bc4f399a6f67873c043b8947c116be61e622fd24d9949f027d6a8a00ed2207c239c20a70fb62cf319012cdb64e044b43e7511226e9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 d5161e5fa1fc6ceb195b50ddcea3ee62
SHA1 c082231c9d4f019eabf20c0c50499c4b33fc3c51
SHA256 eec08cb1de76426d66792b11b6ab36c688d6dc63758fbd64ed1c3fa7357c1989
SHA512 b58d6729a2cdfc25b5089a4c40900fcd389f0a3657f12621388a3c7d40e27407d26cefa1ad590d86cd8a1b1b8b84d712fb2fb4771147ffe62404beb37454340b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

MD5 5551da3fbc4e3d2f6b5335c6263b432f
SHA1 207bb29f7fe9a05c1b5535dcd56e52766ab3ff3a
SHA256 5e4935044bb923c51b1a8e1dc46b66e18ff12baa638cf49f1397fc5d10ea6c40
SHA512 813e9f196d84650fe9a600d03dafd9da17467b4e50935e2c20e914f6bb281a99878f9dbd291dee8ec3ca4ca12995bc43a6db2a3c8b1a24f55435f79b291a8f99

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

MD5 b81037321ab5018c151b10b88b3d4f4d
SHA1 64f1828f6ceb0acc9674c6784e8798e8435829b8
SHA256 9abc629e17c37d192daae57394d0fb26a9ff427e1611b77d4025864dfa85c0e6
SHA512 03cb79a5361305047c1fe029dfb324a738050bde9d2b1072607961ea36120354028d3aeb22ee11cda7dfb9145f2d1f134f1ff0ece385caebcbeb9a676f61abba

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

MD5 a10b4c5021a051ca5f83e699f0b9a9fd
SHA1 43b35cc1bcaa291636b780de58c1651305acd386
SHA256 8046154fb0ecc7b7aef7e157b0dafcafca7ee0a6e479fef9419d0b6d18a3975d
SHA512 36f3436dac3a8c45868d24c43a1f35d4869c5ec32ec7b662efcd95ef74ed6f9263f429dcdba64a9bb142a0a9cdf5e0f1614e492627f53e24657015ce797b51ab

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

MD5 0bafa7be6fbd5359a69c701aa585de2f
SHA1 078167c11bed9d016d985c581b6bfc4d5fb71ff5
SHA256 a7aec99e7b3fea24aff94e6e63d62e392f7044ec989f186db7856f5f9e65dd7a
SHA512 44c2145fdc1dbff31f84a532969909594005a68ba8e4ef1a31f7baa1a6bd6bf3c2abf1edbbc81fa1d0cdd77057ced3a5960d9994ced6aaf73e9909e732f2629d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

MD5 b1bc1343f800e685775a447fa445d834
SHA1 79944b1e6a0096e21543f47cab076f566f33f204
SHA256 c6cd23147fd416de055984cd6e6d6977d98cac6e699dd4db01b291afb8381fa5
SHA512 c4688be087cf19d9cd898cb299752e0a14bc1271ed4d46b90770c49102f7882c8c45e1966044ef5b91541d5f4e878612e45cbd80a50244f1341fe4f5e4e1ebdd

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

MD5 67da7b0304430da268e31be3a40e6ee5
SHA1 efd3e1f4ebdfa0bb683473ab3a8e79a105cd3e84
SHA256 68f48342cbb206b03a96107e1519c8465fa1ee1518e9cbe3c5508c352146b344
SHA512 23447e4d6aa8dc1c8a503a9c28968fcf692639cca94777d8cb84ced1ad1ed4942a21b1257f6d7ec0d587984b07432d8f356a624d24acf2359ff91964edec621d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 ea5f52a99d697c676e48696e54f3b6e1
SHA1 abfe349877ff0325397d06d4d4d34bd8f2425171
SHA256 b23d2a0e71f8c2f71dd823d6037b0cd29698067d82b957a8704f00a754253910
SHA512 4b54bcf3dd928e10da4c3b908e061c22540f687d3da125f88fc924dd8f4001bd97228b5bf9c8ce02bc5a12f915fb9972186cf5d572bf55085d4782a77351745a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

MD5 5bd5644c07d84f20132ea30b6b283133
SHA1 26e93d6d835e986d5c4473a1885ab6fc7bcfaaee
SHA256 4fcc3da9cc2eb20a784f4b07bb1db98e97f406746b6c5c379acf9c4f6b2e338a
SHA512 d6e4484a94678d6fa4e9720278fb346ff7294ece7d362d8639ccb8cfa14b048d03c45d3ca7c7763fb9341f76438ef6f6021eaf055d9c0a2c6ecf5e3ec84ba4bb

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

MD5 0271145c9069ac128518474097c41d61
SHA1 b414ca2d09c81669d04c003e6005092cf5ed6f0d
SHA256 f95508e702fee73877d67b8c65497fe010d235478f64df2ca1b8d3645025c5f2
SHA512 3021deba2dd23c56126a6ce75e8e541f81bd05e8e75b78e1036885d1fdd0e8618708da3e077cb8b6f8ff01712945181016eff5da5165c05ed3b757e09c77970f

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

MD5 934be24fa2296f80e3d504b15bb3fc2f
SHA1 3515c057c1575627ef7d1866e6ddfa6e2fe195e2
SHA256 7987fad20e750ebd9e5e60b9da0776ada4cbe06dd0ee2c7bb0592aeb95e45605
SHA512 986c4dec2b4f20fcee0fb93867e036e293d149e73b6e50bf1fc6aeb278a3b03f7d1040c1d63a605467c85cf7543e27a8b0790dd0c6de8e5fad16621c0bd74a16

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 6c612b8470739c03445198e28991e59b
SHA1 c7df283697dee1ef8001461330660f669d7cc77c
SHA256 83464e3cc379eadcfdafd9fe1343adf2b7a208842a8385d590a8c59832ec3eac
SHA512 ab5a79da6709bf6c5ca32f734e679c27a341b490d41535b6d402de7ba4e8beddbab60769b1120d517cf69cf43c348be374274cd64c72c4a951d15568b73e51e2

C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

MD5 d4f6aaf470eac38a1f698cff1ef2ff70
SHA1 127ebd9e69e524063bcb62afd463eaa3422d1259
SHA256 4dfc7a8b902e637be5f8ed0744c36e783af66ab4151624a2677fe9da4deade4e
SHA512 58d5e11e87ecbb765cf137f9ab004ade548fcd4c0955401530bc97bc295a99f4da02db799eb87e1d75513198d8562989a1cbd96a570afb1498fb97ccf122508e

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 15e76148fcc9f5b34c46fc866abe6243
SHA1 92b7c1c5f875daa1feaea93df93f7f168df170b6
SHA256 82ad3747fe4e0a5e81e6a11cd874e1ad0b1ac6b92753d62bf7d2c78534e0506c
SHA512 9e6ddba177a27c61a1b9bdf6ed12e03e610949c8d0206bb7a9bd7de68aa2b98cce5947650d6fdcd13e4521c63009ff291cb3fe2a5277355e3360946410b32dc4

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 ca63a76dafc658bf7ba16d954e43ecfe
SHA1 80a59aa883739e98982456b8f05e8c5dff364495
SHA256 58dd1933072c1b6c5c317697d076e254a024497e4db4eb70eb6c24ba3dfea771
SHA512 8f2a31c98a3b6e0e68f6dfb7e7104eb5aa24f86ff52cdc56c91d684320c14fa1de117f473d56c0b799260cbc30e3e81f447432315c9abe13c13ed7ed232df681

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 21eaa2b247d3254127e84b573913320e
SHA1 faf5cb4f8b4d256221ec088c92e01e0f9b564452
SHA256 2833781842575da4fcc58f58e207c848c6f1dd75522b3593fa286d26820dc6c3
SHA512 38845a38f5d3bf06585ee3269cc57ef75f4798a8f6665754b7a3d2c213002c7457d7381ebdad1557b64220c5191962f2428b74bac3d1e6cd47db22dddc1980ef

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 f05f337b5b922d6a873883173d5bedb2
SHA1 665f678e8c124ff12a5e328f792c3ca649384d00
SHA256 0aaa28e187c16b99dd773e3712f68399461e43cdfab407f77e8aa8b6a4fc8e93
SHA512 399dcd42ae4aade528fdf85bdd9c8c86c91b1b0e7d87a85c751690d9677618a48f18841d5b724c4cd4f6048bd263592649ee0ee9672e5abbaadc7e3862ba8061

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 88182967c336f1985570d80992c4c753
SHA1 0b230621d0904ae38bcd5dc3324e96ae9463554f
SHA256 eeb1bd5025bad29dec2c13260cfec79e90314f5a50f1e9a63eb09bbd566d5b07
SHA512 7493bbe59802bac07c79a677b80ab984b56ad4c84c62be4ac8d71cdce5e9e8ad9af8d06937141ca3819c42e84a47e69cbd648d20e803e1614b01786d838f23b0

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 f1949b4b67811c940257c0f3f053131b
SHA1 cd89769bb6a42aa1dbf81b6437485ebb9d97b82f
SHA256 46372953cf0b03c9dfaaf7aa24376d37e2d70fbfd91bf9b054eefade0cf4b89a
SHA512 caa4876c31af286b91820f7f524e3d87eb8036ea1b28211c724ef923876ba0cc1ace2ecdadfa4583eb954d68de5da75126c15b9bed99e0c903004498a008cab7

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 b71c8f68a0ea03797c79e18c32d0ded4
SHA1 70f4e274bb4d92550416e32fc61e74ecbf9772f1
SHA256 e4821912554d9858ebd6a0b878afa2d88ec8e81ec99850c49259a6cb3f6b535a
SHA512 80515a0033cad8c42725095518a29e29be240f9b3c420b23110932df16fd7cbe614fa641efe774fa1d18f98f4dfd2871ab3160d8a6eab978c681b795cf123793

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 bd75ad185089dba84a6d9976347b27fe
SHA1 c90ddd32b7d9b51887e3cc88be7fd46fc4ef4677
SHA256 29c7fab2890c00f7f018b726995d87dea0f02e1ae72e84f27c361b3c4a21814a
SHA512 0f50c538bfe8c92f635a899cacd497ba42f4905c6d64ce8593e0d5f26a83a26eddaf9c67618534ba02b65e304b8cf22d5c839cbe6426eb97222a2ee1f21f6f68

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 142133d18a51f302a04cf4c94b88132d
SHA1 14ea3a05e3c2d3f5f71fb91e52063345c75aaaaf
SHA256 1f171a36fa40fad115fc187e0ffeacdbe5f983385efe8bcd77e8b480505cdb83
SHA512 e7842ac3290206c16f8fb77f3e255cd0019e35f2489a5601d44d17f4a165e5efecb734d6ca07b9c4e2feef7b7ac0e2219216976c7797e5d56b0c3063c0ece504

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 5300ed1c6d0549bdfc2341d8b56e5452
SHA1 ccf0dd14c16e1543c4637fbf20f3f1e531eee08c
SHA256 14ac09d47168dfb79e083dfa74c2914b2c47988ea5176bfd6ede7754ca0f8179
SHA512 8c91eb6e3033b0dc621524aacebe9d66a8ff6c80328175e0c57ee23ecc52154951955dbde3163dbe7866f0f1b70255b5e83e1118945a5178b75b302183d8113e

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 d3dfb8996f7c9b599ae0bcdaa063516a
SHA1 502dfff937e4330e76285c605c21f8276c49df0a
SHA256 2fbaccd501ec69df1a1601731e4aa9b589479c509fa5d77d3252e256e1cbcfbd
SHA512 4bde6d8db95fd4e44a1b93f69ed5a02acb1d9ba617816836e9d7fc4f3b7909ced863f6121a50c4fb3183a15550d30bf7fcd79446e63440659f4706df9e1db8bd

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 66dbd3c747bf47b3028c5de04536a09a
SHA1 019efee0f44da9d7dbf2e4d3b66c7f244e738290
SHA256 ba4be91a69f747f8e850acf75c019d90935a5b641b3915c41f05ad3f27a2dd2e
SHA512 f549094b5dd8aa1c080d407a1ef9cffdb1c03dfda0c74411b897ffe28a4037584ad3f1b2078f2cbadd301b78f2761a2b9e7da16a0637738564c1caaab9a8c9a6

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 c3a4aa7b7c41b8ca3a770e79fe53605e
SHA1 ed5133d3fa01e7fc33310ebc7572e63c99344765
SHA256 c6b63fd1283268a33c36995c1e8014abd465e52d195d223f85d9124f29cca7a6
SHA512 73e6b385cf63e73fccdef23ff142f08ec655c13a978ee276b5686a195ee1196136b6d62b202963bb90b76df70ab7ce96d2ad8ff605a51557c4ed20d2e69f43fd

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 e879df72314703deedcc5f5ac3cc0c27
SHA1 f7f4c042740d547f62bd77d06cb44ce0ad72d94b
SHA256 9da92e14d3a85eda0c958ef1ec7abf2c1655e6bdace821f0ea3e54b985c5f8b4
SHA512 43e6fa7db36a076f2f7dda43a8aa3adad8107a3a4e3d376e246717525cd2bc4ecefb83e0f0f969ee1d525c36bb6890fa5f1cbb868a6655ec7a42fd6d0801ecdd

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 7e141d99cd67e30b3bc0a6341a2aa925
SHA1 88aba77ebfb0cbdf520c6117dac4fd30d3459710
SHA256 ab8053a24d7700c80eedd0b3f59e5f3a617622a6ce16c03b1e3329d0959f7803
SHA512 e00a9567087a17ea3ecfc3d809a20f776cf24111f9e899e61f8c775b07919ba9436d8b4228624b08dd7b1b00c5008661f121ea339cc17e1fca51c5e9a14b33a4

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 62ab3025826a7d193cea7e050876deee
SHA1 24b79d900ae891971ed40fa54377f97d7f70609e
SHA256 9184cf37b0cf86327c2ad122ddb4364de688f4d120662f3c9c70c50f644dec7a
SHA512 e804cc6ed73b3a1dac629cddb658e34b78b83ef24a65d8f57540c21edd8ee3f5f217cb29955d4be14a0f081da613a8c4dc1b2a20ab41f28e9593350ae05165b5

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 b14e7b84b0521db6bf07f6eef0ffeb13
SHA1 575ee5dda2d14242faad1b748294abcc982499c5
SHA256 58d4614f2f528eebf73fba34bb15e99a2dca4703bf0c6b06abd90b25bd19bd17
SHA512 d817d7ffa7ba3e6b74ab550de58aade5189ac4ec5f7282707edf03f46002b92c6fb293f059595644b4553e5fd86462488470d7d8199500507be0ff8dd65b0cba

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 cb40b9af6e82922a72a3b3b8099c471d
SHA1 92a4606a1383501e72d5a040c19f004dcba1c86a
SHA256 9eb8b5992434f3ee6ef4efc309e5215026b8af48d9c702aa8fcd189db69f21f1
SHA512 f56152baaa7d9960cdb3cb4f5636f131e6c8b1eb33afefb37876eca6be23b8a69d0ce27388b1df36d8da3ef1d4ab4c6263b444475e752f42486a159dd4c17933

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 16c19c579c0c65061b6092384be99769
SHA1 ed797b60f1ef52c0f61f0dc629ac86566ce1ab51
SHA256 ba70c4016d37de4c65dbc0075200e956fecedca965897e790ced6de0958e8cf4
SHA512 1cb490aab3e6a2a04c8e11f748dfae18ba127975edb78bde6c9a5cb0cffd12aaf1ac7ecbc8114e4d0246c647e59e40cf6bcbd49f200340e302fe64cc752e2679

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 d026270303dcae6fe7ca281bb6a7a88c
SHA1 4237dab44f7be9435e5bb797d2f1fc8b4b03fdee
SHA256 f9031064151f69a3b8a6a2aef43da4fced416c5df1ab103bfefbc5dbb298dd5c
SHA512 4ce0ae60430efe70b6d058ee5656b12c8926bc264b23c929a0c58295463b6be6ccd717c418f26ae1e6f30657b904f862087937551d937e0040f9d6726704d274

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 ccca4413ee94ce9c786cebde628a8ea9
SHA1 5ffa778c0f69f044a15ccb7026f27be23ae6f15a
SHA256 61a9bb3d41ee74c5ba7e0c5b41f5f2c33f6bad6ee65eff263fc70730b08204a6
SHA512 dc39571707376fbc79c346c44527d3aff5fd9036bb03e8d22e166ff1050c98999b28224489353a6beddbaebf640ceccc27c9b581f05b7d2798810b6b78bfa6c6

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 f7cf011c9c0a2873a18d7c75e32c24c1
SHA1 3d41ce45c637ad10b4a6626bc8c068cfc7f987b3
SHA256 9d3f1de4eb4e02fed64d1653d37e76e1c35dac6ae764fef700a0220db4333ae1
SHA512 14484bfe5ba002f08f52f0dedd54fcfb226346521b3d87c88d758595c7f62afc5248947b59c716ce7dba599fe5473db15b410db3864ee47bb8201867deeb3234

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 60e39f5fd87b6f3699a034d3762dadb6
SHA1 12e34ff2a10e6b9bd999131d7e4a1527e6c0e401
SHA256 5a0f1eead61bc6095ca2f4c92e3e0f99875f71ef632e420a84c6118c9d0c0d49
SHA512 0e168fee9ae00213d494d01f08fb0ca635930b7a53b8ca847119086419d77ea294f1a031d69d251927f297373c7903909c1aef0190e12d36ce2c2b8740e00931

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 57c0ee6aadd0c6389699a4b95eae458f
SHA1 bf7ab5dff771443d3e513bdfad345428f9a23168
SHA256 3f8c63ed27475178c8c42e284d2faa42c2f8130403b8a802fa5ed523aef99473
SHA512 e156a79ff5c66629284869dce1bdf9e3328f802f94f354ca59540af2f7a8ed53635309d38dc71f2b13e4df5f4d3dce601c8142dd8e7f2580fbd71055cde605ef

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 02c6b19c56034705b71363f829a7932d
SHA1 eefc6dc38f21604d91bdcd409329963214b1fd61
SHA256 e64a59915e06c8ee7005177b403dee6a32cd0324e31b1ab21b14523dc3f36c76
SHA512 583737a70e3579e6c535bdf8ffcab016c43e5b593b6cb329a5ac2b2faaddca9e4de4609604d692df9b31f0d2990475d37948a4c90d4a862c5dcdc497e87979a6

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 565d84086fab0f87147e121ae5af3847
SHA1 6884e8a565f682d27ad7945d35b2129de5f44ebc
SHA256 5eb81a50d0052c1e1840786cb22e1b8535f928f4ae421c881787512455efdfc8
SHA512 cd442fb382430974e77c5ea67a9f24694977273ea7f4cda545c56f1ceda4b5adcc44d9f30807b9de74383a8102408f77e1fb0a57814c6778ed778ee61eaa6ae7

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 d95e56d50723bbcf579195da7c5e8bfe
SHA1 a7d60326e8340085c5502e941438cd8eee479080
SHA256 907b20aee202682e278d5f11fa62205ed9bbf90fe9d6e5b4572b7c6d22f61180
SHA512 69b16a2e3e2d20777f2f99525a8ddad40117bdd0c961575b65ed85fa543c5a959b29d7e7ab902c189a18051122522b9d07d3801d39db60bdb779678185647e99

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 ad898ab18a0aa3f1cf7b927c84347b71
SHA1 b9971412e61c2f549984e9c59a93f4bb16594d34
SHA256 67f85904f597b5fc9b85e059ffb998f6b76db6771562bb6eb8e9347630c8f021
SHA512 1eeb006582de0942ef8077a71e9ec6b9b420117a78df01f125754534496c082e23c6642057002b5a781e50828a3343b597ce6a54876e247105d875d09ff3dbfc

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 62f03b870ffaa9e6c33ff0ce34d291b0
SHA1 c203ff5646334185c0a52a5a4be5703b7e02217b
SHA256 8e99ea15be478940d32b2ab1caf2449e7b58a6fc990762dc3df641eb035f8458
SHA512 d38cee2f5fcab12de705ca6133485b4d0955c2e6e09735c05bf1e980a33556863714b7cd11dfaa5839feb8a9c6bbbdf0fa2929402ac0e0e102f9ccfa08a1396a

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 9885cbfc79340395005e3d958f3cbc17
SHA1 213c938b03f02034390286768df7b2107ebf5ea4
SHA256 21982486d4b10b2649c5e5a30d6bcbb3f6ff2c9052f297961ff34e67badcfbf1
SHA512 3d24a750a456fe9c231f8a2ba4d3236c261b325379648170877e7b6fc60481653987f72b14621b9d78dea3fef5ae78df03ac25e717a791cfc4d964cd01d03a70

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 6622321f1abea0b6c1d9d6d8c49703a6
SHA1 1263c5fa93869ac6f5778184361dfd081cd6e06f
SHA256 5870907219575b63cbb0e114101c7622da812f162316a874f99002913292d054
SHA512 0eac4158a7da504017247b4b17d8034813df641d8e1e03ec4466583e4f0aded1b872588fbe584901a77b76209c0376183e052a8952c97ca0810c40683cd536b9

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 35fa4cd2c95c6527c8a334ad6a8797d7
SHA1 1e2035c73de80bbcbaa6ed6f540c96c6b733e653
SHA256 39e5ad6112ad94bb2991db1d0bbaaa35fa3abe77f58cfac3c04c3cd9de6bd8ee
SHA512 d4000a65816ba5770ca4967bdedacab3244c2dcbfbf01883c6376ad6c1de7d06e1a2ab5be67c11479d45909a84b1e7bd328684c3c01dc6500de403a9e23560b3

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 8696933fc3624ec9fe6df952da8ad958
SHA1 da447e27ff48504d03e6bae221bfa7c5bd42da94
SHA256 5419031075f9477087f4db15ba545b0e66d4a3c08a664aa82711f56efd09dc4f
SHA512 1399f0d02e7f4a6e713f2fc7aec6b63f91eadc6f21be993e39145fa70f475c1df961b1729fc820a0ad9eb93efa4c8c004f74e7945be823a6fa90ab5c6eb31db5

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 164c6ec8304961cab9b8e95d9a6e9dc4
SHA1 ee2259af65c45c441679773c487d163b9aabe9e2
SHA256 af1528e2ff0072ea629b81a9fa0860b6d8fe9e175af2795e7e424dfcc4f7a424
SHA512 826396a4594f81ab7c5fa46a8fa3c3a85879a036b7f39b0199def09c7a991307e02fbf56a84743669179290555cb9a3c7326cc78ab81564157255ec3fbc6566c

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 61aaf0290cd6c30c9ba6273e22f063b8
SHA1 27c2b2aa5cc45b2e191884963a525858a59b1706
SHA256 fad2494871abaedb832e9286cd658f769afefc098c264ef087603420293a8f52
SHA512 d1438b694a3765ddc4703429d41f3f8ae950b89db7e54e41a03867e4ce637add7aded971bee4c359f7cca6c39295122784f0cac5592ab8229026d1906f5a608b

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 1bf27b26cc58405ad2caeb5bc2b31d35
SHA1 6fed93dedfdbbf87b99e774881e863738cce1172
SHA256 9dc7e834e1a155a4aeb83c68f7615e3f307be63cc94cc14783b82658faba9bd9
SHA512 1655899e3fa62cf82c513af0cee1f74a3ffec186a12144efeb413aef6f65fb2a0838de73a8c19e68dea8f26ac68dbea4a019d12a5060129cba279f7e062836c0

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 f0cad9f4369f83350e4bed58544ac938
SHA1 067aed8e842840ebbf2acefebfcbfce1f5e6e008
SHA256 12364c0903fec30e5066c6979b21488ec3518ee5e0448f215bc3857833c20bdf
SHA512 f240090099bfbd22a9e70305c2cb10c8091c5bdef19b27eae354a2740f81f3bb6d2085763fb5ee589ec8715006b930cf9f4e5d4ee532b7e5bd35ebfb13525767

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 b007e271ba39b473a09208ab693aa6a4
SHA1 413aa942fba0871ae70f0a56931871b3b9598bdd
SHA256 2228a913e749a420b83a79c6fca1843d59f0f6881ba318baf8da2253f7d3f347
SHA512 22f34cc8fc2ffb3e74e57e81e2c71b3df0635f8eb1fdda14a8a57ac4733c6827b182f2236f3487863dd673812eb92965f31388736f914086cf9023e6ac42fb5b

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 81864b48acabe35709f1ba4853afbdfb
SHA1 cfbe4f595d7557db388865129040bd34f2a0ad93
SHA256 82c290f554f6ab6897187062657307aa601b2634842d759bd693fb89ef7433f3
SHA512 f91d4fe758faa25f908b8bf62aed86e52700e2066fc9ad31a0cdc414217da5f7d56d0dda565b54e0fd9bc27a409e9072075da63c0f0820176822f224369229a4

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 9f027837448462b0dbb95fab21c12f0a
SHA1 30bb839ee9f7d4ec669182748ef1be0e5aba1237
SHA256 d041047bc5aa00b51e85bf7611d4e5068176bc7f8155baeb0344727dd40705e2
SHA512 8dc7d608a4e9f0aef1dc6e27af6c74668bb3ddb1ac79bb821bf0dfaaf30c32a9c157bb33afed46e8175affac62784e1de459a30c3e521313b3b61b58e866a82d

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 40672197e5fcba8035230e3627c934e2
SHA1 820cf766541fc7aef4cfe6c008527b4db22db2eb
SHA256 bcbf8b70c3ba15d1adc6be333a7777df2156b43bad0648562b96cc4d99014bd6
SHA512 f2a64c63bebfeec1142dd5f79330ef6a1a0545ad471b1cd43e5f2d512e4d59757ddd8c9f0d88ca9343f50429eddfd3f8bacc81d993eb871da4d0aa4fbc4563c3

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 cb6df95e81faaf51835e61225d60c7ca
SHA1 0c43896188d9faf6cfa652b317e30807f3ca6d01
SHA256 aa111c364b8a729d259ed0a20fc62a857828eb7950cfc735d12a56b9284931c7
SHA512 f4801f61301b971bfa0576ae7dffb04bb21b1f38da618183141af163c0bc97aa1778da8131d9d2efe7610f3a37c75d4e7cb4fc731d745331103bef9216679e42

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 fa90aaf17c64b5598cdb4ba6a167b505
SHA1 c306cf95706b9dd4b29d5ad19f34bc971da93a70
SHA256 7a5a6bf3681bd40426a944977cae62ef30fa12c163b66ed60d3f04d8a558b266
SHA512 cb7b48504c462e459694064069ef6b4d9fa63982520743e756e6defdf7eef1eddd5752c7c8337dd317a8adb7ebd079acb76d70491ee8529e31da8efd3787c78c

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 17e9692b8ec75eb2bfa525cdd839100c
SHA1 bf2e19981b30bff11d2e99cc5d7bed3e711c2e8f
SHA256 ace8544b98ed35b06ff890a8da8026aef2788b5349d0290d2b450350c260108d
SHA512 d3998067ab8d65766dd8b4a5271342ef82253ac285223490de48d9d666f113c17f71968ae81a26d53ec99516b08f802dd70ed279a41043e50d63bfc6a25a4fb6

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 6e5e52a1977cb5211644e25f366043a9
SHA1 19908d3028ef5e916acf0d25ecd428f81af6f889
SHA256 99819c31706314b4512ee87536ea78f0ccf7bc99f76d6cd253efdce31a4f9f0e
SHA512 1b1b19e63a7ee087483bb9aa82a522ed34aa574ea7ae8ebc28b02680cc3427c5f975e4596cff7299ba146a298a07fe8126e86e078d2c9fc45836abc7deb94002

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 ce3437006f9dd9dcf4990d3ff08fe815
SHA1 49ee6a401b5e5d82360e0b1b500db34b9d4fa86e
SHA256 aa4b3c30d5e52dffcf1f20d315997e2f0bce80dba720e7fa22b68eb1154b6af9
SHA512 e376acbd6b2f1c10c2ea66d73cb01a8ae3527382b76e685c0e52e2bed318b0ebfe51d6a8435f32c942622b934b75948b63fd862ae38f55419ad9deb31e0c7db2

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 559e0683d59a0b3d0b98c319c81cc9a4
SHA1 cb401cc384cb4788339338a176a4a45be6e4af9c
SHA256 cb4202499dc3981606a7a885f6239b6ff58174c28e66689b0043323f2b7a91d9
SHA512 5ec93abb0c79db817f77b6e86e4a9166e2883e367a50831084a24f03114e7b847a296b294715414e65dc33b25ec4487812d22357a262bb34aa5e582a27dc7c29

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 192ceebd13d5bc5ad399db7877b86a2b
SHA1 69fc1d476f78fef3139d366b2dbb9ef25c4ec046
SHA256 abecab77fee547ca2f0ba69b3050c4f1ca2716f73e8818784c0f3ae4bc590ec0
SHA512 82ccdc3053b34a347a39562cadfe9e60f93e0c30b818525c8cb41ccb83229a799c44ea936fa56af1c316cb971d49e5842b19e6e596b811c02e43068867ce8cf5

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 ce61403e1c0755ea2b166e7d1f56c3e2
SHA1 94184368fe05bfe6ac54f248744b817a0d7f2fa5
SHA256 baf2596f485ffe6d4ff3e228e0c02ccaa39b232965ad8d596ab99d8d7f4bd795
SHA512 957603309405ad3294266c4a6bb210301da0c65440d3195906cfec5b2003169f3f96138c2ca10ea753c505035ffda09fa59aa15c0b29e0292a870eb2c8b4d9a8

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 a44bc4e32a5dbfe4ebf08f2c4c13ee74
SHA1 141aea8e47c78578dd9b0cad4f93ee50432e4f7b
SHA256 4d46c6d2c3ea3380a7783e4b43d076a809c05ee95f57e7242f83c9d5cfd7ec41
SHA512 87356a87b71d16e79bd3bd8501711e6e49eee466cd43316d50bfae9e71f940f68e7e147149f08689b0fcbc59a60deb27b547bc18010788ddcd693b28e2ddd97f

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 20f8a7691a0696c67f791eb942b4b90a
SHA1 13c42059cf35a84ad3914d96a2325b14af92aa08
SHA256 ff22946b3718308baf46e2848694969484975e8653d788f59c4e5dab43e11499
SHA512 e37ff13635bbf60ee71679c8a8eac77a563220916dc155ed168e907f4722fa0f115d277b3d1509380f2f5a2f94572fc5535e1fd94bafb3bf999b14991da0994a

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 7a38383973c7bfab45d4870e01d7fd8a
SHA1 b212bebb4ff17ab058b9961460aa30ff0cd09b57
SHA256 dc6440d6281f328b892f58e5b203c648b6c3099aae47e64a543d6ffcbf9c0664
SHA512 5c3a754ecc918047c2d1c43bb96b23075364bcd7dd0387ad4e4db464986c0818f4ead50adc869c2bb718cf62f351775ab686be0faed1a71695d9cfc780c68cd7

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 4c45510e9d07625a3037230b30676518
SHA1 dda995c253d78cd2a3245af17175d79cf79b1508
SHA256 777d9de5b9b3cfd32881bf650e4412ee395c767fe9b0fe2d18df883625167a73
SHA512 b41597b17670550742963db29298c12fff1a6b2cbc11f5928a4257922de01b186251d98b357696aef91b1c46a8dcb58dd2e28d748e405e7d8fb62abc1142a63b

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 7ee6cdc48d8af5c8595f4b0478614d70
SHA1 473323f6f3c4b864e783ea96c84dcfab9a3d5044
SHA256 114fdc03d10b79a1a7daca7e573b865010f5452cd0aebd3e798507616edd2f42
SHA512 e31d05d7989c2afcdae30a34c7ec7b2c040c8cb17cbe22524d0532162f3032a93d26a7a1c0e76502d45ec1bd769d4f3ea2805f7ef6e49c310400d09006557d4e

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 ab5208b5b8d2b21b4d87c951f1023dea
SHA1 2e7e0e11b50501b058e16dd50d44c720b65bd743
SHA256 d5d7c29c615dc82173f1b85031bfa2f9bb093900f4a65b46aba19f286c9e8889
SHA512 680874359b9aa91d0b019d7c97aa75f2b3167fb54b960efb6076b81111c5e3cf0cb331f969e2ff6235c49caca440225d1d74233c15ad578d60af39a50bc64671

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 a4996b3ef4c9850927a54af129776fad
SHA1 f8bdf7a29aee7aa589624f05af349db2b8f87221
SHA256 8a27f2922896e5c2d4a47ba4333b284216e413564310be121516463e3d48836c
SHA512 82af824e7fb4063a4295c35d6747310bf35eef5e65640272499ffca7c6f8c30c5e1511c0d4cef5dec0e3a58993d2093395104df4dc439e893dc2f19ad1624eba

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 13820b8fe3b439b1217b6960adfb12c0
SHA1 c278ede0a96acbc6367d7eb4ae3e40eaa856c066
SHA256 54fc33ae440fa7522499941fcc939a275a4194e2abf80de78a7dbfb1bdfe8d76
SHA512 3bdb0fbb267a699bd610207c2f89f23c7e87c506198c0aedf660b4ded6749a43f52c40454ad807593aa4e43bba5ee9229897935b3adc642db0b578567a867bd9

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 8e128b181e7d412ee1ea7624d818e5f9
SHA1 d900e2a129dfe87f0c50a483cf0c8ae3629daf02
SHA256 c27f39525669b3863a7f1ad5ec03983da74f48eacff10530908f6ce861e56cab
SHA512 13d83c6f02c66888c132d686896fbd7f3145710c8ccb7474df087792e3a3a8f13ac8b2b2c916a4304de1f4d56436f56113c0c31c5417b74ab898721d97ba255f

