Malware Analysis Report

2025-08-10 14:15

Sample ID 241016-b2bg4azhlr
Target 2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk
SHA256 435815bf9aa9bff43d1714001d0dce774bf1c720ac7fe54652b9c97429939fbb
Tags
bootkit defense_evasion discovery persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

435815bf9aa9bff43d1714001d0dce774bf1c720ac7fe54652b9c97429939fbb

Threat Level: Likely malicious

The file 2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk was found to be: Likely malicious.

Malicious Activity Summary

bootkit defense_evasion discovery persistence

Sets service image path in registry

Drops file in Drivers directory

Modifies file permissions

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Impair Defenses: Safe Mode Boot

Writes to the Master Boot Record (MBR)

Enumerates connected drives

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious behavior: LoadsDriver

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

System policy modification

Modifies data under HKEY_USERS

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 01:38

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 01:37

Reported

2024-10-16 01:40

Platform

win7-20240903-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\sgfp.sys C:\Windows\SysWOW64\msres\setup.exe N/A
File opened for modification C:\Windows\system32\drivers\sgfp.sys C:\Windows\SysWOW64\msres\setup.exe N/A
File created C:\Windows\system32\drivers\YtMiniFilter.sys C:\Windows\SysWOW64\msres\setup.exe N/A
File created C:\Windows\system32\Drivers\netft.sys C:\Windows\SysWOW64\msres\svchost.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MANC\ImagePath = "C:\\Windows\\sysWOW64\\MANC.exe" C:\Windows\SysWOW64\msres\svchost.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Manc\(ĬÈÏ) = "Service" C:\Windows\SysWOW64\MANC.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Manc C:\Windows\SysWOW64\MANC.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Windows\SysWOW64\msres\svchost.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
File opened for modification \??\PHYSICALDRIVE0 C:\Windows\SysWOW64\msres\svchost.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\msres\skin\background\images\xk_02.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\ourspace1.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\btndel1.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File opened for modification C:\Windows\System32\DriverStore\Temp\{4e1dd3e9-1739-04f6-e1dd-82491c167c68}\SET73BA.tmp C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\SysWOW64\msres\LocalSet.ytf C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\config\ScanAuditDB.db C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\riant\ToolBarBack.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\userchange_bk.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-icon_58.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\Rar.exe C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\YTFunDll32.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\protect\License.txt C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\background\userreg.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\background\images\scyp_01.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\repair2.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\riant2019\查询.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\up.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\userchange_01.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\x64drivers\vgwdrv64-win10.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-excel.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\8021xClient.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\NetTran.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin.ini C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\btnclose2.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\test.ddf C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\select_all.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File opened for modification C:\Windows\SysWOW64\msres\ExcludeIP.DAT C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\SysWOW64\msres\ViewRecording.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\dlp\dir.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\riant\max_focu.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\btnnew1.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\svcYun.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\dlp\wjj.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\sqlite64.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File opened for modification C:\Windows\SysWOW64\msres\LOG\SOFTEX\2024-10-13 01-34-13.TMDATA C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\SysWOW64\msres\avformat-57.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\SMSS.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\xx_01.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\riant\exit_nor.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\icon\icon-pdf.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File opened for modification C:\Windows\SysWOW64\msres\config\policytmp_p_port.ini C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\riant\min_down.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\riant\res_norm.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\close1.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\patch_icon_left2.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\x64drivers\vgwdrv.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\VSCommon.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-menu_11.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\open_03_03.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\ufsd64.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\btnrecovery2.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\ProcMon64.sys C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\GlobalUserCtrl32.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\btnupload2.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\TurboDLL.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\images\c1-06.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\images\c3.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\images\mainBack.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\ExcelFunDll.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\swscale-4.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\open_03_03.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\select_fan2.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\vfsd_fre_win7_AMD64-Replace.sys C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\ViewC.dll C:\Windows\SysWOW64\msres\Setup.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\setupact.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\sedisk.sys C:\Windows\SysWOW64\msres\svchost.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\setupact.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\setuperr.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\setupact.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\setuperr.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\setupact.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\sedisk.sys C:\Windows\SysWOW64\msres\svchost.exe N/A
File opened for modification C:\Windows\setuperr.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\setuperr.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\VSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\7z.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\svcdsk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\VSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\MANC.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\msres\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Windows\SysWOW64\msres\svchost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\CHelper\Settings C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Driver Signing\Policy = "1" C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\msres\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{920E6DB1-9907-4370-B3A0-BAFC03D81399} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99FD978C-D287-4F50-827F-B2C658EDA8E7} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\SysWOW64\msres\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\msres\svcdsk.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Driver Signing\Policy = "0" C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\msres\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\SMSS\Settings C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications C:\Windows\SysWOW64\msres\sysaid.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\SysWOW64\msres\svcdsk.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\SMSS C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\SMSS\Recent File List C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\CHelper C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Local AppWizard-Generated Applications\CHelper\Recent File List C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Driver Signing\ C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{16F3DD56-1AF5-4347-846D-7C10C4192619} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{08244EE6-92F0-47F2-9FC9-929BAA2E7235} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\msres\svcdsk.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4E77131D-3629-431C-9818-C5679DC83E81} {0C6C4200-C589-11D0-999A-00C04FD655E1} 0xFFFF = 010000000000000030fd472c6c1fdb01 C:\Windows\system32\rundll32.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict.1 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\VersionIndependentProgID\ = "NetworkCVSIcon.Conflict" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\ = "NetworkCVSIcon" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\HELPDIR C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\VersionIndependentProgID C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ = "IInCVS" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\0\win32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\msres\\ufsdicon32.dll" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB271980-7374-4ABA-B5A5-A5F619B33816} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict.1\CLSID\ = "{2F0B3348-0AD1-4229-B825-38A88142F2BF}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict\CurVer C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict\CurVer\ = "NetworkCVSIcon.Conflict.1" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\FLAGS C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ = "IInCVS" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\NetworkCVSIcon.DLL\AppID = "{DB271980-7374-4ABA-B5A5-A5F619B33816}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict.1\CLSID C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\InprocServer32\ThreadingModel = "Apartment" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict\CLSID\ = "{2F0B3348-0AD1-4229-B825-38A88142F2BF}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\Programmable C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ = "IChanged" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict\ = "Conflict Class" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\ProgID C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msres\\ufsdicon32.dll" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ = "IAdded" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ = "IAdded" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\ = "Conflict Class" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\FLAGS\ = "0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\0 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\HELPDIR\ = "C:\\Windows\\SysWOW64\\msres" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ = "IConflict" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE} C:\Windows\SysWOW64\msres\FSHost32.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\rundll32.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\MANC.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 31 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 31 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\INSTAL~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\FSHost32.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\INSTAL~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2304 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 2304 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 2304 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 2304 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 2304 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 1380 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1772 wrote to memory of 2060 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2060 wrote to memory of 3064 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2284 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 3064 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 3064 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\msres\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Windows\SysWOW64\msres\Setup.bat" "

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /Serv

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /InstallC

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Windows\system32\msres\64.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres\log /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres\log\OutFile /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres\log\OutFile\File /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\Program Files\Common Files\ytcommon /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres /G system:f everyone:f

C:\Windows\SysWOW64\msres\VSetup.exe

VSetup.exe /VideoSetup

C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe

/VideoSetup64

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{450dc599-2441-364f-fff1-d40b359d904d}\vgwdrv.inf" "9" "60e76459b" "00000000000003C4" "WinSta0\Default" "000000000000058C" "208" "c:\windows\syswow64\msres\x64dri~1"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{2520aee9-f582-0363-8cbc-824a0a92a706} Global\{1ada0ee8-54ab-1245-bd58-5b4208820327} C:\Windows\System32\DriverStore\Temp\{2b443b85-048f-5bf8-dfe1-fa7b7b098b5b}\vgwdrv.inf C:\Windows\System32\DriverStore\Temp\{2b443b85-048f-5bf8-dfe1-fa7b7b098b5b}\vgwdrvX64.cat

C:\Windows\system32\DrvInst.exe

DrvInst.exe "3" "201" "ROOT\DISPLAY\0000" "" "" "60e76459b" "00000000000003C4" "000000000000049C" "0000000000000494"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{188ab76d-23ac-4641-887a-04ab7ea61a0e} "(null)"

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /Commit

C:\Windows\SysWOW64\MANC.exe

C:\Windows\SysWOW64\MANC.exe

C:\Windows\SysWOW64\msres\sysaid.exe

"C:\Windows\SysWOW64\msres\sysaid.exe" /QuickStart

C:\Windows\SysWOW64\msres\svchost.exe

"C:\Windows\system32\msres\svchost.exe"

C:\Windows\SysWOW64\msres\setup.exe

"C:\Windows\system32\msres\setup.exe" /CopyeVersionFile

C:\Windows\SysWOW64\msres\SMSS.exe

604

C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe

"C:\Windows\system32\msres\protect\FRSDKTest.exe" /status

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /other

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /Reboot

C:\Windows\system32\icacls.exe

icacls "Setup.exe" /deny Everyone:(F)

C:\Windows\SysWOW64\msres\INSTAL~1.EXE

/USPI

C:\Windows\SysWOW64\msres\FSHost32.exe

"C:\Windows\system32\msres\FSHost32.exe" -installicon

C:\Windows\SysWOW64\msres\sysaid.exe

"C:\Windows\system32\msres\sysaid.exe"

C:\Windows\SysWOW64\msres\INSTAL~1.EXE

/USPI

C:\Windows\SysWOW64\msres\UCommon.exe

INI /ClientRunTimeIni

C:\Windows\SysWOW64\msres\UCommon.exe

INI /SetScreentProtect

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get vendor

C:\Windows\SysWOW64\msres\7z.exe

C:\Windows\SysWOW64\msres\7z.exe x -oC:\Windows\SysWOW64\msres\PacketC\ C:\Windows\SysWOW64\msres\PacketC\patchconfig.zip -Y

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get name

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get vendor

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get name

C:\Windows\SysWOW64\msres\UCommon.exe

/GetSoftListFromCurrentUser

C:\Windows\SysWOW64\msres\UCommon.exe

/GetSoftListFromCurrentUser

C:\Windows\SysWOW64\msres\svcdsk.exe

"C:\Windows\system32\msres\svcdsk.exe"

C:\Windows\SysWOW64\msres\VSetup.exe

"C:\Windows\SysWOW64\msres\VSetup.exe" /VideoSetup

C:\Windows\SysWOW64\msres\X64DRI~1\VSetup64.exe

/VideoSetup64

C:\Windows\system32\DrvInst.exe

DrvInst.exe "4" "0" "C:\Windows\TEMP\{0218fc55-6f49-40d2-8d5f-9413b51add7c}\vgwdrv.inf" "9" "60e76459b" "0000000000000494" "WinSta0\Default" "000000000000049C" "208" "c:\windows\syswow64\msres\x64dri~1"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{57516774-81ff-2b11-19ce-f01262c14238} Global\{0109953a-c35f-02f1-7c32-8e2fc366bb26} C:\Windows\System32\DriverStore\Temp\{4e1dd3e9-1739-04f6-e1dd-82491c167c68}\vgwdrv.inf C:\Windows\System32\DriverStore\Temp\{4e1dd3e9-1739-04f6-e1dd-82491c167c68}\vgwdrvX64.cat

C:\Windows\system32\DrvInst.exe

DrvInst.exe "3" "201" "ROOT\DISPLAY\0000" "" "" "60e76459b" "0000000000000494" "00000000000005E4" "00000000000005F4"

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Windows\system32\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{4247bb33-30f8-4463-81a3-397154705a8a} "(null)"

C:\Windows\SysWOW64\msres\UCommon.exe

/SetWallPaper

Network

Country Destination Domain Proto
HK 206.238.178.116:6671 tcp
HK 206.238.178.116:6681 tcp
HK 206.238.178.116:6679 tcp
HK 206.238.178.116:6683 tcp
HK 206.238.178.116:6683 tcp

Files

C:\Users\Admin\AppData\Local\Temp\7za.dll.bak

MD5 65dee16df82191784797dfc46728d689
SHA1 8a931eb391c247827ef64c8307d0a1b4561ea013
SHA256 cde7464eb0b7885a59a9b5b7444bb4d1a5ae0a5018997b5e90af459c3e7bee66
SHA512 64c2e79699a5018de873d37fd8d38ef7f66fd5fa413f2ccbf28b79ea892b4cb8ca9238004b57cbd595e456c0b51003369d08beedc031a7d0b00a7d840bff085c

C:\Users\Admin\AppData\Local\Temp\L9qmhCrVkv.7z.bak

MD5 329dc54390be231cdc107f4fdea72044
SHA1 226a98d0bf987225e74a4baf1bb7448a7eeea15d
SHA256 34a2e1b2bef5da5bf131aa7f75c4edb2a42202eb1303def90f8021ab780e92c8
SHA512 ee7918357955f5427c6dccea1ed265319c1d437d1ddfddc3af90bca4a4db9bfaa614cca277cb5f6d0b880826eb54d50d99de6c0eface3ccbac9789e1262fb84d

\Users\Admin\AppData\Local\Temp\7za.dll

MD5 bda80d260ee69e6075e68f8c34f328e3
SHA1 b8b0a6b5ba2ee79a3d4e2b2ca2de0c44b92d8116
SHA256 c4e3f8f2852314864b2b51c049c327f399395acf52f1bb8ca18b358bcedb4143
SHA512 7ead2dc0fd89772c49e19897007a682b69c1c2e5f0ad5921a7a9e4278228ca4305318d170bc0524c6b7a495bc8c935dc031acc9546ccc0c35d007fbfe61709fe

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\btn\qhdl_04.bmp

MD5 f40286a3b4a4b549a927abab8fe32ea2
SHA1 4192fa430921c3265a00d5fc9a77ef7e6253ff23
SHA256 192d30e40a0b9592c31e757311e8d9f86bd50023b86928082c49b2b9ee8cb9d1
SHA512 a6b088d4ed41a72c6b74334f1867794cdba24121903530644f19854d5bc034697d98f5c7518a08fd3eb7960521af96e24776015960eb672793c65123e4de4e88

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\max_norm.bmp

MD5 61c58f47c99b4ea32104df13e165deb6
SHA1 282d94b18cb798408e35c3c9719d3255050d78dc
SHA256 c72b4f625082857c9e26f350bf4874d45f0bed0c6ae57cc69e3cba48535469a3
SHA512 9b556928d9ac8ef6135a84e717756bc42a683b937062637fd33313c92da651307e373aa29c77574eccb41d31f28766c3e8397f936a983e9d8b8837fed25bf724

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\min_norm.bmp

MD5 f1f4f94cfc05ca1684e077a74168867e
SHA1 efcea742f13608f6d29f5086c2a78ab2af37e3c4
SHA256 303dccc16b4c9ce21a6d63cd8c89e4a6d5494fc958ab1425c42bbb7aa57fc472
SHA512 2314f354cc54c56a7b0fdf3de04f5463435b197935e3c93b4d7b4c7a98f9669c4e4ab4e58db43346ba209ec2def7d4d211cf2b29bab86421cbf45d0813f245e2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\new-BtnMid.bmp

MD5 e909c29d9f0d08e50f72a809a3d0ca88
SHA1 c3814bfc32ad5912f97df87217c4a9969f02f91b
SHA256 471b4898508f8c209a92c668d28793d538b561d646eb22ad01fe10cd17dda4d5
SHA512 141b97d878f249b6347462231d3b4507cd57d9125e18c0fc443d9ebd1026232fab931384c44c452a5309dc119e5b412cc53d72628d8c818d5688dafd288b34d2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\TabLeftSel.bmp

MD5 2594a024a2aae22b105298d0954e18d8
SHA1 834ecf11cad8986d61f4a06e5a262e86a2503622
SHA256 02c67d2b27a369142b55ef86b8fd2eefe01858a1eee3e1f549d97be5c7d317d2
SHA512 2509578c838f4f7441c39f95d94a6ed2ce8cfa34caee694df8e8f41909df455ba9ec27ee3b91231bd514bdcc12c7f4a52a2a705a12876cfdc014c347f345acef

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\TabRightSel.bmp

MD5 afb692f04d78d4bc6c64c761dcc120a5
SHA1 8bcd93a749b4103922701f26aa3f124b4e8ea271
SHA256 9175f8901497a326ce07ccb15b3ac2959235625dc5261763ed5981285540e289
SHA512 d09b48216d48bd13fbca37797bed8bc90c6c96ff0fbdd191e657a5510c3386508af30e9a9706da109dfa9a8f46febf12b62fb561d5aa54d73a3c7bc0ce74abc2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\x64drivers\vgwdrv.inf

MD5 67fa111ee285b491f05efe2b7aa2b5c6
SHA1 7628efc482e81865cdc4a393a5c9c8908cf7197d
SHA256 dc41417edd4a2819fbbea8f0294e1533bbfd10249df651bb9a0aec0a33ce3086
SHA512 136e4d0dad17efe56ba6d9f0f0a20ea9701d07627b01a4481d9ae466b342056ce01f9aa5095cecd99a105b660bec843f7f15024bd1b9f192a4ec35cdaed85207

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\yundisk\skin\images\AccIcon.png