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 7a232f90a8b29c25c18deed696edbfda
SHA1 1463a603a05e1fd23b0df343bcdbaf87025ab193
SHA256 2f7692915024217f2508b1fcd38206b9f0d0f9f8abb0c6a13ce17bf956161184
SHA512 c0ea44b46e2b53fbeb853e56378e7df971420c0e2ac03e30426ef1a3536ade7e8b9f51da63ecfe0a258de68c28fc0a528462890ba3e3d8e1209c73d9c66fa9a1

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 2aac3950424bedb857ddeb694e1fd95e
SHA1 cb1e907fe236b45ddbf6777ba296d876fcf7576c
SHA256 195e2229c06888bbb7fe907e35bffe650db52e01f3ac3332a528a432412bc4f2
SHA512 a644eff28a603fbbe7b191cfcbd7a185686e98c41b6f60a19b7c9c0bfa82ebe904fb3df7de4138dffb11d07a231e4ae3208f0ec5802d40bf1b3b1b3147a20b2c

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 6cab92e74bca40124a9a31d6c4fd092f
SHA1 05d3bc032b31ae9c11de8f1eefd503283f64ced2
SHA256 79e63264e1946b324abdbab2f5d3fcfba4d8914bcea66fbda89c50a9e2820dbe
SHA512 06a6cfeec31b945e957ff86eb920784f78fb42d07dbb0a667e4695fe91425649377f3f784d1345ed79f5dea75b673f18ec688d6c1d1b9d361bc5e15571238a82

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 cae4c20a58ad91706fe31413ce4d86bd
SHA1 5d3f8fb6bd1e510f2b685117a531785db1bb941d
SHA256 27bb209fdf2bd92cbc134717cae7dd450826b823a3c1ba40de127bd952f55ad4
SHA512 e3020241ae69e999a225d7efe2c470a4c9ff3d43faeebc334200f6953eec10b4793b30a1cf3e56aa73b23ce997229680d8e2b1b3751df0957124a843a2b02ec7

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 1329e50d50bef174f3e436df65de5141
SHA1 163114f3df58c61d7df1471922dd3062625f7ce7
SHA256 4ee3b7a4bdf15bfb5c53e5d214c2801be70103534f8a09d2770e0a5dc47d9caf
SHA512 9efc0d3e04ca18092892f272db9433b5ea3db5e8861a3c9eef4ad8faed65ba8078fbaa254bda92fabccc22d5f0ee584c9ee75e6eaeff8949d625324a0bca1bd0

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 f2e645b7b291cf51a1a278212d7cb829
SHA1 054af1385f7f1404c15dc2fb85874699746b1e89
SHA256 f0ec143b1f8bea6fa5dad714e6725b862f2ccd8a4f38d47c1dbf73e2fb268850
SHA512 de2a52ba5e56c56f913855d5df9d607100f0ffcb976083592c50e731a90d521c150ca314a25cff86f6745cf805cbb03b25233cfe1b6b163fd02618e3ca19882b

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 1665b840ddb567ae3308595d529c1807
SHA1 46e4a1b44169c942f69c0d3e3f7bfc3b49f0c9a2
SHA256 4215958363a2eda1b1fb5a489d331c8677412e6e412472575a2afd39d385bc4d
SHA512 e121f9f68dea767a944e500df942106418c89995b7eab1792289ce5d4c5f3dde777c0e845658b72255277d11b3c125cd6a528341d9e0010fd5d3194482b46884

C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

MD5 93472cf5a2bddf2138cbf991b8478c72
SHA1 8a111bfe9571c61a8dcc592210d4054a74dd3006
SHA256 ac6e27b49965eab9b90b472bd32c8631e314c447f28a7d38318ebbc8133ff8a3
SHA512 1048b57f39aa173153cabbdae7247ddbf427e49415dff3d9d4f22799958c2b37e58a4b416a7cb5794ffccbb5972d305bd622a58bee4a86ca754eb88d5350d2bb

memory/2364-5780-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2364-5779-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll

MD5 ff3d2f9059922a063f2b9d5f48b8f385
SHA1 aa6e0600d22e3e619b583f85543ab172e7ece75a
SHA256 f0ea7e36be7a26ff46b7de4757643a381d21c792bc244cc203d6926881b02150
SHA512 1d0c585aec591bbeff42ee2eea25f6db41c149b2cbb5dfae6ce66d7f7df19f1ca7ffde2b15afe2e5290c14f1e7d7a1313d6cef76c453b2e612764a91f39f84f8

C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

MD5 954e83596dc9129db9a7bc0fcc6bcc6e
SHA1 7f4ac85b14ae2f369ba3e3e275cf241bae87f7bf
SHA256 8f377357e029c7e6b2dcf8a8d3ab6a19c15bdd201fb1898350eafbe304d19f87
SHA512 667585b861b12361d53be7865851838bdef5ade030e66da8fd69d954ac3b55865ad8177efb20da79bcc4dba5c26d7c8947fc9697e4047751913a84e59b007b83

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

MD5 a7fc689224224c7971f06912b3650f23
SHA1 4447e903a92a38133de47721a20b422feb29a408
SHA256 ba9f04cbcf2f7cc8efa073e1696120996cc42878e9d2251d18918f129367d398
SHA512 77ec356da1bdf5e090f53b6ca1176b0da0b70d3f417a53bb1da34fa2a917ad619451830804b0e0ef192aaa33586d21b3f2260d21017c5d3dbbbf93d71c4fed54

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll

MD5 60551d00f27f02477ef094d272fe2c97
SHA1 3da46f868be85d59256b87d09a6f4145decae947
SHA256 4f5a9877bc053929344beead9191f856a8c5bf0fbadfdd2e1266c1433f7bd500
SHA512 913ce83d2c9658bf0f74b348ebf2735bc28cc272994f79512c935bda5ec86910198298a639070ac3fdd1448a5a44608c291e1d879ce7cd2ca1dae3a23c6d019e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

MD5 880462ebb4927f8d556a5d6588683a55
SHA1 5037b38d3969faccc36e67bccb2712afa2017b8f
SHA256 1539d24d3e78de8b6ba0d79f0e957f01a1a9627250a65242548051ddb14a8381
SHA512 6f0829a784e9fff322e477e4e6a4e0ae237e0d4563a92d7d1cdaa679b2c2fc8445eec1f8ccdc1578915e90433c978fe659aa8d2c1ae587f94550c28e6d9e1d2f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll

MD5 4cfd6d3240fe7800bc7909e3fcd0fa95
SHA1 f6842dfb10cc6e19d8c15cb5048dd874c0eb0421
SHA256 2433085a788ed8117662411d5e9990ae51c1442d6dd3fd5b87ffea3f036a11a8
SHA512 1fd87ebb4bc3551e14e7761608be39a9f9a13d097144e553a7382c9c0653f044d87d8414842a8c1972a515097f1f7e18a5ff01f079b95446965385c707f9ae33

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll

MD5 a5bdda4543a2f28d493a58d246a413ea
SHA1 26b44cd43cc6c0529ca540d3000b49b7f174e23f
SHA256 64b9af7413b719b94507d6d3ef12d48f8fe811e877e2d62ea0af636a7f506718
SHA512 3a59952b6cdc9a6a38f1486af9715059889730b4b639ea37b620c0dd66e840270311d90d44709c7a77cd0b5761cb56a560737691de07e008435f519f3e392ea9

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 bbb49dcad3a9097212a5272cf2057679
SHA1 f4e9b524c2f92a0089597a22defda307469cb65e
SHA256 96414a77b436bf3ba5f513f42ca4af13ed2d5b6959a74a02e05228ad7f468ede
SHA512 840fe4a9b44fff8a06417e917238ef87fa70e887f6598064e022da86f491b0939ac86a187267c9b789217541f7a236d0763bd0607fdb7c3aa79c60e523ebc1d7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 c505af163c3645bbc95d8ea75007b121
SHA1 791b74544371f75be8b191ce6efd0be7989ba01c
SHA256 809ac9e5d0840f8ba13d7c4681bf29b9090e2b5a5dde39e5c754b9370c3611b0
SHA512 1c0d5f7f409cc9576605d15cb0fbb0cb1d3d261b80d17ccbcdd78d5e304ada2489ead0135a346f8b274ad4bf2d5de2b2c881f7b4c3c85fc1e788f392fc3806f3

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 caba267d78619896f2b76f3cbff61a58
SHA1 b2a43ac5e41f17aae9b94ab42f59d430040199ec
SHA256 d28f18c0a27c1f837bd96e866140ab4367e0963befc5df841e458c6ef707492b
SHA512 2482b4c4bece8a9c26cfb23a6a3d706af51ced345ed423073671009f8670bba9d9fe80a12b801567ecb47e1e7fb0175545ac5cdc9ba7eba976e8da975020ec95

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 b44f904da1a7a972e3bcdcdaa20e3d8c
SHA1 702420195bb0358c6c6bd535f13ee43937fb8d30
SHA256 94e6c89466a9ba2db9b9c4aa25504028973b3b129fb0bf508b98b6e6fdddc1ea
SHA512 756556fdccca6ca09b2d4b341cd00ad3e0846b5c82e6cb46ef7f0f53f181430d363256158b62c47887812c953484c58bc653eeaa46761c6e0e11af335078c7e7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 d3823f4c782d8ac22569b5dffe305b79
SHA1 532452a02d07d15eb187a0610586215d17501718
SHA256 63ac91e43bc2446f90d6671a8956c4181e75dce09766c3f6d6831eb13c0fa148
SHA512 a7ec7ba4003b3db63b221908941c9646885f9eaf1f2db5fb957af3db0cd4058a775efc2fef8314cc3e26926cce5b842d2219e88af36fd98b99e17326ac05a483

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 81bffd96157f39eb3e96699330e268e5
SHA1 5c93d5c283230111c0f6e78c301f0bb3f373dc61
SHA256 b1cffbf1fd11c4129bb58c15f27c69a8965198613546ef819ac31408836cb8bd
SHA512 be10b23c9f0df5da49f858ff1f9db51b486fffdce493892af0ccf80a66fc1b3785d4b7e5d557fa85a7c8fe5c5f5371d71b24e0cf76121fdf341559ecbcb7766a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 313ec47c34b8fe12294896c5fff538c6
SHA1 c8002b3c48d3918d342b891d19ca64b5cae66a1e
SHA256 f5df742615e3cede7b4acf37bafc534b9611d97d2e7a52583b78aa69bff74e8e
SHA512 df639bdcf38dc73df9452e6f33b00d161a23516ed6700cf792c83d22ce6b8a88c23c8a35b1c58b8e8d673a9c4ba625a79bca048d3273d01a14b3935e70f3f701

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 74931db1b50e9626777075491ceb8061
SHA1 29a220b4fb9a60dd2d1ee1df5b6a7c08f4fc0fa8
SHA256 cd5f5b43ef9346f1ea2e4ce0a5ff678704eee36d24c8289fe63e6ef5066f592d
SHA512 4f3b85703edb7496e4757a34d11b4fa6b3bad7018250cc773d1de8ee29451581d7088f3ab12e54803679bca0686995a33c503c5d934c74decf7174e31ca298b6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 6f789e606f65312bdaed7d3c6fa17747
SHA1 667d9f9cc1f0fbad7f9b27cf6d4686b3a732de00
SHA256 def8206ba4433cf26cab3a60380731e60e7a0a1c572be808be709300aea5f3d6
SHA512 6ca92da2a2e9bb7b2e95ec0a38c6099ef23fd955c59ab207bc907fa5ec06477d097b773110ce7dfbfeaf46d5d814cb1ddd9082f3585131216d33d3ed5986555b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 18d4c2075780a4f7fba3d8841d176a36
SHA1 418ab77322954b45dc96129c3775445a6a7df7ba
SHA256 c82b676e16c0f2749b7b34ffa68eeb8dcb403be5bb2d5da037f0fb5455c19a67
SHA512 2a8449acfda904a449c496b4552b1930c7797bc502c31d5b7f895611e8c240949872ceb51b9151f8b010074191950fe06efc74fbee1bf709fe349d4a7b60c672

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 204b2d78109077af632a8936006cd325
SHA1 d9712917a44ee44c4b6892d2e00a7d6589590c54
SHA256 8928761b4338bd26298819a677ab6122ed69c1af6d8cfc79f91c65b1c000f95d
SHA512 63815ed11a9dfba4fec0ed720660efdfa6d7093e038de84c8093ff167378e4a580d10525926730bd3565fc4feb54bc7a9aee392fbc33e4b03e0e0dc64ecd46b0

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 cdb11955ccc5f7d1a84dbb191b5d5ed2
SHA1 5fd01e62e822a414bff177a76560738759a12bd7
SHA256 2882a859b042a8ad5911e59ad7ca65de3ead5c1ab77e84a2d01cea2739738664
SHA512 5f00199c5c673a811be5d63022d277aa3d16c1699aebf7c6f85f64fa021d1ba16b47edf56ae41d82645981ed5bb9149862d176d465d57c9030ac69ec253c039a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 eb1e88d5fecab2db7cafaf5ce8a979b5
SHA1 692dfce28d3f4c16fcd0b9143900a8c17a8548fa
SHA256 202d0e075211b3efbd9dee5171b43ac6468255f7b77fd21fa0fa4d649ea95e01
SHA512 0ad72400b05e09b7ae5124227cebc125250f5e37bf96908748b0e9e948cb133127ffb6b699c30b5634165f9f630fc4e4fffb64eee2ba6b91dc021446d3f92a58

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 47d5ac07eb771546a65595f0d54aac59
SHA1 1cba838974b20a60eb034c0629b83369a20283af
SHA256 10bab3e50ed6322d98e37e06ac0796118efeb738f97f9ca0d684d004a39b4f52
SHA512 0f2053d2eb12e5d1bcd7a0eaeb2bbe0ef518bbbdb0cd9b56ac5a8fcb937e33ec8a0ef9d2cdfd9a1111a9267a69736ce76c03030248ffb56f78861efeaaed580e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll.EnCiPhErEd

MD5 1e563ac21c6db850d5749a91efaa5b82
SHA1 55d3ab558b46acc97a7a64b1b60d29bcbd49e562
SHA256 1fece556f0190e3a3887bca67dbd305b4a2e85ffb19a49527df20e50f5e96d82
SHA512 541164c76a818a9cb760923c09c19af819391da8255b49a8a25ea5dd28a971ce6be9e07d5aa224eafcb5db6d5b986fc0451659e31fea04a1f72d20583c7e1c86

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 e8fa103e2e7157c4204c1c69d58dcd2e
SHA1 0aa855d9b89dee60e34810c31b54ae8577b55ae4
SHA256 f74b9e329bbdf8d0675ed24904380339fc5b45e4666f4561d1bfed097d0adf48
SHA512 f1612f5962ba0a82576231b38a1dddf433ab1285ebe866fbe7ae3737cec62060840c545d9772f627423971033f0c6a5cf0a014e4888c5ced223f4502126cad7a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 55e903ce040333b0e221c19db55656e3
SHA1 6cf2df9030f2a3b191900c1fe808d218ae3343dd
SHA256 f88c105a9f5011454ccc1ba70feaac2e315832b8bbb4045ada794204f5f9906a
SHA512 174fe0806f0afb20c155eaf5a01e2730c76d62ac1369c10f6779ee64f34ada1e8fa8df49b870f544e226b1dafad01495d1117b25bcd2b17393fa165031835f77

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 1de7809180f88ea71eecf0f70365f2b1
SHA1 bfa27b68f110016d3dbab292cbb29f911b5ad180
SHA256 01999c6141bd16f052d3f933102cda6d84c3d91f483644a9ff8525e90490ea66
SHA512 0a500bdd9dff149bd300db61d8668e1ee67bd14aeb0982efb018ac5bd617e7f481797f1901534b338129d143713ae9d8ae1eb4324c3e3c2e02896bfa3e1ecb31

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 be65c723e2829f3da4390f2800d639e2
SHA1 c5b3f1460e63bbe9119dd630b1412b18c55cca20
SHA256 7f157363a8b0cd3170b5710aa05fcee0fb285bfe8f5df29f3530c487bcd8ff82
SHA512 333f6bdd11548c014ac1935692476ad8924fc558eb7a78271402df1857821ff376f286b6ad879d0732d3ada6f6089183b2f2f480003a29fab0799f4741d9c01e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 e190fdf93de79abfe8c685b4c93b1394
SHA1 e6743de0dc1783b0664ee9ad95dc6ebc6c198022
SHA256 cfae6f7c6844cc8186872d0a5866944f23e640dae19a33800cc96fd7754e29c6
SHA512 7577d1a16e0daf6b2bd5798cb68cd0a8a62f53b9404ab69254b45957db3467b55d8718b98ce567f8821b07ee61efd28ad3d5caa9867701056dd4e56b08fa9c31

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 4d29c89f531a025f5b6d7d2161344ba8
SHA1 2778d8e95e44d43443eefb45bf47420717b62504
SHA256 29f3c25e50a42d61ba31b9eed4895722323446fd7f27d322ba76f671faf2245e
SHA512 01dcf16c4198e791a7ee162e81030e6e03b3fb41295edbb8171712bba55a31b9384ce7b69c87a119efbd9b660d3cb5aa539b7a2d55c4170899cf0af130c12f38

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 320bd53ec686c7250e229a8f63c4a887
SHA1 fea2b6743e055ca56e765991e330d2ee284bc9ef
SHA256 17cc1d21ab4ff303166db238942547f44c56a369136d4046361c31c202771045
SHA512 e5e2c611b54aaf74fe938856cec9f2b4d8a4db43e75bf96b891b868ab63f1b308052362309b26e582ebad89be00e87cd1214aa8fd38e39a6dfc5f5c829038154

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll

MD5 98d514ba7161f48b42c064f4989f110c
SHA1 bc0baffaa11ee4b62e288e7cc806dbd12428ac59
SHA256 7e64aa63b08b484a361e7fcc4f138a5640a632c6a8083c356782c3635a362da4
SHA512 ffe59e96347c9e266a61afa4b7110db74bd1b51acc86440342d59a3260453df85fe5ab38597fba09f24a8cab3554e9497dd595a8557dd0a74e60e30dfdc01f63

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll

MD5 57affdc8b628547c02f5758a45c0e79b
SHA1 38e448a734b32685f85881b91445e29af4c516e3
SHA256 88525f48ae4dbf6a20a81043a2fb16d42a224bbb9f3cd52195e32a9ac321be53
SHA512 4f1eae9faa44c1ed6f9f59631a341b7b74915d9613aad0b29b6cc56861b67b5183e08c0ec176bd7536232112208f3281b4b7b54e48d27272089cdbbbaaec925f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll

MD5 94a63f4faf34da2dd4e8a0d23b65cf89
SHA1 519a68909df7d4997e275166c7cf95fbe3e6c636
SHA256 087ae88d42fcb0cd54f80f76fbb0e882e3e54cd6845c09e4331973cbe9346751
SHA512 becc8870658c39112be1945d6056b54965a2a5d8c8be1c34cb484d5eb5f61f528ae91605d1e70e0ff1c9ed8784f1645f712aa099f07b520cd10477f71c2a4d8b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll

MD5 14a1f6549f134211be00e5ab97af9437
SHA1 8c8b7ce7b50caeda3c7e24a5dbe825e25adbc5cd
SHA256 328c9cd97a4a204a9cdc9f3d52af802572d65e32e95b4d1dc5bfe10fe62fcb03
SHA512 d8f5628f8742b622cd5290d1d35bd2005a4e149e16932069a5215a3d570eaf131792d1b1d053cc8c1e63bae54a7581f6585f9870c498603b308269b8a4b1487a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll

MD5 16a54fc71e1950022a1a48a172441657
SHA1 267e77851f1a4684e5f1e53d44fc8cff2c251d97
SHA256 62da9816c6a92defaba7f27aee478bbbe3e42083980a7d202bcbcd8ebfb3e72c
SHA512 14ca3adffe77437123acb3213f018702a323cc5a846d23c61cb1cf542ba6a55d838469b2f98900525c5f47a02daa8d4b2d9ef6c032275e6a19c700832fec6dc9

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll

MD5 7d3484f18a6918cbd79874c495f35aad
SHA1 4b5eed65f3d492fa3b031b97d7e268121f59e546
SHA256 842d5869e9f3e82c8581cb1dfb65af846b02b9a19d4485d6be69d0318d2e22fd
SHA512 749246f460071249b240c8d3d4352936c904f8df42379dc1d797eda01213bcc0f975306402cdad4e4f3483cd8f5c90ee078001308fa9eec1133458e40da61dc1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll

MD5 84aaca5cf7e2400b279cb34534fd88b5
SHA1 ae2661a1f077aa06ae1c99d3ced9dbedd0bd42e9
SHA256 c826fd8521de4a8635ad95c0bfc15407656395bff0f88c446c35f1284c615a61
SHA512 362aca63b29c3d0640e8471d9e88951c10e69959e63f95768a8c7bf702cb7096ed63a9549633f3c900ff3fc386a0cf46c793c123c002a3b10eca0fb26a21225f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll

MD5 63e03c37f7d8b4276172aac5f979b67b
SHA1 91e6da7bb2305a36124e80c4648bde589d1a8e9d
SHA256 ce52aa94d8dcb27261adfd2dcb6af19f045338c6b717e043036258587b060916
SHA512 c014cbc1d03b91f94d2f3e1a88af35fbb0de528250c3657e6facea28672cd0d5a9baa26dbffae4d7da87c21ff58f0a62ad71f5b8635d5f0a9654e791ebfda4cd

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

MD5 6daf43fc92a2421769289d238603d3ea
SHA1 fbea592ccca6c90fd974f51e360ead7b02d25280
SHA256 4ecef047da282b0aff8f5146189ad46d6a7b19abf609221190b530060d7e3c78
SHA512 893b7cba1898ed3cc18c0913534da67a0dad1b2db025ab2803905d4742cec09baf00ba4446213502d75be8430dc50c5231ddb035ed4f841598d377328e1ecbf4

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 77d50cfd3fcb4d57e5d85b0725c3e196
SHA1 6119a28e2aa766c5180c7b78b7ce288cbc50f624
SHA256 3433d092caf2994e00156c6d8e87cc467d902dd637f2aa635584d8d3eb8e627b
SHA512 55fc0e933b37ef665b82c69b5ed843e86dbde72c4cf0cb4fdb5db5b5d9135182eb8d4f386c273afb57bfda1f9d810457375fd13b85ea831bcf7539ffc4ff859b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 bd482a21ac01a36e7b56304068b7f04e
SHA1 03670c513d8f952ca422ea51f77445b3b3894ba7
SHA256 072ca3fa4e019b3161106c39489aa5a662a246db9732f35e49b401c3509bc41b
SHA512 251f7921be41a4315e539fc582fb9347e9a9cf3c5a37983e843275b6adb11c949dbd8459e807be66f04e95f58e6b7da6f3e1c8ff3fe81751a8b5d19ff4bd602c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 f9ef9c1377b6f58591c65ec1ed6638b1
SHA1 2a0a1b7b3109c69588fa0fec90b42423c267713e
SHA256 2a52f1533001cb785ddbb69bb504a9fbc97fb6c620e31d9a5416562bf3ceec34
SHA512 01e5dc00afd477326ab58818e9cd0690602031e97031ee769cb561d48fe5ef67c37662d82ad878a1d3b7c800c1c8127da7af7066d3ac9b015662752fe423c1ce

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 fbb7e66420aca3f37ede53a6c59100d0
SHA1 cfcebf873a300859abab8efcfad4e96fddb81002
SHA256 e993e041bbcdd750cd2012cec57cd51e5a76cc178932ef9bafddabcbf46e0110
SHA512 7ee906fc6423044b51092bfa1305d26d0c491331a3c3602b18ebe3779509274f5ffcd3615fa159716a82ac31740752ba4e88f97b6106abdbfc5eefbed39de267

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 f2874bf8f43b5d3e559e67968ca82a21
SHA1 31f44e939b6da7ae4a1d7fdc6121c39b5514043c
SHA256 86e2a3a7e9501bd5b589522889bf2fd7abc2ad337a8b7835467407db1f77c3eb
SHA512 c1293a677e1430aa8f9b57e5fdbf5555579ce2b1095cdc91ad37425950b40a11adf04b807fbc93c5ca2abff6fca8ad9303f8426c4c800abc00c4726b004f9234

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 660039ee59e68a336e53bcdedd6c7dd9
SHA1 e66bf1ad9ad464cd5d6f49726e10a8ad60c347a2
SHA256 78dad5854bd8e4ac7556611d8a6aecb4d63bb7bd3f157b75b17030da1f3dc0a5
SHA512 d93d526d9ba5b7855311b442e5d3ee500be9a597dcf54e3e087956d5bf899b18a9f2ba65bde9e7b7df752ea05a7e846e7561f6c86335d2ebbf9e41094cd4ad12

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 23f7e5030ab6a2f82a07ae3f959079c4
SHA1 eebd6e399f42762ed6609b599948305249084f63
SHA256 4bb98f9af95b44e1e00e373ba10cc8a999399da52c423e75a9e46aaf43c18d0c
SHA512 e49080a139679bbd0e29b4044b4fa6380881352c127042ad77c03c0f11a55c57817b018c00dd50d2aacf3e5025821908089fb5c5ba435df196be4feecc278e17

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 3922f624a531b6ec69262c50664b9a5e
SHA1 01be8800834cd808b1e82ff69e1715cb41a1cc74
SHA256 86f1a1a4037e47a3a6dcce320018633611059271cb0a081ca071f041ef767c64
SHA512 afb798ddcef7551cd013f2467b128f001232c3926606bdc541dac55b56824d33e2249cb5681f30ffa6258d226e370e610005263c5668548349e6e9cffa16acdf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 78e92e40383763f93b0f1321da2cd372
SHA1 7f32474e30c74375339b5a10e6e246bac802788f
SHA256 b76ff1a6302e0f2c57a13cfb38c853017fa86e11ab951aaac24c6998942373a6
SHA512 0d870d82b373102dec305a17554027fac27462a4fec6ccdf8cb3e9301cfa4480358a391691e75162b498424207d485ffc629c71cf6276fb082133d7ea78d248e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 a75fa446e7303d32c7df521ad0995477
SHA1 9759b464d376c31775d97256180bea9ead92734b
SHA256 b489774abd94dfb2d73c697800442c7ad86b64623f164a087c85b09f4ec16b10
SHA512 5f612c60b42c17e83cc04305037d01950bae64f89208b11c068621904e429581d6a34ccb6cd0eef9e656ada2a1023237f8b580b9d3588d2813d33fa584b1eb59

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 bf3587e7e2981b2d1a593e15bfc6be7a
SHA1 fb2b92c9de39fee1b8a728bfae01000a4d3c945e
SHA256 75bb09249190b4248996649c80e603556ec6ae5a919216b0369190fe681f1154
SHA512 0afa95d5ea3989674260078a5708f602b3a802a436edf1c5673b00751ef0cbbc77f531e9de78a952b6a8598f60486dbee8a4041805241b0bf69dc0f4518b73ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 13d0524c1981771da1684e0e9fab319f
SHA1 ea152b0d2ed5e79ee70d038d1ee22f20f8b734d5
SHA256 b3f3f41b1984cfa84ae8b5ea47561d84d8623208ac9a77fa25403d4b74a09a24
SHA512 6887522911e2c7ab988276a997b5a016ca8e937108dc7e681467d3052a818f912f32e4aa6b82dc2cbca56833174229a5e78666fd09f9ad88685bb233fcbcdccf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 524b464348da1d69bdea25305daa654d
SHA1 e79e208b5482333bf1e9c0fe80e1cd8d912bab12
SHA256 81311a6020364f1074c6c31888861c78a14a13095bece9dd543fa037fb6e0ebf
SHA512 a177bc29600f8a538e0bdd6f993805b2e35a3d185814853f28dbe023fb564d2b02822626ffef9a6a37786a401b63fd29ddc60d0cd675707d5b8bb5600227ce3f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 1c9c127d182335ba4aa4b136042194db
SHA1 6fa0306a13c07b6ff0587f2ace42e8bc0420be85
SHA256 d43653b6fb1b7e6fa6d7c0255be53dc5df6be6083b03af859411b3867e7f04ef
SHA512 7f214a3984d032036a2c1307fb40a1275de2f078ec8ce23a60f6e446035b4ac0e838dba26bfc2cd335539d5f76b151b9658ee75dde9b39f8c3d624d411133af1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 a5df884f140b38c9cb0372e189409fc8
SHA1 b819ddec5ee03af21e5c69c21515d42238a19815
SHA256 aa1fbb0eb23e14303c2c9b6f8957b26c4d34663601205c1c484514b8517a1ee9
SHA512 5adc6f8273e8566b819c85eb8d7b62c58daf368ff29348ade5c1f4559df545a25bbbeeb8a1344ad103f6e9b6bf3df64940c89769cb4815bb685c330e08fe0817

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 ef0ecf5cce22ffbd804d704826454ca8
SHA1 b525d309e18f3b318654d190333def3c56835275
SHA256 1dea6e70f851b136626dd7228547b220f982da1ce4ca6720ccfac0d93b6bbe3a
SHA512 c304a2cf0fdc9ba9d72e3daeb9fe99eb772f259aecccd35f6084a3b6a49f558c4676aa64a92d86f2db06b259585dcb642b85babeca6efeb668c4dda454ea343d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 7dfe668d62c5ab9ad4b7ac7cab8f0f9e
SHA1 796f47b668178df196bccb91ef6fad3403bdcda1
SHA256 acfaa6a2c0f8682bf2d4357564ff10da7cf2e344d1fa01113a9bddaf0345c695
SHA512 cfeaab92423058d6827d3d7093b0e08189667d4a4cf3039813a92d5510111d4fb0c45ca9ea1c2fedb6ff4b9c1cafb577c9f9cf278db64ed4aa843c0679bb79c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 583ad776b147f987d13bd7808615467e
SHA1 7e2eb470e1b7b73c63d0152750681cb8e1945927
SHA256 08bae49418799919b7cbcce0b11d4eadf5e38ee8341885712cd2822d9749127c
SHA512 f913983b02d06fc311cae0f15c858fba6f342643330d8be912680a912a0343cb7affea4365b0acd1a3efd4300c8c64274d25e92eea7295c4e4de8d2124acf2d1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 a5d275f98dc4dd4891daab013dcc6f9c
SHA1 d55ef536191a83c226117259d010e4937542ca35
SHA256 b10993c20d9e29b90e21d136933b264528d6ef4ceb36b6e3b229ffce8139dfb7
SHA512 511f9e8445544e9554fff18657fce9b28977df069c55ca8947e82a92b2395bb0bf382291adee98be78783067263dfa455ac99f5f80be1791e21b3f86cb96fd89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 23c1c76c9657936831aa078d88c127cd
SHA1 fd9e7e2fda2b05665dd6dd50e9dd401962f8d524
SHA256 1b602f9a7b9276c863662223f487f5dc26624c5dffe7c0ede39dd37d78d0c397
SHA512 e11bb734ba8dcfb97e243d3c99c0107451b1fa683a7c1ce3a048e2c2dbca4d623a62da07ee6596bc32a8a7263d747c8f6ce9585645693505d9f6df403a9ae8e8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 f74b2e6ee62ae704ae484986aa992609
SHA1 8205f6b6791b2358ed7c798f546627d5706830ef
SHA256 0fc56e38b6e1eb2632aa7c4037dd3f07e93148584761b1230bce2f1c74d91e13
SHA512 1a8782250e5c74aa0daf6f53600504043f05997b321f956cf79aa49e8d8f66c5d658efac484f923b3bd393fa6e06d08213aed286f737a5d6817c1394e03be412

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 0dfd88d6c0fe24c8efc8eef268ee461e
SHA1 04fe2e20a55a5b7068a3d690dc6b7f40d36c7fd2
SHA256 f0d8e8d54acfac91959d7a8c312354e0fcff7c4d5324a2c6af8e18e4844acfff
SHA512 74a2aef5fbcfd19db7e0c31e15b04056a3a771470971da5950c82126a48ba7f0c406757e544885e7d7d5a3506f47099d9f869de61ee4540e0e4863d742269a8f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 0f605c467f6c8be1a1887b10a0c09a5a
SHA1 69334c3721bfde10db6fd0dcd7ac67a17342fc6c
SHA256 0a7212fcb350d4956608907a7a95714f182fa5b51b51741bb4b778bf64dd43a7
SHA512 537d1867786b93d3b773af67f8c95ca6e3f76d77872e94d62f7919436f201594ad35b5da3c172cf19b16df5e9d9dc50132a161244827f8c5c379e108e9c7c2fa

memory/2364-10711-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 9ffa92ec630a1bfda542ecdc785bf364
SHA1 ac9014d80ac8c6ebd94762eb3ee061dd993f7120
SHA256 a2d4f970c220726f4e9dfec72c1bf170847e44c9060bce2e46ab161e27e0614b
SHA512 d1aa3a76baf97a056256deee9c720bcadde60257015332a78784ee237412de5c209c8ba6cdfe7c7c8e69bbfaf7949b9f2de18d8b9cc03f6cac3fe934c6a3b922

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 d61e4fa92bb82be0c46fa83b8833ee3e
SHA1 f40c20eaab0f792f7b1b6da08a472aa539892d24
SHA256 99970898144a971e82aa43ee318935133ea352f3c51393f8dedd3d29704879fc
SHA512 29bfe2af495aa56368321eb18bf41ab95569e5b2ba4cf60aa32ba25e52a36b9b2a1de3e384d574095bbff14bdcdbebf0fe3a1ff64184fa68b7b780fc9099ad90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 525dc6b61ed382105b3344dcaea271df
SHA1 89ddfcaf0a2736e7b18fb51d176ab69fb90a6de4
SHA256 f7325b276ef7a6b3f112ea65d47d96c598b649d6f2652a26f739d55cbe72a1c9
SHA512 d853d67a7b51e1fa6a0c7247dd8e812275486c529188fdf2fb148f127433084d6c52a6388fcbc7ce7affdc497b008385b63844f75208d08a7c05fd3785454b19

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 e67b838b9500f3d45fd5b9bdf0c59fc4
SHA1 2c2a83edd6d4ee959f4d1e719651264794e02a4a
SHA256 eeda34355d57152775565d00f9b296984ec964c3a6ad79a8757a95c8f2536e1a
SHA512 c5b4f19aa2fe49f99a8858445fe0cc61f58513060c42ce7f007168e090ea245203edf4336332a6237dd0079c163e8d8945d5e2b064d7d1129424a1fb30af5bb4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 450325f1c28bdbaaac1aa7306218e485
SHA1 1c2a700eeb0985821a42593c890b3eb302429c69
SHA256 b5dbedc826e528b074f495f818890e28654b476da7f3b723bd7c17e0e3ec9120
SHA512 d0f57b804385fde84250f7680a0887ad84242fc237a821bf097726867faf396484429675c2f682aa6430c2bfb73764451d0e4605d028ccb6274e5e61454814fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 f8fe80e83cb73fcfef0791e6cf136aae
SHA1 4a682dc6185d671eae5a130e04a8c3cf3e10cb12
SHA256 3cbea64639037b3b7af1c0e37a0e7ee57f5630ee506cdf7ed14bb7de8c3669b3
SHA512 da802643c0df7191e6d1543fa5c0eb4976ee9b5124134ecbbe2a1b360aea93a7b0feb6c650fd6850c6dcd162e4e9795606978c5805ae647e1f1d3bf94d1581fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 a48e8a1b4320f3014bcb59ca65085e10
SHA1 2796a9fa9583d2f58472aa9ec0b12f24c3f547d0
SHA256 02d88902ebdeeeccc1457b5d464a76bfd403291d51e5de48d0ea4785bb22d018
SHA512 173a24134660d42472b64aff86b60cd8861fe5316cfd6e705914d2ce5e3ea1f6dc5d9866000a50095fa08e97b885cbbf6b0bba5e35cc7814f298aa58efd79351

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 24c0e086646e6b3daea622fe6f6044cb
SHA1 2b46b26d9dc707fcc969d5a11f33f99eaceb73ef
SHA256 d9f1553de01e45c02d75bc4e549ce5fc561b5dfcb940105589d0a2ea59960840
SHA512 2b6c471673b06f02d0a4eb48237787883786516f68c90f96e01b18b7511791482901208c2f1978b96b044b8020e400e0c653b6c0271c024be25af7de36d39f43

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 c58aec00229e23a022f0d5e092b04deb
SHA1 e2e7d32406b216b188fb9e435d6f81b17518c2b8
SHA256 7da5ab53cb9b2ba693dea6ef9e7ee65af5f42a01e98fb38e7863005b77e2da58
SHA512 bddd41db0633cb34134116a6d116f9d74c2da836bb0ad281ee805c503d0099e2969dc9614ce90ebbe1354d98840ea421db629bece146aa515378b5f3d6058ffa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 e072f1e1f743020b44ea194c4998bffd
SHA1 0668e924c4fec2dcbe92a1e2feb494af1db22534
SHA256 f275e25fea80f7fff78c5dbc1908d71d15190bf0c66626eb4e0fb0d098ad8bd8
SHA512 72e1dad26345042c953bddb8db265ce4f35362dc523e0e62770bfbeb40e66a5f1a854de892103ee6b0f3486c2b58a748072dbbcc9630ea1836d4c5d27c7b6673

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 a8b0f377934a33b271112768f733668a
SHA1 78c6c700211aae7e37ddc7efb84ac9719e11da05
SHA256 0c304789752e8afc69d00c345d3e369e86463fe6283b344f62677e7940b9e994
SHA512 6f1bad2e335b9239e81c2fb10fb222f1e08f9c669c25ad43eaf8459823c0923c2442b0a8670c81e9514b2ef9152a103ca531da5eab9cb89f4263bcf44d395a21

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 e92abdf1f756654f6511f95300208c0d
SHA1 c4518c5db433a41f78a36939e3f950f0df876db5
SHA256 3d23f9a6c9c44a1628a0221fad8e4f263b51a61f0c29a78e48607162d8b8cdf5
SHA512 c64fe7a48a12094c6d2ef7d0f22d1de077bd72e4ee87933bc6daab278b88fc0712030e50f648c7b3d4dda0a4c20f6a22c1fb04456544ddd917174c2b1da71a99

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 33aef50aa2be6521c070ea3d493e5c56
SHA1 1df681f10366d005b9add62413498f5f20e916d7
SHA256 ac7fac5cd3148f3fe03f8e3c95700d532b49d2cd6c21483681e4f6e9fd5bbe74
SHA512 326c6a7e0dd5d3f057091605b66c178f9d8e0b17cde1412dab479665d0b1842a840b6edd879e6a8663178361d5767a684692bd3c22ddabf67691bc0de5432dca

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 43e5804bd90b8089b2e6874c8927968b
SHA1 eac1c8c0bde71b4dfbcda8a70f2e8d23074cc4d6
SHA256 f8c53dd0b2911a9db04f4c6b16728794493a830d8e15673de8de6b2ce172abf7
SHA512 2188a962491ad899968fcd729b533bd8cdb4c7f3fa618f3d0591cc4a54fd2cc2fee04eaf7ba881ccc38f860c44cf6b6193bc6913fb1a2d41ebc7cb21cba335c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 1f8be324708f92bd82e15cf5b9499d17
SHA1 8d33750e0caac4a80d45a77d8e7c69c47b126832
SHA256 90016445b34dc435e84575924e8f768294ec02f24527450211b20f7ea5ecd172
SHA512 71670734e941385c35beb436d9fa431c217d3fb398502d3fd644a38ef05c791cb5108afdb9230f9e7222e5b40ab3d44e1c450915f0aac97c38ff38bfec256e4b

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 5521bfa867726ec725e036bbe77009fc
SHA1 e2d56b4fc90a09a1d82e08e49c5c909835a32688
SHA256 fb0f017790ddca4304deaa9177db4abff7f6058fda9a2716d653de22f521cbae
SHA512 06f49215c18428f369d0c540e230501604fdaac809e23fa8ad3d6231df96c1e6438940a8987661b7c299bcad1a0d463851449a7d8e9c2ec7aeeff69a3fa9e6a4

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt

MD5 79548bd08cf48f9d744c504978f0835d
SHA1 181a352c70c264ce36a0bfa93a357bc17e4cf63e
SHA256 7379adaceeaf9c74b7e051f0efccfa0386b4c781ea65626863634993731445a3
SHA512 cfe6f8b083473782a05cfbcf34503205ba4c626dfbf170a6beac18bf1a2f0d66166e001d1ae715cb60c85ac1967fe8ecc3d38688009e8ccda0c9aea10cd38d10

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt

MD5 b2fca71a0248fe9649f37cc5868f28f8
SHA1 33e3b8ee94810292f74130477032b9be9b39d257
SHA256 3845cb7e2c7bb23b4fc045e6cad7298b2468b578c90872fef23ad011b36a3f8c
SHA512 be2fe2afef20ce8c15f22e73972aaa193409a7bc2ca83220d1574dadee17061b295ba38f1583027ac65569a42fec1698267f60aa7016d98f210f10a76dbb9ef0

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt

MD5 5467355cf4b8cd3f38828775326d5968
SHA1 e29d2400f948d01bd2f49efcfb9ba2eb14cd2a01
SHA256 6b7801627e9ce2e43c9999cd7f2b25a30b54fc41a1c2878ec3789d4380c99b3a
SHA512 ac45b3b2232173908a451139018de05f7524884d64c9e6b15480abb09835c95c35dfad1a7244fc14b518ffbfd44cca20db16bb7ea065264bf67b67f430e1c0d4

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt

MD5 ff315dc4ecc5f79721530afc827f1932
SHA1 d1d4b14e04f5b60ecf95861bfd7ea7488ffcf38c
SHA256 bb4d297b0cde30f20de09e1373ac0ab4c48ba02019e56c7867a7d012fd90eae2
SHA512 c603f63fcfadcccaafc0bc7ad5fc119cfae7728b695a4275bbbfd0ae9b052e88e9db5406cb55b2111ce89bfd364f74b4f838266c62b4d8cdeca6baf17873baab

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 5988a2fdfc23b72d4556879d2794b8b1
SHA1 c395d5271c1b3db5b0830ddc59943a746cd12455
SHA256 51f722f41741d4abb845a0c3c638ad157f557a4d67ab34b93acb7aeda0cf6f79
SHA512 4475ca775d64529db5105d7f00d6595687baaf4b57b5e48d4c757dc285a9ee3a373e239b266b5ff9ad11e8732ec9617d7e336a05bade99752fdec7590f8e3b5f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 b26f5cfdfc5868e02a1aa60e56a797dd
SHA1 0fa3b12c2b7937e5d50977848aac42ad4690675e
SHA256 9ebad899a2d09e3d568a3cdd72bb406d9886f5cead19d861fa826f8006d4e900
SHA512 448ce77d138d1316e4931dcead2451a06076f6cf16e2e405c3c48070ed9815b7199d7ffd9f4e7eef08c0ae9a998f82b48702fbd5af1a998993f9e139329b7585

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 fea5f4e018dcd46832d84530bbfebf88
SHA1 b877b6d3eeccecb16ee3701bc060d107cfc18a95
SHA256 2abe992f82005d31dba0b6acb701699591d37676de930def56c10db4d727f136
SHA512 d2e6debd96f9415136e20641e6c555c187acb80d5b0c9f8ae88bcb950df0d2c5360b4aa25b9c5056a043205ef5a70cdeb5927367ba76e58d92c36f647d7b83e9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 ce1cc010a7d11edf83334fb9be3cea0f
SHA1 3598413f3da7a0dd5db3e22e71a6d4f997530853
SHA256 c008fb53ec9bcccb6b85dd66b55796c11782d2b9bcb495b76a31b8c6b7b5afa8
SHA512 d46a409cbe527b4da421dba110c0741a61d44aa6e30e9c62b98308862fc05e668f1deec891772c3d585fa922031232be2f4dfc2a711f139c809a73302ab446ae

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 53aefc70b990c100cdc42747fdafa267
SHA1 6503b7302d76d3d91ccf22e335a91de9995f8de1
SHA256 ae914e4e409aa6713b575d5a6e0bc68211b88930f227367949fb69d56a965375
SHA512 8185594c459cf169c229e35dfabc234e130ff0344eb5dc4a261223240182a88a3708eb3a282f862a333545d234fa26d2b8008de0a13366f9cd9b5f722e9c3cbd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 dced33eb1546832abf1afc07ee0edbbf
SHA1 20c7c76ba557d10b04ff95a895cc46a717684edf
SHA256 6923601dbef594c3620d496d4fe87c6baba237b6dc120dab1484fec18e7875e4
SHA512 abc2c37f39e21a75b3adbdcb2203e3a725acf68e85bfc2451478051c3fe7de72190d586fc58597b51043150074fc779e8ecd620378365136ee0d11141f0a519e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 c0bf4c8ef969ba5dc302c80333d23a00
SHA1 093d91d0ed97a16da6628799be74dbae10dff547
SHA256 782e1475824a8b97047a9574d8bbcbd41ca0fb0f55a3f0a8f2ae2d717deeb095
SHA512 983875ff800e329fe618dd2a18c62c09a9b7f11548c7f2542deab26b486cbdedfd19b10acd721ad09e448024a7ae39746ee32281953b0f1f6682cff7a5cfb23d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 5f072d5a44d7a28ee69bfe62b8bccd5f
SHA1 d12ae22e7510b9b9c53a679d09825dacc3363a05
SHA256 87c90a5d721669f108cf6d9bf885b7568e006825b407b8624fcf9a0fe0f7d9a6
SHA512 e17a2c7cc73ce21291b755711ff9637beaca052ee5a3f98a00dbc7ff172071cb7f1fc7ea958e4d0e603c90aa609c771ef97f224bd6678f3069a5b616abd10849

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 04225f85f08993476255ea5e584e532a
SHA1 d7b1fc518a6949e5554faaf60bdb6c391851a7c3
SHA256 4cc5414b1d976aaf9975a9a6110f89fdd9be6afcf0f1e4016646ffdd82128244
SHA512 d874a295bc6228aba1a505488476eb26a67cc8a270ffa9e24feeca0c7c5a02f5e65ac7ca2d59dcfc62e6f499819a4496b2736a19dc3efacab9acdcbe6b1236a7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 47fe08f9da249e60dedc62a3210e2373
SHA1 af4b7a7106a057c13b2d09032613efa073713849
SHA256 1bdcc5c9230c6caa6caccebbec99799781bad1b02085eff30a4aa68645546566
SHA512 1a3e31ad4a346cb70a199291fc077debd4534fbd57c966abb9e41e005f70b30c1a7fea6222390a1111e6a9f9afbe6b57f05f004c45ac020e7a4814d61ecf8757

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 41ca268b51f892a122163d2cfdf58602
SHA1 6b216769ac4fa0eaf89082298afba84ce410d7cd
SHA256 e7621e3b7376e8705b7648d88f44c92776fe46274e0bb007758dcacc82596811
SHA512 741f51c08b5624c562fea757307ec175e0c3ed617d3392921cc77f9e57b9870b9bfa00d34444e8420b2adb60c22e0c25409c1c9fbc12194a877684dcfaed20d8

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 09c0150a966eb5780ba88908dcf05c9a
SHA1 d3f16c6103e67ee4ca8127969785f2807eaac0e7
SHA256 647dd6deb188bb1687e7753cd2d59d9d1a7c7dfbbc360238124218967b6663b2
SHA512 d091b87104697c16e3ddb796d3f630d701e0a3792eab0f8a48378a38aaee7ceccfa21908b104e7c2660cae005e26304715b997f3b0e3baa563afd173791c839c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 86754a57724dfb3e4e1ca4d7f189c98c
SHA1 7f3b28a7cd24c5c16c5a85ed12595f7e34fed781
SHA256 92db3df798a0305dcaa5bcee7c0fa10b606015ed3eab8713d72f4b91f6d6250e
SHA512 7efbd2ce2f07dc5b1e7ffeee9fe43022876b3c81cca36ba5cc226ac8bdb2a0521d88f78fa5785fbe0ea96997eb10baeb6087c1a80cf7e6548a48ca5f541268d9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 f26899f476a9dcc01a76ed2d598a0662
SHA1 704d0aaa6dcce8aafc57ba2474b3c6b06d19c074
SHA256 759c36a246c1d534bd7cc27add067f8c8baa3f15a702bab9f8dff2da86056372
SHA512 32571b540c65fe4f814c9257800b5639583a82c271e844164643d0e160b6aa2eeaf819530f86cc58a6ad1a48417b5c302d1d55902fd21efe09147dd6a61bded1

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 726e33f3c6649a0ec07e17837c102d88
SHA1 eee070e1b1fa48300fe8dbaa66af84b0f783e57d
SHA256 fecad4dc87e18602498c4654d69131cae767a565f69ef80a05d0ac753b7a3b17
SHA512 f595b6ab76c329874c70affb2f637d77ff985b19a9ade53af78e03ebd0b3386b0682b729f2f448e7788eee5b4c318a1555c0d0443e049806b80c26a02f4f667f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 7a66a19950910136995942283db64252
SHA1 928fbc790823b6828c31918d3c5b9495121f39e5
SHA256 573c341525779dae6ad7bfa6fb6f815026a240a30bd9b55da06a6a0be013a9f0
SHA512 01c06c60f8572da1027256bf5e26d2b1849358519b7dd07361c75814f505b25591c8fee7fbc28039099f4dd22c503169f74c5abb1a655c7954d1671cc457ba98

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 6d001d899b261908dba766050090f8af
SHA1 33f67f7c73d2574040a224ab2dcd199d5e5073a3
SHA256 8966955b7e1ead2b929b7565dc27b4f9961eaf4467ad87417d13975fcf58a69f
SHA512 9776cc55d9da86e233dd2e2f212b5d41a64633a8fc2e76e82bedef4420f25f492eab756e0fe77f594c8acc447b462de6a789f31cc8a916e50f0f5fd76c9e75c6

memory/2364-17602-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 5c19e21241f14cbc64d8f25e5406280b
SHA1 acb236bebed64ef318bce29752d81cad90f31755
SHA256 8e53a7e03f1da2306e9d617d742645fc17ae2d813604a4f9851f34c6e65433ba
SHA512 900239f01c421e1e3c86091db07b4a471e1b60fa3ff954c461c6daf6af0bb4217b982b9ba9e1480eeecba9d0a2585f8f6698ba120579f75327efa6c770bace9d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 b6c117f52a099ce4018dbb67b40c62f5
SHA1 784ed2ded8b36d99d88fbb03b8e70b298e54167c
SHA256 b57eff397c3defbf7db7b90237eb0a557f6eb5216325a8cc38a52bbe1526f3bc
SHA512 2d95c3a3a40d90affcc27dde535820ea0e61704f417c63925dad453ab15a83e6effea9762c6115e638998bb377b0342fbf3c543b3714fa18fc292416cc801164

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 31282ed5df5c3e7c2abbfa86ba4c2ab2
SHA1 5a3bf064164c3c6b8611008ce8d69604680a4267
SHA256 88dcd248613fdf00e9ac60b901aee234909bc9dec87cfacc31cbb42d8df12954
SHA512 94badb75fd4003432f8dd41db31bb8e84fd47dae13716211f83e619ba52a0b0868bbebef0497e4d1e2d8204dc9de82d452397928fb5741a92c44a794794f6605

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 1cda5a835f473b5d89160edf72e5fcde
SHA1 804baf16386b203bc165e58d8ab9c8de82ef1c32
SHA256 24da08d84a700a878523e6a112af590cab5572b5e5488357f9462f28c883b9c8
SHA512 55e7b31d2b39ae63009efff74303581253088246858f1d28599526fc08e2573fbd01c78ee0bc8e72f9cf9a5e271ae03de4ab15533fa466d93c1eab8cd1801e5d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 641931c9e50a704b02df7276bfe0a4d7
SHA1 071a465187b61a23634e1e4b888783e86df2c021
SHA256 7a9eebf27bf0f0a3a2f67575d6b82a44e31a6cbbeb065169fb2a67114a6904fc
SHA512 4ce2bae235794d4447ed1ec9f5fe5110163f701a45416f5a1d50648637ce6fccdff6499411524fd5cdde12de66e4d5a4996a6e13e785efe16cb4724d86ad3d66

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 c7537afd70689752235787a7226639dc
SHA1 c128a9960e01abb7e3825a0bd29b715970fc076f
SHA256 819a4ca2fd805346f8ab46ef20b0f59965bb80711c908038115f6282607e6593
SHA512 b0fa4178ea95e1a9e83646e4c18b0220f10de8eb962ad1c972afb879aa06aeb752eb553f8d76c0f0c94ea36e8a2f2d57bb90bf810dde4264aaefdce300a23397

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 9fe5226dbc898a81c26ea6524c5f9bf8
SHA1 8ccd59c26f6139bea212e64b664ca12ae2968113
SHA256 c76b9e2c914c026b878dc2722563bb22c2d65ba58ba8879bc2d748d372be24b4
SHA512 69750d0567d53b7e62bf8127c0c1facaeb917178fdde97818bca971b493ec27921e42c40c70f368d6dded0757ba1b539f9b44873249c37b2598591b9e113bb96

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 3fc5f06f9c722a9b857586c68a65c8d6
SHA1 5289b8d2ad499ad0f032a4f8bf88596477084240
SHA256 05d86c48fe305384b4d6e1120615f1455e7186b499dbda38611eb226cbb12208
SHA512 ff5a41002f445dd5b7acc889021679566dd2cfe095095398f8356d8b341d07bb6e18ef9550019303244c26935280319261d5a67b7ddef5c4126271a8e5717867

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 c1f9e1c4927fd7b05e10006db281a034
SHA1 7de71aa387f875aa6b76a7e63c5d882481f3ef66
SHA256 96535e861371c19ffa798a249493edb067d19451682a6860f6a730b49193ed69
SHA512 136708e1e2316d27d45a1805fe903a06e0465c9e2e32be7955fbb2c3e81e380e8a8b03297c425271c7b8c0799c0da05adc1460786299fd0a97b8e86fcf4ac2c8

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 92af28e45f80db79e794bb07cb2676d2
SHA1 cacbb263bb0499261fa80df27ed70e9ce85700a8
SHA256 91b6e6073d2039909c14b28c869075f64132a2c687624ec8fe2d00bf1656fa97
SHA512 2fba638f075af5e79c6c470976a565a64ef280b27ed6320d697108ff7b4de420ea3098d9c730b5d3c70992fdc4eca40b8a49c8498efc0491b82fe03f0511286d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 9978f4b24b45416f824b436a66e38ca0
SHA1 944425e2019e8a888119a379b7239ba6d3a4bafb
SHA256 1fc921f48a0661360d6207b740500a8ff725af4777ce80190ab98085624805a3
SHA512 fdd440d000a6f3888850d3fcf1d1698f873eb16223acc41e4a275ca231c9aadcb1951c7b24b9f3068672a2caf2c7fa13e98d33586a9acb6887b6e27e8dba53d4

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 8140e3a81dba81371357f580e8ca8112
SHA1 305363297dbe7a06c9564651af7bed6a21a0c825
SHA256 e3f4e945764e23aef290f55ccf0fd200a00bb714c0ee28e3ed1910b68acfa2b3
SHA512 1b359e3f099044c2646833a17e399c189335440a767bfe1c0845fa9da0586e69511db7f2b922763e50264eb996a72fbd37c8124cba4ea0e5de4afbcdfd0ade9d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 f33788a8422b16c666c752266f0c5525
SHA1 eaa6ff1d9fd54242449e905689fd8e2ef2f47601
SHA256 f9d72c3d8d2cc7070d2c5c0fe7b8a10d6276c3d32711e1cf2fd6563d57b53095
SHA512 6e2de009e8888ca108381149eb93b6b68c227cb97e41301be4088b33207374b81f0c487d48884e693ab2f00b6cb3bbbd37379d8d8d0096aa59d326dc4c3a040a

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 9016e493ee33b23d95ef4ccbefbbb76f
SHA1 80763a41422a38dc523e57c13141bce68e1a6f49
SHA256 16db2c35fe0fa926d735c540ac4b59ebdc557058f624ece79fe0dd211fb79eb4
SHA512 a2be8c5b22dabaf339431f02d30d4d88b430e05db6ee11d077e54c8eb4ee74d4f7226ccba5b0d7083f40988f4a90220e11553844ce9fe0ca1f6fa0db928ad4b0

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 234348c00377c101996f6c3ff3eca56f
SHA1 6d16b1583ef0680783622b970b5edc0391af6410
SHA256 0921f6ed8efa80a1ae633166e924c4edaa0c3b0d7cc00d9739f701b5a531d4c3
SHA512 eeb6c914a172bdba9f4be9159ed44495a0e23f6fa6017aa3d9de035b564c3b4498c31040d8f64a1c5c72b5ce9275a5231252cbd6e191336b146e3a42d466c89c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 590d8aee1cf1d39440a9613b5a37d405
SHA1 6c82404155ae16fef86845b4f01dad2e6c9aafff
SHA256 e1cfaf9c1bf22990f2a34a911e6486e002085a6b2a81cd25cefa53ca20c7036a
SHA512 8e38890164000dfc6e0206f7ecc5d782bacc3fd3b5662d3e09d9ef71b06e1bba7551b555d5db9132df987f8e7ade141772067576c270bf6807d7b209604013a5

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 7bfeeac8d3193a7e42eef062c6a8e276
SHA1 eafe5708f53be12096b156d787f53a75cd076492
SHA256 fe78da834463afd7aa356aaa98fa9ac40cbaca69300c53d58735b9d8c0975b04
SHA512 ee1cb2c759dbf5ec4df3ee560101edcbc06a4986d57655b673b9d9d237c7f88dcae4f9050b408223caf94b3df52f4622167e77923fe19db8191b7ea89e090ccc

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 1665355d2db0a6f8204018937cb9731c
SHA1 ad7b24007f892242a7e0dea8ae12304a1723a1c5
SHA256 9f72c4e9d0c036cd9affae1967490445c917f0f7030ddb20aa6348061416f47a
SHA512 58d60787bd98cdba301cc59178a9f45aa6e099c338723b16886232ccb322eeea7e257deb35d9377ed5594e4c30e00d202893920304c24175193ca5d2379fe8d3

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 60684cca914b84188d69f124eb92ec0e
SHA1 80b0c1bccea3f953581f9be6f6244c19d37a9784
SHA256 42a11a41f706b25af46a43b3aba7dc3ed55badf659bc29eacbbcb0d8b9143223
SHA512 0dd842ccbd1fe20d54f73b5d4eea6c645fb8bd3d2de90bf6c2c610571c864c45b4a0717227d55cb4ccea372b64747caf71d8da626878e19c22983d600ebb66cb

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 66142f98a0ee75fe4f32e4dff397d835
SHA1 cd633ea20d31ea7c419c93c9dfdba13d22017a27
SHA256 40f7ec06495857c1e13bdbc5fa5fbd0750ba827807fe3f2dbe20a2af98be7333
SHA512 094d591efd999240de3a9e7c8847f086de9968b327c55b14d394fbd0660a205caa361556b5508b352b81b5fbda229155503fa6f5bfb034f4fd617cee5048d735

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 cf1815e82e0577bc3ebfa5fa86eaca25
SHA1 fd9b82e0adf2ca1ec0bdaa4693885ea6cbf46199
SHA256 69d52efcdabf5784d70bb1315a9835e463ca37aef3512098ac297fd10c5d6c0c
SHA512 3ae0852d4d424b9c47198a5812d84a425738170d932e8139cb9967708ed30742bbeb411bddcb9a72dd7797baa115c5ecc8aeecb5662c2fda31a167de24e4ac94

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 2d50c6a78296edc2f62bfb18440e41a9
SHA1 c5dccf6ed512ba8e79d8706855dbde162a6de777
SHA256 bf06e6edbc828d5d332da218b5d9987ab6ac3da1cc5e52135adecbaa3ba13b31
SHA512 db0270c1c2d28f64d4dd05f885a61ad8d5b1a9e1ab52e07843717d4ad24317201e9eeba61f3522d3fcaafca02f53b59fe0cf37c03eaec404bf2c3194d0f29bd2

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 558ed49b2c0c1029d7684cdc955e4792
SHA1 430b70b071e0aabaddd4df8c012e3ee27b9e5b0d
SHA256 fdd0a781e7eaa85807627ed1ac40ce87bc670d1a33851793df15503f56daf8ad
SHA512 15891ea1e36610db0da86834a17af45bf328efa632e4af88f8ded6e157e4491ed22d8fe3bf27a18cf22be01a5e4e16f048962bf13ed423e32c104f3d756ad6e7

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 c2433f3f4bd8932efab7d99fda1425aa
SHA1 f24472686fcb3dd7fb18fc8ac08d1f4c36786367
SHA256 377d4600be64b8c92e2ce30b285d04e6a0dfe71bd8daa1fb83764c762d84bd25
SHA512 a6247417c5e3295a5d23be36ee1ec6da2b6466111494ebd2f9d7e04dacdc06c22f9872533e642f5acd86909d7a81f99d6d03edbc342c42bcc994f0b555c2c5b5

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 6f85d6cb8ae5c6a7287885d74bcfc8d8
SHA1 f92bb810a15ed85dd84531e301f7d83880dde402
SHA256 a261bacf7a2030344219fedbdea0a59c83456e27d9a2b9298101e4d3aa938a38
SHA512 b32d63f7088eb8a4773ec84f84d53c7e55f6f5bb11c1d2223065b07b8432ecb767aac91d8650a3bf1e593fd305c775f7793ea579b0f04d52ecfec7160425bf6b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 e837e4fcd3c735efd2f7ed909af389aa
SHA1 68e9c1eb0e19f7cc0746313499234f2dfea2dfda
SHA256 a58035c206e42eaba10ebb176f8499ec9d9d2fa698effd6c26587ea96b4c9e69
SHA512 900be7bf6e281792563fd504a9bee1c9eaae85f8396d66b677c9503d8f831eec762e522d443d9f277f81c399ecc06ce62eb2489a958934bd6ef0437b5b480501

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 ddb8621651b257c4b7272879cf192433
SHA1 d03e54858d22a93e5344f6783029b747080e143d
SHA256 84357f938f0ecf01222daf44c36d62a75a8f4ab3d414583d48f103a215c00c24
SHA512 fd70d0c66c3e8bf98b0c2d15d0caf309678a967414f2a1147321c5b7b2810f4f8f66bfe3628b59831e12d1fd2ed180f10ceebf0c8e576392fabcd583698f18b1

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 22b51d20d58694e7262da5d0313f6596
SHA1 5a50dcf4b4f86e6a10b0bd2f73df7ef60316c39c
SHA256 8d9a5adac08b40fd1506c3c77a963edae93852cec424c0684fca5553d3b70b10
SHA512 03c96a26436a48650aa8c31c0a140551ca7e963310722d7bef2bb06c6f29060f5afbcbe3092b5488e046f1e8c193e4cf6a04c5fc32234f53765e90ecf993e656

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 a86af71ede8ebd7221322c366b33ac57
SHA1 d498760d6fb78efcc3470b0d7db440242aeac124
SHA256 a37d69dffc152b7d1c69c73a53f0030806d7b79e45e8dccc5a2f7b3150135489
SHA512 53f2e93351f41836975ce2069c747000e47b8a2f0c650bb5777f03e648fc6650aee1babd3fb9193cda558aa87cb8b9801b28d2c4db415387580ab82f155a734b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 cccf64ae455fcdfa5c4a652eaabfa969
SHA1 6680b2406d166f4f01fd60b9dba79210d7d03c71
SHA256 e5e5f9b52fc44fc5b3e85c78ce4b76143dade7f453b2f586fd71c15865467bbf
SHA512 c974b447d715c82cb9e9228ac6bc56f911ed5b547e89e9bc0a610c7ed335f671861de92bbf1a93fe0a015a51c2e0f79a63399c06c68c0720a870e96b68a6b60c

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 16507165b38ee620470a997b3e220188
SHA1 4e16014b5263d9800c1d03b28c085f339ff378ff
SHA256 6af0e7e68ad8390ae45fb67a2bc881d8060bd0a8bc7471291d1ab77c58eba5bf
SHA512 9c60a1c9019e927f38f7f1bf6a9561a3b4b0b6061544b03d607eca2b6ac624e650499081a69dbb967cd637b7e56776652c25ed4b6f19078bd5892e8d6fd6406f

memory/2364-19187-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 531b17c703b98e9bd4b68b80909bfc66
SHA1 c573f0bcc66d8e2c38fcd9899b2c8093a9a2c891
SHA256 054e7a602a83480f34f1af3e8936be2e2dc431b78f4aa68c6ebe821fe8abf095
SHA512 17e0e6597dfafab43078ce5e72a7abd30bee9df0de263a88510b7e410025739e1a4b4713a12bbb63f9377888773874784014142a04de5ee6b480b034a1759b6c

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 71d65f2835c970e9f2fc042b88b61287
SHA1 d59777349434066571f0ec8eeaa733e5a94d4de7
SHA256 8f1af9ae03d753f2f6e3715fab02d6bf6095144b64a59137af0c19b58ed5a33d
SHA512 bf1231b2b0c174ccc9fbea516bf99e3332f364d038cfdcddbe187387e534a5abadb72421e5c83af8697d1fc1c0db0228293c93abd5dba3eb4e1b1dd2687a44fd

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 2e1e909df287bd0f5405e7cb3f11d40e
SHA1 eec8abcfe9583337a09758dc11d77dd536d21e05
SHA256 361e47cefc762826d956b55418597d1aa810f41adafcacad0952c4ade18b438c
SHA512 89919067b6d53c3980b1b746536e6cc1630c19cec55c929dd0acc11575e7b7ece1113f5442c5eb422bb873cbff2c7a09ed5ece592239661988eb2c81f4d38308

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 84e40a4407cb6cfb9776e129dc156f4c
SHA1 44b93d3d69c56794cbda61a70384f5a94e518e77
SHA256 834954c89a419800bdb3ffcd1b4bd09623579270c38278295d70815e8f8b0cab
SHA512 d6994a97c6382683be803d7fda2f4cb3912f844ae7325988fe8f680ce0a2aa931edd63b6e7f83b23d7a813e82c355ebffbd4172c012763a9f979c1f48aa4f91c

memory/2364-19582-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2364-19707-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 7b96d2169da9e2c636df3b2223b0ec6e
SHA1 64d380e99e98e457f7fb7b55b8712cd06efe45ab
SHA256 d566268d21e4b6ef46b04dc97750ac7867f185b4e2b5a2c24c5d1621009b6c32
SHA512 413e4cc61790b9705faeeb1b17e11fda825ccae6f3836faf63f3be995edf8a6411d1698b792d5bd8b4b8407e57776d9758ad87472e8a80076c37ee40825da3b3

memory/2364-19734-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2364-19736-0x0000000000400000-0x0000000000410000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-13 18:05