MD5 fc2dad3da2ea91356925d548f4a8f4e0
SHA1 6c3c0dc85c8305df9a4dbba62e89038b4000ddef
SHA256 15096b3498809990fec36661f9dc6cfde967ee231ea4b18a0d5b8be6ad309769
SHA512 e9b0dc4d81c92525bbfe587523f84ebfc25fb7b64c2a9c9dc1fa135aee0eda0756de94fa1e9403d1551b7ca319cbaab69500b1ee38cf3bc1945354f8d5b644fc

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\sedisk64.sys

MD5 0f1bcf9c6bd8d3bcfc6f0ee2d20d416d
SHA1 86e4b8df9f7a49d3f807b3d251838532aa97e7a6
SHA256 bb98eb7d6525ab575cb8307489ed2b5bde3ba762c7734e222f1c999cff97116f
SHA512 35cb8179cdc5405b60d7526e4d39683cb4c8b45df8ea7eafc0ed802ea00a824ee8a477f4e58e2194e7de15704a4ca1e3645ecff5934eef53c03c3906b751a58c

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\vfsd_fre_win7_x86.sys

MD5 0d836e4f0b9566ea4737f9fa60e5fc06
SHA1 364915405550dbbe0ac9c21569a9525ed3d87cac
SHA256 93223c8c15681ed4845a547867c924c1ca04b72ae1bde60be8a6023613e4a085
SHA512 cbec6d3cf96340fea031554f3111baea968f6f2054cb6324b850be40a31833fdd5d66b6957ba298148a588111689927b3c697a6cea90ced719a9d10ce64a74b6

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\x64drivers\vgwdrv64-win7.dll

MD5 36e921c65f6ffc1c2113ad372c02bbfc
SHA1 e2deb5ee0225a1711c72e8b7574158c77348df5f
SHA256 0ef28a2a79f70b01664470fd345c4f08a3aef8cd36a850a2e58b297c5ff2a456
SHA512 39445c111cf5284c09f2721736e446a555c11e4ca03e32aabb64bc8887a7eb2610b67464f716b6b01c87a01e45c94b0c8911dfb6e2f948381c16b5c89acf9d98

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\x64drivers\vgwdrv64.sys

MD5 934a9fc5468c24331d62bbd1f703d228
SHA1 364a24bbb654fca187e1c1c41e8b2e0056abf0b3
SHA256 2634d8dc1fe3a415ce566101e25ecf08bb94c9353891cbc5afae2a8f16e97619
SHA512 c259d75e578fa202db8a8c2e00e23030d419fc248a70c559acd4bb0457f4fca0cba342cd24e84a7cbade8dda98623aca7fe24b3c5030948b453b57a376cc8f8c

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\YtMiniFilter64.sys

MD5 c7e0aa3a6f1c52afe3a7b3e79b24662c
SHA1 45a828269dc3727bd7983ca4c2ad25c348a8b2d9
SHA256 613b327fcbc283656f9fa7aee5563775dc758ea657b03d22a7802698c6c269e8
SHA512 bb30f40b6f811c2a0a4663525d64af7e2d2656a284619d5648a372bc4f1937f097187fc1b72b11b57ee312f434a26e3bc4272b12ebae4fb6ef733799cde890d2

C:\Windows\SysWOW64\MsgTrack.dll

MD5 52255ae42fe4800dbfcbd39e614650d5
SHA1 f0c61cddaa35765a7c92d336c0bbf533ab82a819
SHA256 ddeba97be23eb2469dd890657e2eb5154c5294dd399fa4ece5b4a0db5a0c5d72
SHA512 92bf52a65203cc6c06f052b9d1ec2191df8479c2b5f7db51059879507ef5c98b7f1f3a663fd32d8bef1f1221d3397e8b37525ae5f96c521a719f5e602a7fdd58

C:\Windows\SysWOW64\ProcMon.sys

MD5 e4d052f5a377debac03a760872e8f013
SHA1 43ef94ab0842d7c1473123a8cb66bac3edd7ae28
SHA256 6bdfaacd0116cbc17386409faaee51e7a9adbdfd61dbc1f2a36338fbbdcbac52
SHA512 fc640b3fb5270f826f0350307fcda5108b629aeb198fa389492609dc8d171fc369343c480348bb0b97836ffe75fc5d48f8a193dd52ee0616503607077cfa9d99

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\MANC.exe

MD5 d10c8018922c211653b8f86fddc3ffd5
SHA1 c5901156b038e87f1a3a25201b9ac306b157f6b9
SHA256 8e8156c5a8be682dac3b5d867031e8d5cbae031ffeb4c0ddd5e5a6b41ca76555
SHA512 b978ef2533c52d1681da613d9668505220c01803775818949fb97a5cfe679000261bc278da854588ef2d3e314933a5cb9b306961be262be64c3e49541f1c42ca

C:\Windows\SysWOW64\msres\AdoBase.dll

MD5 14f1f01a40c663f59caf95e0d44ffe81
SHA1 cb265aa854781ad5f8be604670480f73a4dfe385
SHA256 2a84586c30d1b8101ddd816492407e97c60183301e5b73fce89272fca6dd18e1
SHA512 13d84f8d6417d95d289b9e86533fe2b86882d1913a448978dc8f6874fbfb7c0617c5efbce384ebf50235618a702d77f46ceeb06edd32a5927bba0a808aa6d5b9

C:\Windows\SysWOW64\msres\8021xClient.dll

MD5 a40681338269bcd7eddac97c5549f0e6
SHA1 e48585f27b0a50b056d468cd33754816437b842f
SHA256 9c373efedebc010de1aee393471ad7ef5246db3310fba53147e535833e5a709c
SHA512 60befc5b11b3b6ea96a71cfc8ad9ed7cb06b762549561b1fdb67e39458b324dd0e8157598ee9ed2a8f1aeb04c40e09df5cd68aceaa3bd497e87e293030f267dd

C:\Windows\SysWOW64\msres\7zSD.sfx

MD5 7417e9e3225dc6d8769e05d056fde688
SHA1 839301d5ee0a7e973520fd757edadfcf634cbad4
SHA256 f0c427908563ed7d248717cc1f94fb57a2c047fd108e0395a403d19bc503c5d1
SHA512 1b318a85bbc22f7b7b2e336b7ed4936e61693e1a1706f8a4b076dbefc7aa16c98580df20bbbca9e325a430b4ec810bb65066b2d44897096ddc3147156b100acc

C:\Windows\SysWOW64\msres\7z.exe

MD5 36a3807a11df584777165172c71797ee
SHA1 fa588a65041d8947fa98e9507c69e43d11b450d2
SHA256 26d550366491ee0fe14f6cbb67c9bac55300a04b34e92f973a96d00cef071e5e
SHA512 8d265cfe5abcdb6b627414786763b1b7099e8dee52f79b99e768dfc77995ee1139177c5bc26abae219216d0540a3c5dae9aca8aabe322d737a0509f94d269779

C:\Windows\SysWOW64\msres\7z.dll

MD5 3f78c51a0a5cb5e0536ff63ef3d75e11
SHA1 557e55064b161841da857fc6bc6f408963f82e07
SHA256 4200b6b656c3c7b6447a42632451e2402245815eccd6f9a3baff60585fbb0b0f
SHA512 f4b485a27341e8c163c704bea4624cc3a9c4c8215790f83b290ce59526e0515a3f4a96bb17623a404f42a7b47a05ad6f912d61d6cd7bf6ad370a2004ae7c48fd

C:\Windows\SysWOW64\msres\64.bat

MD5 9691797adcdf7babcd6c31867c96258d
SHA1 7714f250a773647c0c3633103b0f94e202a4573b
SHA256 81b824464c9ef5a338d78dbad2e65101fe6a8dc48de096bd89b0bc14fd5fa475
SHA512 9da92ec73bc350d006b7c6cfbb793a23bd06d8ed6a83367559091c20da3ae7d7e5f6dca02382fd2063f663e8ad96b0d41bc130d1b91d46886d236d05c819c5bf

C:\Windows\SysWOW64\msres\32.bat

MD5 0ce2a43f5762b693678b09c072ea0f7a
SHA1 bdcd35586fc5c51975d65d858c139c45887b22ac
SHA256 e2fe1a6be8388716c83a8f112bfc37d768c638793fa6044f1f74239f2ebc9809
SHA512 5afe3c773585ea01dca106f4f3c7e8b012a4f6ff1a0f7addc6c5a6db83a3af4d0e3d70f67d16f1ae3a5c087dd79b2c14b61d786c826680332ca68317bab6f125

C:\Windows\SysWOW64\msres\AnsiDLL.dll

MD5 2f8e26e74a8abb465a3828ca9855e5b4
SHA1 bf6c767e9e12380c1e2631079a46586c5fee1c40
SHA256 eee55a11f553fbf058d07301bf0a68a000d93288d755b997fa96a454e2f10582
SHA512 aba9abae18c219ce33593b2916763b9b666fadb148a62bfedc0201444fc0e41a4bc206841bb13c7d7b5f232f003e525022278f6ef137325f22fb280ff71da94b

C:\Windows\SysWOW64\msres\AssistantThC.dll

MD5 88210439224cc84faf46a2f79bb2fd36
SHA1 551da3a9efc85868a8d7787921fbea4b6110a1aa
SHA256 1ea78d0a4b16162aaca59e25e516831ae8208da17b6a50f566074544292571bc
SHA512 859c15566f1d4de79d09e22c3fb20ef62d19d39612feb919f5bafa63f216d00e770d4d4873b41a8450fd0164e754d441b47831bea446d30630f3aa7e731d9bd3

C:\Windows\SysWOW64\msres\AuditorViewWaitList.exe

MD5 4f2b063e7369c836403ea27e305d2c54
SHA1 55cb63ad57507089eb9b1579fb631eb3f5e7450d
SHA256 b0525fb84cde0405461a9be559b1875e0a65018b232f6e206b6a8b5caa76825b
SHA512 9ca368d3a244a115cc245406a37ecd44e98219c1ac4c117b9115c1743c446554006c32363bbe73357ea8613f9708e38fbdf24e566dfbf6ac994686965055ef94

C:\Windows\SysWOW64\msres\avcodec-57.dll

MD5 170192d9ddc056cf942c7ecabca8f48b
SHA1 89199875f555531aa2dbf9a0ebaaeed7a9612540
SHA256 fcc27aa0aad45d8b144a0271c744941b7476d96149265d6ac4695ce89f36897b
SHA512 58af3aeb11af1571cf1f43a5f3a67b09247a93f8aa007dbabcf7c55091a71a0874a90fc4195a993ba765d0ef5d70c07a94c26b699b1017fc2673418ba077de82

C:\Windows\SysWOW64\msres\avdevice-57.dll

MD5 735b64f69b9c3abde04cfc87164772ef
SHA1 e15846912b4fe059aa6f45342d196e674cb8300e
SHA256 0e7eb7f0bcbc3a067613d88a9c9d44466de7d6dbcbdf0139eab5a46e6df99a72
SHA512 6c38ee22b3f8260c65cc07fe28d2d358d2952a0a1c10a97877906944fe1df080b211563f137f507d6619f621ca4237b235c64989d163ca40bba0ffc400254032

C:\Windows\SysWOW64\msres\avfilter-6.dll

MD5 9f1842cb605ce27f9c0818fcfb23e50c
SHA1 ada4f136539904054207e8a0a8afbc8eb9a60efb
SHA256 55ce7664f5c572c57cdf9176131610d0ad173f662d8c4d048a02207cd21aeb1e
SHA512 726c09a482b879f042a9c1a88beb3d27511912c145a66becc98d4a2036f4024fb63e98c78b8bbc2312cbb7116fa43b4e2ab81c002df7052cb1b53a298f935b03

C:\Windows\SysWOW64\msres\avformat-57.dll

MD5 d68f601b1f900b4062032d41597aebf5
SHA1 92e14512888dcd9a8eebb6e11e0db6bb90d26406
SHA256 60d37ccace3ae32bffa1bbec6220c5c91b8c41d0cfb851d024016294e70c1688
SHA512 cffbf50e80462ded21521f718367e8abef0f0f927b56b5bc999387d1ef532881388ef130cb685cdad22dc014f10fa50101164063785fe9c75d604be2a3604450

C:\Windows\SysWOW64\msres\avutil-55.dll

MD5 798698d99a114118e5d026624a3e6d55
SHA1 29371ee61fc748ace9fd71c43a4bc6584bc116ed
SHA256 87f4f3c05f1b7bae4308cdf25fbf77fb16e91ed5f476103edc55bd12a4613e4b
SHA512 233a44a4f9592171b84982960858dcf5c34721cad6e4d29782932a2511bf5c841117e1b2788b00953c430717ed96e728ed4bcca5170d74dc30846668dd1549a4

C:\Windows\SysWOW64\msres\BeginLog.bat

MD5 cb1fadc5ee3bd2aebbb3d18458ef3dd3
SHA1 12b5fd4f26db42df49ec11c2dff87b3aa0179002
SHA256 ab36cb3e4190c25a9070152eca55a7d4deca4f8c893b6753b1bb45c7a48145b8
SHA512 b5560efb652bb1ef60930b0bb3c093f7bd55c99651edaf64c660c6e5a5bfc442cafa3a7a2003ea7b5e618072e1321b19b4cd0f3d6afdca677f4c500229436c27

C:\Windows\SysWOW64\msres\chi_sim.traineddata

MD5 4eb930bcc52867e79c953fc0fe52bbde
SHA1 3960dad0d17ece03bc8de3aa6a0cb86ca9a57984
SHA256 a5fcb6f0db1e1d6d8522f39db4e848f05984669172e584e8d76b6b3141e1f730
SHA512 384895a4c6f6c523437e2f934f9f12c96fb42aa63958ff6473d04c79f6ce919c46412f6c0143c0e061c0198e9c4d9898b6734f7f18cfc30d427b644f0a089397

C:\Windows\SysWOW64\msres\ClientTool.exe

MD5 f5e8931c754192b85d4b4c9f1b2520ea
SHA1 3a6d934ff332fe4255937c564584346fd52d574d
SHA256 ee482c148f573cc0f7dc4aa3e83eab262db7216e3acbde6fe1e2e7f291f9a1e8
SHA512 1872ab36cd840663f0fe46e08f42074f7d673c5d6bb7513d2b7a4a6401fcf316f81a081174be6d6e4ec337ebef5bafe5391e6ed24e050dc0ea8c93259d607b67

C:\Windows\SysWOW64\msres\CleanPermissions.bat

MD5 cb5e28e0aaacac4ab0a23afd8c57ae78
SHA1 ee227589c6faba9017341fc35f82c21ad3927ba5
SHA256 1fea25eb2950b3726c6dfc21b25a44a78ea2e3d47565b11ffb877659ab3436e7
SHA512 778193a29f056847195625d8fa5ca56adaf41efc4feb00c6c02c133a1991d28121a02ec2ee44f19ca2c9dff69104e1d3bb6b10023d8ee8080673a2414a683bf2

C:\Windows\SysWOW64\msres\CJ60Lib.dll

MD5 5e9d3bb28e9412d1eec451f96dd0e947
SHA1 824eea5c3493bf042b56948addc5c02aa647941e
SHA256 c1a060f44e8cc5d4dadc67dd22799ac6c3a8c7bd7d01273e6da6d250e2e6ce80
SHA512 c7df4315ab7e290bce5ef0af4d147073fff267a792d4c670b990957dee8b2573e1033795e865d34fd9cf4f3d763bff7477bf1f0cc2f23e5cec6c021f93160aba

C:\Windows\SysWOW64\msres\change.dll

MD5 f4c1572e081e8855eb1b332008f61f5b
SHA1 9c4e09f67c5985940b90b41e9c0970e6fa11e73a
SHA256 c3d4be166c848b7e4eecd973579ab85311f707548fd2cc1ca0de6f894ed937c4
SHA512 ed6007e9ebcd3674281335dcf24fdc0833b7c1f2159f2f0c7663cc61075c475fe7e2728432030bc152855a768313521ed7d5de202c6d9392afc65bf9d5dfe926

C:\Windows\SysWOW64\msres\ComFun.dll

MD5 84023c82183a94eb051bb222d998ac55
SHA1 b0cfdc27e4509b1f4292649bb1f8be61d953005c
SHA256 9626af0d5dfb63ac4797130bc8f1cff54b8ff3bffb1e9ce4c5b52a9932f7eb36
SHA512 0e69c19073dfd237b9c060848dbb3c436df4a297f321057b5cc6922c678bc79de685c99c6040fdcf246bd65f6acdf4d42823aae0371f1c128d2109e4566373f2

C:\Windows\SysWOW64\msres\desktopDuplication.dll

MD5 5b8b7efb1e496aaaa72057cf672dfe8e
SHA1 1ad4b600dab18ab10c7900c70031d629e70b025b
SHA256 a7b4afb3f0dbe6eae4129945d8bc4d22a4721b3014a7fb7b4b2cd403ecb38416
SHA512 0214f48123b532dfcc92b8f6fab028c28057081186f8c6f68cbef31ce55a28da85416150a853ab18df2b2192f210fe1a8d76575f5dfa327ac469d493f476f8af

C:\Windows\SysWOW64\msres\DeviceManage.dll

MD5 aaa8db2ca01bf916fb7708f00be0b8d8
SHA1 674c8ac41bbb140b0783e5c2a1b64bcb2382abbb
SHA256 92ef2741c29618daa2e188a016f4f7bfc500f601c0b6ca71be754260aafb0142
SHA512 f781b02459b2b0597eeb85e07efa0bd00238f3e1b6d23612859e259874edde5cea785df2dbfcb22ba790547f4022b333dffccaa8b4adf6582fd170c1d8e09e38

C:\Windows\SysWOW64\msres\EncryptGUI.exe

MD5 8e13aaf3ef3870d90484d4d125c9144f
SHA1 7f8fe7a05da81413066ce4ef6000fa3040733791
SHA256 799d02851e8019d171f187760310f498ef6e212c3a84331f237c8b6f31842a55
SHA512 3605ee2b4a287cb62e99e6e9aaeb80b8c7fece8a0bb25ddc6e6e4bab4b4ed49db127f179592375fa3404c3cedf6abef91f4adccad5168510800cffda36d49bd1

C:\Windows\SysWOW64\msres\ExcelFunDll.dll

MD5 14a7f3c1ae5e7ab3f8eb95ffb4959617
SHA1 85847ece52253457ace1fecc327310fe9f9fcc1b
SHA256 c09fa3a3b7de322132a2b7f417568738c5549722ff5afbb51f710684154c1262
SHA512 38b6bb67deb2a7a4a29de0c634dcd2c3fdad1bd87524f68f4db040d8495703cfa3fc263c99521948e605f84592c60110c597c420d9aa1f340516cce73bf234af

C:\Windows\SysWOW64\msres\FileEncrypt.dll

MD5 fee3a36b746c86725bb707617f363a43
SHA1 c84b3456515b207e556155063727c1613d35e891
SHA256 b1dff7a1202f0d0a45e93280551689666ec1546b5fa469011c8de9721e1c64bc
SHA512 3499c1cdfe2d71d60e422d6d308190a6b2c381235ce2171469c69e9ec75913a4cfd26b90a855f9ecbc2c10374d76302ee78bc07f83352403998e6f01046cf22b

C:\Windows\SysWOW64\msres\FileTransport.dll

MD5 d51ce31187371a8340b4d33c0571ed5c
SHA1 95a5a737dbab124285f98cffb3e69d0b041439c8
SHA256 2b6ce275665dbce73c6a7b83233c3c04a69fa89b116560d10ba9fdc618274ac0
SHA512 0b175454e287e353021b3891c7a02db04466e9d3f15cb06af9db179ca3b91d5d25aed1c5bced67e643108408b363f139cc70a60bea6e6b48fe325daf15c5b530

C:\Windows\SysWOW64\msres\FSHost32.exe

MD5 541d41703971ed57fe2b29d8f41dd09c
SHA1 c28e9408a45b9f3b3639568f4a05a6a2b986a10a
SHA256 529b0c0daa3b32e02e92d2d76763508544e8e7eb2f0124872e3d0adec4528102
SHA512 94433f45c2e05e080a2258959515d9e000abe6a0e95d103db91b0bfd010930e9a8389b507ae0f6334fb6b65e87b27130a3d16b23da7bae85d9dd97f5952e1ce7

C:\Windows\SysWOW64\msres\FSConfig.ytf

MD5 d5a3a02d1fd8a43c8905064fa9c1cc2d
SHA1 cf2dce40595bcb48c8a2b299f6f3aba83d3bdc5f
SHA256 2d48b2e56236f3f915e3c9cc4516afd8be10b3512ac51f025aed496c6abc3378
SHA512 b5ecc39150647051c2eab431d01a32a7eba0b81684f11e35eda8be82978f190e2b36cb000389d39599ad555496c56b5892b4e386a0feb764527ccd92226f5d9d

C:\Windows\SysWOW64\msres\exit.bat

MD5 67ba5ec790f53e1f481b68492bfd8688
SHA1 eda057cd4d0b5f111b02db4a2deb114918ff894c
SHA256 37575840eceab458fcec26803083b60405054b26924c84668e3a8002619c17ab
SHA512 c2594f14a1f49063913ca437d8c9f984fa5129ee6ef54f74e1278a50ef54a6daf3ae813272efa3dd35937e52e1207785584a47824e5d9a5cf94b49fc4dea9988

C:\Windows\SysWOW64\msres\fxz.bat

MD5 afa1de87daaa01e7106093bad89df0c4
SHA1 f6d7fe53082ba63f61e552e4238279cf88876be8
SHA256 39e9eb45aee17681d0ac3ef5d9599f028a3ebd4c41f82bee4c6f0438813c5400
SHA512 d93be67b2b8beb4160014776d7edd1e3794e086d14cbeb9b27b9f387a48c7057e8daf5eb2031bc8da85a85d74752f93c5f7123251b3d663e8a7a35e37726fa91

C:\Windows\SysWOW64\msres\FSHost64.exe

MD5 25f13ffbcf41c0d71b884944723fb804
SHA1 c80bb883966bf71c4906dfc9cf3989fedf7520ce
SHA256 f66a17bd793919f5427a1888860b102446f85ff18530bface26cf49420f6b89a
SHA512 1c2ee196605c04b953cac96b61cd2901a8e07ab833eeb0bc13e34fe9f8a39405077790f4622505aea09d77311ebdb34aecf7faf9919c750c7be93f39a2bf3c34

C:\Windows\SysWOW64\msres\GenEwm.exe

MD5 b7147748dd23b30455225d1f524c8379
SHA1 00d7e08788e2881540964cfb5583af3729623037
SHA256 e1239180e1c8ba9210ae0a5d5a8f6ffd531cdbc7bde93723de69d657517e5d06
SHA512 8ebbb47e62981b8ff131583129e7ae3d422a33b98108383294c2bf41987a6c606ef4e4c8e5248d4fbdee8341917c60428493efe144af43f22088b49ea9e799e9

C:\Windows\SysWOW64\msres\GFunLib32.dll

MD5 7587f2cd023e467109904aa777ca81ff
SHA1 d7c556f59d2f68c17dc78f8105bb17770bd4ad7d
SHA256 ac3434dddd73e45ca49c1df6126ae933a7dfb1e7551ce9c252259e5086ac5c66
SHA512 8611353335043b7afba3a817aaa848662edf71593d88003448af78786de9d482dbbf7b091c336291f9c530b8578debc8ff413440948b06a6b29b5c4949dcaaa6

C:\Windows\SysWOW64\msres\GFunLib64.dll

MD5 6409466cdaac9468d09bbcdf03a4bfa6
SHA1 8702c08905ee543377507d5eaf4b16db7d4ad84c
SHA256 c1e723f58169fd4e5499d0d750bd2b153eb8bdc0c1b451b39f290cc33c314edf
SHA512 c8d8bd18b20aeff83be4f976810982d1e7582704d237f84e04aa6dad07893d8dc9a17710436fa2837fda60c1e99344486dc8b751c66a5719d301bf807f97f18a

C:\Windows\SysWOW64\msres\GlobalUserCtrl32.dll

MD5 fc178a9f3d4ee7405d1c60310959b1fe
SHA1 ce58c5d2fe5415be1d2580b0fe718716ca3264b2
SHA256 489c3f7081f6e33516f15070b07e24d0891d3604de146aae57f78e062f6f9d52
SHA512 139426ce5746ac00a304af7ec15f206388dfb4d977e0d776e18cadc57203c3dd1680bf6e3a040e1fb219b25237c6128adb86e606f7e6c55ae5117373a47635b6

C:\Windows\SysWOW64\msres\GlobalUserCtrl64.dll

MD5 ceef5e1ae1acc1fb566b791687b291f0
SHA1 1b79620ba874e5e6f489c1d0c213f6551e00562f
SHA256 eda254235f25345c78e854dd1ce88360fbd71f711c6d714b55eae160b04abd6c
SHA512 7dd99ea5f1fd1cf023722fef4db4cc1f08a0861b6c494c0efe27f410e39ad8b151758d80ed63838dc6b83914416feb3cb6ce8d8e4c7f43e99510aeaf84aa93f7

C:\Windows\SysWOW64\msres\help.bat

MD5 ec6fed19c0f0215e9a9f82e475eee04c
SHA1 9bccad279f5f7017f5689f11c9e4adaed6d08132
SHA256 72eaf1d0ba948f467fd98e85883aad933957167640e6a1be74a79d3e11ec7f6d
SHA512 011bd2f0582606b19ca605920e6db1e5343837da50e8401cf4212eb383b116c9dc92d439b68424344bf68719dc1f09c98bbb21ec6aa1e03b7d0f7c1a582acc74

C:\Windows\SysWOW64\msres\helpformat.bat

MD5 e166b2b921db985f0c02a5f5690c32f8
SHA1 0c048123f7a93b884f2b93e1c052c62f7dc3d22b
SHA256 956873d9b0fffcf73bb8a7e5c9586c337d9524862393fb286d489c4d1f009e83
SHA512 1373e9b53ca850e56a17ca5e077c28d6b80dca0a5ec1d530986115db461b3387019dd4f7ebf009a3a3d7602e7730731a78648405eed643818a8baea9dc58ddfe

C:\Windows\SysWOW64\msres\HKSock32.dll

MD5 df7e15963d3c675b06edb8b34d2f44cc
SHA1 8771c796203e9dc19821c0ffce697ee7228c359e
SHA256 4bd453a2af713299a7493c749a35a52d24b10238d0da1942a07d54214b1cd085
SHA512 8f62cd5450224c054df5fe6d60492b4eca21c1adcdcc5271545800505f3386dc67f97ffd067b047b6714959f93fc49c46af99f3c7c991f4f570c1dabdc279be4

C:\Windows\SysWOW64\msres\IJL15.dll

MD5 edf2f50f221de6ecf3171efc598b2d57
SHA1 0fe9530ad895ea6ecc87a784d579ce0736a52661
SHA256 85969ae1d3c51dc21f5431a69eacac07e8f2f891acfc298e8dd41988fa38786e
SHA512 25d9546706100d7c7a516e5f81e77773a231717353f850b98f69b82660e9286ad0b62fb9e56ede5568e13c0982e4a19dc7aa63a6d19fb56030b3a6174ccfd27b

C:\Windows\SysWOW64\msres\ImageLib.dll

MD5 a58bdf7ff96b2087aad3b23608094d6f
SHA1 a1f4be21079fc148a3dff4f8f90d5adc60819dd0
SHA256 2ec996d57779ba2a41c5b78a1dbc06791b8d6ca03fc269206d0a03a6e3842728
SHA512 4e77c62cfde3e616e00d9ca230a90d3bf0a38638f4c3e59e15b429f5d95a179591e8d4d9239178c16c73718b7cad8118b80d89537c40d12bd0691c9f19334399

C:\Windows\SysWOW64\msres\InjectDll32.exe

MD5 ec6b0e127eb520a2bdc89e974bd73d71
SHA1 950051a12ca13a65d7f1be70939072ecf569d0d0
SHA256 1ce3915be07d472fc6fd66cba5a467e40c295b9cd8d56ed391fb2b37d41106ae
SHA512 12343255eebe58e8076759a1573e790ee8bbfe477943ef4c83736ce5861ab307cb97d580b28ea413a74b0e69f710a0f68d1153334c86dbbf563d94f452f06280

C:\Windows\SysWOW64\msres\LanMap.dll

MD5 78b649accb64fc9874f56e322d4eb206
SHA1 4781b2a89ec1edcd69f12df1a4d93dde2e374dfb
SHA256 ea65c4abdedce21905668dc8198cc7612a4132482a17e0dcba9a533db426d711
SHA512 782821f0d0ecb0549d2f9ad318280a850c5338ca5d7f4b0fd2ea91b290c32d741bf15d0e927b1addac018b589cbeb85d01b1428c41a3b33f0664d1cd1128b884

C:\Windows\SysWOW64\msres\LocalSet.ytf

MD5 4dfbade0848835450716c514c1773917
SHA1 192f4ad8c335594d03707dc509bdf7d779b61509
SHA256 bc9760dd52c86d7d9b26fe92c27f334fb3b25532eaa186085fd171f2cdee116e
SHA512 4acf0fade5f85c7e22177206d353af29688ca304229c11156888ac85cd81d418e0bc868464d68f6be9e6d724afeead3d2de1e6c476a1e8e0c5dff0d4c76460d7

C:\Windows\SysWOW64\msres\MFrame.dll

MD5 1d1494bcdf9f582a99a1ede1ddf498b6
SHA1 82798d3fe5fe069fa83dc895e54de283bec3c661
SHA256 4a7cb2850c50857e3014238c9176a3c65d5b6f38cda3a52f1987378894f76b8d
SHA512 0bbffb9409fb8eb41cd09413e58bda45e420f9be7ffe346b9dc124de0f14168230422e1f03de0f467fd74b4ffc03ecc3c22b2f8f0f1a29677abc736e9c11716f

C:\Windows\SysWOW64\msres\mspm32.dll

MD5 0d81756f820830ba5a1dfd4d9b4423ef
SHA1 d9b9807e6b2acd95923b18daf6c00afa3eed62b4
SHA256 ee0983a48b032db76f18535c23a4a12f1facbe57a07774473707bbe4d9b54bb2
SHA512 01ef964cb28f7927610894be01d83c5f20531455de0a6c8d85e61aaeabf828a09de76e798ffd6fc9e667e2357dc81360acc33dd39770eda60d6b358f14e00ab3

C:\Windows\SysWOW64\msres\NetBase.dll

MD5 615978b04fdabf69eebe80caa526188b
SHA1 1624a3adec3b895101e2706ad6df5ff82181626d
SHA256 c02d4143e20bfdf2ed11da972414e3eeb6f4f155a34e336aa3d1b5f0075d6b8c
SHA512 2e1cf411de46d2b4a0137397a5820c9d0ec18ecd403f2b6e2cfccc9f6843ef57353646b171e529ba1d3e03c753a9a7e1b753a42834a71037a3e86cbb8a13926b

C:\Windows\SysWOW64\msres\netftxp.sys

MD5 ed591cabae41d55e2e5b3c2acbbe3f04
SHA1 a93386744c9a9fd481ef2993053c4b15cddeb57e
SHA256 e019f34606cf878e6b0a2f568673ca302936a8b949cefffabbf024b8d88136a5
SHA512 09b33d49e6ac030b1e2620cb22d3e0219dddd97767971c0014e5efb37bfeb04c0e30527fbad2da85d1a8fe5f8b1c862ca4d5b42236f88442b0f6179473a7657f

C:\Windows\SysWOW64\msres\NetW.ytf

MD5 31683315c930c53ba320e316e4744fd9
SHA1 4f418fb1f4353fd8c5bb5c68fef3caad32450d51
SHA256 d5864001f2eb922ac579f1cbfcb3dfadb1216ee43550f3955218c2792bddffae
SHA512 f433069a382e1b47436576167628bb8c84aeb2743ad006310f1a9b68242bd55371c43487de7afa8e131f5bd3b6deccc950b4b440356eb526ca1e9f52f593de98

C:\Windows\SysWOW64\msres\NewUIShortCut.exe

MD5 54be12393fca842a33f070175722d59a
SHA1 6c90afd8ceab16577fd5d34284177b1ee5a687f7
SHA256 fa9403fa3e02b39575a9e65b2a8ea5aa3c57acc6cc7153edc663b11334d1a20a
SHA512 d97582146485e42ee81053c80da4cf7d48d45141317e946c73823a63070a2d4481ffc429838334aae9e04bb21f249e836c69e4d73d9ba733ac8640d434614803

C:\Windows\SysWOW64\msres\postproc-54.dll

MD5 409be8b3004e6b3fc9c02c0194579ba0
SHA1 e8c0a324e8ffbce5bc87fffb0650f422260567bc
SHA256 72351bdf4cbbad4f9dbb49db4d05944a78e4c326e812d70f6f5b2380e5253121
SHA512 a8dfee8ed5cc079b4bf4786195b73c0cb67509c8e1985e6eb6c06bf8a5ccb0b2f92865d54be033c5f5d16774b12a6e8404c603fa59990cd1fd6af06f3e3a9227

C:\Windows\SysWOW64\msres\ScanOfficeDll.dll

MD5 bb6e51da32e9ca85fe7d5d9c5aeff5d0
SHA1 904ab1ce0348c936e97cc8eceae655ce0ca6db8e
SHA256 4d90dd390f2fc2c345011c690066898409243e39d3a72e2aac2baf385e82e508
SHA512 e89c66588b40158b2f79621365c4c071444f4b88cbe699b42145f9b11b0102e54e1ffb5b27fc2f7e9cc4861938a8fb03e2c5c8ae94212621d3877a96e84f851a

C:\Windows\SysWOW64\msres\sgfp.sys

MD5 9235c4c979623ee498ec49af36cb4d7b
SHA1 ab33a64adddd19fad18d8bb1478880ed1212e28f
SHA256 764ca705469ab9ea4fa11d25886a6c40d1c14ec1bf7ae0bb6e025d53769d2119
SHA512 7aba69d0b4b231c8b5ec4422a8cfe7a803b37dbfb1efda0b442cfd356ed57d301c787c84570b57ae0fea006357db68d840bc3aaf2c114b3e89fe7215af01db70