Reported

2024-10-13 18:07

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Renames multiple (6091) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\wintrust.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gX3l02hO2C0d6Y9.exe" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_6.1.7600.16385_none_de06b4fbd5b45f78\autorun.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_neutral_6e97842bb8d9e6a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\mdmpn1.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_neutral_9b64397618841a19\netimm.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\Amd64\CNBBR297.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\wd.inf_amd64_neutral_759109899b486d47\wd.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDNO1.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\riched32.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmhandy.inf_amd64_neutral_386661b46df6da3f\mdmhandy.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmosi.inf_amd64_neutral_932d048a735b47c2\mdmosi.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVRA2.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\scksp.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\taskkill.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\appidapi.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc3.inf_amd64_neutral_1da6abc36a79974f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBBR331.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\prnhp003.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_WMI_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\mdmlasat.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\esentutl.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\wbem\fastprox.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\EP0LB03A.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\prnky002.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnnr002.inf_amd64_neutral_37896c5e81c8d488\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\framedynos.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDMON.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\rdpd3d.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_neutral_560c956da9bcd8f5\mdmaiwa.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\CNB_0311.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNB_0337.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnky306.inf_amd64_ja-jp_97f0de39317f6837\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\prnnr003.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\taskeng.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\thawbrkr.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_neutral_d1563e8412461eea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_neutral_c3910bbf4fbccf97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\imagesp1.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDINTEL.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Throw.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\cca.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_neutral_4443b423d18c3ffc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\CNBUR.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\iasrad.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_prompts.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Command_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\modemcsa.inf_amd64_neutral_b64a610f1f09f267\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_neutral_4616c3de1949be6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\CNBSQ4.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\EP0NRE9C.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLWVW.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CURRENCY.JPG C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\db\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00174_.GIF C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ARFR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\ReachFramework.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\MSB1STAR.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR38F.GIF C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\wsdetect.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14790_.GIF C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Windows Defender\MpSvc.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14754_.GIF C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\TOOT.WAV C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIcon.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\dtplugin\deployJava1.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21331_.GIF C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OCLTINT.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_sk.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\d3d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_bg.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)greenStateIcon.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00157_.GIF C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\NUMERIC.JPG C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Conversion.v3.5.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\x86_microsoft-windows-s..interface.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f2f0ec3ff16942fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d2c0ff1e722cb495\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.17932_none_68c05c919281774d\api-ms-win-core-misc-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_6.1.7600.16385_none_533d797efdf7728b\SystemPropertiesAdvanced.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d6af84b382037a00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_server-help-chm.iscsi_init.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9c47f75a94d4c99a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-n..kexplorer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_864ac7393465ae4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_ru-ru_cdc2da7808ad189a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..gement-ui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7c0a746d3386bdad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_wcf-system.servicemodel_b03f5f7f11d50a3a_6.1.7601.17514_none_a1a7dc94939baf6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-u..ationcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_70cb8ab9770708b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_bthpan.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_465f20bae4a53506\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.1.7600.16385_es-es_847b31e13926c41b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPZISN12.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\diner_h.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\flower_m.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-zipfldr.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6a5d39a0f0c1dca6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_es_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\inf\blbdrive.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\fr\Microsoft.Transactions.Bridge.Resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-snmp-provider_31bf3856ad364e35_6.1.7601.17514_none_08e183f8dd5f48b7\smierrsy.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Foreach.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-processmodel.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ab6e7d35d9d73cda\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b426f5cd123e06d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-activ.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cce589757d79fdc4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-speech.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c031aba6988a59f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-netman_31bf3856ad364e35_6.1.7600.16385_none_6bb20d3d6b80d9da\netman.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-processmodellibraries_31bf3856ad364e35_6.1.7601.17514_none_38c26240c181e54e\w3wphost.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\msil_microsoft.transacti..ridge.dtc.resources_b03f5f7f11d50a3a_6.1.7600.16385_fr-fr_32d915488d7977e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\schemas\TSWorkSpace\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..ystem-web.resources_31bf3856ad364e35_6.1.7600.16385_it-it_99569e8dac79e983\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_2369444b0573521c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1\ATL80.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_netfx35linq-framework_assemblylist_31bf3856ad364e35_6.1.7600.16385_none_d2345696aab11309\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\msil_sonicmceburnengine_31bf3856ad364e35_6.1.7600.16385_none_ebb34a71240ecedd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\39.png C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\MUI\040C\mscorsecr.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..vdsupport.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a2a92c5710d7278a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shunimpl_31bf3856ad364e35_6.1.7601.17514_none_b3bc7baa4af52181\shunimpl.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..llaboration-drivers_31bf3856ad364e35_6.1.7601.17514_none_64f550c5ec60bb1d\RDPENCDD.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\msil_microsoft.web.manag..netclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9664a58abdde881b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0000044b_31bf3856ad364e35_6.1.7601.17514_none_657758baa1404a21\KBDINKAN.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..rectplay4.resources_31bf3856ad364e35_6.1.7600.16385_it-it_098f1b9f66d9920c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-w..ure-ws232.resources_31bf3856ad364e35_6.1.7600.16385_de-de_64f4fcfff76e7869\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\inf\mdmaiwa3.inf C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1045\SetupResources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\msil_microsoft.web.administration.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9c28becb97be64cb\Microsoft.Web.Administration.resources.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\msil_system.web.services_b03f5f7f11d50a3a_6.1.7601.17514_none_c721f9706ebc717d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\Performance\WinSAT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-packager_31bf3856ad364e35_6.1.7600.16385_none_ede664a73211b389\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_a1802b822e2a878c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-o..ct-picker.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9579a02cae67d99c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\inf\MSDTC Bridge 4.0.0.0\000D\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-naturallanguage6_31bf3856ad364e35_6.1.7601.17514_none_fc00d9a9415b5f6e\NlsData081a.dll C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_pssession_details.help.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_netimm.inf_31bf3856ad364e35_6.1.7600.16385_none_60363d1b8a50f87a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000488_31bf3856ad364e35_6.1.7600.16385_none_465111f47beaacea\KBDWOL.DLL C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-u..ationcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6676e06742a646be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "FYKFBQZZCSUGDBT" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell\open\command C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gX3l02hO2C0d6Y9.exe" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\DefaultIcon C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gX3l02hO2C0d6Y9.exe,0" C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FYKFBQZZCSUGDBT\shell\open C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\killOS.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\414d06a8dca67540149d09179683c4f8_JaffaCakes118.exe"

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\img826.pdf"

C:\Users\Admin\AppData\Local\Temp\killOS.exe

"C:\Users\Admin\AppData\Local\Temp\killOS.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\killOS.exe

MD5 3aecd251d296551ec8827008796244e5
SHA1 2b225bcd484f71b14e3c4792cb0c5965b26a830a
SHA256 9be38b91de4c97f277b1cf221e8a3e8b95141e617e82cfdd5341faba775dcfba
SHA512 ac2a5f2ab6173145e02c07e52a423a674ca9a1da309c3027e52dcd1c0302186f0d1d124c6d89302f011bd945dbd1f92b0e44a9bb7d2ccf081f7a58859f9fc975

memory/2812-20-0x0000000000400000-0x0000000000410000-memory.dmp

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 7b7d352a7eaf1faa87385a24b34edf71
SHA1 d2d03c8c818f4abc41d4e25b9f98c4cd32e297f9
SHA256 b83e129ead7114bab33f15ddc0aa4939a588f120867304a95063adb8ae62ec88
SHA512 a1383cd45991a0e73fee095172ed3f024f1d98c1e0ce517da5aab2cbc376924741efe6df9909e2469336b1dd6a04c9f4e83d7f3b7f196c016cbf14fc6f0c7753

C:\Users\Admin\AppData\Local\Temp\img826.pdf

MD5 421d272c6219e99e448057941cf73f26
SHA1 1ec8c0a01a3d6dbf453b511b5f1775374729fc62
SHA256 91b02198b439c0f2f91bb799823f6515ab1c2d679e46731b2cb61b9d8d9565be
SHA512 5a64436e82192be1b365cf40d34cded2c34952ab90c970af045d4962c89bca3dc605a0fe2d4e38ce9c9dc2ac6df806fe9ba616ad288bca4305b6fd553daa0ed3

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll

MD5 ef1752aaf0cf5c912e74145fe3bddfbb
SHA1 865a190c2741d98d4965317aeaccfff1413817fe
SHA256 3dd85d38b29686adae8a613f4ba1637e5b99316044ef3f3c501fd8123c11e67e
SHA512 f1a17315a37e7e97c12ba31d0c1044968530d3badf4c20e30529581dda142e2b8a0587ce061389328ab2ab7fab47fee325efa27859a4b7d0e89eee1506be0219

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 3797e72f022ec08e7f4a33e1e1d14962
SHA1 a46948a11e241102426a541cc8a5580097cab213
SHA256 61304a304d3fd32aa781eb96691240fc5a49ae05cf9ec6f2e78fec13fd812a2d
SHA512 5f75fdd63da242d3db8580dc7984959a7001da75e33eb7f67fcb24619cf6655390384c75754e5951910c9561e5aeff4dac7dafefdceaef6338ead5ea0b5284f7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 d6efa40609018b404459c363659a08ac
SHA1 517dc1998588f0380eca649d08bc69dc7f2a8f84
SHA256 d5a7e9f6d9c0fb1aca210f1ed7709d7da41c28caceb07f193d0a50b203c52d11
SHA512 7446df5d414346a8728dd500aacc54206017e3d551b2649d19034a2212aafc8811e157953d5d93415a3b5a91ab47dee7ac18947e263b5d1773be36fc26e75283

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 a93eebc91928aa9c723d156bde59611c
SHA1 9216d300c242231b55808cdfb4021b4504f8d356
SHA256 feb8c43d3e742c8adf0a5edb1616ac2865fd51f26bdfe3a1bbca816bc7aaef2b
SHA512 354c5e803ea15adc29ce45ce76f573a4de2113b3078dcb673fa3c04821fe3a0883474ea1f3c2374286df3c417663a71f9bb2b9f2bc75f8af82350a8a4e3d93d0

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 154d9df04dc187083d2aa35493979a63
SHA1 58f8417981b3dbec3e3acfb6c66c3a1012125698
SHA256 97548f464bed41f7ce7da9a0f3773087a8ec83f6fc749af581f4b00342a73712
SHA512 7fde19b23d3785cfecc601f211412be1faccc8e2387886c40aed86af8becd366fb398634952d7d679a9ee0a0b92ce45fbffa135c503d0a6fc6c315bae491d000

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 596995238ee2e1e1c8aa43a4eff056a9
SHA1 9679f66d8eaae42d8aa646a01c639e5420283bee
SHA256 efd3c1dce309593eb3eb5d53a1d9e8914524202ab0786c7d725e6ea9a3e7c176
SHA512 363ce8181d14c8e2f9139328a6b12e7f4767849d0e0dc1f7a76586d1b5a26ffb7b133b302909b6e624486a1215269147a909bf33b6afe730fbad125271415235

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 372037bc45194847f8dacea3018a855f
SHA1 54eab109bad4d1c172e67bac987e75301ee74dbe
SHA256 e7e22ee956796067fce5bcd978d77a67abad124d4ccad43c1d14987e7dfa28fc
SHA512 123334f71efa9160a9ae4729ca7a1227b1b2e544cd7197965ce4f0ef045646e168408eefce40b98224bdaf27f82d62991b3d37abee819fe8cf36c98a4e168c32

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 777540d2fdafbe9c7dfdd591b4dd7aec
SHA1 b141e48ccbf12493f775578577853de7c2edddee
SHA256 fe40b45a657df21688679db9a992908849cdfc21a72ee76d351177e07f712924
SHA512 800920acc8f3b8beaa6eb984afd56b4030d746741e1645526cc1aa14870a9c8ff50c2eeb436f45ca01ccf8468915183d8ae291ed284027ac83a44b85cc9bc045

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 7df973567afc201dd03f4de9a8c5f96f
SHA1 a6a178212409cd94edc4f8e4487a76703ab34ff7
SHA256 5928a9063f66062a37c10fc2957780bb5f25325d93571c61930e847a16cedfcc
SHA512 3afb91e9a965b1529389a1099a5852c429aec0275d26869d2b9b19d519a42880c4e131737e35f70d7068b2c0c5a1f74a88a1a523ba87a9d5bf839f5ae8dd73bc

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 8f46fb31e3547fe4f0588fc4dcb1dae5
SHA1 562a69024a6c51cc3d9d1ea2497a1449a622080e
SHA256 0ea37c322172c182a6ada6f7913e28f74d8878ad16fa2ac2df47a93c0e3d24ff
SHA512 7f8fc06ea7121e23246f9524b6afb0e61cae7c59c7720305fdfcd5470382234187fc9b402906eecfd580439af53029bd62de98c412425dbee95698d5f9631b32

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 e61c55cd6d8c3221eaf7a362029af92d
SHA1 3e175d99a39c014ba2191f15c6c9cc8fbbe28863
SHA256 e5c91fd45ea667922650c06d9d4b134675180db0578b3d33bb10d973355ee9a3
SHA512 fec7bb88bbd9f844fd6305c2624925a37f4ff15e937e6f9b91169ebb6d3a9ea757c5c920e1a0d1f2fa490d49757e156f24180c8d0799db647c9a4d91624c6317

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 9f4ec1f622af3efca2fa00c996a55516
SHA1 3f34aceae8f8d4d04d0726054a80d49c17a62f99
SHA256 90450ecb1f749010a54773c7af5497178c7466511b29e2f8ccc642b3ed85eabf
SHA512 6e0cf01e1bd0874f82c02c0f1851beda80bab318b03aa821aef74e4533f418418660e0bec58f7a2ff5925480b54dfe135569d7a6230acc4c2978f74de03b9653

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 b1ee37667e4fde6e528167516e1d6fd7
SHA1 fa9c22a88391c71a8adf3ece258e32e504e3a0f2
SHA256 594c9deffabff2e82831ffdc5e37afcdc5a3b0f4b393a8c8696fc18b8176f29e
SHA512 d1b0c81a87b46c03d7894f94d0c582afb0326ddf744462a050900067162ed898586eb943865bed96dbea140a27ef2a51124db1d5250a047ba699161bf2177496

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 27b431e56a6f8235d57f23803bbb85ae
SHA1 961748e597502d9c7bc943347ec49ab2459b97cc
SHA256 0be7eecd32dd381cf8e31519997322ff2634845115130eddf74007c9887c485f
SHA512 32eaa2956e4f24c5929d605009da7241e06b15f5009e8399260e241ff92460306f59d3cfad1720bc2146de233b9a993fbb73bb3d0848fecebf4cad62fa3881c0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 3326d9186b0d95a84f4b0b144390389e
SHA1 934e409ce262aecb4a649113ca969c7e5ad75146
SHA256 4e942e6c02bd7511b51a27dc94562df0ee8b4528e41253f9494317078b8917cc
SHA512 e615ba42abc83f82ef2dae8a2de3de86c55a1d65628c75bb3a9bfc6dac13830d733569fb8840399b2549ad5e4f472154c18af627be3b3a89fbe446a592ce3cbe

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 dceebe5eec593d1ead9b33645f65f97d
SHA1 20edb19786a371caa4021afc0bd8760dbc049e42
SHA256 f09c3e68be5f750e1fd01f62ea5128c7721839d44449d3ae1d0770671c306efe
SHA512 07b380fdacf77084888a60132361f153c92a57d07aec302d6482acc71d496c10cfd46a6e7a12a4a4a4e1d98f7519871581873f89beb6d37f9ce5314913d30118

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 5da9f91eec978c441293a94b049806ce
SHA1 99a8c333e06dff2f92c01be3feb57900530df8e0
SHA256 86612e4d0e8e184da7e272f992853d2a6bb9b46f0728749c69154c02d4174ee8
SHA512 8dfa139f9e657455c61f7038e8a029049729bf17faed0a495e5f39bea4d2b33d8b8212c01e73ed3d95541859a0d8189cde0b72452cec1fce20a35a9e95fb5273

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 88dd89091684403deb91077009a8e416
SHA1 5e4fdee98ea3afb803462b4e42609c6f88806c38
SHA256 c372f71a355971edef9b887c008917ab2ef3e35bf075071e032811e4e83cfc29
SHA512 c1aa1da739a2c4149cf89aa8505d1e41e1ee8cda754c0a5787f8a5f846d7d6745e57e18a60a8b2f8c6450ff043f120cd8f52ae2f2b9c48dc8559d2fd12697dcf

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 7ea48c01d5bf78e1072edaf81ecf8fbe
SHA1 e459bfc5061a64268f4d91ea5d321e8754f144e7
SHA256 505a210f1e446f2a290b8dc07eca145557d0ab9eca82ee43cec849d1a5046855
SHA512 fbb0fa0bc3ac725482d963a835eac19e28d85e92ecfebfe4e0a3211c9aeb10c19e39c9a916b501832132c484af9e4eb2b428bc77b7efc591d2b9ea0941a55bbe

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 57d58d6678c635e109eee98adf9e5a60
SHA1 9a9ef21adf39e3be03fd595c4cef0ccb8a773c42
SHA256 17c7c65b4321f28c272dffd286f9a1c8b48e205202677693f87ca286109d09a3
SHA512 25bea7f7560034a86ebe816c9e6c2891b1b66e7b20fdfd26a8db5e241c6f26fe74a84033ee6369e57605d8c92b53a3d23208f065a34ccd950742c500fbbb6661

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 0123a85999a813ee262e9454ce8f9e8f
SHA1 6b47d87df9ac92e30c5799065d6df02f34dabd7c
SHA256 2bb4a6d1c8ef59cf6f2696f99fdaf856f11bb6dff2cbdec30862780179ea5d94
SHA512 1ec3a80ba233d3bf4d9aeb1da70e9347f61b64a03ea36e82b71a844ac6a4e2813c1096a74a86fe21d7b67a8774c0b1b8297c5dbacfe41bf90fbe1c8113a48688

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 7579eea510a29a95aef2b62be0a9f8ac
SHA1 a9c0fedb227acca1b6d3091aa4dbf899a0148918
SHA256 0066bb3b64e50f7034d0e75126dbdec5b3977da99afdcfc848e9161f7bb2f57c
SHA512 81887b83f00f2747938e01d5b4f80813ac28adf94a684f4c8e0893f02438f8da5bdb21b043e63dcf52cec5da65cf11c2b7e8936e265878e200c7da91cbc5eb90

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 3033d8b998849dfdf0ea3a15b37ed66c
SHA1 5edb419b5154711074bfa0abbb5e12e9919a7f5f
SHA256 8b604ebbcb27d8937c01d1e336e61d2f01f15f183113854ed8c7b2953a2c8617
SHA512 02a5e772ad171707883d52eed4ba20aac788a58473b4b190453aced2f89e6df7c1fd393779fb7b0601780cf5bf255362209611e04320c59d46ca1b770591b0cf

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 930137e112a1185ccb080c7757f8de98
SHA1 db7dd2c41d55cff31558a1c15adcc1140971dd6a
SHA256 0d90fe130d2571560122607bc5cf94c11ba8c1922dc52006b1783f639619dc9c
SHA512 75ec8f14c1246e8d6539bd56783bf4f39b5340d9ed9f9aad506d6b8d0d77888642a51f2b4fe2e67cde621a9547e8afa73da7df4b0143c457389b9ddf8ece430b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF.EnCiPhErEd

MD5 adad3fc841b8a7926a1e72e2526782a3
SHA1 7836f50164a729e2f7f2e17a36357fb65f9804b4
SHA256 d13a28c93ab50b94383749aae66f5c2fbb2853c6023b2390ec607fd4260ad3e1
SHA512 5cf678d82adf6df3d45e259c7368d549c6b85f09814051d0d80ea10f4082027f641882489c97d1a04d9e040b9d7b867b12a9ff644f85c1dfdeb4a562c905d9de

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 c844068388fdb804a1aac2a1d71bd216
SHA1 709658fe19303017769f4010c51c12df55f82e49
SHA256 2a95255fc5a2954f25c0647e3ededa26cf8f3d3a97e9995bab14dc2432e4179a
SHA512 b90992ab1f5749f46a4248365e7b459278bd8f15ea05fe9b38cc5b3f27d0a7aa3ae2df6532158d6ff39c52deac6955d600289827111eaf540b6bc7169436fbdf

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 d4fefa6f876a8fbf52b4ef8becb3daca
SHA1 3d0dc8379085895b952d6f3eed81b5c790333914
SHA256 8168a5ac36b5c6a8e187612f08e16da6d87e88870eb415b888579ca603bb67b9
SHA512 7f4ced4baf6ac7d76ae3069281a7917d3dd892f31c90379944219bb7298c7964de7fe840d7654645ef62fdc04442f6aaff990ae1960130ecaac1b050376fe678

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 8441122654fc890ec7dd8e19312eae1b
SHA1 00f629e87d163c7bc057014cc40d95640fe1aaee
SHA256 3a7f6b677b225c374a40dc3e5f8f6007ce716cc0790818c057263e03152081b7
SHA512 a22ca5080d219a8a65ce1802f0e93e5dbb2489795ae70df399b8083d9d8140a5af484479fd818ecc67e19fa691a4bc506f0a5ca5d0cb7b1ea4b95acd878b8216

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 cf199ecafe6757c41c563bd93914383e
SHA1 bdb5b484c8c65d43454829eab008aa0994071fb1
SHA256 09a00dff4bdb9f191473227e9f06d942002a1229b9281f597a0cf3ce1bfea26b
SHA512 7bd52985f439ceb83113828ecf0fa49b2d25a327ee6cc57d746c40a8492b8df47226df436e9f376409a13c4868c92d9b1f43112268267a9f78bf51584ef240ae

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 e717e4ae7adbbde686179103d3a03278
SHA1 8f285c32feca59557ec335fcdfaa4ad7a7a7fd47
SHA256 f35a71feef8574b44002a8c1d728606818d245ad2bbcf1da5c0410d251dda931
SHA512 ca29134e8d95556684b3f3aeeb94883f6f5b51449b62d767b96fba75a30e3f7c83538841fa85048c4c46b768bf261bd4058ef60e95de7cf14fc0350011f667fc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 14196938dfd3556cba80fe10de7baa5a
SHA1 d04d8bac05369d372b17205b975e1edc4a4687b7
SHA256 2614b0327c6a4109009878eaf1b52fafe43581d7b8c9c8e61b4f289a5a7cbde8
SHA512 a8cec331d41a6b0230168ac92d9aa9acf9363a00c8b1b062e7ceae040ba344033ddeddbac54206041768e5b0e60dedec753aac6693b0435b420ed28d820ca68c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 5aeea4495d47e953949e604b52dbf29a
SHA1 c00f40df6e58e49bd245140c5a0deaaca7231d2b
SHA256 1aa6c5211311ccaf6445833ef0e062acbaa11a2d6b3f5c2768161a97c276c6dc
SHA512 23dee52c58655b16f96ad22dd388f7b05c2018132792690e308a9ee3a1fe9806d2641c5dea74e3d38e69bf192a11dbe917c6015455143bb19952a8695620c299

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 2348a78b456651a7e13ad37e0633618c
SHA1 f4c3e83960a1a291414494b508924f2299636fb2
SHA256 2e113e4493d06cc4d85605127936566c7a0b21d0a9c4c1dbde196bfc8838998a
SHA512 df9f0724513a285e59c2ba593026cf2df1512eb6968bcbfdb1f511b0e17460c048f08706eb0b485f4115085e9bdebbd6a7a1255f65d85852e677a9f301259d01

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 39d3191ff12099a6cb2c304fadc81ffa
SHA1 38dc0c66d4ee85ba96bb81366fad728318dffc5b
SHA256 8aa8a17ae5d0ded02a5cbc32999ce9b1e92ee8c1e132de92e095312a644491d0
SHA512 276968ffefc038a52e58ba18b40e6aa054285e29feda796238e15750d730ebc05b32961e144c7a16aca194f03d75b55894ea8797a22a756eb52dd4d9d6f3e119

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 7ad09f6e7623bfc3a43a2519d9bf04cd
SHA1 cd147dcdcc2b02f2afe4e3ccb8a6ba402a9340e4
SHA256 73d3d0a97bf0af8a7d6a3ff1da726f0ac5f52878d9839303492cddf9443706fc
SHA512 dcc289a450da35ac1787230a8dc9cc35dbb6480cdd3dadc381f404c8d191b1a166b2b48f546a4d3a93454c817fcde9f8e2553d7f803f8cbace4e136c9beee43f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 ca956c8fe41ef4301dc815f265c40037
SHA1 77d766192683065407ba8542e017673b5f3584b4
SHA256 d2813f3dd52b643cae579557ac653602b69b7ff0364d1e3e99aae3ed26a824bb
SHA512 b824f31a78e9bc86be74228d5a341ce51c20da10f5a834a2f3c095cc0633602b18b6ede3028346dec32064fdc38bad7b87a32fd723169809e8613e54a86a72de

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 e85f878e13a8b0977d08d9c8e13f761c
SHA1 fd97221b7043dcb5f718039cfa09b78d83f72224
SHA256 eb8e592228eac6891a7c6feea39a560af2f90b7ada1dddcd07f8bd1dd31b97e5
SHA512 a3197a7e4a15d2b8b53e55651b6769fe1d0db3871e2b7d2e23dd62c91485fc95837f9ef2f984bb530bd6f673873127cb1c68e690461905d5273a97beaba6a743

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 877c326e883f4907b136a124e2d18d45
SHA1 b48a49dcbfa02d3e29ca8a67cc92d9c6ccd5e033
SHA256 11f086484f8de0353999926f4ecacf76cfab8cc4ba51f834e1e80cfb0b2f85ea
SHA512 02046dbba2782571f47b036111c46f8b93dfa63b751f5da13bd6e382c49872f7c24ac703573b0be44c560cdfdde6ca634296f408d6e5c64ae662e6fdcbc027a2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 e56efcada70bc93e3e6da2a5bb50821a
SHA1 9878490f867a42b4f51a37d741e51db08b6eb94c
SHA256 b8d373d5228fe766fe6f08ca72982f9099acb39634b26e66506ebebb0f0fce56
SHA512 e855b1f23b948bee7411144c821c231b8cf39fa0301ad620c60893be5a14239b9713b6fd28ae74d07630de0aad044d370c1be77e56d325a818f10a589ab54cd6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 e96b14e0df7ab349675a9bc40c117b76
SHA1 72a9e1fe6d849d3db52a3d8a8339d84a33d857bc
SHA256 68f411c88460f9747424af7ebf6dec71a39f5041af45d7df67bd18266ec53de6
SHA512 6c690aec23bee2b4361cb1cd7cfed1118548c5a7d95f58a887f3222d8c7e44b3c573f59fcf5526cf2c51e1a0f5de49df029d73328111ad1ce289788e2b9b3bb3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 8a6a7861b8a4e209d6e48c7b0669ad9d
SHA1 745feac09d69956d6d5eb290c3c3b412437177b3
SHA256 e87969510e2f509ec6019f97737d71b85b21b07ae5471eb69fe5e03192d17637
SHA512 c8ae8d2b8dd5f1a42009c71a5254c0dfb1107508568c0332ecc9f1018358034f3175206a8aecf1cd559b2fe82f1c1caf34b3c251fc1d51dc99d4035647b4bb38

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 997e71164a84aaf1d7555132d37b4a3c
SHA1 78e964d394a763faca4e5187f763dafb50c8db81
SHA256 d1a46ac1df74f9bef768a5fa7fe5b6b55c17da5df8e17939adbb7a185576e875
SHA512 4fa76bf1d3939d463c587f66512a06a7c61bef8a842c7d7def82128e9c229e36995c84509eea28c412feecadb7e51f6f857ce45b50a8967b19a0d7cf2819be7d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 328ff028f1f7d6d724185cd2973da7ea
SHA1 29aef8a2f496d9a4c08af48d9165ee356e92fef0
SHA256 eea66b60d2a497ea88ba9f473f4df1d556c44449d31eeb620802e8466c66265e
SHA512 b79b19e898c3271892f271345f6bd874eec6cb741891654ff66fd167456b81d7f48d05eed886caf35add04d02387f247aa1e550b990d2d590eec39a61979b5da

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 9d4974d775344c4464ac23f826c29d97
SHA1 5a80973463ebbd95228ba8e067ee3ff2d8f2362c
SHA256 887d6bf1aadcd79fa64e0c338fa6d5de674e94c4531d24b775b1d491744873f9
SHA512 bf2b5ef8a0f8f02e68737c215565bb9041c351db2ade70d2c7f7d9ecfefceee26871da6fa76f28f4449419fa9b14b8f4983af38390b6aae22c80b884814a17aa

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 8a0e2b65d5547c39eff9e91f7516f612
SHA1 4cf4cb8ed8f6890b5a2140848b3969b3140cc051
SHA256 5e60c34084f0f31695066df24c6d194abfbd99ddef9bde9cd3759cf377e267a4
SHA512 83663b6efbd62fe7844e4be3e8576708e3771ebbe3ca7dfc80517a307bbe85a7f011e3a7682dd9362fc4e73672b29186094021cff72e86e3d696dd12af7c3edb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 b47afb0e359ee3173b488fa56d82609b
SHA1 b6ba8f7324a3c82011f3d3a7e0920f214681ab5b
SHA256 500ceb8a8097d4e29cee0613b8f3b8ffc0ecb55a8ce77700ce9efc2a2cc43b88
SHA512 4032269cecf542fc7f012aad117918e7a5f9c9701d8e9c854c38ea714d91c4b85c12f4a2737b9c8f3446e39513973b7a7feea3b47f451f3d92d3594267d76e02

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 82ac0ad03d3420bb23f1fee55c5e954b
SHA1 c3ec59ab8aed2228485e14579b1ef0112c60f947
SHA256 846f4a0ab38632fe5a232b5615ece54cad14b346213dcf5d8d63334f4c8201f4
SHA512 dfe105e62f3af26498434a0a21472edd5d9d8ffb86b0f460fbe1dce862681ca94480d0b2dd59b5045877de11b2705fa92c41df635d6aa0bd98fca0e58776352c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 97b626baf6bfd07ce306df2391c5194a
SHA1 aa5c85cddeeb1a8e0097245a83f9579a4e1d126b
SHA256 3d0e3102396f8d754c40823f091b79bb269cede6e738327eb2cd71a58a0f873f
SHA512 f6b12b8142d4e5a74caf9e0a4ee24d97c219c1a4b101106d0a481605a7995781e490d0457aed9f789ad5caf5ed136c5d93125ef435609d54b496b92b95b5d247

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 b3566730de16b792e782e99b581e0a8b
SHA1 e40cc201ac6a68d353cfdf0871de8ac357baba21
SHA256 767be7955a6805c2081ccb29ddb6762717a0d28688b6303f693158063a55ee86
SHA512 bb67f6b4b9cec1a26d49165091c9aaf4f96c0b5070b12c72ed0a9ea3129461d1e24d51c4087ef325411a1b7a084509ae928f7ab945fc3e2e282bcd5a622ef1d7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 aa9b538e2e44b3875330193cc2aae558
SHA1 f7f56f0dc69afc3ace567bf81eed2a731d1012f8
SHA256 ddab89f8fbc3ee1494cf9aa18920649c4e3ed733c23cebe48b1351fd02e21697
SHA512 b8492765ce8ffee24ef88d3f66a691de9c01d53d6635612a38c00c61a14ae490932def7d9a332df00a0424ae23b161c8eb10ee11e7a18a8b341ac3788cd3bf90

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 325a2c0b33ae7062e25034d69523495b
SHA1 7f1c719574c42adef1e9bcf92b9b20b8864e43b2
SHA256 bb848bd73dac1500fd6c3e01c8df36be1cf724734feac012322120b4c90c4c74
SHA512 eec6e831f850b3cdc36fd41518d44c0d4dcd69cd43d3f0412ceadbed931ad0ddf00e5fbdf3df57ac91eac1d8ce1547d03086b6e872b29383cabc51407a0bb6f9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 e46cbde18be98c5052a72a46d56319e3
SHA1 a40f2ff574f563315afefe8b7a3a81acd606e429
SHA256 fc3764950c81cb467e2112ea3d2a98869e42b4abd33166b4e6f377786a4189b8
SHA512 105ce77ee5f13149a7b5a10dfd1ebf4a341e9e55095b23780aade461a308aeff8313f9fd0f3d63cc6e8e04d353efe55c2b326b5323f5bc8927a5bcd413f4ee98

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 39f1c4fcdbe5ba0731c95e2b35833946
SHA1 c4d396274140ec9b18f77ef143d34055361e782f
SHA256 3352d265c485a4157910c11f79a270e9b386c95fb0c74b679b1e3fcbb640fdef
SHA512 aeb06d6473a485036611d00f74bfcd3c0b454858878269a5c916872398a7101897bb2b87e078d90e5b3ee4a100e57e91e91ffe1c2b70c202213393eac51e1ef9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 005fe77f527bb6ecc64f129c8456a586
SHA1 c90665d2541e70c724893495c41cf1c7bc9c203d
SHA256 f4d256b869a57e3da2063cca66cda1fb5fb0f41c42e531abdade433282466438
SHA512 31599387cec9c07453253e285dd56efd05d8130b30d904f8e0b579b7988bd118fcc3ec9cdedbdddc8750c9c30d5875c5e738a377d685c40c5976dfac169b4647