C:\Windows\SysWOW64\msres\svcdsk.exe

MD5 338d4704a839d4d4aaa168d68f2e0cbd
SHA1 b284ea3a3c127aeeb68656b5e9c6371faa8074a8
SHA256 0f289124de7cff4558565da42fbdeb74aa3d525150ce859785a64a87afb41f84
SHA512 39f6608ee4d8a9c255273b1c3f2349b673c7def25f75cb49243c3c4745116e1c1d56bdd2067bd4bf596e096b748d2b728a8eb314f682915cea26cac995795ecb

C:\Windows\SysWOW64\msres\svcwtr.exe

MD5 b6f5f1518cf246b8bf4017077e97b502
SHA1 03cdbfdbc55e8f6036dab47af8dedd04790e8575
SHA256 22aa5e3e2c4e64c0f01d74cec5b92c9ca96eb60a3de0d8e8dc67474a72d952e5
SHA512 ff349e10fc8c0f64f4e4f6300d47813b0b2c16a5311313725628a03cd4a94c4d55cbdc6cf50c921c736dfbc05b60094c1140a91fda339fba5db7f11c434b6d3b

C:\Windows\SysWOW64\msres\TaskKeyHook.dll

MD5 55db3870c4346302deba0b3e90c92a15
SHA1 0160cb1afaa02743450c125055047d3b7928000d
SHA256 bec77506c9b95aacd2703d45d2767141c5ec6186123c2817537c77d8a9cc7bb3
SHA512 6fd08dfe5369954f102bbd1a3e1992d16a44332a3a96ff63ae7f5c424a8ec91fb60d0ccab3884664783a3af4e99e63302cb33ecdaa9d3144fcfdfff7d263f28f

C:\Windows\SysWOW64\msres\ufsdicon32.dll

MD5 3a7adc5b176da8d2110b743e0de17f64
SHA1 b2631f9bf25d27d8efcbeda08226e8ef1584c0d0
SHA256 677719900cc390a67097b433deecdd4036c39a79d92b2ff1fa1717cbaddd1908
SHA512 44b8ce92a254856d5b25c274c8cc4f1e353c329ba94a480f8cfbf007523aa03862b20bf85ad2bc9ae764464b6178952c301ea457d1658be9b49afe908268cd3e

C:\Windows\SysWOW64\msres\UserCtrl32.dll

MD5 41adc2a37fa216b9f2c3774ce1987a8f
SHA1 25d2b77df9e4a5413984e9a7426cfa0be7c3e87c
SHA256 97f9c7be68f97091660db56d1813b9a561d9f5e87d8b1f08e84f4fd8ba5f2acf
SHA512 72277edff74ab3e9b084d33f10673d0c7f34c37a5ce58c0cb19f9dfbefbbd8993a23f79953a289e0ee77569264bc02fad17185b7a16b659cfa7e05e8500cbe84

C:\Windows\SysWOW64\msres\vgwdrv.inf

MD5 60fd4032c9a1f4654df9a7e8be7d50c8
SHA1 4bfc55a4609bd452731e6cae54b6fa61db446706
SHA256 f1579ab34267a69494303ddde980fad73e309bbc15645d0a511d4cdad7aa5093
SHA512 4a7b191667064d3fec33658f678b8537e928f66a8f25ef8a43153fbf9b6dbdfa052aea78173f186099e5b3d21af2d84c3552d22a8df3399cc5436cae4d9c2f29

C:\Windows\SysWOW64\msres\YTFunDll64.dll

MD5 102274f4908dab25069c235ec0b311ac
SHA1 7d5ec17cadca892ab2f6c235f14e1faf43e0c38b
SHA256 7d2f08557153c9b37022c3dc2c0b16d651967ac1524d76ad6c7250be8fc8106d
SHA512 68a03f6e14231aae464559f15d1790a846011616cc171e56c6b94dc021166e699792ac2a0f2b11b95af01227e57626ad294d082f4e67cc45df4e414985f57805

C:\Windows\SysWOW64\msres\protect\Detection.ini

MD5 1b5e768a8bf9012730779655ffd45335
SHA1 3266191db09c40124b52d93a4f958ab57f9404fe
SHA256 f2de8c5418cf7c6d13c64b50ce6a38ac4294bd57f4c44ab02e059a35e40bcfbc
SHA512 b0b163f1b4fa9352165f3cee848384d273c4a7658f1d73bed522eb3f1408cb4df454ba2be9d799b7c5c6c0e8228bcf30376670830feaa0f13e2b719881a6179b

C:\Windows\SysWOW64\msres\skin\background\seachnone.bmp

MD5 463c35b53a10307fc361a94e5a4e42cb
SHA1 d1c4420c5168b3748ef39983fd97bb1006742f39
SHA256 5d6e028134e8c16fdc8eef127ee6f504b57853e4e37c7823e074585a5f9a52a0
SHA512 02c8c189d86ff9a27b1fd654fa469fffd8b5ccdd1d1c74e3e5b9db06e20081043e2db1a9704a1968c5cfc0e96e71715e74a496b1859f9dade7ad31f1d6c7ae5d

C:\Windows\SysWOW64\msres\skin\background\images\qxan3_09.png

MD5 e3d1814087385dc89fb5e2c255c9e859
SHA1 87a19b8a43eacb603c5285c80eb9d41cc9fb6301
SHA256 974609a4238edae2007588b6e9509a34ffdc2abfa07d32cab5871e9c5cc80051
SHA512 dd68665d6fbd09a7c0e4ce8b32325b1afb0afeb14043790bcbafc1f9166a63e8cff1751e3864957b5d3779a3b1959e8973469030d2be9227d1e7231611c581d5

C:\Windows\SysWOW64\msres\skin\btn\btnclose3.bmp

MD5 74cb833ac4dd0cc8a58457b400fe0fd3
SHA1 4bea035be376ad6e1f459562fbd7fe2f1831d23e
SHA256 a3defb3d69e2723df06914d054e45dbcf22a3c36964eeca84f09115cbdbbe6f2
SHA512 d186a13e25f5cd7c034ab384e61d3a1e5cc0d3f3d9b440a96542fe2d03a12bd3ae0bbe2f00f818a17acbc10ccd58cb7a47b8323772118ae81d26761d5ef5e052

C:\Windows\SysWOW64\msres\skin\btn\min.bmp

MD5 3a84c43ffc7a64495fe7cea2c5db2944
SHA1 bd309fb479a7a7737b9a947766771ace11f0beb3
SHA256 40074c619b4bf8669f5b22608876d5cc96d8d738a7f2216b9f2ea74e89e21642
SHA512 cd6be896b25d92c6d8d87cbdc0097189b69eb0ce98d0b8a4209f6066ed8b1279a97855c7626e8135ea28e5cf59c475d9ff82f9747feb2570f87af229ee174f0a

C:\Windows\SysWOW64\msres\skin\btn\qhdl_02.bmp

MD5 f01d748114d6300eeb9752b1a83b7b00
SHA1 9c37ef2259a07d15cadd1c722a05e9967b71a4fa
SHA256 54e44f9ea378ae94fe757d3b3512297b0a44799fbb6be899f600cd13538592b6
SHA512 dc1cca0dbe187a6a819507a889ff04990bf958ef8b48cff509bdfa21cf46a981049833fab568b3e2f6425aecd5e009f0a16b40f19209fa96dd2453f0d8c78667

C:\Windows\SysWOW64\msres\skin\btn\userchange_03.bmp

MD5 6bc5000890a0df120151f350c82a89c5
SHA1 4108a9d46cdaaa4f1faa4fcacc7960679112de08
SHA256 ab6a2e10f0c8262d784c1b2f408279577a3c79ce4c29a1b762a831c9d220e362
SHA512 82c91af78fbb3f0fd2d5022dcfcd5c324e039878ae870c46e73e00176e551e40018ef6fe9305be12d3a315c65a0ad54b22b5be4d2bb0a97624a078ec59ca2f31

C:\Windows\SysWOW64\msres\skin\dlp\yundisk.bmp

MD5 c44cb9768c85d7d5116f2fc530ddb95f
SHA1 faf79d9132fe0039976686978e7b05a224d99dc2
SHA256 cde5d1ad909187eaea434ac6180d75bc8a42b73d2e749d600e8207df480ad2d4
SHA512 b5eaf79ba6291971049d3dabc7a50fa4bc926560313bb51898ea1bf3e36d3ebc11b9969eff55a2f725dd4d2d1287e8aa07f18c14ce9eb4ec8ae91b62aedc5468

C:\Windows\SysWOW64\msres\skin\icon\p6.png

MD5 76e42446b24afc1e0afaca266ca3f13d
SHA1 168fc362a0e12cb93833ac1ad390eac342d055b8
SHA256 fd0e97811fd7d73812a1dd1a3e4f66f7e9953708faf906fb8f0c6d784067027f
SHA512 3d4ee0dd3b1ad5658c1871aea7ef8eb81357c4d38b80962136b38ab53e0a524025bcf5d678acdcf43847b48b8743bccbb73e53d689582dab2bc78fe8828080a6

C:\Windows\SysWOW64\msres\skin\riant\new-BarExpand.bmp

MD5 d8c3875896af1f5ce511851fb5e89b63
SHA1 a01245710a1014b2d0eb3ec258cfc23c696c15d2
SHA256 e93db47e0310db65f41a49fd3e978c5140a15b76610f636bbae61d7d93d1e281
SHA512 99bbda261dd8cc20b7de5d4dd84917a753610d91e87b8293f201df9286c880b7d9d58fb988b4e8f6a8ebd079bef4be5bc9da9716a2a309e9724bb339038ea594

C:\Windows\SysWOW64\msres\skin\riant\min_focu.bmp

MD5 7d097be5f7336ecc11f3e0f9e75b8234
SHA1 55b1e552075b01a2f0d84374bf5f16df1cfd98a3
SHA256 c3226ccb0f3d57e255c66cda6671d1cf6eeb18f914b618805c393abcc473aa1c
SHA512 6fccb4276cb690f1b3b094af3982fd9cdf59a714ee8560b3f4c989fbc68e8cf072185e0e0334646b8477936107916d7fad903ca6d7053d15b64f86062efd5d90

C:\Windows\SysWOW64\msres\skin\riant\new-cancelbk.bmp

MD5 f21d1d73b2ad2f293975fe746543b31f
SHA1 e444a3eb5797b5c545cb9ddd28cd16f77261ee8a
SHA256 708c65d53651360f75a2a2d40409e77d0998c5c1dcbff4e14a6511a7351b611d
SHA512 d4b88f1f9f316455523d131a07ef87dd3d9e79374dfb9ae9f32b584cdadcc72cbf078babe2bd4f4f82353a33ef0d9b72525e3ce77903d05cb5ac5dd3d8a74f5b

C:\Windows\SysWOW64\msres\skin\riant\skin.ini

MD5 46a320e23b0c0e12f72f9c3aa5bd22ec
SHA1 f1f6c2000a3a69525417ff80365401f1e2543c30
SHA256 a12f7b0a03a5c279044281a7805e685671887f9bd01e1238c99dd57abf3ea957
SHA512 cd3a064bc078da673044e185082a828cabe7c53f44a35b209fdac8f0deaf9e82bf0a5e52a8f0361f36480ffd60827a23ca79f85e887a169e92e1c6bbceb95acc

C:\Windows\SysWOW64\msres\skin\riant\ViewBk.bmp

MD5 ae85d00f5df8e9ea1374442dcb86be62
SHA1 ea8fe77ee26b6f4d3f188c77faaa6e6997e84198
SHA256 837bf8d4d5e6558fb60a8991de5604c9af21fc6820e5fc28d7b92f5e901d2781
SHA512 6eb0ae6feb007c663a3de5de92f9ed97fa0034d8d3d7b644295995581a49259d21fdc7c74ca601052fafc4de868e25100c867bce609399e32fefdc94e0edd4b4

C:\Windows\SysWOW64\msres\skin\riant2019\qdan_03.png

MD5 bd6a522fb26cf39dbf1027325ac697a0
SHA1 b299fd0a7bdebbded94da25afe04af0833e5253b
SHA256 7f358dae2392108a94e769aff0f5450b6d2303c8b17b69d411936e76f8649f2a
SHA512 b670fd1f97d690c104027c2e999f42353f22ab68a057e01e8264ffb0de2605d978721c2a457ada03ed91350f6cd4454246340cd704cdb3aa1e5f9cd15c9fbd34

C:\Windows\SysWOW64\msres\skin\riant2019\选中1.png

MD5 08a9e005c2b3c33f0e8dabe1834e66c5
SHA1 ed1542dd5a6cfecea735bd5a98d7174f7ae84ef6
SHA256 f2c482e6f6e8c1c877c10246394ea44d6727f85d04ca73dae14ba49dbe784283
SHA512 39cc42e79c747bae4828172f41ea317f838c3239da85d30470c5e910d16094f75a8948a9d5c28ead8d92b23e1d385f7bd3fe27ea391034fac2f67ded02aeab63

C:\Windows\SysWOW64\msres\x64drivers\netftxp64.sys

MD5 648ec4c1b056577300ec5315678a563a
SHA1 c61f1053a2c994298fbda675f73b2b4670aa11c4
SHA256 bed732c6dba1912556d7255c856eb682477a831435d9569fc97ffec47d749c9d
SHA512 53fdb3f752005b8c41b9733568bae40a3c3dd5e69a7d1275a95b114efb66fa6622c73d3a02c0bc3d9f81f78719b2f2bb7811f977770fcd9e444d506f738cb50c

C:\Windows\SysWOW64\msres\x64drivers\vgwdrv64-win10.dll

MD5 c65dad0baae86cbcdc3b15bb1cc87f42
SHA1 9fc585f8e56572b096188805afb325ba2c913abe
SHA256 ddbc012a24a600cd0f4857b304f122ab58b6ad570ee1cc2022cdd8d51d712cdb
SHA512 7f99c646dbe121db9785b9408c9a8c993d447c3549f574e3fb8635a729d38d56ee9396e82fb0e1ad8abdc9610c4af89e700a57c4085aad3e69003ea651ac53bd

C:\Windows\SysWOW64\msres\x64drivers\YtMiniFilter.inf

MD5 c9bf1ae355048620052ddaaf04cd6888
SHA1 9575cd9bd445597837b825bc582e4c4a515a0ce2
SHA256 9d43d0d5f3832531247090dd5825ab202dbb457e371375ea67d2506cb931ec3e
SHA512 3caf1cf74b0f4b6872b3101e0f523960a6b6e715fb56e310b0ac6d01d0903c0c73b28ef8066b9806ac5cb9738a5b98c16d1394a0b811f30452ec68cfa50484fb

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\vgwdrv\vgwdrv.dll

MD5 af8b9fee15b00886ca491e56884d08c0
SHA1 3360df18e0b2b4c9ff4efbcd3478f160b0d0ab56
SHA256 9db8d6ad565354f58534aba14456373f4f9c26283c48567ac6e30d55e99da7b0
SHA512 f83d839afbbea7d55dfbec7ad8f908c6955e229346ed9aba9a808c58936e35171247d03ed389ab34904c3015984cdb19c0b9a4835904e64f205ad444958823a1

C:\Windows\SysWOW64\msres\yundisk\TurboDLL.dll

MD5 dbb89a5d2795b338c7be376187106927
SHA1 40e88a5531462eff7dbe55605ee9d8f914f69d17
SHA256 ff8a5f18c262d6aa9452a910ecdd7d361ee8bdaacc79283f5ce263bf97b8a7db
SHA512 4b65de7971da34775a7bf13ca3617cebcc0c3e7c1f7b2c0d9c3a811f6ed7a89bc18b18b18cfb154e3e10a9e054523cf86ea5e0457c842fbf3598845ce2fc3c9e

C:\Windows\SysWOW64\msres\yundisk\skin\btndel1.png

MD5 b768089722adaaabc3f0d2f4df93727a
SHA1 7d2b678f334a877257814603a2437d49c6cad092
SHA256 96a9a82d4ebd6a30cf27f2f103ada253abda38780209e122d40e820c8e3acffb
SHA512 9227dc272f516f1563d9e38c0cec8b227378b614feca40f198524b9f66442acad78780adef1332ab7490ef872cc692c0f34d140648f8919bf4977c883c2af710

C:\Windows\SysWOW64\msres\yundisk\skin\btnnew2.png

MD5 a3dbf3f554079b53ff96a642a560077c
SHA1 6b1384440bb5d7dd43f050cc861faa5111b0e061
SHA256 6854bb8aed8c46f11414e00c934ec2a1d48242fdd05940d33ab5fb1c8b1e08a7
SHA512 bcca62778588e78c972d5e06d7d766c97276892f9a729985d6c1d698c49f6930284ed7d5876b31b1e70a6884340fb7e5c9c2c1038ef575ac8257ab2c04217531

C:\Windows\SysWOW64\msres\yundisk\skin\btnsearch2.png

MD5 81473fe5d3c832d1315f0fa3b77d0e1d
SHA1 774e71325520a910e16241749e870b07c071a907
SHA256 3c6125d35b77d74b33a14cb947283987afa03cf12a0b396e63479d8c92f8cae7
SHA512 810462a2359aa504b649266675cabe7bdd72a245854bbf4f8081097fedd0a179494ec904395b88a2a1ca49598156736595b3cb483d840f6aa28c21da3d2c8be4

C:\Windows\SysWOW64\msres\yundisk\skin\btnupload1.png

MD5 395473cb0d88fecb8469e8896dc34d55
SHA1 a209551ebc30b12357eaaa8c2ff24547faf67fd2
SHA256 9909313cee40e9e31e7f9635c61c1df37f8bf7477a4c222592808ee6429533ec
SHA512 2fa42d51f414fcf650b8a4e0bc1aafa2e8525cfa20263839490804ef05b9ccc8f89d6955b19ee0497178c850b3a901ebed547da5df1222c5bf392ba5c1884bdd

C:\Windows\SysWOW64\msres\yundisk\skin\btnsearch1.png

MD5 3153f9ae0b43e82a491f9fbe4c8bf66a
SHA1 28841b33f4da242614fb116c3a081eb885914cd5
SHA256 c8962ca32730b8916c74eb8c4bced1a6310b77c6f5ef6309603b8c1836c00dad
SHA512 e42c74825170d9427718c2cf6138ebaa8067311ec032ed079c5c73ceba44c355a0a98b3fd17cfed72aecc3621746c553a0cca8940e243ca956e7073ee5e43f2e

C:\Windows\SysWOW64\msres\yundisk\skin\btnrecovery2.png

MD5 e89951e19dbe34e3e3c5c041ee2b0500
SHA1 6fe94a2c8b007fd6229d7670f4d295440ac6bd2c
SHA256 6c78f01a5ab00db1ccc74aeef9545a0a9eb842b9378d9dcb0b722645b39b8917
SHA512 ec4d487cc3bd885732d7b1c9b9a614216e812ccc0493bff2be92ff38e4b2a6f6afaef3811b00ef08a968627995e9a233ce9d0dc0a69c7419b89548de59774cf4

C:\Windows\SysWOW64\msres\yundisk\skin\collect1.png

MD5 8db8caeb6f280471df45d5dd9c90beb7
SHA1 3d3de60eaaa71e9ba76456c76ba8371d0503e2f7
SHA256 aa31e8cb1a63bc2d55d46875352688a297e1cc648082034002b50fbb51018823
SHA512 4b97e99ee90bcd9ad2325993a3542ad5a4fd37ce6f6019429e5edfe1ecfe7e02c7e5cd7959b32005a2a6e060afe76bf670ce09eaa27b4cde8ac503c3776eb3a9

C:\Windows\SysWOW64\msres\yundisk\skin\ourspace1.png

MD5 d0e53260e7afef9f02c20874c0d45984
SHA1 08a6d18a7734de62a3dbe460849600f42bdef67a
SHA256 46995dc6fd4055c57cd98064b904530317ab8d97e15e0b3fb126548d6ffe6f9c
SHA512 1c083bce35143e99de4e05589c3c0a0830b39865a9caad8e8f8e8a9a679c8369bc4675c9a9b7dd0b2685a718ee5abda5b014b332e8db2342978298a73e79cf3e

C:\Windows\SysWOW64\msres\yundisk\skin\recycle2.png

MD5 5c74e6fe9478ab705e7d6e79cce0adb0
SHA1 595ce6ac3140767ea7e3ad8681e499afc3e4126a
SHA256 85c5b8096b2b3ad4006e730afba0922b0378e014877feadd607c9a18f3f2fd36
SHA512 12adefb79a2d3bc6a79cbdbb916ad631abb61c340f048ccd3e6de57f8e7075b0c14b5eac0f9ff7ccffab01995b79b0d76fa47fc8a998a20663e50450ceedd117

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype15.png

MD5 b4ab8bffbcf0b1fa0cda5439cb03c5ac
SHA1 50e069c357ef2268cd7f26592ea1ef7d1c69fe54
SHA256 58fefec974bc6fc5ab359e2cc771972d0851d199cb18742bb5a2a23ace489774
SHA512 0c2cefc1700d837f5bd31ce53151e229fa83b4b79774b68196131b695f54b509b36864373bc6ccce17861322e4b31f6dd4ba18ee2c06536ea9e2a3bbfaf8e2c9

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype43.png

MD5 9f682a904efc9280949c246b4c1905c9
SHA1 e4469a625887e591ec0916d656490b17cba77338
SHA256 bc27f02d4b2522a1c1d81fc855541198355825953bab30b41906b584993e9532
SHA512 bd441651b0809463c2c08f3ee4fb398083b72ae0a60015b1695631c9fbcc1ba6079da2f3210e32d84e3978eb0a0a43f9da8e0e654bdcf60cac680f82253db4fc

C:\Windows\SysWOW64\msres\yundisk\skin\images\accBkg2.png

MD5 721f4595b5812ce44ef3fa85b9837b8a
SHA1 7eea8a934921c3fbdb1b4471fa19152676b6ebc7
SHA256 658e046bef65469aa4e36582a3eea2f0bd0f65f014ab028ad6ee14eac975d44b
SHA512 675ba730ed95c6b8217dbbc6155397b379a5a20333530d00480c7ad18bcfe86787cbadc0f8a0071c857800383248d71aa32c21c57d86d15a75db5e780b585d31

C:\Windows\SysWOW64\msres\yundisk\skin\images\c1-06.png

MD5 6b62639549df77036dce9101e4fddbf2
SHA1 01df5b237626e4590baf7e5dfa0bfa3c9469027b
SHA256 82c1645e1b55e1b5c2964d556c808523b12e58e86ae87d59ea30c158576d2bae
SHA512 a510890a90478ae2f189b47982fbcda622ba39eec0af59325750c67b605d38dce8cf146cc6053a2c1eaeeadec3ddab8da6ac9a046cd6f44fbc38a1519e1bcf7f

C:\Windows\SysWOW64\msres\yundisk\skin\images\c3-04.png

MD5 71b0309fd965f4c350bb67c01f2e3744
SHA1 0d15ab1ceea1ef0cd58692d5bad890c8ac5be53e
SHA256 4c006f3e6ddbb66bc4f0189fbeb91bf31f140b6108d00b059b5357627a7d4d97
SHA512 6bde0327befd980d3aa9d33e9a5b59dfa56fe28261f2a70be3b5148bf599abc187be20406583c0efdedb79eae1f98f7d6cecbc0f42ddba2997e0e59e7216694d

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-menu_11.png

MD5 c11375c454f178fa2bf908b1959316bf
SHA1 b80442738428024f86027ec950ca0bc92f1d1042
SHA256 37e0d8839a0e011eae5387185ad8cbbc04b30f5e1f58b0ec0ff74f8fa0c2cf6c
SHA512 3a920dffc8cc97a3661f21ff1d4da93219aa033834eb1a1ce34671bddd1918b8f6f5291ed8f85929752558c73d0b539ed7af9ad4996c31fc6f96f1c7d018c4dc

C:\Windows\SysWOW64\msres\yundisk\skin\images\yh2.png

MD5 a084ff95bc7d3528c4b5d9a26f9cbb64
SHA1 0b335b75e5767a8c97cb33795c8bd6539a0a547f
SHA256 638e0fb95095758bb3b147e8d0444634be6a69e1beb78a42f3e49aad4e5c3738
SHA512 07b0ecbe24a3a18de0de31153aa81ddcffd15b165b9ba2fac120b1f9541d8b0925ad33b706250441a50954e7e55a9b8cd5a2d1343c83d307f1e29cf4a3250e90

C:\Windows\SysWOW64\msres\yundisk\skin\images\yh1.png

MD5 f6136fa01c0f17dc297f377ac6c9c3fe
SHA1 50dee26b90e6a2f34fea6c3af18c99f2bcde97c4
SHA256 b8ab9b753e9096669bdec5b9f7b9aafa3bce219413987f678fd9687017f6bdd5
SHA512 3792f39cc712befa3b42d9698204a17d213a0b468729031b19db8ced158c6e03eb04b05f6a48ddc2ee5aa8bfd8b3b906f9b122ec824895cf1e6e4b3f89c9dce0

C:\Windows\SysWOW64\msres\yundisk\skin\images\modpwd.png

MD5 b33470b08fb9a37db4cb439a75420095
SHA1 999e56dd777f2f5a5efd6559921cf100e790c136
SHA256 7afe25581521b8bf6f02aa36cfe504b8f3f6ae43fcbddfc178659d73e84efee8
SHA512 229225665c8a8a3a6d03ac961982d4c09911a70a1506e2eebad4f0d3efe4e5250d6f13e359c55b8e91b35e33502da116c9e46f158668465104c16f9105e0509f

C:\Windows\SysWOW64\msres\yundisk\skin\images\mainBack.png

MD5 a809110903cfbed72168f8c131d9ce57
SHA1 dbb872793bd262188fd32a669a7bbaebd331ade0
SHA256 e2bb274f566570bb96fd286d29930722b91521b5f6eae659731e471ebe6b06b5
SHA512 9c5be95354d91abb9917560c7bf5fda14357379eef6a53691db1572d372dffb339ae5881d8b063bf5f9d6b309c0a270caea4924f863c7d4137704d9a43f2f457

C:\Windows\SysWOW64\msres\yundisk\skin\images\logout.png

MD5 608710b97e382e30634c61f1ee0bb983
SHA1 a87c4a1af92cc9dabcec054f4a3f7047d9cbfb2c
SHA256 cf70ad1daa7279f7da7619fbd1e75a605d5395de9b225aedc840dbe6d6268e90
SHA512 f0a9bb2867ad20b1e918e32009fa38d5ace8c4f55970984cdb119e70dbc7402047e171c851a15e999516eee2a631f7ca0a637647bc38263b5b530d6c004d4bed

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-menu_11-02.png

MD5 8a41f8b3ef3b41a3806263769b62cd34
SHA1 850705192c903ce44e0b41e8b599bf4830c7ab6f
SHA256 714c39cca87965f9db8abdd0412af0a7a2d8bb1067c8a5d416c6f5fa9f057b89
SHA512 7377bc320869996f6f7e7be15f967e09eb3becc4b216422c1e0bb78592fd37273788e274b6d55e8d78ba9a2345faf5fee86b125504e13fb718d8d4f6743234d9

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-icon_58.png

MD5 5388212b9efe20e2a23458850eb1190f
SHA1 0ea7b0a67446533430cd4535b32965e3711727e4
SHA256 9a5408f63711e65634e0a8148a698561b4beea31ddf0bd6d07c074bc345ff603
SHA512 2645e2c5f0fa3c39b6ec97de5fdaf42b1709ccc43f0c332b838bafb3fa2b61f33d69aa959dd2aac3d51363cfd2734b0db796441b8c6e34a6d58ae47fc9edecc2

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-icon_53.png

MD5 919a1ff115e9d6fba630cb04c747a5e6
SHA1 eff09b8d6de0be4d134e338c53d9eeaabbb47c9e
SHA256 6d7d0b60ec375d0d06053f319f1b5d7a6487d9a4be46ce1ed2bd0e720b744a57
SHA512 cde0589a9e592200c23f660f5439873fc9a4e30d283305d1d58193d5e261ed2b74f119ae2e53822bc2c93fba84a5603ad298e07310e4678a95ba72b4802290e8

C:\Windows\SysWOW64\msres\yundisk\skin\images\c3.png

MD5 a920fe7e4290878054b946a7905468a6
SHA1 8eec943205f58a2cbeb4b46a2a05b769193ae322
SHA256 dcc22524fce29fbd8549f2a1a58cc8fdcd8fea3bfba8d0cfb20f31664fb295ab
SHA512 828e55b6dd3d499b1b9eb26812e43b818e68e7c0473cbaa0ff4cfc54a082cdddbb8e0be8e43def2dee323806b2cff7670873fd103864edc51ab6d4b3a35689aa

C:\Windows\SysWOW64\msres\yundisk\skin\images\c3-07.png

MD5 7acb5ce2861e12e38c179e76333477a1
SHA1 0cceadd416626cd695c86285e768a2b258ad4849
SHA256 8b93d01d49666d1675922465bc4e5ceea22fb75ee5617e9d028afad24945e804
SHA512 ce7e2b300436f19a2ae475fd605c42d2563d095f7539a4298e558172d7ccb8bd005995215312dacd75c543348eb194f6de9cf6c0712153408e413db63be71644

C:\Windows\SysWOW64\msres\yundisk\skin\images\c2.png

MD5 d059203d853efc6360c58fd895178c0c
SHA1 439557cb0ecb6c2fd66a79190d9ab65b8af20786
SHA256 8ec8f7881043a5c23b79cb49af6e6a9fd5fbd81a371dcba2eb337f1e2e8105ef
SHA512 f1b08739917f6ee9f27556f5cb2efa7269e6409ff194eea86d4830333f6e05a786662c051ea6e2376d4d0469861ae06818e1f53c3416b958d6c65b1449ffe909

C:\Windows\SysWOW64\msres\yundisk\skin\images\c2-08.png

MD5 cba085d875b0ccf3611220ced1d3d74d
SHA1 0aea5b6aef91466577f4015819f303e2c71817b6
SHA256 01587185c260c24e0cd9e5b50a4973a6031b0a9a5a07cb0b89ed3d49a05a8d9a
SHA512 5741fa8c1cb3cc3e3d7ad8558f25cb6977776156c412ebf54d9d1d9051d4b337272063b4a56407bf2ec208cce39bfa3e0deaf6782295391b4a2034ac0fda1a60

C:\Windows\SysWOW64\msres\yundisk\skin\images\c2-05.png

MD5 0c8803b187ead9f2b7c45fe9093bebce
SHA1 82aba777aa18675a6e08d0d4b668d1435c421f8d
SHA256 527bcb0957d60ea738bde19448a0f1c37431488926220df9fe77921c8c1faa84
SHA512 9e8654896862d98758b08e75c51c3cb8983db44966bde6e4a2d0eb7d159306d9e3618cecfe40d29e4655a3e49b0914e7dc9c086d7c9b1de8b5ebe2854610db3c

C:\Windows\SysWOW64\msres\yundisk\skin\images\c1.png

MD5 a827595179a5604cfca4ac7dc5092850
SHA1 630df0259abad4ba37a9213762bd2a4de744a54f
SHA256 4bab0f2a81e639bbd1d8fb7138ee39032ad830eb757fb5d6cc9fc38f3e0d55b3
SHA512 c51385b82230c22b4c0070a495a9a8608f7f4e26772072107f89a19ee5f0893e264a5522f953a4c5be710a37af6b2f45f5880f2542649a428bf46a507d8c8201

C:\Windows\SysWOW64\msres\yundisk\skin\images\c1-09.png

MD5 6e4bb82925b6a5763ac32c6a8a517142
SHA1 e24ee14ad64f635688e487e2796def3360eda2a8
SHA256 5b27fed80ca7bd0675fa002e22ab1fb676876cd5aba67e7fe9e833bb94b780c9
SHA512 e8a5426f3c810d72e19195fd88d839e9d867a80a9a03bfd192d2b6d164fd9e05f2ed99da58c9e66cd0df263e553c0a89c94e8fc9afc7778ff899517774ac4c17

C:\Windows\SysWOW64\msres\yundisk\skin\images\btn.png

MD5 d69d49f1172ea8a26f65a21d5b5c8886
SHA1 2d035ef76f9a72f84e49a4efe79eb7330f4fc46a
SHA256 9ece0fb9a7cc5aab19462973bee7cd3911f6c1a0c4885b2032e85f4ecef715f7
SHA512 d5e7f5e3c0f91e24b7d8f225062e4b32ad8eba61668c60357008d6cf2f5922661a396dcfa8cf088ae38034995a8fd4e8f3cde6a29de311b920d259279f42e297

C:\Windows\SysWOW64\msres\yundisk\skin\images\btn-24.png

MD5 361532bef508941ab4426ec4dd7010c4
SHA1 10b90fcaf96ed5a1f4f2b11f05c6169fff243f18
SHA256 b6b7e4b798b3f7f5343fce34185cd25104260778c867808be94388f280f0cbbd
SHA512 588fd78bd5d26e3ac9b3483103a88b6a873a7667fd29155325cbf1b856b3013ad47a4dad03ccf49ba99ae5a947a1085f6722cd1c7ceec680c10a9e473066458e

C:\Windows\SysWOW64\msres\yundisk\skin\images\btn-19.png

MD5 4b4783428657f2037f993869bdc3ab66
SHA1 2f1cb20b92e2cfd5666a0a00869fd3ce3e449d71
SHA256 281b441ea3a31fee96410a7830522ffde8ea552688f080ecf23a39703b20d977
SHA512 c3a75691cfe9634d448a4731cda7af05878137a8d645229191012fbd618fe588ec3647f98a38b6ab1763fdd6c3d7c71c0f128d8fa06142d3b4d6e915a5209f7c

C:\Windows\SysWOW64\msres\yundisk\skin\images\Account.png

MD5 a15a623599d960264d2404b2d9d6ace1
SHA1 469f6376d1739df232d009150afbe05643e1cfe2
SHA256 17b3bf2e22e78df4ebca1e326e7dad0dff7d03511239a01b41f1ae81fc1aff0a
SHA512 148c9172e7c3241b1cbe0a69552dc07b3ef6012e1aae7c5d4645dbaabd2fa1e99b1b980e062030d05ec5a036fd2b55162abb5580e3f69304ebec06de053490f0