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 424d43a45779f50d01268e1c2cd55fd6
SHA1 b74a6db0b34c6b1c1d5c7e66cb55e2efd8b4edd6
SHA256 3f839cf75fea64b9256aea13c1e1cb21b7897c8a27ed7ecf5e5a2ca228eae53b
SHA512 a669f2426fa7fdf6f0f5e8c171babf9ab4d2fa55ba4ff6e0c38ce4e94142925255ff2c66f774d383a1522327e71dcf801e6e50752be426eccd9c3e28083fe2b4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 d2ee0edd2a613a3d36474745abd10304
SHA1 5f08fc17e39235378827fae8ef7f945537c61d04
SHA256 c48c5495b3a9b65d474de35029bc679e64878a210ffaddf369f39bf5ed515756
SHA512 69d47c8a4146d1c64cc4cc95f1d9e55e1820807cc7fe91512707fa900deb188158c4a7d5215cf6a51376b1d4338059c04ca63b002647ee1f2f45e48670dd9c63

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 5e593cfa8588b5eff96f74efba6e14b9
SHA1 0bdfe9f2269d69094d71c7f52581f83460c5d217
SHA256 65fb5e1b19f64eee8de44143aab49f0536da54b086fa3b46e5526639cb88373c
SHA512 03bb624ca7e267f51e7576568aefa0ce21be09b6f92150bef8d137354551ba3da3e7712d136ec32959ae916750cbc6f5ac282481bcc0aa05ca575e6825ae1e01

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 e3af44aed98f10f8fea964e620da562b
SHA1 ffdcbd329378883d0d7242a60d890cebd90e9c6d
SHA256 e7f9752d8233577baa792e2f01e28ee41fab2b3693cd1fb6af1ad7ac077342f2
SHA512 2fcabc03766ddb2c946958493dd6927136c1b386d41a92bc6defdff7b439a0920eb7651370b4c88c2d53eca085dbb98c8c128f7d7064812393f2e64e4e5e2d53

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 4463df6bf76b5785eba40300ca78a0c0
SHA1 b096091e5fabc1f64789478cd394a7f6f29771de
SHA256 b59daae3e882fabe5f0b9ffaf3bf1337552e3eea8088f626239f95a7ee83eed3
SHA512 c6d7ef31510434b953e70a0e5f30f286f1d59f5d020ce2159725aa0a9d56593b7d1775c4500a775aaed5e47cf64651ab977364a631ae548bd3b3ba96647b3cfd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 a09f0112324b239b8d8f5ba403a6495d
SHA1 83650c52c509d3d42b5f6857e61439ae3e704d2c
SHA256 9262f2ef52f9d216594790f55c72da7a38050b3f9d22f02854e529c14291808f
SHA512 425d8f6c116bd0acea44d41d15ecb3e936e15392dd3ba453805e0da645fb6ac3f9b9b367eb3be21ba851cbacd2dde7e7b5d468c8dcd6ee3946198ea001425d49

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 f0b35cf0b5191f84d411944e40becf69
SHA1 c44c2e3403e36b40f6242d7c7e5a1fdf86e43a41
SHA256 c91cecb1d2d7f9a5f9df58d12560608b56f0fdde3ff3c61814106eafa66c320d
SHA512 8bfe162af67cf71036150792da27a08b6e6288915e8c8263673637c5172d38a1f557e49bcc76ac0b065ea78300a735728ad6ac39fc89f32c9b04ea563ced5032

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 ab9a8ad8bb1929d3b7733fd466bc5474
SHA1 ec0619766abc30ee22b1b98c7b312c5d16e1bdb4
SHA256 f1bb718cb7f82c0973daaad339b8dc5232e1672550d35034829de6be1066db57
SHA512 6fd4bf02fb408d5250f7003399a6a11ea0e5cbfbe80b6c8ea980438787395c9afd9cfdb33c7fdcc2baca6cc077fe06cc68fde9111267c1531508d6b5d33c58d9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 1f73a546c26367ca0bb7088c468cfa40
SHA1 bc552d9c051d0dcd8543e47a251f139ed6ef1d5d
SHA256 2d079b0f9caad9fa996705ef78b45e9ead19685c28a7adbb30803053bc1fcfb8
SHA512 c6fb194b46b1eab82c133bd58ce0d5417912ca7d0688f5c2170faaf7d8db66b1f1deb8774d53ad681c1edcbfb6c6f8ac12e760f208e5dc19360c5eea29091dcb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 19b3eabd27294f0e694a930bff8fee0e
SHA1 8eaba34ac97ea2eb55f9aa048f6d006e2707c5c2
SHA256 a2289840c30b6bd45fd9071aca66963e6cf4e3551b4516f4482b48f847664161
SHA512 110a1f8b7c611c2491a1a50b8bae5df42826a66989878de73e97e46fb8cdb1abab2070652743e14f4ea35faa13929a6790a30fc9fb368f29592cfa9c86909bfc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 102ee0fea3a1d84d7b23654e914a3eb0
SHA1 6a05eb677b1d0734138fd4523808703663696c4f
SHA256 644756468ae3f3e5a9ad72c70eb158dcbd0c282e919c6d3c2b14c9c7ea5de3a7
SHA512 1e144bcc0c36a640389eef0754c5c4ffd617cd87b822d7e8bf50601060ffe6193b5a3214d42cfd52b1587ea3d11ef84ba4013d0cc899ce4b4492547a3597fc03

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 3ab640d27bd64bfac393077e5c2e0175
SHA1 c6700af2fe815087138cd7ec86bdd7dbe97275a4
SHA256 0c44fbe8ee39fb4567609dc55e22e8ade621465c54cfade212b5ac414efc892b
SHA512 88bfb09fbcf9583038b32b406db3883b2eb2ffacb43d2e72839b58ee4b07a822326a40632da4e712b0e86887fa5099e61eb9d8d735f466ffe1a6e26ca7a89d41

memory/2812-8634-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 6780b83c61fd37b2221896847ae01476
SHA1 10881f54586741ed68cf4ebfd4416cb2c1411998
SHA256 b06001e9dc53138b3708d6205bc43b688b12c200cb2f623ace651998d3f28267
SHA512 29c795d1ca6e70d0ac69aaad7f06e54199ffbea9da62627f95ffd566eabad166d6a7bf43175dbf21a804f2808b9f833a22f449f0f95bc028a8a15e72a5ff8407

memory/2812-9132-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsLexicons0009.dll

MD5 f26df6b14010d7b5fa4a2ec0ce219d01
SHA1 658ccf964a0f2f4c7e2ab0c8ee29f56fa5b6d72b
SHA256 a9f0b532114d51e6cdf2a9cc60832d78478aeba0c319da90c780b4a26971a5e3
SHA512 698d088e9117098aee83129c87ced9921e8d0db988baa989e456353d391b22a97aedc4a7b53a0178f2f1cb24b5aa6c94c7c2447fe19822279eda88c760ade910

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Accessibility.dll

MD5 708088514b17c01340811d3997419ccc
SHA1 c77950beca05d7e709983cd712b8fa2c6f2dab16
SHA256 3bb1a73e51be3ecff80fd929eee95e5fae1a94a6a5a07d8f49356de9edd7f9f1
SHA512 d11ade94dbb61b9bd0f9f9657d0b768916c2f2a1b0dddaddc6651ddcd70d9d1fb39345b32eff3fae656eb776ec2efb6c7ccf7f7655c8245885fffa62513c4fa1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 b26f5cfdfc5868e02a1aa60e56a797dd
SHA1 0fa3b12c2b7937e5d50977848aac42ad4690675e
SHA256 9ebad899a2d09e3d568a3cdd72bb406d9886f5cead19d861fa826f8006d4e900
SHA512 448ce77d138d1316e4931dcead2451a06076f6cf16e2e405c3c48070ed9815b7199d7ffd9f4e7eef08c0ae9a998f82b48702fbd5af1a998993f9e139329b7585

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 fea5f4e018dcd46832d84530bbfebf88
SHA1 b877b6d3eeccecb16ee3701bc060d107cfc18a95
SHA256 2abe992f82005d31dba0b6acb701699591d37676de930def56c10db4d727f136
SHA512 d2e6debd96f9415136e20641e6c555c187acb80d5b0c9f8ae88bcb950df0d2c5360b4aa25b9c5056a043205ef5a70cdeb5927367ba76e58d92c36f647d7b83e9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 ce1cc010a7d11edf83334fb9be3cea0f
SHA1 3598413f3da7a0dd5db3e22e71a6d4f997530853
SHA256 c008fb53ec9bcccb6b85dd66b55796c11782d2b9bcb495b76a31b8c6b7b5afa8
SHA512 d46a409cbe527b4da421dba110c0741a61d44aa6e30e9c62b98308862fc05e668f1deec891772c3d585fa922031232be2f4dfc2a711f139c809a73302ab446ae

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 53aefc70b990c100cdc42747fdafa267
SHA1 6503b7302d76d3d91ccf22e335a91de9995f8de1
SHA256 ae914e4e409aa6713b575d5a6e0bc68211b88930f227367949fb69d56a965375
SHA512 8185594c459cf169c229e35dfabc234e130ff0344eb5dc4a261223240182a88a3708eb3a282f862a333545d234fa26d2b8008de0a13366f9cd9b5f722e9c3cbd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 dced33eb1546832abf1afc07ee0edbbf
SHA1 20c7c76ba557d10b04ff95a895cc46a717684edf
SHA256 6923601dbef594c3620d496d4fe87c6baba237b6dc120dab1484fec18e7875e4
SHA512 abc2c37f39e21a75b3adbdcb2203e3a725acf68e85bfc2451478051c3fe7de72190d586fc58597b51043150074fc779e8ecd620378365136ee0d11141f0a519e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 47fe08f9da249e60dedc62a3210e2373
SHA1 af4b7a7106a057c13b2d09032613efa073713849
SHA256 1bdcc5c9230c6caa6caccebbec99799781bad1b02085eff30a4aa68645546566
SHA512 1a3e31ad4a346cb70a199291fc077debd4534fbd57c966abb9e41e005f70b30c1a7fea6222390a1111e6a9f9afbe6b57f05f004c45ac020e7a4814d61ecf8757

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 04225f85f08993476255ea5e584e532a
SHA1 d7b1fc518a6949e5554faaf60bdb6c391851a7c3
SHA256 4cc5414b1d976aaf9975a9a6110f89fdd9be6afcf0f1e4016646ffdd82128244
SHA512 d874a295bc6228aba1a505488476eb26a67cc8a270ffa9e24feeca0c7c5a02f5e65ac7ca2d59dcfc62e6f499819a4496b2736a19dc3efacab9acdcbe6b1236a7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 5f072d5a44d7a28ee69bfe62b8bccd5f
SHA1 d12ae22e7510b9b9c53a679d09825dacc3363a05
SHA256 87c90a5d721669f108cf6d9bf885b7568e006825b407b8624fcf9a0fe0f7d9a6
SHA512 e17a2c7cc73ce21291b755711ff9637beaca052ee5a3f98a00dbc7ff172071cb7f1fc7ea958e4d0e603c90aa609c771ef97f224bd6678f3069a5b616abd10849

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 c0bf4c8ef969ba5dc302c80333d23a00
SHA1 093d91d0ed97a16da6628799be74dbae10dff547
SHA256 782e1475824a8b97047a9574d8bbcbd41ca0fb0f55a3f0a8f2ae2d717deeb095
SHA512 983875ff800e329fe618dd2a18c62c09a9b7f11548c7f2542deab26b486cbdedfd19b10acd721ad09e448024a7ae39746ee32281953b0f1f6682cff7a5cfb23d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 41ca268b51f892a122163d2cfdf58602
SHA1 6b216769ac4fa0eaf89082298afba84ce410d7cd
SHA256 e7621e3b7376e8705b7648d88f44c92776fe46274e0bb007758dcacc82596811
SHA512 741f51c08b5624c562fea757307ec175e0c3ed617d3392921cc77f9e57b9870b9bfa00d34444e8420b2adb60c22e0c25409c1c9fbc12194a877684dcfaed20d8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 7a66a19950910136995942283db64252
SHA1 928fbc790823b6828c31918d3c5b9495121f39e5
SHA256 573c341525779dae6ad7bfa6fb6f815026a240a30bd9b55da06a6a0be013a9f0
SHA512 01c06c60f8572da1027256bf5e26d2b1849358519b7dd07361c75814f505b25591c8fee7fbc28039099f4dd22c503169f74c5abb1a655c7954d1671cc457ba98

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 726e33f3c6649a0ec07e17837c102d88
SHA1 eee070e1b1fa48300fe8dbaa66af84b0f783e57d
SHA256 fecad4dc87e18602498c4654d69131cae767a565f69ef80a05d0ac753b7a3b17
SHA512 f595b6ab76c329874c70affb2f637d77ff985b19a9ade53af78e03ebd0b3386b0682b729f2f448e7788eee5b4c318a1555c0d0443e049806b80c26a02f4f667f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 86754a57724dfb3e4e1ca4d7f189c98c
SHA1 7f3b28a7cd24c5c16c5a85ed12595f7e34fed781
SHA256 92db3df798a0305dcaa5bcee7c0fa10b606015ed3eab8713d72f4b91f6d6250e
SHA512 7efbd2ce2f07dc5b1e7ffeee9fe43022876b3c81cca36ba5cc226ac8bdb2a0521d88f78fa5785fbe0ea96997eb10baeb6087c1a80cf7e6548a48ca5f541268d9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 09c0150a966eb5780ba88908dcf05c9a
SHA1 d3f16c6103e67ee4ca8127969785f2807eaac0e7
SHA256 647dd6deb188bb1687e7753cd2d59d9d1a7c7dfbbc360238124218967b6663b2
SHA512 d091b87104697c16e3ddb796d3f630d701e0a3792eab0f8a48378a38aaee7ceccfa21908b104e7c2660cae005e26304715b997f3b0e3baa563afd173791c839c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 f26899f476a9dcc01a76ed2d598a0662
SHA1 704d0aaa6dcce8aafc57ba2474b3c6b06d19c074
SHA256 759c36a246c1d534bd7cc27add067f8c8baa3f15a702bab9f8dff2da86056372
SHA512 32571b540c65fe4f814c9257800b5639583a82c271e844164643d0e160b6aa2eeaf819530f86cc58a6ad1a48417b5c302d1d55902fd21efe09147dd6a61bded1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 6d001d899b261908dba766050090f8af
SHA1 33f67f7c73d2574040a224ab2dcd199d5e5073a3
SHA256 8966955b7e1ead2b929b7565dc27b4f9961eaf4467ad87417d13975fcf58a69f
SHA512 9776cc55d9da86e233dd2e2f212b5d41a64633a8fc2e76e82bedef4420f25f492eab756e0fe77f594c8acc447b462de6a789f31cc8a916e50f0f5fd76c9e75c6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AspNetMMCExt.dll

MD5 bea32a1858d06e2b20134f4d60e58aac
SHA1 9b526bca44e24d5ae0f7e0d7dba1fc0148b4476a
SHA256 a197ad6b1a7f3af324fd0c80cad56731ae1893d30ecd1859686678f7864b069d
SHA512 0371acf394211a57d27de43dd6766ab88595216398246282b5995713b724a9e312ae72ef0384dd69f40f07e10dfe2e8ef7550498027868dcbca14224376a3b22

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll

MD5 058b0694dcc0e73fb97c38c231bc525b
SHA1 54fb5499e60d33f49fca531765d9125cfefd40df
SHA256 beb44f2ba0792d91e763c240bd9c3bbd8ff5bc1243c0cee055d2e88934760ac2
SHA512 9f051b99274d1666e915fa5edb37b61aa557760b69ab760cc90dee3ee592b3f3da01e2df485666f1cca1314971adddc412f3b560e182daa8f2a9eeb0b2ad123c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Activities.Build.dll

MD5 986539893cebeebe48c71cd5294dac32
SHA1 59a5f78b814628c94029958113302411dcb7df7a
SHA256 38fb4e895ac7569b24911d7d349b9b694d70aec207ed2a61a68176d609d5ada4
SHA512 a49df77e022853588919e31cba65b59b91fb4f590ac21dd0193311582765056675e94c5d7c1f1026cbadd89be40c1fd9d62fd02478323d9da82eaa4d24d41a73

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll

MD5 bd3854578cbe57b751e9352c44741b5e
SHA1 364f6a2916dadedd55fd673403d73f64e4011f6f
SHA256 4381e348880f98f8f8771c2449ae3917df3eca32a2ebf6351135df6b5b29c440
SHA512 1731160c75c269c5c650c01ff94b023c06035fe57a4d84fae35bd39a8247bbf60ab5f51f17830d539ed00459a4356cebe47d216d0b5e1079aee053b9773ebc2f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Framework.dll

MD5 5e92ad854911a2fdabd809e3e733329a
SHA1 475746f350c027e637b3ade2c1652323b79736e5
SHA256 c6fa5cd3774059d12495815e5d79d7d7bb3c9782a239069812e36b34dc1fd100
SHA512 61181b7fd654354f64beab7088bbca72613fc06dd79342fa97b965f14ff4670e355ee5fd7e3ab1cefdce783a04ee23ce7ac1b3e9a39dbc7a12711876cf5d6d3b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Engine.dll

MD5 d4bd8e17c0c3713a5866aa69691108db
SHA1 40635b8ab25208afc0c08c92e296e15bec6ff302
SHA256 3d9175670c57dc49d433ad86babc248bde97266931a576791283ca22cd2d02ea
SHA512 5bff9bdcbff3656daa7d30816bba06aa1a961aa24c266d903ca07d90766807277feea13993a46e998cdd1a5a1ad8dfb33cd5ac080fe23faa43886296e9359e3b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll

MD5 546a453bff309ce9ed1dab9fd3d7a536
SHA1 53294d14a7ed0c4eb93048cbbd717dc1507a1c78
SHA256 f944e42e762a31a14f92310a668ecaa6ec9b7ddc9377b895ff1398997f6d5750
SHA512 337b594e392909aa342a5947c8b039dcc147d8429adc63d6e180c32cd15b17df820d510b6f695e334ed2a79a0a0c74e24d1a686bfdb8ce6debcc85facb84fef1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll

MD5 f3b16b063f860df43bc2ebd3fb6c72ee
SHA1 37679427adebc3685870a5959dc5d2f17a64f18a
SHA256 ef09843379a42305d745a2ef9c2d480890d933cea7398463a2a01ec53c0a7d79
SHA512 1e8dfbb671876b121d996aa470ed838545d77aebd5e9e1d67622ce03c21605b1ca158b9b6284e2692c20bbe06da735fab8dd914e3680c3a9717c5bc94d98c6f2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.CSharp.dll

MD5 542321e301756850e68bce3d059a48cf
SHA1 bffeb75cb1f95b40c504cabfb2803d46d785ac74
SHA256 3235ead5c866300a4e4d5f8267872bf10fcd90cea015d42d61df46fba2d5ab64
SHA512 9cede7f4996fe2bddc4da8f098bc931a4cf9e70dd2f8b8b7a7c6fb9a4ff555ee8cb848c25097917795fe88b00d8db93b2e880f686824210d64194f8434540131

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll

MD5 118f8822c9a76f5a5178086b37b4d9f8
SHA1 2399c0ec455883c1c03f2e6e0da3f4577bf8abf0
SHA256 537d004f24a2f9babdb2b1eb447b4992fc1cda0a50d7cf1c1ed7a69aee2237cd
SHA512 c51a89dae3be2260193ffb096067699c5eb7506417056edef439203f0cbe2693fec03d6acadd1771b84db482cfeaf209becf4aeedf1987238d80a959b8ff41ad

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Internal.Tasks.Dataflow.dll

MD5 b198a516c9ecbb5d903373bfd9c1436b
SHA1 6172b54fc684def9de19b77fa32131d8bb8770ab
SHA256 fa09321a8996a455a9d4b75310ff5f69bec8af4b8420d355735610e2ad09aa32
SHA512 4f69227bbf417c467e891dbc0476c18aefff8ffaefbfddc221b90a7eef3ac1ed0f39161d6fd02964fedcb06171f63ff90cf84d3110e5e04a5928d825478300c6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.dll

MD5 daab3021b9e5f9416db15079ad6c6ce2
SHA1 c930d41dfee732de24b26cf9152f57f01a158010
SHA256 49d1fcedeb59bb92186859c87698fc2221e217a55b8ea5b92f87b472e4010436
SHA512 738f6701922eba44e1a4da4001c603238665354bf006e6054e63d8c29e8e79017bac98b4f2d49921f609430429c1ccc00ca46c7dc80a01958e82ca9e1a9a71df

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.dll

MD5 f87448242125e061791b585bedf589b8
SHA1 3844b06950c1269066f7baa3ba6fe01f8718b80c
SHA256 56a3d2de8319ee62e8352608336da489ac5acff43e412ca5dbf89ee64cea4c72
SHA512 ed9360278c9d7f17c56826c9da59ac98ce1a6a25bb062644f94d48d316cacb8bc24860be3746b25e6e5662070bee5e821cfbdd9fcf80bcf87ba1756eaa8d8527

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.Data.dll

MD5 ec1f93ec93ac4c689cd7388cc821d3ce
SHA1 1cf8df274a6ecb93933f77bde9abf447c2f6ee58
SHA256 82f2065ee70e4bcd5fa928b7d8892789912a49054e9c72400e4c859c2585dbbb
SHA512 3f59cb4cf407226b0fb69bcf40d35885baecd0ae38a80ef7aa3b7a93350f89dcde3743f940a81c6f4f430c330e9882f450069a6fed14a584ae16988cb6fa50d3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.dll

MD5 65e4efd7e67b12a0ffac5eca4428ec50
SHA1 d5f3df73e3072da0f0f9ce9aa12b76b7b45824c6
SHA256 b53224299c879034f42dc670cedfa2ecd31c62da59cd693fc9e25fe4d15d58bb
SHA512 9b76a6b435780becea45d22b490efd065d4452772d66a29829970f632169ae9dd37244d8060ae81b54f8af3c621924097c7ce062160503537aa6323e765fcfb4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.dll

MD5 bf94d1e4ce932593692d0522bb39f022
SHA1 8579ae7b5615e6e19981329ee7e67e1d1af1a58f
SHA256 bc5e3f9b8c15d453e5b66b0e49cfd8ecb18621c9dfba82d2d0c9e3b06a2b0405
SHA512 028899936d8a49501028b40180da5737d0c299df0d95745ee8191b8b47f96629e2251240676e67bfa4bea9a100e360196a0f7f056a5e27ab5cbeb788d876309e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Win32.Primitives.dll

MD5 c364b526e836c840406f59040d40a16e
SHA1 3037db3c6b4058452b50b72de1b909efae769efb
SHA256 767da62de5912917cebd83bcfba705ac2fdc4ae1cd16c35b6315dbf809633344
SHA512 af4846c5dd1efad2199d7aaf7d593b5c1ade0765d409d381d53e47b3c0d303a7f85cd295f663980160bdb1716d41efaf8183258ba074f44abaf58fbf052e9041

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.dll

MD5 8937c3232125b0f2819c9677bbe12f0b
SHA1 dcd35bc56b710f2719e1a5a85758ba620aa0687e
SHA256 9db3cc00312f5614624e9ff46af7ffce999a19753fe7c1033c2911bd2523660a
SHA512 f85e8696c638e594461d8c1116139afcb0f4668c8ab11bd22f58a3a534431b0e381459f5846e971c4689fa97fbc6f75423e6bf144df4ed6c9120cdd25027df92

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

MD5 b85021bc1e473b17d0d98de097cbce2d
SHA1 16f5805f0d92146ddd23e63a56bd1dcbae469867
SHA256 4ac8de703173ef31a09d3c3196454923e92175c759ca98f9b592f9292a573be0
SHA512 23160971017027c064638de46dcecb794955bcaf981b0147ed14f1475918bce38c3ee245353425c2b5a487b33e986daefb75421fab885dae4d34ecb1e7afcee3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.STLCLR.dll

MD5 35c87c09b595057adfc06615f06938aa
SHA1 15dcc5a0db398a1813465bfd0854e48be0726352
SHA256 d1424db923a9f823c727488f94042f04bdff7e5a6ab570a3c19256988ef52d26
SHA512 abdceaaacddb760bf58d5b73539f431842a3488ef03826d5a787fed50d423dec728749914604cdab5f4056949c0b4e1d9a9d1c3bf891db8f6e84cc6e18232fc0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.Dll

MD5 eb625d65c7784ec1afa32368d756532c
SHA1 c36121c463172eaa686f53563f681cd8c1163f88
SHA256 8c972aa68100ee8df1215e1c49b6e42f2443ec03bff1de6a494f70a30f6530ad
SHA512 6cd5365747b0b0a2f817f2316008ff5c3daf7f9c53a20ef3c4071d2471b057379267e2febb82c84d54d6f282466bcfbf7931914730d7799068e2e8fec8a184ae

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netstandard.dll

MD5 d8c57644e90707958b64e5692c1e1f25
SHA1 fc73e5eb4e09a50a921392901e22d1dcfec375dc
SHA256 7defbe4057e64b8b40b5277641bc4175f691789fa1ac7a2df11342cc2bef657f
SHA512 774f79332726770b7469ea3da52052796c005bb00df0ad20e8645e9048557f167641164ff1d679434e157e1251202546b8c0ec1acfccf648fb77784e1955c631

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMDiagnostics.dll

MD5 57edebf5b5a1b6e481cf9217fc1a0fec
SHA1 8e73d2942134fd23c30f5376d0fab2d0d53cbac2
SHA256 6630e3db5ebc0afa9638697a998357a16f5e928854611ed86dc0ce771b4e2ab3
SHA512 b2789a30347089196304191efea7080e8cf5a8181f69c5e87b3dcf4ad19746585f3444ca996e7ed2e47f84d1c4b1e44813bbd5ae523c138bdb07ef8a531a8b65

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sysglobl.dll

MD5 759e2cf60340348a7a6992aa940ab151
SHA1 3ba78c5ab64e13c6f59bd0ea8aab8cbd23ff277c
SHA256 106130cfc38c840b67c4bd42b08a43be2a51fc43df5513a91341c70bfe413ad0
SHA512 1b0c58d2a8e0da026fe335597b0b0422ffc36fec5e0449c11f8cbd85f0dfe20ee37a7e5114571122de2b72ce9a0ff839f5d080f3332de1224f984985460b33e5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Core.Presentation.dll

MD5 363e489433339aa7999206279a9e9eec
SHA1 45686dda4abde6320046e8489af25f1c93980393
SHA256 b26cd69e65616b10b9dcfeedfe7177bd2b0aa66dbd4ce2cfbc3089ac0e004e70
SHA512 436f6a912a0a92ba73bce28bd04e2beb7f4720499e7bad423e9203dd04d621837faea0b5117ee1775971cb2442ca29ff10323b9cd87b03763d59d7505610fbab

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.dll

MD5 27a031d9a16dad9f8b179a8d10e27ec5
SHA1 2a5252f73d3baed6ffda6be9454b89162d85d47d
SHA256 c1279334df65a236b8b2aa2cb50d981477c906098f9144208df2dc4d38d06eff
SHA512 bfac3c67df6ffd06ee16cf604c4d76919ab68938da0e63454bfe4b95f11d6ebffa37627af39b7ba6b36820a0b2efadb6c6f769efbefb580ff9f449f139a3701d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.DurableInstancing.dll

MD5 dd41833d134d033e2bce530a9dc25d90
SHA1 53030b93ad44e113a21ce88b3568345f5e69b804
SHA256 f1443d153156c16bf1c6f99e5ab3d903837eef56681e89087e1bca454dd6f321
SHA512 eb56da8f4eb8520f7504a945473c21fc90eee4834262d95dcad946112f5e4129e4ba155708193e519997efcb7b852f37fdd5d42665b5c0449218f9bbb0313065

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Presentation.dll

MD5 f6b0184f1b7bac04cae24cef92a634d6
SHA1 4b99d9f3ef6284879ff0406aa13baf188f58dfb6
SHA256 1f24963ce8a207f630d39352d1f151fd05dee5cacdbb5d8a4f45fe893f6338fe
SHA512 60cfe6ef80fc324d4fdd95e1ffff04e916724c4528a3f52f677e68b67b575b6ac61a35b9f6d2e8d58f399318bdc39f1870fc2f380d8f24d6c4f4ac7fb392791d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AddIn.Contract.dll

MD5 bdcbca84e895f54660037458fe5591cb
SHA1 4adb78b397eb27bb5b53d6d9b41cb824f3448a5a
SHA256 bd31a379287dfdb7406432dd4b06f1abe0d0737c2b5a7e9b4993e89281e9bc9d
SHA512 b6f397f22bf92859bd027d03581194b92a104d7ce46f27727ac4ff894a88eeb1ac9611cbeb039ef5104d1a5dd7b4e388800725e9cd546969962299005f9de125

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AddIn.dll

MD5 cebc103df8437cdf142c801d0600c231
SHA1 edeaac9cffe2eec934491d52b73115e5aa5eb4dc
SHA256 aeb4eac89a2e297195c919c94e798f124c38ae72672e0592d16d9963fd1d5b42
SHA512 b5cd074329934e2fd04bffeda438d5367492cfaaba8335b8e5d394f07498827b20643524e31d387a6ce38e081ff920bf52209c1710031deac70860806c2d2019

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Concurrent.dll

MD5 d6c41564945032c4f28e6303d5243a09
SHA1 d90c381eff1b23a7eb690480d20bbaf4004e9a17
SHA256 2bd63da8ce21ea3a70d4cbf339e15c728cea0ee2e2811d34e62b403023611439
SHA512 d722889776f120f06b27d5b2debab01002cd32997d573069dbbb2c0d36857f5f86b571e050158dfec41055c61da39f41abce256d234742269c02c71c8f7cef64

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.dll

MD5 5158a3865831337c01ad29602da00266
SHA1 04438489ec21c154cde6f35ee0f0a9965036aa3a
SHA256 1cd24611252fdc3d2efcc15efe225a7075db6d478e255f4544eb33e3d0c57f6e
SHA512 080d163c3800d7131abb4b99e9567c3e9144b57f4a4cd60c9b3fcc534b5acb68f832f7186652dc5f68bda79ca0e3c07683df64eb6961347e6920219a7eb7bb5d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.NonGeneric.dll

MD5 1ad3831068eddd969e6659a782a7a5ac
SHA1 66c4bf58336ec2f96bfc974262fdbec2050f1f44
SHA256 461f7b5e0ddf6a1966c936b0a1ea0ebcefc57ed44c3bf10edfccb4b3f617048e
SHA512 873bcf0cac401eeea3b81579413db55cedea06048b54cba385254592473b1d6129684da3bf0da4b9d1f0803ffc0107d17139531411b4dbeefa84c857c8cc092c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Annotations.dll

MD5 39e116bba31591e88f2321a8d74c3eec
SHA1 ebbb4d20f3a1ffbd3165b0b0dfa8b5bc8be7ff22
SHA256 b8508548909cbd2844886939006b086b52af61215726fe52ce1758cebad03e8a
SHA512 dd19f5efa0c39a79cd1fd50424bfabb45d68d0613f5ae292a34abf848c693b2d60bdeac2a4a4e323bd629dc5c244a58c3dfaa771b79d75dbfc38f26fa8213e84

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Composition.dll

MD5 7c0956da17e056e3e082108d442ec81f
SHA1 3b723c1b630863cd46daeaca1d4fa30303e46703
SHA256 ab1062a5622109f18964e3cebc2cddcd5841c6db6b0dcc7ff5d4a7ee25f44109
SHA512 d142c492c432961f647c4980e9c9b1c37c075c44f1d4775b88bb7f6370b265921adbe3ef53c56b222bd75d91cca825f122063b0e0be91050e3ebc368b6d4c386

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.dll

MD5 51d35d21c643026839165a021a176229
SHA1 db69c5f71291d42ebf1e311ed66b2f1c10c6a319
SHA256 612274af1f6957d420b140572a88c3df0ebaa007aefb7bbe84840a3eba912572
SHA512 74a8abc019c26f268bd22321182e4a64e608bf345e8e8658ef5c102365c9414bc14c4ba2d303ae27cb9073db8b3a91207232eefbc8b654dceeef509d3dbe14cf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.TypeConverter.dll

MD5 436a20c66a6ca838ee0b4f6afbdb30bd
SHA1 9f5a7e302aac836d399f91ef5615e9182de9dfad
SHA256 f9a7aaea22fcaf8ca6f761894c0c339efcf8210074a9e95bb5e1913d4c6949d9
SHA512 3b736f9cff8bd7938ed936cb689a38f5a752972371ce85dc56d32fafffe9d80464dd976d4a9a5f71c12935803a0668a1f3b6c6017825ce82a952821b76b30b1c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Console.dll

MD5 defb779f96aafbcf25a462c2464ad1f9
SHA1 80c4f61a83192902bf68af9fa529e6bbd786ca91
SHA256 594cc6c7e91752aad8f6603072759bcc5a78a49b2835972880b7cfc310280ca1
SHA512 23d57d6352b9ab7db0c51daa7ee97182a8ecfe9649cd05c141bfcc4a6bc6e428ebe34c0956dfd5566069d35754a8ba6f4a2d2a1e67fe7f3ef7508bbdb0aa200d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll

MD5 2b3b3b136cd8b0a4582a88c0d951620b
SHA1 82081839608bb1420a3f7730fbcb6ec2e6e3f2ef
SHA256 a0fd0aefecfdd0cd9261ba079f63c086ce20e90e3cdecee8248f73a1df3bd531
SHA512 f4eee1302968ee66481674e9eff80a44d8068cc1d6a45ae5b56b13edd6fde5fbbbb1ab16fc396058ec8ecbb62ed577637916a2b9144a644ec208c832f06a12f1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.DataSetExtensions.dll

MD5 5a363384f687d86e908a5a91ab3e9d15
SHA1 4d7ef9ee1a035dced8812f4304a302707ea774ae
SHA256 571eb8eff42ad49274f9f340c659b688ceb9f90123d89a05855beae4d8a3d695
SHA512 d8113e98775fdfae7a9bec28701e9a9335758f446dcd946a92a5395469aff076801c6f99fb5f66448de6c19db44eab98ec617eaa306afd6ad87a9b3267f15e0c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Common.dll