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-word.png

MD5 38076e19c710742a9706e5125698d934
SHA1 ad6884a97d069b560399bf88e141c6b745b4a85c
SHA256 751cc3a4c50021f324c8c8272d897afa16b33efae56bdfd0948c630c14eee8fe
SHA512 65ff06caeed56c8061ed821c786ea64834c04d4a0469bea6d07f355a8b8a46a16a545d99574354a48ec247d1f12b57bbb91492ea7f6c3fab23f636d460054ee8

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-ppt.png

MD5 fc91447360ec71fcefd301af13c75e06
SHA1 e5025db1d6ea0280222c3ab31045404aaf58fb56
SHA256 070e52863eeada175cf250b4d7ea15e302006f0fd252618bb9dd4e920cdcaf78
SHA512 5da1f8e3c7adb24719acc7269078b85a2da5fcbbc06ced16d9af38010f548d8da80cd32e51966332493378ef75510968406b2f145eab32be1aa0747a37db1fad

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-pdf.png

MD5 bc4ac07b70b6fa26d0cbcd5df224d128
SHA1 a1b8654b3b034d320bfae9424b38d88332f36463
SHA256 0d2a1824ed13f3ed4154ed6ae02fe53eaaadade0a9c20c3efeaac09be1f3cae1
SHA512 715699a7ed18ad2d9330f3569c2dc9bd46a611af5cb4d7bcb9e2f792dd2479afeca9d008cc674a5e0ce96ead933ab5a4714a01d8bfc11a4f014b028ea7ea6e1e

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-folder.png

MD5 4d06cf3042032c2d577cb232cfccb83c
SHA1 3f5c9aa1af1bdcf5de3e24c6cd6014ae56a7d16c
SHA256 bdcf0c2ad71973558455c18f8913a4478c19dd863a47381544f43ac6ed2be68a
SHA512 1f69e7607347dc21d50d254fd71c84a243c65f91f0017725a88994d55c07054bd928c16a0b421d13b3bff7a57ef47a479fd7b0436203f2705b8f9289553c65be

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-excel.png

MD5 41e98816204325516d7c3a2c4a41a377
SHA1 1109c8114bd3ffcc81f49f26e48c3c2634c3c7ae
SHA256 214dd341132d5d5419a56a158092a0a175b3e693187be38e847f8fb9ca9a3e65
SHA512 b04347f8141f0271cc078be5bfb33db463089edefbf25384f87c4342c7b71de7f973d8154583532006b0931867a34b376ce5c948e8930468f10ebe1258660fb9

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype36.png

MD5 2ea0195db9801a7c5175dd32920a2a9c
SHA1 c6ab78993701821470db780298a3abc63b05d1d4
SHA256 afb7d15669147f14864d7cf0b35a58aa73a9a178d44dc5bcb7adbcf768dc3981
SHA512 b11fd3472cbfeda1296ddd08c347f152b85e8fce3440d70b41ca0c6fb859026cc14f0c8973982ea9640139efd56a45ec8944c53a83679d712333c239aa6b4653

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype3.png

MD5 390fecefe786908a2290be42513f1a0a
SHA1 e57fb63e8d2b2670d5acc9248eaca2c112ffb31d
SHA256 11f837facf92d1888f9786c12cef5e26c1e6692b4577bd1b80d8737240618323
SHA512 794347b587919b63c46f83155cf65c60cb9a2c203e55cb2efd87105514b37f6cad1c93c6577c59ca79fb5b59c54e01cf5c21c86754d1488d892778194421d381

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype20_1.png

MD5 57fb50bbe97605fbb856d687e8aca9c1
SHA1 41210149c7b7b27a111e7a47e100a5c71d1db0ed
SHA256 41982417a24de7fefad4cb7a075d05e7d611e7c4a400f688147cbf3114b1af25
SHA512 e2803de78143b3198202922b5b04171af18059354b49898f59bc7ba982fa49fa1a27723611d65633ca414e58116398b22dbf7512bd216237ffab51d7d26bbd6c

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype20.png

MD5 c4e24db9fa4de7a5b55a274831a8b0cb
SHA1 299578b28b77144e054e31ad44f777c6a97b3336
SHA256 b6a601f2062eaa3aff0bc4199594bc3298599eb194b8b3c7970d2959b9b42b5c
SHA512 e5b4ee572bd2b8bb858f984891126d2e0ebab858961799cae8fcf79da026a63e0429133f40ce74ab8811b0caeeddd5e51ffc0dac881d380d7e6689e1580f7ad5

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype17.png

MD5 6e25cf599166eca44d1dd3424c2579c7
SHA1 dc4a57d4aa4bf8b16644b188b121df9572766d55
SHA256 9296ca657dad54b534f33c31e2411a5880ef0dcd1f43d5042a4c5ba04781d886
SHA512 647a02227763fee6afef6aa52e787de8b98fae2df13a7a8b0d53998368b966db5ea0ee9dd5333b9fbea9b37523b59d362823dd03df4b785117201bb52c88e4ab

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype1.png

MD5 391fc72fc14b6f70e67ee4cd08048649
SHA1 45428cbb4cf2b8ef44df4e64e1fa5b1710973f31
SHA256 2aa26139b57a7012adb2694e57fbeb1e999faea213be5ad7801843917fd4b39c
SHA512 aa44cca5824ec93ca62b17a979c750c59c8a9cddfe6f77187f86626cfc1e05524c5cff161c2c2299ade1c233923501ff4022b3a002aa4cc3b2504a1efd366d5f

C:\Windows\SysWOW64\msres\yundisk\skin\Thumbs.db

MD5 cb8e4405f998fc143e156483b746b0d2
SHA1 422ad7577656aa1770d32a4ab07feaa329caed42
SHA256 2062e15136763cdb6c24cec7a2346fe90a59f703612aeb5d3ce400fb4a686e22
SHA512 30c3095cb0a50a068a53de1ac64569441e67335bf2c7b25b9cf7e93bff332f43cf56e8997631c02f8a189eeac845016040a5ff8605d71df5650964ff373d4e1b

C:\Windows\SysWOW64\msres\yundisk\skin\recycle3.png

MD5 f572c6e90d4af616241c20042b7aa6ff
SHA1 8ab6138848f7bce60bada316490a989a8bbb0807
SHA256 26f91bebebf59e2c43c1fd415ccc3d11a63adcb420899a0a576b13d67379fe2d
SHA512 cef03ee72ed76c8adc8ec47545ea4c6bf8de413272b558d06bd401c0fd662842295463ca3d713866bee7aa22731fdbd2447a380ee3a963106ebb838cfd968445

C:\Windows\SysWOW64\msres\yundisk\skin\recycle1.png

MD5 92a8e7d79c595c9f5fdf95152f08706d
SHA1 d70de623434ce9301e814cd44a15a37658c2a567
SHA256 40d5b8c1c5cd4ab0969631295a97addf897a1fa4e219dd31314eff1825f57858
SHA512 75af0be9f4045dbfdbbb9431aa63e9845eaa887d38c79b7df99fae16ab3dd8ef0bc6d2336e9cf7f178ae012b1a544c7497c8b0639bc0c9ccc34964e85c0bb357

C:\Windows\SysWOW64\msres\yundisk\skin\ourspace3.png

MD5 6a9d2f8f8ad2c3225174f920ac7ad85f
SHA1 fdd038bdc6212ddbcf88795fe9d4752a603790f2
SHA256 ed0bf95aa91b4a4de028d110c140eb5772b8af71dc17d57e9dfbc90102814276
SHA512 ae604d1a00197cb7018c799d59d00a1b99967d83563c0c22732e8d28ef261e2d8e5b0b549c0d2f8dfcefd5d33a34af4ce6f8332bfc7b76ad25346d65af7a2f78

C:\Windows\SysWOW64\msres\yundisk\skin\ourspace2.png

MD5 fc5c98411443cbbb7cd3af312f12147e
SHA1 c43271abd004b816778f60bf44ae06dfd26e8cdd
SHA256 d0105b6c3ce113f797b3c677a1e270edae7fcfb59342946036397de76a1ef26d
SHA512 8dea9a1a365ff286e060d063a6b776154146d44773f96921acc4e584fe4c39791c58737ec3aa505a34c074ffb35449688bfbc7e843aa70f97cf768b8b7719ada

C:\Windows\SysWOW64\msres\yundisk\skin\myspace3.png

MD5 53379362ae99f9ecd091fb56a2fc2228
SHA1 1d8a0dcafa2e2d75979e85328749be0d8f5975a8
SHA256 2b6388ee8d7fb00718176730b43911bdb9f427122192b2abbebc8f8e131ae6f2
SHA512 a418095a54c853331b5dfbcc5fe541cc05cf55371e11d51b14fbfe6def48721a043df07931b706704c1e3bbc4b3b0ba8c5ccce5de2f203b6afde4b7d7a4b519a

C:\Windows\SysWOW64\msres\yundisk\skin\myspace2.png

MD5 86c5663d7a128672bb5a129bed7190d2
SHA1 cd08c7bca66f463b1f5b5561994fcf5114188035
SHA256 a416f3040e345dc8abb160a313757ca194b2b7ca0927f1172784bdf5361818fa
SHA512 c703fad692bb0264a6d48af45cf4e7f9d54f87a39aeef6967d95cbe5f2a7d96517817be77449b76251b6410002ee83c09265f64363f9a42aa944dbb92260f31b

C:\Windows\SysWOW64\msres\yundisk\skin\myspace1.png

MD5 56877e120f717c6ea311e59c4ed3480d
SHA1 3ea3819a19a90307bd8a05cb43ede12b4d819c00
SHA256 724cd6175fa1ddda7b7fa0abfd79610f00cbc816a24990fd9302e233e1993873
SHA512 4d8f09ff83fea8ea9632c2d8ba77fee8a85d421ecd280ced8e55a120fb571d775c905f61a54e2c63b77dd3da619f0df5a97e32ade47831359bdd097b7d9ab8be

C:\Windows\SysWOW64\msres\yundisk\skin\myreceive3.png

MD5 d83b67c008f1a0b2adf7371f7cbd9130
SHA1 f2dd9eda02ce1ed280fb4579c6af2a66d57f67b8
SHA256 ba62e9dbc1daf96a2b682d1e51cd2d3a90c34dccec787959d083d53a566bf7cb
SHA512 b9a546490a7d45e5bee4ad572d71677b3130cf75f3db18e8ec81b9ea696fa8aa8602801f492e38b7d372df811ee55ebd8341881a831b0b16c1c13dfb7df2ac6b

C:\Windows\SysWOW64\msres\yundisk\skin\myreceive2.png

MD5 64faf4a699e0323ebe03b1bc7504c19d
SHA1 3c24b2bbde105e4c9e2df7c4f214fcfe96fc0704
SHA256 0b1774374bb3dab92b68079b5f990ba5d9097fa1c951ab054c0046724f80da56
SHA512 ba9f76ee9a8c6b16e23835d173bfb26d969ae5bedde64d3be135e1d8dbdacf0c4c0412fbe9a9abf7f4e85604fd441cd2f0b343dc2534c0afb814571f6717461e

C:\Windows\SysWOW64\msres\yundisk\skin\myreceive1.png

MD5 aeb1ecce60f04c6a00872bdd6eba78ec
SHA1 abee2c40af932c7b7135d208f64989494922396b
SHA256 30aea50138eef92ffd580d9f5502f2a9c4b481136f412063a78ff841eb038807
SHA512 a4f72cacb23eefe39e26355911a6796dec05a8dbe4b6e3fbbcb0b799307d378d93fe90b0231fbe05db341647ccbca45fc08bdaf254b6554ea10f2fc3ec54ff67

C:\Windows\SysWOW64\msres\yundisk\skin\logo.png

MD5 2b1c1ceb972cbe8c70139d8ede4f1655
SHA1 eb7391a2f61bd09c64834d2a8f2e022c8a72809d
SHA256 afb5096823324c72d382f6c14e5887c1882f48cd3ad24eae6a0046d38b1a7097
SHA512 61b4990c45a9b2a25f3d8b5b21184151da25a6f150408a728b0d039dc7a5f8b12394779d000fc606281490c85ab5a4a9e21e4328870f53977a7bbc6f06a98558

C:\Windows\SysWOW64\msres\yundisk\skin\fanhui.png

MD5 7ce1887e646081faa303284810f2f5cb
SHA1 1d817366c34c376363124b88aaf1ae72b7db62c0
SHA256 bb5ed411b1054b0cbe5a941597bfdd5e0ef3c00046357e1d817ad0f0e4734ed2
SHA512 7437a4bd6651baf10ea0a829f5ce3f71db2d255689f14ab9c18799a0f14cba9d28fa73f4bf8311dac043845acba8a0e7539dee10c4234dd5aee9702a52c03e89

C:\Windows\SysWOW64\msres\yundisk\skin\collect3.png

MD5 eb29276cfe9b5d40be4c4c6a9a12e03a
SHA1 1a4cd7728b322d264e07d186b130f9e8d8ada544
SHA256 ead3cf146b13292d28de4316b7b0d7681861d53061ab93ddfdec72e1fff0151e
SHA512 a790b497851dfb63cf52de15c5d6031a7596c6018dada5a13115c33a9312c25a21dad280ce9b29235ec9d4965fa8a83691f24924e4e98dd1b812d809996227e5

C:\Windows\SysWOW64\msres\yundisk\skin\collect2.png

MD5 3375d83ad492f3c7299edef1d2c6cd93
SHA1 cbcffa9495389a0005a496819bfd6078aa08a6bc
SHA256 51f879f5062b678e244de1a1548e85304554297bb598c090863470cd863beac1
SHA512 8ea6b3acbbe5d9cdf12f807f590d738a875eb11a5713345c7cb2d438748459640a2e28164894f3146067167651379fc92530040136119a8187eec717dc2e0255

C:\Windows\SysWOW64\msres\yundisk\skin\btnupload2.png

MD5 0d615c855011ab531748448660ea84c5
SHA1 ed81c5651652dfb8a1bf37123672a1a0a21f9699
SHA256 8630669f24c3bee94cb591a9e9ccc2fe799168aa18ac64c37bcf1951cac6d5ce
SHA512 9e0e33e55e034a3883b1352cf9d6df43f6a3c3107669905be54a0bbcf15ffce48d166b3d4be074a393067295dc28cc86fadcce2b6153059c6155adb540a1c77a

C:\Windows\SysWOW64\msres\yundisk\skin\btnrecovery1.png

MD5 0147525537e84b1f21c2c1973bdd3208
SHA1 94c489e5e5126b77674a9e08a2ae431d09b5564a
SHA256 1ce69cee7569fad14c4741bd893fc0e6e251873a619b246a07f92ae0a3d184f4
SHA512 68f3473962cbe2ef4826f2c7fa5ba6cc59a09a0aa5af1c65b04397fe48a79ee8de13d2181d43603a2c159b4c793b6febdfecc820bb30ae56df6f7134b505b668

C:\Windows\SysWOW64\msres\yundisk\skin\btnnext3.png

MD5 b2611935a891cdb75b8380bff58c4aa3
SHA1 9159995705dc21b69e614470f7410dc4c742532a
SHA256 1b3c572a3b20d5e36dd019cf1ef1bf3051cc83a2a5cfcf8c3e9d234933a0003c
SHA512 3eaadbd150ed0141f872a6f1f90d979f481174d329146fa219a74390ade29936f5744eb21bdf4313276e4a506c35770b1c8c69cb0be44ef87a9e17bdbc361d07

C:\Windows\SysWOW64\msres\yundisk\skin\btnnext2.png

MD5 49495b34e1896de6ed1c94cf8ed8e4af
SHA1 f66df8dd3e0d92aa7ffd5a7372fd3a79b8dd42d9
SHA256 0b3adb73db3da8bc39e38deb357a6e7c61314200a680d496f9189437728f9f23
SHA512 b336c8e314e43035792d43ff32451ec9a84b503389c0eea69295caf8c0bdca3c86f86ee982fd378484cbe532cc27bd2596a9148e805ec3d84c8a92dd02cc35c4

C:\Windows\SysWOW64\msres\yundisk\skin\btnnext1.png

MD5 41c29e1caff250506d563c7da9ce81bf
SHA1 b1fbcdd6b1c4c3143c27646d22967ff012e984d5
SHA256 0c3880bdc3f2e619c02e2544abb51c346c79202039cdef6be4aebea2723d5ad1
SHA512 86a9871f9cf7dd8b64436d534cbca2a81d0e5e98c05f2c2759f4d3c87c9ff8da7de37201cb5cfb84400e1600cb83e07cd6d835d6d2dda3464af33cfb7705a68a

C:\Windows\SysWOW64\msres\yundisk\skin\btnnew1.png

MD5 21704c32569605cb4d6b2b2ecb5843d8
SHA1 2d7c31c77379fd037c5797db0f01240c3826e44c
SHA256 76e4af8f643117370b7ccd9a0ff9b27423060c3a17375ba25fc7015b3fa4dcdc
SHA512 7c3918666e9e05636244ff04cbbf55d97f75b0340e6720037091a7361b3b990e9e9323be0c124ba024c5a0260e62626c785f7c0f2b01f31d033b231558377a63

C:\Windows\SysWOW64\msres\yundisk\skin\btnlast3.png

MD5 13fadca53d6d31e4fcc7ca0738a4fc18
SHA1 7f9eea54a5266a4ccdc824e782b5765c28803e64
SHA256 3b673537a3c786a4086a32d250d1ea65f735e9f8fe0168b907dcc712edd3aad1
SHA512 917e0d29445064f56f1b4810b3063468408228f0ce2bd64b2ab30819413e0f73c2299a610aaee965e718e0c4afa2dec4f2155ddc3b22d54472dbaa6d0b118060

C:\Windows\SysWOW64\msres\yundisk\skin\btnlast2.png

MD5 98fcf82073cda8f6773c9a71802e7a5a
SHA1 04f82c223b96d8307b81b0312bfb42e369fec12c
SHA256 d31df4af8f90ef7d75ae30cd652b8d2be23e7481f1b94ee54d31c6758149dcf3
SHA512 79ca4519b61e934b111180825f3354d7d5278d0d8e0f5b398ec9e94106f23384e7ca31a2372ad2f3a03295f22f899499315f03fdaddd8abfb2de3bfcacd852cf

C:\Windows\SysWOW64\msres\yundisk\skin\btnlast1.png

MD5 7593a8ae7f9b647f002b052fe171b503
SHA1 c22de966ee81864b42660f0dbed9e20d54bb1e58
SHA256 a7fc55a829960fe5a9cfe8368d33396d58e2ee2191d693085ca303d928220184
SHA512 5908d3585c0d7b6e76a68cb1a920d4cf65901ee80997feb7487040eac41840c8db7348cec8c34a2cb0e6f06287ce569cf75f3268e6307a7a19824cc43bf2379e

C:\Windows\SysWOW64\msres\yundisk\skin\btnjump3.png

MD5 3e8e18a7b012182ea48421a8fee27b89
SHA1 efe932086ce7821c8ee4e309db57863bde015fd3
SHA256 df4b68743f291708211951a092b68ca0a16e28e5bec1cb51162684d93d44aab1
SHA512 50f4a29f4bd402aa98d154a37d6698082627f24969ccf05a39bcf6dc236460dab539b08c2d28407eb5d4fe0e397d65696e3657572f02cf28e855d421c6978e9a

C:\Windows\SysWOW64\msres\yundisk\skin\btnjump2.png

MD5 33eb6fa03728132847c1877007229b26
SHA1 530287219ab515d77e991c2fa7ee231c48e12623
SHA256 fd3a038563d6e701462564c013aad4a873f488ae2f5c1e2584184c268ba7b2ec
SHA512 be0cf2b64bd3274f9e2b028924dd065447800ebabe59e3febea05db7a685871955831cb7da176b4eb58bcb6bfcde22d6c684051879f4da40f7ff5a417c7eb1a7

C:\Windows\SysWOW64\msres\yundisk\skin\btnjump1.png

MD5 8935c96a352e01c80afa9a62fc1e3b62
SHA1 cf96f7dfc833573c2d258362a56d41b4a91e1317
SHA256 c6758a0f9ef2ecc5e418d805b7ac020b839e353d720649b7cc9d6fc08ad61624
SHA512 722426a7b48ca4347d07a362d1acdf9024e1d6e25e26be59d71bf9651fc6c16165c96f5f1d92fb0998718c72c2b023caa9af99e96cb27f5943db63aa8443ce6c

C:\Windows\SysWOW64\msres\yundisk\skin\btndownload2.png

MD5 13c454a0c102050f7b9ef60f6a6faabe
SHA1 5d2670680bbe0ccac18076bf25b32251888c2b95
SHA256 23d62c9dcfcec3562614a2a5c57331f53fe6da7cafc7c5ad79551d6925771c6f
SHA512 9e98068fe422d63f11201fccbb8870ab1ee114f67f51bac839084d3c22cdcc492a3efc3b8d7c4253021e4921b76fdb980d83073b62b0dbd3dc491875e2fd4e5a

C:\Windows\SysWOW64\msres\yundisk\skin\btndownload1.png

MD5 a30a7e95dd4b6ba1a8235023885ca1aa
SHA1 8fa2cc4a0c5bddcf726ceef7d307520fba5413a4
SHA256 cbda138570324929d5c72231f306b6a9920029da70df63b399c107e8f254247d
SHA512 9b71851b7b9a8b001c557cfb55f97ffca81d693581773a9eedb88c939317110fe732fb03345f52f875ef7d0c61f6002931ede4da1de3653df7828abaeb434fb2

C:\Windows\SysWOW64\msres\yundisk\skin\btndel2.png

MD5 b515dc37ca6d914f2cc231b684024b89
SHA1 dafde763f1f43caccd94efd864e178e581e6235a
SHA256 63155fb166659f48e1394fdb0a0626b00868cb96e84ec9b2869ae571f2e370e5
SHA512 e5d06e2c682cc73f05f34429bf1af7e8a2a562db6fbf83a0d617818bddbbc0e5a339732c2915142027c914b9e1b340913c282790d3343d222b90dac011840815

C:\Windows\SysWOW64\msres\yundisk\skin\btnclose2.png

MD5 be057c2cc3a4e70668bc78d25983b2c7
SHA1 c8f5395cb7dc70fb0c7c11036110dd70cf3f2e48
SHA256 4655d620d56fe1a790c4cfb5e6484dac5ea1898b1653972b695232996657f9ad
SHA512 6f05e6a892bf612954fc4f29bc78bd711b6ec0e239d3be6a0dc2ac9228228af42df89b45186af6e532102000ef236889b52c98ac3dfaf39d1c1b0fe8b7c37a1f

C:\Windows\SysWOW64\msres\yundisk\skin\btnclose1.png

MD5 bd086caa43b1f83e52d975a71dc8dbcf
SHA1 6f8778953bd4119e28a65baa75845167e6b5d6e0
SHA256 9aa7fc666a63e0cd54acd4db1cb6358bcd32f2ad17f58d08da95f7f27632c125
SHA512 51d84b8ef9ed47c052939005180e5f66cb59499b58afc38ce8166caefa75e635e6b3e499c93690afec5caa3dd8375aa8203576c2677be6d1cd0c9de235ddf686

C:\Windows\SysWOW64\msres\yundisk\skin\approval3.png

MD5 83d4219d788eeb8854667cb608cc1fcd
SHA1 06d20a0c5ceb8e011ab306d98cfe9ac4d8052764
SHA256 b8871aea9f2ee21ff6488d487fe5c638f4cae3488565e551991d8c2ffc349e99
SHA512 40193a7bc19f338bcbbe086c363b2cb5315df169ec1339e37bbd9a852351fb2c11b8b3db1d5b2261c28089a6cd741a01553691965a7a743f1444934b9454669d

C:\Windows\SysWOW64\msres\yundisk\skin\approval2.png

MD5 057c3b5e5b9f5d22ce02761321f3840e
SHA1 a5dcdbb4c1b0ca99a078645c089d42d05d899947
SHA256 778de6f1d3e96acba7cdfc75b5e26f473b18d1c6212d3248124d80d775315f02
SHA512 2c826cd26c7f1bf2781fc7678211a5689feb2a00223e05902bc1ca89385f485e3ee8a8c40a79ad88f96d56529b2db88219e21c453052548ec22ec74d91037acf

C:\Windows\SysWOW64\msres\yundisk\skin\approval1.png

MD5 de20e0ef172d8e83e023c1964b0ee91b
SHA1 2eef608ceeb82039f42236ec5bd4578b45af3b3e
SHA256 8935bbbd7dc8bdb4742a59c671a4cba0c946f788f6b92c2ebaf0059444e09f40
SHA512 adc719466bcd52bc23ddbfb79ec05d35993bcb98afe663efe6de6a2817144775d3797da10b5bb82069ac7a6c704990246869a9cc7d94df4e045b18ea9d2bdee5

C:\Windows\SysWOW64\msres\yundisk\VSCommon.dll

MD5 128ba663539ee7627f578f7a77bf0ec4
SHA1 d89ac41d6698b156688a75138e4b39c2a188cecf
SHA256 91170a8bf80097baf519f36983a05ce6f73b1bad3449c9433cf4b46e769eb882
SHA512 2d9e796a39d4d937affbd689e65be87b4732d6651f1ad1462e9055a741043f04c66926157ba52a495668f4c805d33d630c097085288e5663b94325e292950641

C:\Windows\SysWOW64\msres\yundisk\svcYun.exe

MD5 b545a91246cc13f775475025c3558833
SHA1 793bbe9f57dd5d432d45c48c82e1037fe7cab623
SHA256 358b66c1b6bbf0e020b85f204d54b9e9be17a859525c6035f439d2563d55eb1a
SHA512 fcd683cbf225b0ed821ea99ecaccca28fb2dc0e0f29edbe68688c9024badec460e5d6e1e33d8634e3197449409590efffbefdcae24882cd12924f64b512992eb

C:\Windows\SysWOW64\msres\yundisk\local.ini

MD5 6478b70c86538a843b98e550f6660609
SHA1 ccfdc3afafd7f44fe710a455c5c15660a3f839a3
SHA256 a565ad6bfba5ad40d6be6cb8e175b8087afbe47e560faf855d23dc20f42ad545
SHA512 f4eb7aaa85939ecdeda58c8536282258ec1db29198cd58568b6109c73fb07f6b3bb99fa99cc4fbd5ebdbbd1deb85747bf542b3f411a0e42919377029a0042808

C:\Windows\SysWOW64\msres\yundisk\libeay32.dll

MD5 56b2a5e176937f333627ee5a71328ad5
SHA1 d4c9343f4396fda7d6ca112f19df8a59f72e25ff
SHA256 fcd987fdcccf64ef1eb8782ef5f9ff2df58c9ee1f8641f3f85715240faf1484a
SHA512 6684421f9cb91322be595e99d1ed35dcc68ddb945841b3a966593a60f44184c7b2a772c4b8bf33aa323c513bfaeb5dcd3bad70812424ff0a0564c83838378ec6

C:\Windows\SysWOW64\msres\yundisk\LanMap.dll

MD5 b9b4c64c214eb2d2bd3004443dbc53e5
SHA1 8d4878ea67a1f5ebfa44b4bd96ca71681d6b8ccd
SHA256 fc7184c525ec9983090b24d4e0b4d28d47db8f22ab3728b864c9814352a1b8b8
SHA512 b4039bcfa05a2da60ef6a8a8ff910e0ea1849b8868b971530a6489858796841fce60cb00f6b887e353d3f1ecd6d2d2cf24540478eada70fc5c2affdde2d1f330

C:\Windows\SysWOW64\msres\yundisk\curl.exe

MD5 f4e9398f8fc198c5308a4a9589ad665b
SHA1 c92ca1f0010484daed38a055a6f217364fbe458d
SHA256 7744b5f9e24a5810bedbf4e32f03d40f1c0595a7c89a12e0ff0302b4ef07f250
SHA512 cefaa722747c6b411f20dd0f3452dde08acf4fca9fcacea17d1f86f816959448a9deb6413fcda2e16a3f6a0cdf94ecad112549d28a049b7f4cd38bd3e2c05dea

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\vgwdrv\test.ddf

MD5 f921b080a29cd0131bdbd43df7f904b1
SHA1 03fe4829d3dee7eaea205d6d00f0eb74543965ed
SHA256 3c5ff1f20ed2e96482df35b1b49fa9add4d3dc6591c0e0bd98cba71ade7b5cc5
SHA512 463eeff86ccb365b7c8adf7c43963ea9f257659fc0f8134322c565af9a036ac93e2c89318b6e7c1f322ff01c7e8d71ec72804872fc7da2ff6ca7e2fce4aec34e

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\disk1\minifs.cab

MD5 d315fb0a2c9dc687f0a06e0183d23799
SHA1 89754caa1af629f7b401f29111eb710b890e3094
SHA256 a0a883f245f81885e6601250f0babba0d1d5178bf36e0db51a5cb38397d4dc3c
SHA512 a8997594208f11be33330545e8b863402b5573ce4bad00ef964cbcefe4962f0eceb1cb0c1354b1e231d21d1b393fe01484fb616847a0a39bb46fdc1ab1c87bd1

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\test.ddf

MD5 1209503f90a7bb427b6f7e8f22fefb62
SHA1 4b1bc37dc674a41a0bb5872c7d06b5ad86b8884c
SHA256 9caa83f2f1aa92361b9591e2fa0f34d2cfb5f372d71fbbb4a8bb0f03e162e2bb
SHA512 a879a57f2d011823a5b2d145ffee09aa61fd9981be9985f2346d3c451df71159b489f4266a128b3e0b73b383c02047a7dbc35b95d8eefe228cfb7525b1202b43

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\minifs.sys

MD5 d3cf3260d86ceccd875ec73bb33279ab
SHA1 2404069ef7953388c18a7a19dd075860aa3adfbf
SHA256 0bca4a66e93f56c293e102dfdc0f1a7b2dd8bcbd68cad161dae915e404a9ae7e
SHA512 516cae03049226589397208db81321f7f3cdfa4f1ea6fb128a6837417a2174ce509bed1084a8eb4eebcba691a3b614e544a419eb559a356e0366158b2e96940a

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\minifs.Inf

MD5 ce4687667502c280cb1d072ebbeb4200
SHA1 32a030e31f3b34755bc963821c1e49721d0f3d1b
SHA256 8e7de9d96cfcb19d4f1e77210da33b940e6c6acd329ee7988ab16b4c18a9234f
SHA512 ad48e2ba3aa2dc1e735c0c82ed375af1960aaf03d022c8114db86f1feb05d86c217d80759751653ce4c8997fae875bbc913b96f819e6f9fa849905b550d7030e

C:\Windows\SysWOW64\msres\x64drivers\ytminifilterdrvx64.cat

MD5 45c16877db14f420aefef2aa91a8a8c0
SHA1 7f9a232ddf872173661fb08aa4130a14aec3d0b1
SHA256 d87ea364761705b50960335a90c3fc1964ce183e210ea6515ad8f91af7162519
SHA512 d2d389f793a201ce5cff4be19bcb336c467e25bb6765c82d8d3eef4f516449fb99bb866070e368a051bd93d905b5e16a716bc438f2b5e46c1b746d3c265c0fd0

C:\Windows\SysWOW64\msres\x64drivers\ytdisk64.sys

MD5 1e7999ddb01c7cfdd75fe204ecbce38b
SHA1 fd82d428adf236c2f6ab5209923cb55c5d45d856
SHA256 02693582f2a63a7492d6aa7437a679dc01fb6471357b199de1db9978cfa5fde3
SHA512 5d19b709ea5ff83fc6fe6a34c3a6013d5975d6d5bf5265e9d63f7d32100a836137cbaac8a0647ac1589999357ff0f5429c9d4de2f674ab6371ff8f000fb36915

C:\Windows\SysWOW64\msres\x64drivers\VSetup64.exe

MD5 ec3f2de5a8180a5fcca1eeed56ab9a7c
SHA1 fe97836ea6ef3cf9d389e2e6c606fdc8d3d44b67
SHA256 65a6e8c28364a24d63a251e2809eeeb7533bd6c7de88a270aab7950c7d59802f
SHA512 ac87c6de3505c0c31b242dd06f502da8cdd8e05c717f6b5cdd2196333030adeddc1ed3a1553303e87a42125b0ec5301c30cbbe9bd04d17dbcd9d965a7f2f53b2

C:\Windows\SysWOW64\msres\x64drivers\vgwdrvx64.cat

MD5 868d5896b8c527407e62f52fd47695c5
SHA1 6b3e6b49a1e8b82f207777d63140aced360a2fa5
SHA256 25ecbab37a3ce635040f161cb51d3129882b0fe4a34ed0289e0be262afd0a615
SHA512 449211d5e8c2b5b61b39b536d0119298977bfb97b5c922dea6389a7879f1d8fac023851480952a7b432b9f31634d413c410b2959c81346af1822b6d081977faa

C:\Windows\SysWOW64\msres\x64drivers\test.ddf

MD5 2f78bd9e6753f2c710c096d4ad2018c3
SHA1 9fc01f74538558eb347e5602b9684392b26850ac
SHA256 359d9de832c63146c91e952af2389ea655bf2f4afd03be301a9ae1881896f227
SHA512 c3706cdc1a354b0b8fddd0903703e872eb47782b7581adf8f3c4fc197969d28745be763c184e46cafb5482f62a8036e160d01bb1249154b5ad9ac24a44c4125d

C:\Windows\SysWOW64\msres\x64drivers\sgfp64_win10.sys

MD5 e0e361343c2d2032133c2fed2192a01d
SHA1 86f5894a8784c79b77e42d4a836e155ec9cdc5cb
SHA256 c5b0f045a283aa0a550a92a53fdea316437decc1352c8cfb1e0b05ddb2c1594a
SHA512 2ff52b5cb20d510520f7a1f3526ebc4d20e4a6ec2c786019c47518524150b4f6ad99f2796d972ececa4620c49b2899577bf0e5fd841814b7309d448d1e8b38ab