MD5 386c9306c7e4ef983f4d8a14d27954e6
SHA1 d2a32d6615a5efa2a38d5d3843148425109facd8
SHA256 666db097a26a329a32541f4710995c3cdc2dd8c9d486c138aec388570ab1d2c9
SHA512 720f1b7fa3d0e54e4774e0a6908ed202cd8ef53238e3e16c71e4fa72ce5d4561135e5d54c09097a5b9044bc0c61cf503189b2f94ad5970136c05715936c7e0d8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.Install.dll

MD5 155fafc4fd0adf10954ab1ef7517d2cb
SHA1 dfe12f393087cb34b0521950f6f57557292b6972
SHA256 22e8f13eceaf715af5a6350d3c0c5a4c8980c8cfcbffdc5d5518eb28ac1a0ba4
SHA512 7401309620c8f58d2b61151c54f2620f1963d24b15bd131ab28d97f104dd19a50e7c7433272480ef8ce0fbf7bbf3c507e11e192317e48cb5eee27f05577b0582

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.dll

MD5 81bb6595af24de001250638afca1868e
SHA1 f7b592e3a1aa1af6427eb5181df29f0077b6f614
SHA256 387e4ca209b21f0462844f22aff351bb3fa697ebe7bb92f7a528fb9c06936c4c
SHA512 87d8cac2f3b101cfe18a28c30b278a7314cf3780115546be0801e2f7b961815b0af99183a63d841378fa5a93e1bc2b786bc408436c64fc7a965d038e3a7da75f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Primitives.dll

MD5 1af1fb920b105d99da94e4afee842c41
SHA1 962387faf5be37a9fb6444dfe297af0d46fc91a7
SHA256 97b7e0d0f94e57fd20345c3f96f53cb78c2c4e6f410f11ff12b096325d8a5f0e
SHA512 4ce7f3eeb42504a62a7ac81b9dec92fe68c04ef6a0314ab4a3cda23e4937b1716eed68879ee365025739e71948d0c05445f35dfee55a823c93b90475e0b0d877

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.EventBasedAsync.dll

MD5 b29a85031e1977a920f378849495a44f
SHA1 d5b642f0ce0ec4d3f0f8bd4ba5148cd7a3783783
SHA256 293f36b2b77c96de1f607a55d56b368d2903cdf25fe961380b6e843a4d4141d9
SHA512 77bd6f3d295e5266aa9599bd966daf6e6eba2bffdb88a7aa088071b1df8a77e2297922f0cd3b3ce7aa9c8a2690bfa07bf5d1782349d7ed3ef0058df88f9b3980

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.DataAnnotations.dll

MD5 e2ced2b6360e2e6c801143f280407004
SHA1 7db74ff2f73533b5c79332fb2a9f2a228c89bdfb
SHA256 d4431ea8bb027a187adb148b6aa88ac52286234e4074a86dd5c63581a2f250e6
SHA512 c7c491c097afa51608f917f59eb34baa764a942ce52dd0b25f546c8359b96c31b290939601ab1af21c5a023f4cc123f0dcd3564542d3bcf22fdbe7e94ee911be

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Specialized.dll

MD5 092dd66d54b00a323dee8c1cf191d4d4
SHA1 730ceb0e47e5877045097ca7ae8dab8edf498b69
SHA256 9e1c1d2105216b7d32384a579e7ca663c7b7cbf95a33a49c3aca80944c9f652b
SHA512 1740aefe2b304d953073b29102fbf57ef24f1be168922126975c971ca4c4ebc39b64584a956aefe89c2350e2cefa7d35ac9e97f6f31dcb26dde58adc2c6ce78b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AppContext.dll

MD5 039b2f7f2e21069c1bcc0f0918e21e3c
SHA1 12ce9124a13ef3ab2d6e719d88c59dbaadaf2f75
SHA256 0edd5d3f016f97336ba731a9ac61b6f8a05aec72f055396fd8f48d2244575e3f
SHA512 d113130df6cd45bc0f4437adde6aeecac7590cfbcfec41e378536ddb827718f769f7697fcdaa296f2f6e45d6bcdb01aecd94e8ef529ba038f8df6bff8664b706

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.Design.dll

MD5 a9e2eebffa5b50fb850aa02833925c19
SHA1 6d052b9171aa503f9e958e4b941f043c30de4d03
SHA256 8c75e903c098f35e4f0bc1a54208fd5966d30cf4584c99eec10dccf12044c058
SHA512 14975b2a1579ac8531d57b58057f096e286e841cccf0a82faeb60e7c2beddba1335532a920208a8bcaaf0d38970d63c18025dd605d7de670c09e158a1ee5c894

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Deployment.dll

MD5 7133c3f2de06aa448524b8afda78e0a1
SHA1 0871bad08196d3969145d601d370a4ed5c144513
SHA256 13b22fa8a79e61838b68134130540e7a70ce8ec8fad407a7fe8256bad40d2c89
SHA512 acdc3d8ff5df6b869b95128054fcb6729c21831d7488f6b9c74f00c82e2538b00285977c3e1e314be92e04146d56632a80bb0f1adf0e01582b49518979542087

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Device.dll

MD5 08f1e6084966835e8b4dcd4511c4f10a
SHA1 55eaf5b886f3c8e4f1f3b8b14c4168b1168cb3d9
SHA256 889d5867be1a1fd6359fa2b0f4f7342ad7a59b90fc6fef459058dea97f371b2f
SHA512 42952074ad1ec1d72374795dbb3d518c0c6d2d0b33765990f3be78c17e686dc36007c20440e49f8b760d8ab75309e831818a83f4ad794b71d6543705060a2ea1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Debug.dll

MD5 7dfc7e9c3efd0e74cdb80a0bb13ffed3
SHA1 c61beaf5d821a3ff7b6559e3598fb27304338e3f
SHA256 5a202ac35253d869c3728a2a320a5d1e937f88428d37a5ff5284c86e7dcf2e27
SHA512 4053a4c0420326e3c03c604100c8320b86427f2c5599725e55e289a2ad34a42688aec06ddda2ae2950d605178706a49fcb726e26b5ae70ce9cdda987bf88e045

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Process.dll

MD5 af9f8f905d673052fc1a9cb972c7a8e3
SHA1 bec5f7f4a602b5e74446ba67a44b2fc024e53d27
SHA256 5d5f17a534299a786c6abd79a2d3ff3b17780f56cc15dd028662966fb721febc
SHA512 dfa9fc93900e94e5beedb611e0c86fc0b7a305532d43f294b2bfe0be90a951516df7f437a602879f16da16718f98a72309c559e079a60edd56eab02e2a54e35d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tools.dll

MD5 20c46b1293333fc42124efd2450b4a37
SHA1 e2b41676fca197c3f7ea2c0cc130b2997af26ed6
SHA256 5fdc3aff7fe6e522cfe3eb558f90706f39a9427ca66bfa9c2f9faa654e54a77a
SHA512 9958a00282fe3b17a1f29b58ae160e09399721d5a15f8382cb712c70e49f25c4d87f7d56bb91c831957ab8645cb4c935c698cd0a4059a3b2507014cc56a8dda1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.AccountManagement.dll

MD5 47bd0b32422f187bc740020808b59f3e
SHA1 12b6d7fa36a0dd46b59152610dfd083bd66a2a4f
SHA256 9e451e7c0285b1f11da94452d9be24d71bd5a230bea8a1d74310b9372889734b
SHA512 4e66902054004bdbe12c929bc50a261109b34e8cb3b29ba81ce59ca10a38e890d61ee05fde9ee4aab341c16cc95dbbafec3b69203c4d761cc2c15146b59890b9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Design.dll

MD5 2681dedd9eb3ce926ecbb9bfdde30f44
SHA1 9450626adf01e17451b6a546305034a87367f805
SHA256 f2339e36a25aad0ecd1aa4b22691e129c264a2ae97e4047b88ae766b2d38f53e
SHA512 47619ede0d38208a706333b165ce9ecd93ef4ae5b2d17de931a388e9e14b345133de541b18ff67d47bfbda5f050482806726fc4f7f5ff2bb2e6faae31fc683a3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.Runtime.dll

MD5 1721d627715c7e5c0507a5461363a440
SHA1 b9a2715d92b32e423b9ae41d3412f47878b9203c
SHA256 17cf2d5d3ddf88bae76940c08e1c233ae499838df3af847fcf00925cb9f1610a
SHA512 89c9b5d800e30a62cb8fb3940e5eb920c55897a9513778e5bfa3d46db2a705d6a899dc084765cbb247c553df2bc83e0f054aed46dffc498df4f24771a5cf90a3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Services.dll

MD5 d4b21e35996a10291ceeb6d383303f67
SHA1 8a8ecd5bce1198e9c2bc5dd0ac9826e701871ed4
SHA256 d56228d85692c4a66cc196969fe7d68510b63aa90356a4ebe988d46faf89a47e
SHA512 0fb82b76c56c8ab94bc3f8f1b6ff1b740cf119c013f94c76b5fc90f0119a93f6470e1ae4497050e6cfe507aaade006a68d1996aa3da61c67942408407f729e3e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Primitives.dll

MD5 2c37099af7442b7077bb77b3c1b5f0c5
SHA1 dfdbb74829699a77f1645b11511e02341a938b4e
SHA256 96055c90d0ee363f8e5d41eac16048eb3feb07b16b242fc425ff068a2f005936
SHA512 c1853ef35e400e241554805c9127a25c0ff1b73d4a93d344a3890f6edd37dfb873c5e1b2d28cee0c228f3fb9fe8a0a6501fcc84abe929a0d19dcb72f8f0aa7c1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.UnmanagedMemoryStream.dll

MD5 4bb2b56a84e0df027b09451b6bb5bbb4
SHA1 63b3884bc429ee508273f8b08163237d44ae5cc2
SHA256 63ad04f01e3260ea4b1d1b3ebdf8e03c52eb43773bdc398d19ea5cf2fb3b9f5b
SHA512 fc0d7b341f7ad09d5344e2db5f7b60366e410aa82ec48dd8609402a9492103af053f7397d54313dcc3aa09b1ff885259f29aebe077c3f21ab81a94ed2f8e8056

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.Instrumentation.dll

MD5 6d96df09566c5b4d4886741de387ea7e
SHA1 f0ec33dbe8eeb8fca47ac908b6855f28e9f16116
SHA256 ab0ec5a51c6f5dc01385c62c5d7ef1e202b14ff1c241c9f1b603c732c6ae0aad
SHA512 27f1c6896d3edff72d52f19c81c4d79db1cdb362efed8988fcb559804aa07c1302e2a0e1f7f16dbcfa10b78406570549a999de452e29d3e4534b73a72e75651c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Primitives.dll

MD5 80686ed77dba83a6e4aab15b4a147a03
SHA1 987bb7c12fbd95f0e13800143adec251a2ced213
SHA256 ea3d3c19023d3d658b7633d1f968b89642e59158babc1655ee3ac010a37dfd52
SHA512 9dee4f2c6bdd42976a274fd3002d57a180db5b7a75db86982703ed027c7e6b2a427af663273812b154a6cd7f6fcc05aa399755e7d35e658be84448a249e153b9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ObjectModel.dll

MD5 7c69c3b90574d2e789babbf2ad3e5f53
SHA1 adc4cd18b32559045dd4537036b4b0d48736b7f0
SHA256 3a16ae989056b1a315d06fac7234b379467d78762ea85c40d611db2424477353
SHA512 2034df3dc1a1ddb541be6107dc09b7d06e98a07c8619c8b29b49f9f3bb2bf70d1511b5cbc471a0e5e19b882f58763503bf064ca43ccf2a11b512cb4e4fbbaa54

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.DurableInstancing.dll

MD5 a83f0a5f1dbec74a3efb8ad1ac4e2278
SHA1 38be8ee7536251d704374993886b9f336f2d24bc
SHA256 21b806534b21b4ae5164e2231c222307da36bbfb5fe178a635018c6ebd8f6ca7
SHA512 cf3edd344d734e2d0d7351ba0c44f515b36f6de2807bf86e889f10e6de5c17d608f97b85acf134d7c05c9bf62af42f1ae6f645980e487740bf027289acb31988

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.dll

MD5 449428f7dc9229c0a6880d45f1c063a0
SHA1 31053d2560e5e6d57432fb1782740624234edf5f
SHA256 576df49d987ecd6763c3e641c57f306b2649c2076b15008986cb6ea3707ae314
SHA512 0603c3d460ecdc1d9d2a3197ce5e8027740dc6b44ee12339c1bf03306d7c6ba4c306342a11512f1382631401dca4d90aa4132f46ce7241013653ff0ec42d42d1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Csp.dll

MD5 b5e32a8abaf1b8a2968bfd0e6670eca0
SHA1 d00554cbfbcef61fd498eae0f4882153dd67c379
SHA256 38b7568c80054891531a445008c6be186ae1a151f6a79a61639ddef9af3aa023
SHA512 630d60f9de6abe0594d9d60dcc42cf6fa991c3a3fe281357444e143def78875ddca0413e41123acf06de7803d17d3a3c9b529c362443cf2a2677eb4a682726c4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Channels.dll

MD5 01c5750dcb4ffe18e402fc8c8396f91b
SHA1 48ffbb5f961a9fa94650986d582c604841fb0b66
SHA256 faa8f66884d12e4d6913b078f18922647bd3079d8e9a4e5c409afa7ad33e87d9
SHA512 d93662cd2e7e1388d9fa0ccf5032d9f99469fa6397ecaacc364c38da6f8e1d67ce2838a3798d39bd7e2199cf1cd558158ac20c6358f2d2e63787f861073e67d7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Primitives.dll

MD5 1b47a06e706d7061673fcc87138e92a5
SHA1 3841a22359def0a70e4c7fc93286578d63d2709f
SHA256 90cccb8499c0327a42acf58debd4e0c2a940ca00327f0c63b35790d4ecb6df9f
SHA512 fa0ebe7d6caf671bcbab3a711a589bd51afacf80c79592825e03596351fae5352dfd1e46c2d9d5e4071865d7fdbe5f30afa14db99ffb85267bf678ea8482033a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.Extensions.dll

MD5 9f200446eb6483345a6b95f3db4540eb
SHA1 5d3085c3c10707e7cf0f5215206536b6d59debcb
SHA256 1373eacf71776efa17828515b3c2a2fb5261c089e55aad7ffbd353842627ed65
SHA512 95803a80c260486137f96cc0a221d30c2c2b0b573eaf0da3686e0271678c83985cae00147e53930e0bd2f93839eb0a9808bbc6cfc01bd9ccf747453ac0656805

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.ApplicationServices.dll

MD5 5d901d3975e501c8a199deca6e703add
SHA1 292ee4516bee20ee7bb3bc02735b24415a97ce9d
SHA256 f76aed77c27931ec31c8fd1de81c3ecf680ddfa4223fe302ead697d798ae0282
SHA512 b859b991bd0eb51defe2df155a2653285cab550040ce77212b84d03e377292ac9c1b17cd89cbc8f869e2ec4338085bdea18a7b4cdf1827531746f37ebf830dc5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.Design.dll

MD5 cb3050c0fa0d2c08be339c8f87c1a4a6
SHA1 3a85dd1c89cbe4e029436017ae8242b41da4e815
SHA256 7f5b9a24dd64883bb381c03897b5492fddfe60928b91e89f28c380d64e70fe0b
SHA512 faf9d51813c94b06aeab1a8280eaba007984c0de6efd5057b8bbea8eb19bbf9b8222d839282f7ff0c0dbcb699ff3d9fb689c34d2b4d3d7e53720d77cfcc8356a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Abstractions.dll

MD5 6a18e40dc78fe068c482f0e3f8fd9141
SHA1 4698d1766b0440e60f2342572c21be276becfd8c
SHA256 7bb49e998116053de38ac90ca66ef2adb1db045ad6295fe770858151b4f36620
SHA512 0550f35948f50c5739632475dd54ac232f58b503d8f199b6689b42fa485964b38b7b599cf6c4ebd27162d9a590ee35fe87ae3e22f29635fe6fc0c8a9bea6033a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ValueTuple.dll

MD5 457dfb6220fbe069e814a96190918973
SHA1 02f7724f7ce03ce806346937c923e2ef7ca4c2c0
SHA256 bed3d93a6701231d0970a50450c15ec9cb0b232fea55f7c9397791a59e21bbf5
SHA512 abd7c28161a94f8046b541f23f088615281db3f2c9afa83d32eee65128fcf46e4ee3b06eb94d45cd2900d7f17503d302783333de80894758999374d404d4f502

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Timer.dll

MD5 103865cb9429773e3a2537e9f6d844cb
SHA1 c74196ed9f2e57c704b609d8ae7d4941cb5c3e28
SHA256 b530be0c4308605ed8dffb1f046a1a1573963fd6e664ac7a9daf152e8630488a
SHA512 f71c85748914c51edeb3faac6668001bed7dfeb09403d5fc829d5c3b9ae0a4b26385e3869e8f149388e4afc212884b2e331ddaa60a7840dfbad4d5c0f74716a3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.ThreadPool.dll

MD5 709eca2de284ed2461bd5531a64dfb62
SHA1 d4b85c96bf8a0ed8fd528efd22412633dc26fbb2
SHA256 4c89af55d48b33832605ef580a99e709b2232ed4bebe5724e4b394239619f0b6
SHA512 b10b4d136fe4f98dc7043d4549d7c2dd085cbf010bc77a006b7b7ea4fe23f420076568dfd05d8734b18ec8af49d90b520343cc63ef6d9035bc0b41f562b5942d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Thread.dll

MD5 a5e6ab246c18eab8d91e35471b6f3514
SHA1 45627c82e9d71f174344de5dd33a5f1ccf9f3cbc
SHA256 2b08775e0c00649bd3a25b3fd753d27ed1561ec502875a6ea1ae21ef04f9b8c6
SHA512 7f07952c7f36a24d0434bb6f307e0c0cc04283832e6d6402a40ccc2a8593152e8a50c6e3b9e24f6258235cc6611ffbfe2c795878af5dc068d8cfe1b71ad06e54

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.Parallel.dll

MD5 74b261ed83ec299787f27657f4ec52c9
SHA1 7d801b1ece6e80b5826ca36d831fc752b5cd9566
SHA256 cc7285753a246a4e174b26102538b3f786c8565e72c312dbdb46b96bcd30d57e
SHA512 adb917b9fba04ff08c9c0fc5710dfe6cb786e0da5272a4dca2d18ec8410d86d58ad1729f2c06e7f2fc906a7d69ba9f36a69827f6e596fee8631a5060f9db8720

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.dll

MD5 9419399c247cf46c1db2d51011a61539
SHA1 b2870e190765a9d92b6368231423a869c3a5fb9b
SHA256 9ce809d91fd1b73adf582585ef833beeb3e6eb6b0bb08f7199d0dac210ee8699
SHA512 66b316b4d0757d3c589d703bd83542aefce609e4fc10fddf1ca628dec6d48f5030750bf7962e3f42afac4db4ef51a96b82cace5480d45872e090626c48de05d6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Overlapped.dll

MD5 94ccbf829d3c61d8600981ba871b37f7
SHA1 38e136580685ba7e50be1123b577ef94b4b6813c
SHA256 578667a8bbee64b5e10553a4f0a28709a1a43b0cfcf5ce106dc9c18d39ddc5a8
SHA512 95b6371d89fd24f19effbebdb55e54e1d8e3fa07c3361082daca14927c73359c82f88346c22155c4f313d43c952dc15c7a08dfdc9dee7ec1aa95cd5de22e9b77

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.dll

MD5 a47efdf60e676a872a7ee14ee0c568cd
SHA1 eef6b6dcb8a90c7c2aa353bd82072415fa0bc70b
SHA256 5157885860f09e872a45d524131e921e1ab680d97d5acad505a2f7d090411295
SHA512 9761b9a49da771f373e038f2e9e6e28b101d411a3ea2599bd9356ea4ab74c74369fed5b8d71367c6218453fa7c6107c2bafc06358904af32260d3ab45dbae7fd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.RegularExpressions.dll

MD5 e07738cb65748665adff8e716133fe16
SHA1 782c22d83dbf3bbf01dfa9aac1ac7008f43ea697
SHA256 f75f2f2fe4a962678334d2884364649cfa04dff40d9a0a93c4a624c3292cb6fe
SHA512 000db30b8f615c2493549f060e08b9303b48c032280beacad3938d1c88f678ce262bcfdb8e0f2faa9e7a41afb69871a9a80d2efd0c7cd0b0f04cc63990c0f550

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.dll

MD5 505f1ce1e66164126cbb744dfe1229d9
SHA1 104d99abbafe0011b0bd1eb8e89e4af416d9e6cf
SHA256 4e9930c41b5fac7773dfd47c1beec33144e8b38b0ce22d363a5a76a996f139c5
SHA512 a660e1712b175639589b2bd3fb642d382a562665ebb5e6612ab5c62d70604a0015ab1975423c7307b7bbc665ed989828a6b8014087b7086779ffa553ec584142

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceProcess.dll

MD5 4a8cc3185fc9ce07859966ad05ac44ce
SHA1 fd17f0d137812370a96cbe9b5f0db686e03ad2b9
SHA256 c1d0a5ac7c87b9c71a9776de684d0b7d9bcf909b0b3b5ddedaa218445e54d30f
SHA512 2547536bbc67de6e46b2cbb031ad3b738ff6e8c8a3fae26c86a0a74a486938ae87b22d30a4e6ece6c94375aa19084d0a46e69254e78ee43e666f391833c0143d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Web.dll

MD5 8596b8a6e2152b73c27ff881da10d313
SHA1 f290518253896717b1f51e7816c7d6d4300dade1
SHA256 6538515f369abedce7747428aafa8edffe048e451cb7d13c82e12d6418d8d055
SHA512 048df526ba75bd8e3768d30a51ee0377530e7977299f8ee1f6813b467f1ea5c21b125bfc6ce4960c82caf42af6e4a3d4e099a4a818f7e3ee6eef3b37ef654c80

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.WasHosting.dll

MD5 4004ec336f9e68bb5e5b0b6fa33b169e
SHA1 c03cd9673a1117ab0f9754e77c9d573a3289cf2c
SHA256 6b9f63288b44cb7f67e2cff6e3660ee3edee5e672b53370c74796d82b02c964c
SHA512 7d528256e888e3746bcb781633a263dfebd55bcd0101c68725d1a6724610df4b4bc50dc5df7f6f8b4f04dd3105bd8434572f1895cf7a646fa05116a90c26086a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll

MD5 84090b149c738aec129611e01c909e35
SHA1 b34db7ad62c1683d604146bea969cd8d32425817
SHA256 eaa41361576ef28da8079950cb4812168574ce3dc98be2b11edee4b35210cc4d
SHA512 b113ad047b533e5e2608637902bce7795cb9dd2c0743552e4059960b648de19aaf9675e7b236bceea9ba116cca36ef8e33507c3747a563828b4407ca1beeadaa

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Security.dll

MD5 d01bf80585f17ba85bb7b2537c8f6dcb
SHA1 78319831a166117f3876859a3ea2e08f0d8d73fa
SHA256 1649d436b96a7aea0cc4289e2b2a0408c0b1c75f4e2b33cfbfb3b94373adae55
SHA512 f303ebef82c4343cfe19028e68637fa84fe528b44f0d333bb68b9a5944c31d280509626a96af218273253aea5bccd3799c2eb762101a7482a82af230775f3dbf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Routing.dll

MD5 9cf4b3587f4c98a87f5258f505f7163d
SHA1 1fcc6008be57c5ed83e8a85660c9506593480e5e
SHA256 f00285fe4e60bda4c344bea2d9ca17391e72274d1b3ca5dd20ba194fb6a2f4d2
SHA512 dbe1687aed35aa8a9e223e019e215d7ac400a4fcd9296a253b12b9015476e360e638c1607859c2cb6dc819e05953a41bf77866c0cd0b05bc866df0290bbe6d08

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.NetTcp.dll

MD5 3542c9d78868a5c834dbe7fd9e43e59d
SHA1 d41383bc8fdefb07be6500db92f0fe428f1ce98f
SHA256 42c128fe373ffa47317be19ccb0fa4fe8da6c5aff909d65a6b3d79cad176cae0
SHA512 70cc7aab273be3b47f354827b1ea634bf56e899b992222e33281737f94728bf71219070faaf8d4e268e82211d9a30296c4cef7a9289691f8124800c23f2a68d1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Internals.dll

MD5 b6fbdeb5d8d1924716c9c5bbd5ac62f4
SHA1 1ed3cc640539c9a038c668b15b0f2244a81add86
SHA256 4142cb2fe849ead7843766f5f9f48a23905f28791f43d059202078aa7b77e970
SHA512 32d750ac76e9a18ece5afad8e8d99cc75e9600976aa94378cd0c57051fdc9176b5c4cf67d36a5b50d0a9998511faafb90c41b2c011dcad76b86b3560bc12b5fc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Http.dll

MD5 28bcd0e98f2bd3ed5482c90fe056cb6b
SHA1 f792c45c1ba9fd242e2bcf8efd3d1c33190159f1
SHA256 a58b27b1ed01dfc38adee4f3ce30b880ec915119ddded05eb81eb708f8decd15
SHA512 cff2962bbbab1c0e489475df01f9a33addec30c1386fbc37a9c0253e269b47a5a58a05b700c53c2eeb216a08fb9313c42bbbbebc99188aa858ebd14d2d2ff128

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Duplex.dll

MD5 6e3ecc882f16044c9974b2bf32e4bd09
SHA1 8f4ecbf84543640822dca8a433e9293fe0b190fe
SHA256 f9a1d26872320875a65106a5186044abbfd55cf6ac169cb3753b7c95bdb1459f
SHA512 9f77bac30bee65d8a9afe76e6e02ec64a5c465fcc60078b891b2fa49c1432ff1fe2d62d0ded1d9de88d9b40f9c50d389910c22ca03c43d3243307a4aeedc5126

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.dll

MD5 78b1c6fb9cf72b6642be19e5e5eb4e15
SHA1 e5d98de88b5d1c73300cd5f2be8b74fbff6f6681
SHA256 a2a0b9b7ebd2b4db5281ef9c7a85cabe4c9810d2f26701b0018fee133141e910
SHA512 cc7b78a20f9ebd5edf29ca72d47fcb572848a641250aadc62c855868687fc2123ec95cabc808d84a82a29db3cb7f2b0ab2c61984452e689fe9d892e64bf8de0d

memory/2812-16096-0x0000000000400000-0x0000000000410000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Discovery.dll

MD5 50b824a5c8ead954145aa650fb4ec526
SHA1 2381b195087de8b603a0ccc281678c38ebb0e572
SHA256 0d8022e72cb9df38fe4e0eed5d759b17b7b83960c4a72278b7260c6a01477ab8
SHA512 07a34ad4b6c2295b038cc8d8a34ce2efb7da53305185a75797775abaf12ae963391c8e88b4cb9da74ce89882136450b4b0ed2cb422f419ef454d588c595d6cb5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activities.dll

MD5 2841bb4f6af1741f5596432bbf6d8459
SHA1 f1692e9ed1e4438a3016fc8d7f7e54fdeadefd31
SHA256 a1699d637bba88ccf9b4fa008261a0736c0cdf52f0ccf338bc858f1ad25d9f89
SHA512 85dcd8eb5676df33c6b79a77d9efa7d2b9bf29aca118af9347555799468d9bdd4ed5321b435bd8d3e613fabc2029a9c559324ccf37c5d8136abd45845126bbe0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activation.dll

MD5 529a41f9141c6063ecfe7d283e7271a2
SHA1 c96767ad684cb577baa2003b9ed6af1888d01187
SHA256 bfae77c847159bd966f794902101548c9e29c57afe2effe6a7b493d426f2e26b
SHA512 917457f77429a02c8ae4536e0575c3ffba0afcbb83bcbebc8cb0d8095c5725a33edc02f75dfe759d14e3b654c29b40c646487ce0268ce277dcc07f9317f769a5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.SecureString.dll

MD5 1cfac2a6776b6494eae3df1c29cdf7e4
SHA1 a596fca75c2295c3b0edc6c272aaa404c2025000
SHA256 59023cbde2223dd77b12b036cb894d61064773187e8f1190970cfe792d8148a2
SHA512 924493d0c8d058a2e540495e18f4528b2394c3d03065646cffb62dc905ddb0e7312b79b77bc50b1871a20f0274172e377dce46dfe308f4664eb16a6b193a562b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Principal.dll

MD5 dd97252e6bf003f6360daa0013aff2e9
SHA1 1f80c997a3994715eafb10748ea8a7cb6cefa437
SHA256 2787ea040607f8abd69ec703acb8fad523d7089e93af7851de8dfb4a6321ca59
SHA512 6fd70b25e6a82d4f99a4b6255b6fae4853426fadc285b1c83c6e442bbf8a8f252574a86ca56f81f4f55dc34f4ae128354b607b2e941d98bf11fa82425354cdb8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.dll

MD5 aea030736787c894654206ea78bfa6ee
SHA1 f12eea1da68dcba6ae06ab96e2d699f3e92ecfaf
SHA256 64702ca8073748fe539e02abd7f3d4d62437af9465583d2a25bb9aa6e785870e
SHA512 62c2dc4b99de21d682b0a56269add70e9f365e6427327aef06dd809e34447ef1c384b9a8daff17ad2fb2e732e1298fed81625a9dfe787eb4395fb12846c0b15c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.X509Certificates.dll

MD5 03924dd5b6d4b667e2f7a49e47ff6ffe
SHA1 39a1fa1fa490d954b88da41e4b6bb79e456aa331
SHA256 e70b488645bf161483dddc22e47ef09274ebd3f993e43e4d434677f6f8771ba7
SHA512 7a27142fc295b89a085bbb722717c62cc93b51536d6db52495f00439b1565d092820ffb4e83153514045e9f9f69f5f4f1d0e04e1a74043def3d3130fde5dfcf4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Primitives.dll

MD5 4a091fb0e86ebff08b704ddee25c4f1c
SHA1 85a808ae01703c46ebf5d478b34336948efbd2f9
SHA256 cd4e38b6314941dca3b840ba934527537508d7f2cb7efcae43de08f562b68f6b
SHA512 9eb9fca42f2021a6019adb10236361bbe1ed4d70f43e9a9c4a2766fb797d19152d7dafd0f0523f5a63fa9653edde9efb0f8a9f88deff51625ac924d4f7985d80

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Encoding.dll

MD5 31506335311a0f2622a163ec5a275538
SHA1 a4efd5bea8e367ab0e5b464e4545fafedf1eace7
SHA256 80c43a5920a8079c3da7b83b53694b22f0cac291b506327e299a613d11fe1953
SHA512 0e5bdad5684ff640149ec195f5e86cb80bb22b05d3956087a870353426f1e9e12fe13ed886337e3a7e4054d704d0235f0541b54492107335437aaa3392d1cf35

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Algorithms.dll

MD5 6f515b5fb2c9a24f1d689501c0179aa3
SHA1 bb7e00d5444758483422aaf943d6d6bf4cee8065
SHA256 b1986ea38564e1e32f72b517c19bf6c4f9dfa5e02c9d56f657f09bb8ba193b24
SHA512 4dfb74f327b495cd458066e33274ecf136b95f5dea41f5537bb7e7785bb308b0bc8371b3116c5bccf4be3c5c424fc3a427f5fa5a73fc26ec9f6d56351e02653f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Claims.dll

MD5 a482e34fbe20e5f82a40d9ba7f6e0da2
SHA1 df384c08bb5457d6a41ef3aeee97ac7abdc8a157
SHA256 c8a4842ad56541f023510ed46c58efd9c54ef5b642acb5325638d959618df8d2
SHA512 23500ca00e481862f1e2fc43f35329161d5b6a381b9768ba23ed9c84a789b0d0a737a730d57f0df86f38afb7806c618dad33f6319a5ee1b811ffad2dc16539d2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Xml.dll

MD5 e707b85364bd39ee420c9001ede23208
SHA1 7eb49ebc16833587ca2b350b381b04c102605045
SHA256 a710f70a79f6de98964fa99933585c3f425edf4b27c4f130ecd4fce08f715657
SHA512 ee4920dbc6e2633138364dc394141fbb499e346c6f27279bda243ca5010bbf20c1589c4dab3c33cb78bb545931eb4e378347241cb6e5ba5ee8413b2efa4d6d6b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Primitives.dll

MD5 8f201671a42068655f15dda850582fd4
SHA1 41dcbabe165a683650154c89a0ce15ff9c9fd02f
SHA256 00fc091f1121805fef479d2d53cdb1a11a7ae8895dbaeeb247e892c648bb29a2
SHA512 e69a754e18099b9b583d6746b777fc2094da8c806fb4d3d2eb528a78e5ed358997bcb5801c155cd3cfa9cefaf6ee93f8e7e08667a7cee4f0289b913ff1232601

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Json.dll

MD5 3a08ff8ab1a08fc4e83c257e52f0d8f3
SHA1 87a0760625063d2627fe83db0761aa53c164c7eb
SHA256 0b9893e5b6b9bff4ed183441e6aca54a332d9341136699ef2f93e3948bcc20fc
SHA512 a7fa419eb59404b24f8e0b35bed6b778f9604a67359097ada1e1e47172cd00cb90dfd10f3df5cc000759f6ee72e57453b08e351021d207258f61612a2b16e0c3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll

MD5 087705a646b9705a0be5b62903b4a707
SHA1 7d7c617298875488bceaeaf8f0f76abc9115f717
SHA256 1be9f91a566ea17d8f6e29acb15a91648b1f6dad456eb232f4a84571f4d711dc
SHA512 bea23d6afc7805c301934929869fcd6a220978d1aecabbfb765403a84e12070e802788be539f1962ad496bd564703d9a9ee99d5ffc8900edd370e2ef7439a7bc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.dll

MD5 9d2c504f45c04ab7863c97b05ab73087
SHA1 d82418da3573b0206bcf2432cd7930078c2d3d88
SHA256 b3f7403020d1ecba99821ed8548fbaaa506dad337356070859a6cfb761b90a8c
SHA512 ddff855bc42195e0cc83e5c65861ba1c81d170d706833394c78b30cc5bac4a0b1683e23a7b76116e030b1c613e82f22ac06948e4ff8131d7d91a29e93712cc07

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Remoting.dll

MD5 9eda2e7fd24310c0b5fff29f46374786
SHA1 804bc3f9d2e76a539aa3f028e4b0085760394c97
SHA256 3c4c8f44d1bd2b791279cccc184e3799ab8239a1e741c6d66d3669b0dcb23f2f
SHA512 e2471f9a5c1d49287165368a383cb8d83f1bfc42374ec16a40242d7099dc9b5b71dd379c1d429f68dead653a16827e79a8f90d56a161b80a90f35f119cefd86a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Numerics.dll

MD5 1b3643151d6df2ca411e3b26e3743571
SHA1 1efdf3863765d7729053622b12b336717cddc3ac
SHA256 61a3e41c4afa7c047713d9c4a91f0843017939c2bd2b98739285378a8f922a50
SHA512 b67542abe7a4a8e8adda4b6f5e07bb1cdbe693a782528f8806c2ff21553eb87a1554762cf7464243678484bffefa9710df95f9f0690bf22231591311869076c0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll

MD5 00578780bbfd0397ce6920bad36fa4e8
SHA1 94beffa782453c3ad476b124b7078db560a89b13
SHA256 c2454c2c3a720b112f9a9ab3e11efbb12ad8ef1589decb71ce844e9c0a71ea09
SHA512 5b6106df71aedce0d7985920ac9fcf0847d38a5cad6fb605e51bdf56c4a62c4a6655753de73b6d77c23a1ba363b25af4f2c5f01d5e4e77ea53aeb768a99550fe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.RuntimeInformation.dll

MD5 37c4ebe1ab9d0050b7ff0100132d8661
SHA1 aa2cda6e5083e41ffc61bca21c9dc66d73bc6e0e
SHA256 253fbf39f34ccade399013cc1d811f67322b7dc157707041b78aee79f1b30075
SHA512 f0cb5b713a5a46e6f0f6542d8064a78a8d7de4dbb8fde485fac51a463342191b3f81bcfb36064abf6a20e658bb117900b44a686aefebc55cb1e6ab71d90f216c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.dll

MD5 6cc0f4ed08044234911e39d09857549f
SHA1 43c581a737aa1992b18d752e5c812c01d2b02dbf
SHA256 5c6111c36efa90bea66042e0769f03d55b5f475fae9d8d8b0ec3a7fc0015805e
SHA512 bcab6460de294bff7ee97bd6e15d81260a582d0607d3ea365cf542c4188056d8eb400da282d778477b01a5962c72ad4e6c06b6ad703a90bf1333b7b784bd1fb1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Handles.dll

MD5 c35125cebc06448f5a878b52a5be7727
SHA1 921b011a044b01376c7614661dc8d562465fd2c7
SHA256 52114cd130d80dec26f58473f8fa3aa241f47eb28720db3079a1afdd35907433
SHA512 d6f8fef4d841efa98a7fcd826ae90c92608f3e95fbfbe3e56b7a0b91752a53f1b164792b98c620e526efda6f0543dcdd92f2dd492903c8b759683b06ccc9675a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Extensions.dll

MD5 cfff2c607f3b140eed717c8346bbdc5b
SHA1 4b582ae33c6e3befd908e14c2f8d76e467944428
SHA256 700d825e20c89a69e72be66331a702e5e33c1e7aeada587eb1846d5e92310c54
SHA512 48541eb90fa18b0b181f001ec435de5f0b6e318424217c4c9480cd74c11b24ce8632bad760128057dec4ffad4a7030aa08bef4c7f79c53a78e84baff6c3f4371

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.dll

MD5 c95b25dc058aa25494ea03f346b50270
SHA1 6e6d378f07bcfe9dda432b031399e6e99fb8db37
SHA256 e8f250e6ed028640dfef8c60640c489a3b751afce506c842384b170ec88b2651
SHA512 adb098776ce5a0d9cb16c22b3256afa19b815484ccba3cefce3cb55119240a29557fc3c7a86aa18aa439a03d43da4f960bad7f87f3876974cf071e7c307cc0e0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll

MD5 ad3a3fa0ee6681a92215c1d7330c13c8
SHA1 7b3edad69a33c7ce002ac4379cc111ae988a21cd
SHA256 4442bed6603c89f60d5afea5ec4dc8c991c4d9c4e93263f0fd0bc6f5eb821c7f
SHA512 653469fdf0d5a05a01535d83cf7c2cb419924b5414301f8dd6fbb2081c2f4b0e8d7a02303dfe23f73bdfbefaf4cf91586e6fb0f3db31593574dca9bb73ac6025

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Caching.dll

MD5 1ce88ba6bcd3ce68f5bd188ae5ded560
SHA1 4076e934267e1eb69232250e080fd5a72bc67ec3
SHA256 731f883b01d73f30aed45d565159666e9f90a0304a24ba92b6bc1683b63f5f99
SHA512 e5ea282ece1f1ca5db9e7f41954c7918c147df740b2e044735dd3848ca8d5e62dec83d56e3f16eb0d08c0d64785664d09148eeaf92066359599323997964a5d5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Writer.dll

MD5 093660f49951c4731c72e52c6eded921
SHA1 35b7f7dd65b6c7c4544857e4d0d5a5fe2537675e
SHA256 60f391ed5f92e850d120b95c837aaae6375a97e0d25ebac777f2cca2cef809e1
SHA512 f16c65c5c208321d824f570fb74712a20551afc31b0190699907fd4919b7e2901e31f16a84cb5be96c44d49aee5deea0aa81a8382ad54617a07d793450b03e93

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.ResourceManager.dll

MD5 20fbcb2ade2d1b66aa3acf9f313e4b08
SHA1 ca0f81d57f920a9f73b069a503254d8df0d0e971
SHA256 cb75660b042ecce7c2b45f96e13097a7f8dd54194d987dcf6484a54cbade3ad1
SHA512 8c0311021307dabb63d1ce555cc9afce8a41d13f77b3c27082989ed122ec5eb1d771ab718e9f7ca414c275284495e0243830801dc39bd1c244e2d90971644612

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Reader.dll

MD5 60a5d1fb78d4322512a0c82d39a28f6a
SHA1 7cab6b4326ca3d1ec9cd1ee5d5864f0a5a4dbd3e
SHA256 5fc22583347d6af8dffb4bfb405f93fc4708575b03ae9b948f7b4180367a897a
SHA512 92e88c00226bb605c6328782c2ffd0659add21f4d77288656b3769a9ccdc8ea21c6ad4609a4c8bf371e762d7b8c770fc493748d79e3b6286f5cfeaa509101c08

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Primitives.dll

MD5 1ce3212f3bfc3a54fcc7b7d8dbd34983
SHA1 35b8477696f65d23ad1fa2f92e55e48766c7ac31
SHA256 4afbe82574f752d7a9c79af745c36118f75a7f68a54d7400a5fa7dd5a79c65c6
SHA512 a555cb83fc6ab96b6e8bfc088dc2947c6ff98e4ea33a6d68aa4d9573d16429c9d2c8602d982ed21aa7f9aad88ea3774a0cb49607a19f49521d695ba1810d4168

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Extensions.dll

MD5 09bc8d0faf799af0661f600104c60ad4
SHA1 b3612e52d6a96379b97072f7a3951ceda3fb5b20
SHA256 be4e22b77b5ee4c6134b0e61a5c83059d48e24527fe51f0861281df6e80f14e6
SHA512 d99aca22dbe5631e7bb5d8a2188b14120f334c5cbfcf32723a968a2a8f15e46725a736398d66e19a45e98ee19ac51cb14014a6870c162f70d1e985d98b0b06c1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.Lightweight.dll

MD5 14a87e9b06827953c8cf37d0402d859c
SHA1 d1515f4402d861a7ba9660d49a2cf6afab775bfa
SHA256 e3fa795a6c2a5ecc654d6a7457abcbf391a1e24061a7f54950e8a9685efed987
SHA512 997f5534a4cad360a9956a587c06e72decad2ac945318d677eb95164af19150894f5c4da0fc1c1e15517adbc728a349d1997888a5a7e777e080800462663368c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.ILGeneration.dll

MD5 fe6bae1c53599ad74458130b579f5290
SHA1 040e2f0a2df6dd264e96e922f64bbd89d1bd16ff
SHA256 8c008da3c3913a9a629f03a65ed5a1008385e4b0536176a3471f6fb3105cae16
SHA512 c3db0cfd04cdc3bef156201cf1d284f34f30676388ba75d7075217e2b8e3ade6c35a91ec3902c333782b8b461010ca45d200a69afce8e994fd1741398f11f2d3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.dll

MD5 6542c62225aa21cde0e73a4cd550233e
SHA1 a1a3532d9f5b50796a05e78628cb7b54f7fa5b64
SHA256 944dc0f45830368a77d1241b2e0d164c107d80c2573679fdedc9a3e49e480f12
SHA512 176304ba9833635f0578b1247cb8ec1b8b9a53bd3bbeb9b06c7b90a3b4ec9267f3314ec0ff5c4fe9ec937991dad7f19045d32a8556b35207989e3a39f41aa91a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.dll

MD5 4274489ee0d63a2469f0a66fea13602c
SHA1 d5e883dda80d58d4c527a02be3d86adb8cd19cf9
SHA256 081b740f3e98c8e97f93a724e3c37964ee5994ae680d5abd77bfa10912374482
SHA512 7fb48b7c7635c68eb54283cda54e2582dc3ad6f5053032d9b5b2f3c41f7920b45e26210623f88e387bda09359e9b358a01f7e248d72d1bac1e97682c6b896002

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.context.dll

MD5 4728712d055d8881a96f41d53eb797e3
SHA1 e6945ba0f590bdc1a8d07500527426de167614df
SHA256 26ba42c2aa47d5d04bf21bccbc8ed54c4754305304a38b83191a567653a7f8ba
SHA512 1367c3f3762dd99c09934c07b516337c55b9e341630cf2b03b9d9cf4effb176a20f10eeb2ea86400090a22de6c4e917494a637888ff35d86969fb4e3d7a9e893

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.Vectors.dll

MD5 43c2575c69261540fd04b271b4014c96
SHA1 da65019e44d381ff34358d7cdd5fc66fdd16ad91
SHA256 b729cf56a56ada799f33f2da9edcffbab07ea36a0ea6eaa4b73d0ee9d89ce8c5
SHA512 f614d44e6d83938030c59e5e51d62741235dc2fe4ee567bb4d03c1673617b6dc951745d9245a7e3f2c8d1b52817193b451300db07000f3aad3d46f4f8afcc67c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.dll

MD5 595a329f37505d4f32d28a413395f607
SHA1 652ebc34f85af17d93d0f412aa8c6b03d67cd9dd
SHA256 a2bf81986b30477a2d3cb76cec18a75ba7186593394d0cfeb15daea1ade5740a
SHA512 cf336dfbb1637014ffb870c3b87a2e743ac78ff94182cd5881a7ef6248ecd5f75c4c8a2a4206ffa5b6a5af5204a9796b768f74b6d9ab7e048d83de4d8afc3f46

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.dll

MD5 496bf57dc98e6dc6bea4167fc2ce00c1
SHA1 2182357f2229fb2fa76bbc19a813422840d501ba
SHA256 05e4e4a398bcee1d01a7e0a648e0e224f3ece9d8f41a71041f2fdc5aaab7809f
SHA512 ca0960f46d652c7cfda4cea9ffba5bf8cbbfb8164699e85b6df636c3e00e2868270306527d6e5d3c5c7354175ab57f5ff42a2ff32c2900088a61a0f259f279c8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.Client.dll

MD5 7b47235be756093a1ad370a9ccdea25a
SHA1 e4b125ae2cdb61467ca2a75e563c7545361549c4
SHA256 8a3d6db704e893fd56ef2585e99022981026589076445bd80e45c2994b85fc3b
SHA512 1301d3c70b3111abc7d564c19745f1173184c0d9c6b0c2c96974375b678e822c734ce1b66f6d34ef700a505cab941a0d04210f3755198b0d0c79d5bdff1a5209

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebHeaderCollection.dll

MD5 469237a9c774604de2e23146be6991c8
SHA1 c63ade8a9327067b9fc9ff2e4a55456661e39411
SHA256 b7abfdd41806e4baacb83504a9cb67645e1d1aef2f594cd22fe19d6ee4d150d6
SHA512 b868ebc06056419027918b3aaf39765653295b85238ea89aa6f695a72a704c5310f2c5e9c222e3ead68e12024804943ee591238bfc80d840fa2f5eedb132b1c8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Sockets.dll

MD5 1d943df7ec061c5ed6cf6c936e914227
SHA1 e5e0ef1a91fb39cd59e214fcaf471b40c1a14ba0
SHA256 fcbbce17b12188aac9fe22535714041611fe5fb19035051377fac771864a4e60
SHA512 d4bf6fd02358440aa69c151475bc91433fb4b5b88b1e6b959d2bc73c2a6d5761d034874b787dc41295c1ed957eba792767aab2307c097641401aeede2fb42986

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Security.dll

MD5 6bded0779c5e5c2ba2ae1064c8ad27aa
SHA1 bcde13c8a0051c14a89b904ab33129a40024d63c
SHA256 3c32f9641f375269beff1a892c61f4caff099bce5347d55b7f0acaa07313c58e
SHA512 2cba30788843466626a4f78165822cc69dcd30b5606019dfcef27b0a718038983e60b0422d42f516221c6b1d03a3984be32ade666691dde1c60950e95db1b0f7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Requests.dll

MD5 02d55206e37def01ba257b03b2d1e634
SHA1 2614fea41169207b1de40748b413815dcde46dc2
SHA256 3ed612bb11528fbd945314e1d165d6e28e5d8c07dcf899e9cb1c886f5a9f91d6
SHA512 52b7d59b3a76617b641c0e8b5502e334e4b84368fcca4acfa0e062f26b03fdf5918677dfffb0c893f316aa0d3c4e1099a250403d497b04e42a3e872b571d18ce

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Ping.dll

MD5 f530e83f5c84a286d48c0b88005459cd
SHA1 2acca30cfd46b3d4c4ffdc1c3326484e56e7d5d2
SHA256 5af02b04627b1ed70f0b86cdf4aba3a823a0b4942d403e521b71027c5191c5fd
SHA512 81928913d41496adf30e87bf79d07aec775742bbc9628a5a3e521bfe339140f58606a51f365b2a26412a3b96100cbde677c3aeb475a000d0a62beb598350c5c8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NetworkInformation.dll

MD5 d93754e6d6fa1ca283e7d2d41b0b79bb
SHA1 51767a02a4fe431b7ba3c4d8e86cb61c693890ec
SHA256 dcf799dbe447f15f03240344c547bdd3bde8dffa1a876ddaf1b619fb56ee2d7f
SHA512 30de365617bb3f1b2a5189f948619082c584f85efaf1dac0e461f95316ee8f755ecf215d17f65eaf08f768ad3b759de04c619fd7d41b6a3960a2e6798818bff9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NameResolution.dll

MD5 710cedace554aae2626829b2ba498b0a
SHA1 d6f6809fd492c2a58f1db2d190fb08b7966efeed
SHA256 7eedc8e02aedf246124883b500c24756fb947dbf8a1e855e58d6a5b6f9963c3a
SHA512 96638a5399e6dab84e261af687b5bb511b1a1f0d8f8cee6a022cb490be70ffe3418b2f9f1081c4c5d0841afce4e4881933a1171693ed0aeb7607059afd5c7b47

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.WebRequest.dll

MD5 a28c383bc4972768017835f5f8b17730
SHA1 45032f555c4d8808e945f48120507c9b34b7785a
SHA256 a4a928c76559ba81ee291aeda808adde59854884698816309a6e69f528dad0dd
SHA512 3514173ed02a09d9c0d0e96604cc01c499b5835c449146793e44d2620ead473fa96e2c2ea5474895fcd01d651b9e42607958f77dfd3b07762c6416834064abd2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.Rtc.dll

MD5 4d88f918533027100980138576170fad
SHA1 950fd6181a0318bd92dd5b3191f76f87b750e01f
SHA256 1bee122401b4a3c7bebad7a5350da57e7873f92966f539bdbab187b8251a2e64
SHA512 be90d4f1f2892b809b06688330c1f8afae298be1669b5118fd0ce25b5547816abf5da4554c7b68436439a895c8a6dfdfd3d66c645759892924f21cfda197da67

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.dll

MD5 128fb45d9428c067936751fd360192ed
SHA1 d163225ddf21abfeaa5e9cce97b9ca87a18a1f03
SHA256 da88c16749838a1684704b6ca0ea754f27c18271c9cff023c2cefe81a788d55b
SHA512 013cc9c8785e5e81f7ea855b67bb6666186c111359bbaaa02132db8d2e6bb51e6bd2d1dc047a1eae914147867e39c90d362bea01a128541e87f66df0b88ed6ba

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.dll

MD5 2acb408cfffca461c5bbdb0c3910da9d
SHA1 f2cf89c7fc12cbd696828a76d78cc472b82cac5f
SHA256 6f8f9b0dfd139471f9e66168a477a82d557b3d359ad016221fc2e7d3d2a5e8f1
SHA512 6c9d0dac4cf375954154d2e7d88c3d5e6067450fae0225ac9a0b724cb13d0e33bb761b538e4fad651cb699bfdca256d6b1c3969f97e6313d78808bbd517b302b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Messaging.dll

MD5 3cc7a99eab24d11e5a5aaf7d044271d9
SHA1 d2355afe2f0dc48ea10d4ace62914672a22e0ccd
SHA256 a951c408853e38c2fd3b510a91eb781a9350b8b43ff5f12b780004cea47c19e5
SHA512 034a4859a902b59c96ff94881beaf724d810906648839b7a279aedfa8f7e84dffa3b552f40686beb4294c70fbd767f893e5f7af44f7ba7e0adaa846baf32418e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.dll

MD5 c624b311fb0435c0a8951f312d946b64
SHA1 b4a6bce8090223a9359ca965fbf6fcb7e6740698
SHA256 5a6ce7c42cca680bd4c8c883338bfc55c57a92660e8185f0458fc0634b450468
SHA512 69197f51ca7ab7ee2021aaa026bfe5bf38eb77fefc4bc1851b79b1b8b9693ed0c6db1fbca1a8cedf122be18a32a83d67c4d5f404ca5ff72fbb66819b001a7939

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Queryable.dll

MD5 966c23bf11773c23aa50595a2f0842e4
SHA1 421358bae15bd42ecca86a1bb8b7b09c16ccc579
SHA256 15147976eedee55012b029a12de87b48e82d4bdc4fd65e85ae93b7b2cfce76ab
SHA512 7d7d546330b7e528bbdd3571c3b9654b98fcae8d806d7157b85cfee543f475a943669dd896ec06b6d99c066f2c10ed37d5398257d1bc02cf3b9e995b2c5181d3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Parallel.dll

MD5 c0d266050025b2158ca14bc80d785508
SHA1 8b6fdbcd52a0135296b54c9155f3419faa83ced1
SHA256 c55352a3f3f1a051380805209802378dead80e46724572e8f7e7256ba5f6d39d
SHA512 b193fbee1e87ee0e57c3326f7c9eda84f67fbda00d487ed99c4786d06bbdd885b3fde00c6fb56e21419b069cfc22b149a2cfbff015cba764781ca9182cc32c58

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Expressions.dll

MD5 4914fb8c8dda5c956494b49c5c38ec7b
SHA1 f99647338efacfdf52b5d32bc66f1215c275d8d4
SHA256 b87949c141262f6147bfc51933a02fd4bf7ed0fb4d8ea27b35ae1eac9349297c
SHA512 4c1f6504f6c754750ced6bed427e7a5f9e4341baef4c1a75e0409663374b5e26f0d47d9394d18888ccf4d6d25f7d23a5cc62d4ad1b9c702ab8b36aa9bc2cfaac

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.dll

MD5 8b7679cc7fe23c4c299c6f2e0e7ce8da
SHA1 352af034a712f724524ffdc9f40eac92d4d8666d
SHA256 6360e2bf2cbf61476300b56f29c6779dfa2171cb44a49d351b9b7a2574084c1a
SHA512 6ea7e62b732e2d40b3191c434acedda8793967ae3bef7d60a55edd60cc8945ca6a3dcab272e4398a6910223701bf82e320af948e0bd6ea895d8d1fd8e87b8a47

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Pipes.dll

MD5 9868f64828acb52dd00bcbbcb374eb8b
SHA1 b9d832d391ecb6c09522fee5f43e14b1553dd37f
SHA256 5e576e297c9b530d501e3a2d3691e3b7ca1dc3324647f4b9cf03fe2d3ff48494
SHA512 37910d60611fb0821bad8619bf99b1e959d0e4aa347e52d785a57b53f6d46c2b0fa1158df6866f331e6e9d9999b8773b50cf75f2aa56baa22e89b89c8399e96d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.MemoryMappedFiles.dll

MD5 6915aa0aa76747cf6070415c15cbfa05
SHA1 550b452ecb077903140cf1098bd46c55ffdc25df
SHA256 72af9b51fb2a23df79258fe18606b412f6581a166e2b8c06e656572a1831ab52
SHA512 a994272aeeaf34c6f76351ae7e37c6fc03ca7d963b18949c4cb97d65abdb26d1404a7c4712265f42126453ec6b6826faeb533815b133902563ba2aa8e3c2b563

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Log.dll

MD5 4467b60589e864062f4ea6a005c7dd02
SHA1 d3ebff82e76cc43743767afa8496c83ecb59ccbc
SHA256 5975ea59480fb062a5fd11b0a43317a512314f33a8274ea6fede112726c184bb
SHA512 11df972c87c3d2f8681d83e863cff58775d1e695dccdff10a1b9821a136dc54982effdbb0d25f3a26c5fa83f496e0f379f99247e973381061b7685064640f7ed

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.IsolatedStorage.dll

MD5 7d96ee010d53a4c5efa4aac30a4b7afb
SHA1 dec6225a1a5b534ce723d00d16ba126eabf3adfa
SHA256 fdd1a909c1398acb68ea34eef67f4b29b0893216fac6145abb95a93d07fe3d65
SHA512 449cf8cf6118c5d8c6ffbd8bff421a5d3cb02bf494fc4c7d353385146aaa8621a3cf58683cfcba720712322102b28aeadc629b32c9b5786587574074ba3f9443

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Watcher.dll

MD5 c3f6e44658bd3fa39c7447511d372f2b
SHA1 c8e8d220cec4f05fb77112b2a2b21956373c214e
SHA256 e27d7c58c92797e430e125988464494d223ac289df479185b630544deaba9728
SHA512 c06a0c111378eec9786eb5e1d5d23987d61c9b29cca4aa8709583de5424381ba6edc66e5f3b209dac59105e29013dcab0522188f2f35ce377016c2452aee7c38

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.DriveInfo.dll

MD5 580398dfdf6fb62e896821096bb4ce34
SHA1 3126d41870fff534f7f220c2040e5984a698f57c
SHA256 89ca4ff8c448eef7dbc71ba4783c028921c47e4e45a385ac90376d6c77a1bbfc
SHA512 aed9c81f6f7e641c349c4de5f44df310e4f1478771be7f29d52d2e4d98a6102c081acab814bc29b807364443da12d4d33de5bc5e0b633ef921cd2555d1bc4e4d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.dll

MD5 2050d2562d8cf4682e1235a8c1cf5d7a
SHA1 47bad238fc599281e3e7a09e6380b598271e5f05
SHA256 7276dbf3a337103633ea83f65790bd9d19bbf63f772549dad08f499b8295e550
SHA512 c00d726dda3c7fa77cfcb994c488c1d41ef8558e76be6513c369adbc2fd294a23bb58c3c791fa520aeabafd8ac2de3cb307fce3480a0746db66d6b7bad94d0e0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.dll

MD5 176ce2881ce2d204e162ebb1a017af9b
SHA1 43733b24dc039d01f98dc109fbfa0d9a281914b6
SHA256 941a40ca00ea64c3d4cbbdec22d5cd7cea06b620263e493662f4f49cf32579e3
SHA512 f4f1782afdb35467cf272dc125b5c7b3de6530c50af6c2902e957f01634881303c7d1c49de24046b942b9035e869334bd6806cad2c273c087d665b0e9f7f3e47

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.ZipFile.dll

MD5 6c69db5438b30083626aed74dfbfbe0a
SHA1 e6889807525a723687dadf82000cd971397dc1c1
SHA256 778717686728ee20dfc1364681a510f5aae01f416e67e428c7dbdb7037ac8266
SHA512 6a442b5630994c74168574e9a62e69486fc98e56b5f8cff1805dc2df054a5daa8edd1356da891d2c65417931df245c08edd79a6f00bc60357414e99e9b18cfc8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.FileSystem.dll

MD5 235cbbe91e9fe5d616cff98e8e1f59e5
SHA1 9cc1e1ee73296f6c5c90d4024daaf4cdd79f7659
SHA256 d08b012ea9f86759a97358414b3e6d6cd98dfa14428f2f665367228b5fb32d34
SHA512 523bc6e79d5affdfe0e152f0dc2dc351509e3f49266b0da58304006998545c5b797a63e0bb6bf30c00402b0b8945061536364204685629fb16df88d9b8280bca

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.dll

MD5 608a0220d424e2bdc148aa3f9c34ec0c
SHA1 fe693053f4e8ece9ac0ea20e6a53879ba5793d96
SHA256 2c72a24f5dc68c10ee43215b0cc1e87860585c5ebaf32ac57d63d69546ebfae1
SHA512 fecd20165d6977c7b4e4f71a326744aa8010ddfa32cd945320949b0f9b64b729851ed8b2e96b52e4b4d82d4a35795be3b8368c95ad02f83d7a39391145e6976c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Selectors.dll

MD5 f19d76029ed61e2a45c6b6d3b8a746ab
SHA1 6bbd19a9cdeab5b419209a423b5115609d596b4b
SHA256 27a1af9bea98c38088ccdb314da83097f168830d746230a7f40134478db7d704
SHA512 d1c3dd70df78933f507a82353c0d616b7927f65793a82efd4864e511a6317bc9ec8dedd95c9685438b2072b98a82928ead2db84f8d88d4ef6243a96a106654d0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.dll

MD5 d65088f181dcde68dfdd9ba96c26aad0
SHA1 b721d3172f6d4c2a708da9e1dc66d97ee6324fb4
SHA256 7244f55fdda39517f8380d7cdf73b189da2baea8d71f6b6249419bbb9cc2ea06
SHA512 912813ca18bcb8a46eec509544e2fc1d2276afe09b71b7523e052aad7461ba637774936289a00c71e3c78a9d2ce72d40a5d452e5421d15360f5e50e853b58444

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Extensions.dll

MD5 b9a314b1f949feebd299bdee8b70b3ba
SHA1 73d05b55949b0f1cb433153c0364d3337f07e515
SHA256 104a1a437b9541ea7d7206aa884a41357acdabfbf455a13b29f9e6be74099922
SHA512 619742d970892e09e9360cc267f691777a1ea5bf5c63d4e2466545d1ec2dcfead15badf2d7fa25da04e2d1053d84cc28ca69a7e418d45e271226cc4be8b059e4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.dll

MD5 7417001968451ddb70d46292519bc452
SHA1 0544242bb758898f4ac64b9066667b2a606f9a17
SHA256 e8cee2c05772b0a3a4a44a804fdc623f86909a35d671597daf9bba3f2130997a
SHA512 57ddbf3ff54735682207079c719a493f7beeb99ce2d236eb9f22c6ee9cdb9217234732c294f7cef0c85d31e9a91fc14b2f7fedc153fb57a9897c81758fdf2da1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Calendars.dll

MD5 2f7bf2d29aab1dbdc621e0241fbb35a9
SHA1 47dc5e3e9eeca51416a26b1733adb64a124a5f5a
SHA256 2de1a61a3113ffd3d7adaa2d7cf3ce334f89e1b11bfbd0dbd191e69d6660779c
SHA512 0c12d283c85629167e85e3db41435d0136858bd06c02fdabe60507e7b03a5995fe03f7e8f8ba7ab8a8d52a929655b549326138d879afaf52d3e168f625e616e5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.dll

MD5 125937461c0a3891fe129f3a972b2166
SHA1 050713d0c2b72792cebd15c2bb4b988317df6f87
SHA256 5a66377e4e9814047e12d4a807fbc5d82c53ed43fd906367bb92257e3ae344e6
SHA512 71717015afc77aa09e413c342876b2b177c4b03d30d3a209d2e008b005bcfb1acc404868347ef4a40ca3b0b4e8e8fbd0ba4ed1d4b44eee867f85ae14cb00f1a9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Primitives.dll

MD5 e73fc9f55fd2b1ffcbd361b81991ba9a
SHA1 cadb71f915c4150345cffecf6a5d7e3aa2c028ee
SHA256 902d90867598f7d2d7ba1e4c19c4b7d1202f3b1c2a59c2d3383016c43f2880fc
SHA512 e44e7d92b1f03f886cf6db0e5684b760f397ccde84d29cc9d9a2cfb68a25e0ba6019e44ea10932ade739903726c6cc17bad82d266c6a766485a2b98a1e035f91

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.dll

MD5 55b19caa4c95c64122093c8df509adf2
SHA1 8949cbb0682b380749870d02be648ce069093a71
SHA256 77995a91866820e13503b211a850df3eb723e75fe76bfe4bf1f60d3b51990b20
SHA512 e34300fff7c9104174cb8378980de06586d902bc100a4cb5a67ba1c8f925c51c09a08c458004c65d7babcbfe17783a54118637d1bd23f64a59488328018634f2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll

MD5 355e597e15958792bfde91e46a02c262
SHA1 8f3d3532f7e8d1b0ebeff6314c7d458082156815
SHA256 608221914184748c27a3c51488a070b75e31c562fe4bcf3eb310164f4c865026
SHA512 b1f1898783f484f07105ed65084449d7eb7e156cb9e43076d1dda8bd63b0148b8de2c4d9224966796c3c46298c0595ff61aa586f438124090a10b32be6c5e272

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.Protocols.dll

MD5 c2bb0fdeebf53c22235f829dc5213a6f
SHA1 61f0937f30aee5518423e2a41ca2e7ab5df61844
SHA256 f01a4c3671337ca4258a4ce995b1ac75f81ad11681bb0866ef1534940286c7a7
SHA512 ac5b09daa0c7b80d01b771b85c81bf169f0cf7a857057c319729b57534b8b176e5008a9b21000acc2ae5edc6bcb922fae41dd80cfbedd35ba497fcd4a8d95106

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.dll

MD5 9da12711d05a898fde2e3ca62f25c072
SHA1 65a9702631d7897ef3b16b647912ecc1fd9f527c
SHA256 a2ec94587f82a627143a4095e046ef732de6ce5bbb72bdebb646458a33e7978b
SHA512 529121bbc0b70a77394a5e3c689cff25f10070804383bbb5563bc1cbbd316515bef0ba55071f16d1e132baf3ff4cd44237d4e767917062fff84ff10044b6f568

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tracing.dll

MD5 3f50d4f6ecb6f495d14443f705e58fca
SHA1 fc5fa521a5ff32dea4695b3bd74e1210e09aead7
SHA256 4dfe70ca536ffd9d46c9e21442181ed8cccb85bd4f66461e54479f40b8ebe4e9
SHA512 9e060c6596dd7929f4a9106703c7fd1d8cdb0d8a6cddf9d47a27b6c1eee14a6dbc4ae91a3c5847bc7bbb0e771510964e485ff01b0608316b15eac548cf0fbb70

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TraceSource.dll

MD5 097c794494993cd549faa2bf28373ee9
SHA1 907fa8e8e842ca6ce32fcf356b17aa18e40300ef
SHA256 827fdd39263764be4ea054d25fc96a7bca5f9c28395cdf5592bc91c869b15179
SHA512 0f1030bbb52dc9a93f75203dfdb194f22fef1da3f058859f19584028b4453694bc18c576a741efcb0ac1b3fb626c8eff03701659e629f106b529dd5dfbdaeb20

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TextWriterTraceListener.dll

MD5 fef16ddcda40cd23c1e785fc017217da
SHA1 afaf807d19f4b1a77ef294b398a29d8dfdf26d96
SHA256 f356c6e521ddda6447dde6e6e93f7c9e28b1c529a4b692801d191ad54475d8be
SHA512 3780ff4e6b79dbfb0a329de48b06095a7c4bb6e0662ffe89b197833e195bd4eab565ad0856f66a9360bada656b715110f7788b44b64659bf9406d4bc3777034f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.StackTrace.dll

MD5 77b624bbce206d1f962bd7f54e3444c2
SHA1 b9901a75490d93a2999356d548e675c432b1dd08
SHA256 c01dfa30f0554ec3da488c34b8cc5eb89f4377d06da8387f4071cff66515dffd
SHA512 5423e01490f52591a782fca1314e0d8cd479e4d9700ca8f550af44dce60f7d1f724f97f894fd2d54de2e51b880107f760b9fa4b686e5140961ebef18efdb88a6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.FileVersionInfo.dll

MD5 830b3dd6cdb78bbb037e004c04239f20
SHA1 f47b06979408119b8b013890470be81fc06c93db
SHA256 6d4d46c2db435afc4dd87ce961448cfe3878510f51b5a022f394996cb53d9d7d
SHA512 73e46ea7cca28517405e67d07873b358af41d815083d0997cfebe51a7bda38e5d9bcd29d71d7e14c7c30d5dbce33d7bbd6bfc25dcc41ec84e26a0f66e77b77ab

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Contracts.dll

MD5 c15d17a513f67edc718f7c07ded07f03
SHA1 923661c52ad69d7347b82ebf4e688713f1abe2fe
SHA256 bae38d6a2f5c10d4e93ee0610e717b5645b21c90886a71ac6da1fbe0d985fab2
SHA512 fd549083e5317572da7b4e61831fc8f783afd1ad72a71c9f29425488007b77ba90fcfe2ea2526481b302ef485adf935a98818c42e0a3bd99947c186fe75393fd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Design.dll

MD5 1aee994a1c9b1c60dfa8ce0250723201
SHA1 2bf4144a11c9c09c04756501be309428c9559b42
SHA256 9dda71c14da6eb474edf3c76cb02cb1ceb4ebb558fdb26b36911e3a661dd4905
SHA512 e41c71e0bb59fa0eab4dfd96b23f118fb31a3cf19be17e2f78e2f3351bb0657aed9e9c8a0a4bf05b6d3be765cd1623a3dc4246d919900c43ee238393909f8ff4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.SqlXml.dll

MD5 9315c7d5a9c592b8efe5e1b64c3e9992
SHA1 56085d6bd43a6d5c25fdbe0863b72f255a83eff5
SHA256 771280c979493628e91b72cdbfbaf3d593f7989d7bb713cd271a2777249df8a1
SHA512 ed3e9cc134815fd620c93211afc281f81a2986f4e1af71b6461e667a3634726a2d1d57c9ab04f4051125a759ec040c347ec316672d7c70f283e4cdc2a3a83c6f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Design.dll

MD5 f30d861b6de1895a401b4d5703ca13dd
SHA1 a81f16ad5accc41736d9af26e3b55d9127e6c59b
SHA256 034176681a75c645e7e6bfe996522e3b3218ad517aa3574bc4b29ebbbf5476ed
SHA512 432116392ca0a3ed600578a71419b506f03b917b33d3661bc38de66e05f1f03c07770edf318a3898b7a7dfe536e2787d5af5caa7ace7def957cc04255f04a7f9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Client.dll

MD5 0cc39895ad1d6516919d84573479f625
SHA1 894e00c594c9bde00077537e75c01b0cec8edc9c
SHA256 6825de429a6300af4e6696d8e9f2972ec0ffc9608c73c520db1a1004541f0f71
SHA512 7c7bf7f0fb8e93295f505e7183033a0d3972bf56d6a2362a1b2cb0f6fbaad932aeb3cd332a02a5380b34c44303c1a795ef24cd8b4356df909b7f04a87457836e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Linq.dll

MD5 e86a0744c97d926d5acdab460429f161
SHA1 21e7cc03826e247fcb453cdf1f289d1fb2be2ba3
SHA256 c04eded43e93ca95cecaa83700c604fdbcdf8e75e19fe2f8834ac33aae23e006
SHA512 6c16b402a83e8d46fc98137d748f8b0a48c11c857be3fd8d31b772767dc3b3f298bd4c7840018c6928951724706d1dc52d596a7b98bfa1244bce943c0b49e015

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.dll

MD5 eefd61cb133824925ae9876fed57f297
SHA1 8d100149f785f3d67ec544aa4b133fddb58f7f2a
SHA256 07d8db405a11af31da2344e09a72c9e4cb3632cb184a4827769a47ee98399a3b
SHA512 75777f60d3eb94818fa9dd7f209d2b98c4006fbc1ce60236941e371453171b763f6e679d18eb08de0cd32a5ce7529274f5ccefc6ae11abe0f3a303f82f2026fd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.dll

MD5 214a649225d71325410f53af9c6efa06
SHA1 44b63fe95fa24ff4ee6a4647b1140f31732c4506
SHA256 b7080c9ef515f1f09017d9d334d07cccd731000fd4a68236abe86f5fdda59f8c
SHA512 1cbdd29a92c2e8685aebae1ba1d5529b67e8ed04e799ea7460ce28997e6061e8e05dfd8a36c1207f85098971d1bc10b1419cfdf580f164af5fdb01126ada0934

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.dll

MD5 c32249969867dee5262f2af9f94d80a1
SHA1 5872e9119ab8b6647ce06edb9a0c6b5a2f62bc08
SHA256 0d6015af2b9c165541afc5bd583442f3699686489cff2e2e5410c7d492b63344
SHA512 67cadebfb79ddaf7c236d71531dda0e9e0f42dbc12b3c287d9f34a5a0fcd6c30282b84e00b8c445387b78d8b07c0de03de9acc9b86ded0ecddb5c14915057582

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.Design.dll

MD5 40a26c81d436edf75f772f2c1b80cb6b
SHA1 599cc99ca03c1f862ffdbe5e97e68e2f2a42f4b8
SHA256 752efd2ff66b1b1a8e713ae466701748120148454485ab00b3dfe6b9d1dd1d04
SHA512 8ceec3e4ad24a88f1bca651377b5aef2df99e3b009052cbcb4ff238e59f6493434e225c676b29f62eefbd5ea0c3c20bb2af64dcbb2a98e713dfb6c08d0dfadb8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.Design.dll

MD5 242f94373d13f8c803181f1238c0bd75
SHA1 755d139d196498b1cde64835e9b7212b547ef0c7
SHA256 be426ee7c5e45444029548e9dc533baf5da5e9f87205ebb2a1c71eb45c91740a
SHA512 f1c1121f66d0d2f863b10fda2caa52a6721adf04997aa732d656831a5d6a51c6b752d9429ef0cbcde52a5b4f8dde3c4b7a7c0fb85dfdd1ec0c5358e0abca5628

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.dll

MD5 13f6d6b395255aeba50175afe47b0616
SHA1 5045ac84e03624c9417f61f245ca0afb9d0523d5
SHA256 b674c4b5ff748ef00a7fdb3b5a7b9ea297813a2e8b4d60f8680731db5e2fc583
SHA512 a4a3a0aa5d0d91ca5d22a9c530b60c45f5c61a119535fd841eb5b13d1ace557087ae44da5cb371d7263a77113af64688311369e4b11494ce51661bc3e9e564bb

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.Design.dll

MD5 8c9cb9d6db31549939d9c0c21e9c15ea
SHA1 fc57607a0b084d81074419aff6186664144c294e
SHA256 c22db9a5d671469abb980e8897440ca6637eec515ff29aa9edcf262a61963300
SHA512 6c484612c01b9a60570e7eb012d887e0143607ed60febf822ba52be61d42a4d75be5a5e5eb637c9aef0895263a8c4158fbf6b897c05de7d3ced1825cad8b0a2d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.dll

MD5 00a77f6c752a2c63cd8818ebe8f3955f
SHA1 791ff4209f94cac02fe0d96399cfabf04d5df6dd
SHA256 3394657747acb8a969d2e4e7b96bb7a02e7ad629975500d16a8cbaacd80682ff
SHA512 772d3d03bf44cf07b3442be372d2885fde2b73eb0b7fcffde272bd3057eea02875a2fcb1dd7872b768a32afbceb1cf3b5e556eb5ad52f8fc0d8120383c6e577e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.dll

MD5 1231d55a5a309e0561d361b607dfd2d7
SHA1 81acad52e6b35a6b8843a04ba9e77af73177e295
SHA256 60986b29004dbae2750bbfe75e6c27d8bea4979b0f15a92c8fe1ee8f313b3f11
SHA512 59b4cac74e485a58cf0823be97c5a22b258043e3effce4958fb6fc59001687b98da7c0ca759e04a486ec460fcbf5fdf9a151c7853dc9f9074589fcafd20fb623

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.RegularExpressions.dll

MD5 d7f7f64eb364669dfd36c746c9632301
SHA1 cd662110ab586b2a9984246c24732b920b556b58
SHA256 891792c0dde35eb28ee92453e19c7d120e7e2feb569249e8b3d6bfe021c07ec4
SHA512 e2c2ac6644f726510310a5cbb97b9daf051a36bcb144f6d4530c7aeec2aec03591fb6af97f78d4cb7832cfafe4c13e0a8326a1b5e28c0ebd250d00d045964554

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Routing.dll

MD5 6ce59240b78c5b99897da716b09fc02c
SHA1 e401a9663ba1c26474e7a3b0c982c197fbf8cf7f
SHA256 679b59f894e2ada2e34a67035858b6fed5b3a093cb01282774aee1f3c386c473
SHA512 59d7f6ba1436f9ec4935641cd2b4034f2d0ab062a8cf19f31dbfdd38b5e06ed5ffe1cd8494267e8c3ade7e53e95d26bbace6647549dd163f8e94e731264ae018

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Mobile.dll

MD5 d5909e9e665f3ef45a05b03082cdc1cf
SHA1 ba7911f3f81665669da7fb888829c62a31bb6187
SHA256 21f9c8154b62b41beb7c9ae8ba857bd7d74d7866674c8e6bd8f6b24c1270e71c
SHA512 9df57ae88e5ed9e5fb3708809fd8dc4661a4f5734a6a065398122fda5671c0a9db3d7a3a11f39cb2744ff0fa26cea3c306f84788d99775d79493ee98531956e2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Services.dll

MD5 694ad8e6f1884104fc2a4ebbab7fa094
SHA1 d1cb788bda28f2709ef0324d791431966ffa31df
SHA256 e8c7070e966d4c80dd0b4a6bda25ef1a2cb18195d49b8144952e65837525c378
SHA512 b54ba0e9402b4f3997024271b4b32bf7ee3a27296bbf260058d9e86c90ce9188778e2d09456f44c87667735be945eea6624eda458713530f0e18f55f7c8e10f1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll

MD5 83b7822ab887cfb60fcb2c55c3926e93
SHA1 d365cf327302cca8735b7d960199f0025af40299
SHA256 7b51e79731686680ab4e769343d9a208899ec80d9ae998996c424db8f9b799dd
SHA512 4103eaf6c3af9130f0a19330187cb7357828b7d4f45a98252eeb9e3629737be5e3ae29d1354814be8532d0d13236e36009f697e18e4a2a2141b7258f60664b20

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.dll

MD5 00249c36f1e28e90e29874d5fda60dfd
SHA1 ced5361d0235f864700511d483025b5eac7dcdaa
SHA256 337ab8df77d888fac7838bd4f372d9a56f06263cd89a3142cb2530bdd46b7de3
SHA512 1abc47849825aa27e07aa7eac2d10ccf4d7f9ebb5c12ee6bd4986a0afaf9d05919cc305ac849649eb95519dd5b5ca0d12ecccabc1d5ebdda0c286d8fc1c1ee8d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.dll

MD5 aa96840b1e99b128c9197ed44c37aa69
SHA1 02978560f6820b554455c60855947ce14ce0afe8
SHA256 9fbec3957d7cd291f93a348507c35065c3ea96cec73ba4790ee309ee6d16d677
SHA512 6664b3620946c44abf9151b656ce1476210382bf2b1acfa4af494cdbce35de06f7d74970448a5bcddf6ec1757e070968c3d5a52aac225d87d6f8c4eb3a139728

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.dll

MD5 b08308f8cca2f714710e1164b9127284
SHA1 d897f8b561f8f12facb680ac3f6432764511dd2f
SHA256 24b0c97570c7e23198058c0d1ec24d213f27461ae0e0417315006c596b6d3c17
SHA512 66e3a09baae674dd2c874da9d1c8830d7113e9a30a1668e2131d16e25af497efee1baa5d2b8c35f0debd4ff2d4374e89714ead815958d6889c2e5856b948bff6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Activities.dll

MD5 fd3dc5fa68a03252b0d696f0ef568492
SHA1 326a6128377c6a373dc5b8fadb577fca198078f1
SHA256 8af4fae831bbef6f1d94a217190bd2e00a255e4f4c2ee2609a0a42675c6936d7
SHA512 6d5d2581c990b7ddeb406ce0f881d860d7e352954d0c00a03f51a76739b0b27199de753aa5d38aed48de751fffb8128fa0f1f799ce8eaf0514c31ace5577fb42

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Runtime.dll

MD5 c71b5db201de69c70ae14244446955eb
SHA1 353fa5e0ec739d90c743da37875aaf4e75545ff9
SHA256 d0c3ae4d9664d0f8940ed4dbf014ca233fcc32cb998c2c040dadc4b75418bb8a
SHA512 daa9294c670fd141f79824f96bdb1d9e38876d32aea209cdb812cc60117f061b496ab3e072c7a0914496c58dd9bec16cb9a5f10838e4c106e984c8e2c0383c17

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.WorkflowServices.dll

MD5 bf851d0eb7d6d740069c5e240a17f5d1
SHA1 f83f520e4875129d9b499ac07a44b139662ad5a8
SHA256 797daebfeba36ec80a68b06de73e5531c422184275f7606726d8a62f7164ad53
SHA512 0f21c3fce3b3dde4004df2e5f078723022b27922b7bb84c4321c0e9027b0c7f9f5aaa80b1b0d524a4b3fe352b52c6726f084423dc4138752603abbaebafbe038

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.Hosting.dll

MD5 bf9b22d1e7118571c0b87b448d705adf
SHA1 6b77e324304af74ee5e56a3eb565e87a0a7643fe
SHA256 f059f6357ea1c231886187c774f5e3d93137ed1ed0a2d9713af1b44385c35165
SHA512 9e0108216d2b56fa22dc2c9aa71c8a5a37834e1856f68d84637ed96393c1b89c1960d454ce5b802e551f40566e0a45e3f528c677f892bc5a0023e663db5f6ac3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Linq.dll

MD5 c515e577d1f7ebda6063be0840c1d271
SHA1 0b1d26d86f9cbbb8f0e6f6f1dc43627f9c437779
SHA256 cacfa4daa07746c39ce5ced6df80e0d65e664eb0776bba2eeaed88dc77a98729
SHA512 66250961b9152ad1f0c41c58e104afada1bad29243dd53eae8c7b2e59ba35277567f0f3c45c9711a68852105a58ad8127499833f41c7de05400c08efb9f53d4e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.XDocument.dll

MD5 83f7717bae0e8df212b1e252c1e551a3
SHA1 f7e3b1cb5c4993e5162daefb9eca1744e1110527
SHA256 a587686cc16727327fc6abfe03f047dde21a894a5f2464bb6fcf05095a746426
SHA512 548afab74a4b122a91359915f5e15cc09b344643a6b8da311dae83889ac02f6c474a14ad2ea9f8c8b16d1bbea17d7e6e3dabe3de56bc5328982e1252ed89cf1f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.dll

MD5 8279d7e495b22d0835aa712dd79133d4
SHA1 0fbad44e5c646411ca719a272019309fc990f0b9
SHA256 a64fa04608643c53cba9f9b9a6bec160ef31a4f973f8558854604ef4aafc944a
SHA512 8c723c3569ccfaf9ca1bb2aeb410b0993886a0c03e1d69cbd9d64c1d113357ad139196776e19a572ad27df48c2cc919de5a04968d21e2fd2537fa2b51d49bc8a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlSerializer.dll

MD5 14e1cbb8ab08d6b9223f2edfd2f66056
SHA1 2111955c1d5f88f91acffce9f432066836aa5592
SHA256 caddc7e1775da048c21cc137d6f29f5bd6b08888a093721600accbcdea35331e
SHA512 3c55b14034f940e8173e0d91e97264873c62a3c108307fa59e600a10b597f99366986fce0b93b25896f37fa8b0208590d4d9afb6ac6127ff7336b4012c04f8d2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlDocument.dll

MD5 74556cd8a5f94bc8ec2d56f03bc149b2
SHA1 d20ac5fa2ec27db84bec0fefd31780dde82080f1
SHA256 b1ef606f261c883f340f02b5626551d87d717adcd8a2450d1265d9cb971e5ee2
SHA512 e96cbfed0ad055a0e5e303b5ff056195ac6ade33e8325dec425ddd19460770fea5700e88af7962de6ba762739b4462594fb9560234b7104c14b8ba945d671fbd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XDocument.dll

MD5 381a35343fcd8cbd2bcbb653c0745824
SHA1 d8cfbaa91b96c0a5dd86de250b59be33574f04e8
SHA256 492f8bcfea009a3ec8f8a5e6286b203cac8602970a2ab4b27a4eee3048da60f2
SHA512 6b2c2c71e0b9e878438bbadd400bc7d4072f8cf471c3a94640088fbd749e654d8252b8db345252f6313fae702acf9c8c94ac0d5f3b5b45935fc491b7d8938ffa

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\NlsLexicons0009.dll

MD5 c9d76245945a39d6c74657149bda9e56
SHA1 6c9a20e4364de9d97ddf57ae9e7968e94afe60a5
SHA256 09c0fcf95c6d5ab60ea7e12e8e1c8a3fb16dac7b7eda3ea3f6fab898185e3bec
SHA512 dbbdc443395777001b9dd793ec36f73dff8bb79a319c2bda3486a06d2fa26980f3535fb99f529320e86bfe603f813211ff047ddb8655f00b2185f66b54616db3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemData.dll

MD5 dd8d5a7e1bdda22913ea9978dfaa10e5
SHA1 31a05c91defff75d2594b716a77f9bbd5f34fd74
SHA256 f7ae9fb17075845ebadf93e35c4c0701e7cb8a5263f0fa8a6a0380e91c7753ed
SHA512 07b9b3d69e956200cfb765998559c3bfccc58f81f91d6bde9177f37d7e6ed8d2b153803014dfe4ea8491d5e50ab307d74ae66b449c1782425d127307bdc7b687

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Classic.dll

MD5 d1817f11316da9969f628cfa5c1b1108
SHA1 712927e6401f28eb0f61814f71fb6c3bc75277d1
SHA256 0009a612f637db6b558c6d5478a933015209e344961083de8eb4bc03010e58aa
SHA512 759ae4a264360ac92181c14cf4a49adf0aa1cf1bcd4a105c89b0b798a8f15511ac807aeccd698811420088dc643efcdf9acfe2db22f9f16a3c05ebed4ecf8ae4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Royale.dll

MD5 4cd62eea1a081afb78502aed22afadf7
SHA1 f7b8b0fe256b33c5657b1e61a839fdefb4f88fda
SHA256 e7b4d2bf94065cd3f1352ea761c7359f450d1ba93ab90617ee9e63cf905a2bdb
SHA512 131b035cb5e53e4cc729a6b632da054abf1d71e042b9f83af0735dc9c41829cd11aeaa15442057de0e3e5b978c33fabd54750af56d2f8dbe163265f0134bac97

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ReachFramework.dll

MD5 5616b51d5ebde2bfa846550f848d15d8
SHA1 485c0280720cce93e733438513da7bbf97513a27
SHA256 a485accdf396164a833c811496116912ccc331cf39a9c9102cac136d62b4d480
SHA512 60805a07bd6d2648c72094899aab0a15d763d158a50252e314139efdd20b7532db2e27336d827f985c446cc352cb5a279ce5dc99de55776d497bf81d226b694d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Input.Manipulations.dll

MD5 95ef90f0f86691f28e2afeb2b21b232d
SHA1 9575d51228c99118c13005fc268fccd4f00e1031
SHA256 4b698c8b79af525b6236c2e11740142274ea41b622ad13a8c8602ba9e6dee9b6
SHA512 ba20623e37fd369b3274180bf0e1af33cdf2c4ac111a4e406a85226bc48f2c365615212fb51fa31d80201a4b3aaa16de681dfa82d9a7142da1d91caef64b1f98

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WindowsBase.dll

MD5 77f1724391c68a2199050de7b2cb8b4a
SHA1 fbf4899eddcf3e3096ecf7c7abede2f326c4e491
SHA256 4d73a0d1517997a1d79db9e66469000374b98e5d79ed13cd46eb73ab00c10cfc
SHA512 47fb1088e350a0a239f9bea54dd57ccd1cce2b0992292158377dc91a69889bbea3bceb8165d0984bcb50468a4f5c5c3d2927b4db0f20a0e42ceb7feebbe45ac4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WindowsFormsIntegration.dll

MD5 9e79ae38474574622b5f9f6bd4cc120d
SHA1 f7db45f2dfecf6013a34e7f73ae1e23dd5b2db13
SHA256 17786cf59f8e92d0a93191f832772457f45dff8e0140cdc5bc544a7f7fa2ab74
SHA512 d589892c604ada0c4bfd52cba4d93c9fe34d851de0209dcdeed32aea3322a50f2326aa17cfa2d7410e2280d5b8dc804a1392d43e4b1d41d7056ace66f4de489e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XsdBuildTask.dll

MD5 70f8eba663ce54f2c3d41f08e94fc2fe
SHA1 726eeedf58943c590b05661a53164bc7ac0cf993
SHA256 83f8b7e072075b9b77e949b3d0d151e52015969894ff3165962886d005ed9f6f
SHA512 402d705f89035a54b17c2308c40aee92646c90d54e5b5dfaff79a9c0b56b61ce539ee842334150a3cc3c7ec3f09ff8d654f9892b377a3dafddc3ccfcc9ae5ce9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XamlBuildTask.dll

MD5 0476614eef18be36b246911a340d5415
SHA1 0015e6f34e17ef5eca346e45a0d62a8381c347fc
SHA256 69b2139bcf6b856d6e5a155478a68e278fceb2edac48dbbd8d0fad7546139f2f
SHA512 809081899909ae4a7b06d6f484758fc69574139ab87146a4130480aca8e1d7b2a5978c2f87b2e220311d71cf23252202f5225b1891855b655db32b9856624f85

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationTypes.dll

MD5 050680e418cd9e22bfbb4d91a3ed272b
SHA1 5c6e32652015798a140cac68ebe864c52bbfe87c
SHA256 6cacba4605307f3fb5428334d240cd1ca5b61a97d2655d8cb644f33877451df9
SHA512 ba25044c16cc4fb8cec5bac9ff75372501bfa7a4b3b4b90c62acaba3a08baa72dbdd4ade97f5aeb0a1b16836e1343d89dfb69715d8c765c02096d902f0201eae

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationProvider.dll

MD5 c096eef90cdfcdc387ee23a8e10892f1
SHA1 a0d30cabc6054f7d82b77ebdcba5df07caaa401e
SHA256 b94874d7cc3e5c936178ff47071f16fa2d96167c49f5e1f4fbc12356feeb76da
SHA512 f699277480848b79e8736f63c5fb48bfb77727661bd9a15c954e145ac3d9ab74d3ddf57ca0c36b25e9829560c4f7b057717622f1329df578eaeda799c58f089d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationClientsideProviders.dll

MD5 19e6ce61ee45256e0e801e463a4adddb
SHA1 b3c214c3705ae348df58e2c3a294f62ad661c941
SHA256 0ef2fe5fe86af05e00127373c7f7161e3e046934568459fd8c3139465621dd72
SHA512 4ba43e82da26acbe1baf75df03743a7789b827ca7fe92bf02d04d555ddc16d32412bac3cb2c6d0482c1d93e8f795c8e8a217f92302a4334af79fa4dbdaa2975c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationClient.dll

MD5 4cf72b60f3fab2683cc9172a1320a62a
SHA1 b05e668fa47891ee59b652bd25a6951378e438a4
SHA256 509aa78936231707d5ab2eeb586a7dfe6778e788016b395be8a462977943f604
SHA512 23a7d2502b4f2ecdf40a412d4305c0c1f951f704e5378b2972ddf29d6cfae193dbdeee05218a3538bfb0a7f16309b6326e3d1355e8086e0d3e4f3bd05f11a1ab

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Presentation.dll

MD5 c44a105c970c9bd83b69ba8106cfd07f
SHA1 e8c5be9ec3f204c693b4b56135a251eddce14fc3
SHA256 779779557bb7e087335d27543b121c62d655a38a7464145b1ab2cdf854f2ae0f
SHA512 4bee883cac90a65eb05b966792556eaef3e2486b7e76a8a011ce4072a99094b05d1ff95081b5a90ba22afa5cfac85336044419ce0972a178d8c30003a33d499e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Controls.Ribbon.dll

MD5 eeaeb2b8b2e7c93b1b2322488a501790
SHA1 bc59a7ad0b5f9844ca787768ca19afebacd7bf16
SHA256 108cd052d13556f0403538bca07375501c2a4f91ee8a58cc4f296333f18fcb5e
SHA512 213ed726e922358cab9b358b06889106304ab3b370a3cd8ef98103fb8fd9f8b17fa406aff72fac4c4a41021f1b91654ec5eb151f999c409a922399dee3b1031d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Speech.dll

MD5 44cefac17b05845ccd7e4c5338deef15
SHA1 bf2b666961f82275e696c92ed1ef3546d5daf19a
SHA256 ad8f62761dcbe4c6e6f377e45549bbca349f7c71beaee87d1ceba2318fbc70de
SHA512 970f456f893a4ec25b4ff34da0e2ed034f3be1911d460b27276e264c7e87e34fb0d096f5dd671b72b589279a36cf96a8eaf5e7c89696b2536eb0b84c637b8b77

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationUI.dll

MD5 14736ec85a3edae824d9c79eed6e80d1
SHA1 c0c4ccd0743147502a3ac558351c8388aeef0bcb
SHA256 7155f3773129ce25f6f040e27e7fce426a9e0163295cccc39157ceb9db9bff5a
SHA512 b128a2ee4814fa296f51c2b6083a013b3f66ec67dd32c1100084e1525af11c8df3a8489f2811fb2b385e0e1323f5451c465cd9a4583a54962f0565fc96c76f0b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Luna.dll

MD5 4c707b95673ae728aa101a36f9063846
SHA1 add3098e9ec7624b063a8650c17156f3693f2509
SHA256 8efc7f7fc9fecdfd8d252f3d9733ee9ace567c5e17f13e85c41c26cd0e8ec791
SHA512 53c46187ce27b018dbf33eb99d86e9acb969455b4c6fd3d7442c2b10cde7db125d46f21e0fcc9b717018c38f48e2f43c61e70512e84e326b6f17f390e35c7719

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.dll

MD5 7aff71c71e7599f4e08ee31bda3d28bb
SHA1 a216417d4b6181d57d10f0e19aac68704780f842
SHA256 5a7b8e44f78d1692f577dedcf94ea29c29e5e91901fdfcde7864abc823432a7a
SHA512 aa9786ab1ebf2a7b798fc8242b539ac7178c108a2fbe53123547e5d4f9ca08b7e7063d66f1c8d49a42d265a7ecfd009b6d5b9b3be3ad452c34ebd8ad8a2c7c9e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.AeroLite.dll

MD5 81e2b581ae7059199fbb61dd1b667c37
SHA1 0e785326bfe2ab4196837e9a74418dbf9150e3a8
SHA256 6615c94bfb0b5b1f26ec3c3be4ac5d3246ae0c643c764340bef221cb727b17b5
SHA512 87e716b488984e41a866b64f4a435fb22ad7efd03de36395dbec638feebc130f7521e8a567921cb53d64639ff3128597553af9804b1d34f51dbb86bbad8618c9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Aero.dll

MD5 18b2b3b757b8b235b1e39b271656bb71
SHA1 7aca3ecc94c46aab519d22a45394880079df4556
SHA256 610e0f741e304574330c1fcaafff5481592c1391cd8f87be4315a6f94890549d
SHA512 cf0ed34c4f0605c4503301218aca240b79cb3ab9f2edfdfb9c4f918659bf742e8d8d2cabd6f2a086612164466f690e345869ddac829ef29c630d58550a29a92c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXmlLinq.dll

MD5 d2608c53f101c2f34d8216066b87829f
SHA1 20bdf9a9f713816afe38108a20b7f2637a732848
SHA256 55a7a4eced97e9a09b7d1e42a865487ad655c3f2c53cbf585d6b7e11a31d55ff
SHA512 be152598b691846443823d7b041f3f316fab5b034e7c68d53302382915f45fa116f17280e8e60acda5863d844e189981b793b050fb6c6a929c3d5f4f84778869

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXml.dll

MD5 bfd58e94029a221644dc56c3f1ebfc15
SHA1 79a56563f4fbf7a9057db9c29b1b62258326aa1d
SHA256 72409843ccfc53f16e14106533096c1b821eb62e896488131b798989d523e716
SHA512 aee522956142ccc02ef6f56e333e088e87d0c12fba3f2e4c933957fcb1d1ab198ff9d5dd28d8505bf65a01f6d855919c9f51ab809abaf8f1cca86692c3432096

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemDrawing.dll

MD5 1848e69aaac0c209e42c1c13856a1b39
SHA1 68a20ffd97bfd0794613b9ce685434bf066151ef
SHA256 023376e4b65d885ece88b408e129b7373f0c7eebcc212e67bb96efd7f008a7c4
SHA512 1a04e0975ce87d0e397675ce87f09fa149a45d447169243427a9d7e3808f7b4d359a26056b796e36b66bb6a38b86622ab5eeb51cdfb47b492f1dda0f4b95eadf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemCore.dll

MD5 fee29fa151c124672863755c3d13efe6
SHA1 261b4c98ff2883569d0529e404f21cb6ae553cd9
SHA256 7a40e83f5b5244d5d3bd17d334bd1eba13f1ac0b8e64d82d3dfede686e944950
SHA512 33e1be2e1d4d19cd3aba05a0bff985efdd521455a5603bc39f16cbe391430da21595c1ccc720ecae815721c08b84fb1498130dd5143c272d250ecadab0d1c80b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationBuildTasks.dll

MD5 87a7f12b3d2858e410aea6a472bf2de7
SHA1 72662ab5c7da20aeefd8b5a5c62d24fa0381689f
SHA256 6a7a0ca6176058040c9fbb4c03fac1a494a02dab5804fe3f8d51d3b36758aedd
SHA512 444d3165d75b1f9d63a4dba0acf8e34c6f685fc1a7cb23949456ab9096474cbd8d5eff62dec9ff12a8c6daec1db36ebbbbaad05650c25fcbc3a9b4369e16c8f3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Serialization.dll

MD5 62111fd97c6f3433adeb16d7f2c95182
SHA1 9d48b5158fa43e7bdd2477978a8388c28e3bfb42
SHA256 dadec3a1d60722ebf34345a3dd1c42e240e49b5ddbcffd40d7c667de04219ad5
SHA512 d2d1520d2787e62ccf3d33aecdf08e039aaa5396ad5385d59908a771f4c46eb35363a856a0102840a49848145b8491bee8fc57fe22363956ddc9e5e98d5122f0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.ReaderWriter.dll

MD5 d7c5d7d690dda3412425e93d2e7a45dd
SHA1 6572cb7899f424ca53d6428cdde7f87ad607999e
SHA256 ae007b79978c6fa618c72b4d5c11bb58bb2334cfa5384b6f8e40f5182f527c90
SHA512 7f6da0787f54935dcb66d3ecb538410bca7f790fbb917adc0362ace4abd6b8762239a685bf239a24c5b85078a92c2b6cf38137be8c0c2f7ceefcaba74758039f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.XML.dll

MD5 9409d76c7243df9c0b7b8b8be95bf57d
SHA1 5537e60df96401df9809ee955bf5b753e92fd68d
SHA256 8f2394a48ef5aef9e87b1b4e1318f39a62d5e2668d137bb5573def8b7d167d2f
SHA512 732f85460f7c35d508d9be5294107c0efb45112e6d1fcbd6045dd7b0b6f8573940f3df5351eb2d456bc517167c1303ccb3f8df045c0f0cc35c45c2e8fa6f2005

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.dll

MD5 685696c9905c809d1e1ba7e36a908d71
SHA1 6db2436f63cc97cccdf720dfb255a8acb68ef2e6
SHA256 a20fe0ce5be7c9fc33f450fe921cd547db21a544f6b5450c80a1b5abe0a14af5
SHA512 546384a0a65952bdeb23b8b6547bdec7658e03ec625a998fb32d5b760e8e2a194d51f5aabe7d0a65fbdbd8531e66ee3ac18ceded8b491bb527b907a4d4c0c840

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.ComponentModel.dll

MD5 90ddc5ddea77eb68b28174d3369b68cb
SHA1 cde426e1f64106b576d85b79ad3ecfe2e8212912
SHA256 601bda48e4fd1716438bb69d86092bd3ebd9cdad5991f430560aaf0a498c74e6
SHA512 2e1be9abd36fc9e95df93352b34a202e8047b755d65e6fd658de661b787b0ef5db4d876eb14c18aa875765bb88b2ba9e311e7f0fe7e2f8c866576b464b5dc10d

C:\Windows\SysWOW64\msvcr110_clr0400.dll

MD5 231f862312efcb817a244468f567f4b0
SHA1 ca802d95ad9f9fd3f0c0b8780a4eb0736e058b86
SHA256 3a118856c0e24160f50a5d79c947f62f8bafd1a85133565496e06ceaf088e954
SHA512 14d049d9807f504c776a3401e10e6003ed0486dfed22f0d5282efaae599bf04132092968e2def14ba1bccfb1800f51fa3651452789419aaaf12035bdb48ed31e

memory/2812-16896-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2812-16897-0x0000000000400000-0x0000000000410000-memory.dmp

memory/2812-16898-0x0000000000400000-0x0000000000410000-memory.dmp