C:\Windows\SysWOW64\msres\x64drivers\sgfp64.sys

MD5 c81546040f8cfb05ec7b0fb6ef7e794a
SHA1 b43618e1efaa16cb7501453a75b58c7f976bcf2b
SHA256 fabb5e79ff0aab237a0a3626ca60bd08852426ca1e58d628d2e99a05dddedf90
SHA512 8c1ff67728207bf339a491a1c05c443447e26ba8411eac494dd626e2b0d066271cdac6a5f42a5c056d0d7199d16e80f0734c425bda05d222fe4338bd9a783b9b

C:\Windows\SysWOW64\msres\x64drivers\ProcMon64.sys

MD5 29400e78cea86d8a750cb5184f376ab1
SHA1 af00f453783dc90333db698d2d8e9fc6ac2f48f1
SHA256 36d2da5acdab7b7941ab63b08cd0f2b6d6b11d3d8be4b98b6dbd18593bf87137
SHA512 3a2331c2c0e0ad8fcee29e590ac13f9e72a947985fdeff1b8e49a78e37b04a1a8afff7fd229442ac484a4e4a048fd78dc90d9a98532546594ddeba68410424a5

C:\Windows\SysWOW64\msres\x64drivers\netft64.sys

MD5 c9217b97cc7fb297cc640f683ad764ef
SHA1 52f28dd5268ae0042d355048f600443dfbd9cff8
SHA256 96e305378195ece2bd0322528fd0fcc6f4c5cee5b13ec32e65521e1a2946e82a
SHA512 5d6f9c2021572b775ccf5890d3aa7c6b7c13dd309219f31ad4b84c67086d62538062dbdd08ee8ba9c3a9a46244b79cd771c333c3d7541610c388c76dba83c2d9

C:\Windows\SysWOW64\msres\x64drivers\dismapi.dll

MD5 7c4ff9b0302c59cb00087589a90d2a38
SHA1 8f4c022afdfb30c072a2e71939824ad9b2fdb0e8
SHA256 03a6644eb95c448a56177e5f38ab8ec1f2295089f0802b3f7f8a2607c76f4fd0
SHA512 c73922f9dca064716de4bab02b0130bdc23f16d47ec6529306e36620ca0322ab63aa9a3564724ae8fe432ba48b757eda497d6761941316380df6fdd544871d46

C:\Windows\SysWOW64\msres\tools\setuptool.exe

MD5 1e5ebb0561439c65d78fd651013263de
SHA1 83076134120fa56c110809dd39daf60644bc1c26
SHA256 a5927aede0fcdb9e2b45a0f62de8adf803accae612324f68f4b44ce40aff0cf4
SHA512 c78f8cad97b519528b8b8cf97b7908a9af853141f974391339188c21b31236853639ab3e641ed76ad590afa53f6179a3d44a6515c3e66458b14cef972d74bcc8

C:\Windows\SysWOW64\msres\sysinfo\windowsPatch.db

MD5 e4749a9fd1bf804dbf0a3ce5a5a3cc40
SHA1 23a69c3fa98db88e224eee3240ca28ffb57cb8ba
SHA256 18cc35b61fb7b5de9a1cc2dc44a0fdf928c9e5ada905d5a4dc36c6821b62e137
SHA512 d12bb8eeccc88d777d7eb08ffecde177eea1b6b7c0e6f0f6b877feda697a88f73cccd4dc7c28e158becd0233ab2a265eac09e76ad22cfb4324799b0b6f136ad2

C:\Windows\SysWOW64\msres\setup.bat

MD5 ca4a6dd96e8e0913d52d03b85b00d458
SHA1 dfead962798530a74442eab9a51d5f2e76282046
SHA256 69320f35c81cfb61c0f0b02cca7047ae77a2f2804f21705735b5bc85bf8be188
SHA512 f07698d32596324e97ab5e74c79f6fe790eab697a3db2535039d30524dd660c6aaf76caf3e2a4e83d8035b42726be869fa4982245f90e1f2423eef6996f72df8

C:\Windows\SysWOW64\msres\sysinfo\OpenClose.ini

MD5 b9ff663fee817d0a030a36f3151ffeaf
SHA1 76789ce988e8d71395c8d772e110d1c59721476e
SHA256 4d9872c5adc925dfd9207983fe306e153684684c07ab1bf019952ef58b26c235
SHA512 a84b2bb127d677a51fcdb4ae2fe397c4b82e16dbb3e1d0f426896be5c1b77ce4b89eb2247055e1da7514f367540f5461a2cdd9314f2b043b442a09cf1df8c1b1

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 2a3aea4fe9a0b9476e322f003b0b69c8
SHA1 3b4a52e16dcd11c372e067bc07c6979e27e45076
SHA256 b848ef594ec9970c8876645ed48e7081e7a97dbef72bdbd2f6e6394105a52405
SHA512 e5330a26fc64e55d853350a16800d18d6c132a54ca4f6ff4c7af898b825a3201aa8d6d82cd87d598bb4a40f5a450bf6ba0015bb0044cb0836dd257a8f660f8d9

C:\Windows\SysWOW64\msres\skin\riant2019\查询.png

MD5 cf76658b0a235d7fd1c632862acd380c
SHA1 c4607f4cd3ca4b743b7e9f360fd8a7b9a1e34c6a
SHA256 904e7899581ae4fbb862b37151f3953979868f5d2240de7f6fb2d518cb0f94d8
SHA512 2209f900c1a5bfa7bbc8e36ad1181697823edcdb03238317e402bbd927a21baec83d41af4de2a712a81251d2198b7ab7a06d8df0fa6bed85c4e73e539ce31c7d

C:\Windows\SysWOW64\msres\Setup.exe

MD5 cf3dc562a1fbf2d3c94a152b368b621a
SHA1 8df486165156800970a031aee21270e2a7b4fdc0
SHA256 7f830176240aacd9ee1baf568f9f26c65dc2de36142c125922c73be8587abbef
SHA512 ceb21a8f837c21ebc0047c29da650583de8127ce9893348ae85ad2aa5bf01fe962db6e68253491a3a3565a96b9b00906d33b728653b8631e21af8c6539e585d2

C:\Windows\SysWOW64\msres\skin\riant2019\未选中1.png

MD5 a54109302a50ac727e40f058e8753623
SHA1 20cdd9d1080f9b8bb0ee9d3a92efd805d258738e
SHA256 f401ebb1a2d1622329e8a023e8a21461733186e0f2acd93f8fdaccb8e422390d
SHA512 a72de48560ce40ca75ca7d1bf697a27e1b8c0e20be125826a1d6d996b538d08f5b943cc8cca693a67d7ba5baef498c25f2ef308e4906bff8671cf19f39c67d3c

C:\Windows\SysWOW64\msres\skin\riant2019\snapshot1.png

MD5 e817df8af67f7aeeac49eb2b38823ff6
SHA1 34a36a624559a151109ee99591ddedc44fdb7d61
SHA256 352ad4b713f892dbeec60440052aa014ab18235494a1293fb993f5508bc5a544
SHA512 6f3843c53cc02a5205197032827aea753b35ce9550a8fd9d9130fb76cdcfd3b5ba2fe53109a571368b0ccfa8a94e63a71b898a20b3d9541498aaed9adb45b905

C:\Windows\SysWOW64\msres\skin\riant2019\snapshot.png

MD5 dbd88688258b0d125f7add7db13d4ed1
SHA1 6fdffaf5ccbf160a0d0c048ecdef39d23c8f9072
SHA256 939a51cd16e607b31df20c1f3b7d73326a36560b0e6efe775dea482b3fa1e809
SHA512 04565fc84aab14c2a52d6ddde023c24d1a2c64c1da5a04a7745a36f75ac0c1ac3047583d674905acb1a926896eed298fc2da6afe9943147eb63a81392477bdec

C:\Windows\SysWOW64\msres\skin\riant2019\smallChoice.png

MD5 3cf4510664c659b5cb3c0b4e74e69b89
SHA1 086642d32d95c16ca04b337d565c0cde93ce3cc8
SHA256 97c6415344483db7bac3551ede9047bd7f5cfd22e5de0161754489cb15e0462b
SHA512 1c248e70293cff5dabf8496e70955b6a8ff4b66ede52355e3f5169f56a263215bd64c3d634342bfe0a94c38800853729e5df4c9b68d758b09795f3d6f5ffc80b

C:\Windows\SysWOW64\msres\skin\riant2019\small.png

MD5 4ff26b376ddb07c30b7ada21a4654549
SHA1 8b78b2941071e523479eeaca63e9c21683b6ee70
SHA256 c55adf8da8ede4ce55846660d5439e037d5486d176c69f11fb4331041a218a21
SHA512 bc315dea899b52a653226bdedb66f4f33552efe0f0c8d46c44d83ff5a69416727cb13fbe945f859b9617984db4c4d1295f9137ac681e3f8a0f16ae3dcc3a728a

C:\Windows\SysWOW64\msres\skin\riant2019\sendmsg1.png

MD5 7883bb39d3b8c608228168273742a301
SHA1 07e1152aaf60297b6d8c3ddea99fdf9cf45d4c79
SHA256 0cf9d578d5578790ab24440855712312da66f1fd5fb8963f089e9ef1c64475fc
SHA512 c0997b23e8e337d4611693ed6b47ffd8513a854bbceb557fe3b46b618eb5c8bd0ba3255512b08dc2e50978a3fbc3a6d0feb8d2bffbe19f9239c9ef92d9df9b3d

C:\Windows\SysWOW64\msres\skin\riant2019\sendmsg.png

MD5 e8c04554d6d183ab6f66b43885dc5cab
SHA1 bb2d42903ab2f50ec74ddae7de3d07d2240a6572
SHA256 2683fd4c52870a1c2ad0f621229cfcf03f9ee7f858ac7ffc56b5129e90acfefc
SHA512 d1cc93f82bb35b5f0f0591c70f4afc2cdcc9d0aa0b525220ff4de8537cb8c4ea5b771b287c80334390e63040360a17a7e178c09cc376da3edeb3f9f7d8616461

C:\Windows\SysWOW64\msres\skin\riant2019\sendfile1.png

MD5 91937e8539b0403c147cbebc1bc6da52
SHA1 bfaedeb4d58adf0ec970a309a983dca02696bf05
SHA256 1c6f1585a8ee8c74882d988a1a3ba2d4cbf0b69dae6ea4f7dea1bebf25e9026a
SHA512 35f8e76b6fd59fdb9d9a2eaf0203d248735c04d0d5dc486aca132a92ae8cf1c7ecd5e492b31760764c0c2e48060a631313ccffa2cc6f69b2158961c7d54d6a6a

C:\Windows\SysWOW64\msres\skin\riant2019\sendfile.png

MD5 c28768cf3f20f81cda761a4af3cbab45
SHA1 c9a3950b7a78413c705abfb9639811ad9d9116ea
SHA256 12bfab2aa72bcf19b74ac031eb6faffd97411961c4dd37529656064f644d8d8b
SHA512 72bd1a84076546145b817d0307767c851e66459e15fbae80ba3c115b987b2955aa9f64caf39577c442646974afd31ed264958fea77f77671389850eb2a343f15

C:\Windows\SysWOW64\msres\skin\riant2019\qdan_02.png

MD5 fbb4845cb67554460dcc50c5a2ccc9ad
SHA1 6e14d4343d6944a172a05678294e3ce842771527
SHA256 2dae0dad3ffd36cefa6521b450b62e85739024291f344b140ce7b8d7b7d88d5f
SHA512 dba532bc2391dee4fb1cddc61db944a741ce74c98fc2c668041d60d539320939535a5659afdb5ae9db4f9ea5f7386731df7bb5557af94a432d21567ba5da2c6a

C:\Windows\SysWOW64\msres\skin\riant2019\qdan_01.png

MD5 201b4595d0a7a1346b3ed3db1c98b279
SHA1 8b8965fcdc41402708bc5ed03e827a51ad6cd63f
SHA256 eb83cdb44e9c338828c562c7d0c56d08651b019e8bef222a6f20ef989221d18d
SHA512 f50b6edf0a2a944393282406351e6ce22aa3197a3994cf3346e4950fea78beb0523ddfcaa20f3e149abc9ed6cf90ff6fb28c77d4c69afa633cb26fa5d6c8bd23

C:\Windows\SysWOW64\msres\skin\riant2019\depbtnhold.png

MD5 d3a0cb351beb618c9b115eefd9a0a5e7
SHA1 d0bc49ccd8abbbff5063035b5fcd9d4fd0c80e41
SHA256 6aa55fd3a2d67afc02c73201d6f1c3d017e35bc0209d6c98fdc41cd54d7f6f2d
SHA512 cf07c77f5d4498205bcfaf999b3ee53b974ea86aa88f1fe3ebd50df36e5eb095dd8b07b0831454c023182f2b54abda90f1a6bd00aa2a8aeff02c0c8b2ec5f1a3

C:\Windows\SysWOW64\msres\skin\riant2019\depbtn.png

MD5 74c77345a6623e8c104d8a12a000f36e
SHA1 fb03c546cbe0e583e53fe63a1cc96cb55991e806
SHA256 8079c30d1b87893d74f247a73942ba0623d49fa2aea2e2c7c8e181a3f7bbddb4
SHA512 52ba563960d97c22f0d74c225f7a831c7c35fddca30f9f119637b204ce98136afd9fd771a6fa0615295a6e3d6e3fb589128349e1e7c7dd95ecde75d86b6331b3

C:\Windows\SysWOW64\msres\skin\riant2019\closeChoice.png

MD5 4726a9aec052c380e26671a469015f42
SHA1 fae3eed64f74bb66e1bb382267174669d81395e5
SHA256 90f6a8aa3c21c14a057e017226dd41bb6a3b2e91a3b2da8bd3455a4137be71db
SHA512 3491dcb5efd0dd491036b4f6f1a6c383f2dd343a57a38f3d9a427526df33ae9ae7b7f18edc214a211f44da3493fff412d01aa644603602db3777a961fefcc60f

C:\Windows\SysWOW64\msres\skin\riant2019\close.png

MD5 f3ae3b7482b2188b38a4f30bb5f25f66
SHA1 7acc3d4f4a2590ec4af1d337bff3f96134acd6f6
SHA256 a42648958da47067a0b1fc4d384eefa0fd7e6f6a57ae286bba33c05d511e8e36
SHA512 dd2c537c786a8a35b3b7246a8fc3e043dd1204b17c369a7de7e6476fad2f068c83a1f080c9712bc860f3f7b7bbdcdfa7adf363e6ce97ad3313235d3cbf5fa73d

C:\Windows\SysWOW64\msres\skin\riant2019\chatbtnhold.png

MD5 a28731e81b5d65b1a6b5a9d135ea0521
SHA1 40b44161a0b5326e2aa8ea5919e99115df6017d9
SHA256 7e3d19c117cec19b62624918cc473af4969ec62537e9144dbfd0c1abc6b75e7a
SHA512 f6a0c93a32bf6b4419c12ba7070a405b7ae393bdcfe9a86128d4ce1b977aa793ce0f77a885fd0736e784c35c3c1c563ee36d9db783b8fa6bc60adf7623dd4465

C:\Windows\SysWOW64\msres\skin\riant2019\chatbtn.png

MD5 eaf68c767dc0ca3efc5066d8513a6d8f
SHA1 3b1cdc18d7c0590e2582a2c190f0114d2f73cd2d
SHA256 4f8e39d1c2cd592dcae800624e71b7b2238c81862f64c14ee38f8bcf0dfc7bba
SHA512 f8bc83637f916906e08de215ca0df331b90b034e61d4f7bea89c2fd1d0f0f94fb8af129941510d1192c930ac6e7dd64457d10f3aa61339dc90d1ecc37124aade

C:\Windows\SysWOW64\msres\skin\riant\ToolBarFocus.bmp

MD5 55a59abd1834226278cab73975430814
SHA1 4d5f6813d3716d0bbca030bf74539fef93947e05
SHA256 c64780197504541e53288b63b3652e68ece3b5ceaa50090d76c9753fd6760f2d
SHA512 f85c8abe2b05a1cfac8d47561074c74f139ccf9e10a0e0a341e1b49a4dd10cd0983cd172ca3d4caa3d0cd93c3da21999b53196406859cc031f2c5b8d64c03fa3

C:\Windows\SysWOW64\msres\skin\riant\ToolBarBack.bmp

MD5 88003094441e7603ffe3876e94bd7155
SHA1 9acc449957457d8af7fe9bfb6a88d404ff6636c8
SHA256 4c3b15effd9e490a8e42a496fd3fa2091ac3985f22204a963bdb6f6803743d7a
SHA512 6503ae277e6934b048181e859856dca00e9d4a2a5712791db8eff3cf7149616fc5c5044a343402bfb0fb466b7bc4aa9ad8f23f2826ee7bc2658d812f60700e8f

C:\Windows\SysWOW64\msres\skin\riant\TabMidSel.bmp

MD5 035d69ea81bff0e13c9615d70f2dea3b
SHA1 3051502b461bb21aa2a23eb9fb4c6baf0ed4278e
SHA256 a8d5bcf20171923ebf7186b028546f6547f88befe49983fb44a4f775932c6efb
SHA512 2489fdcc98dfadab488d621caa9a7795bd615a5c31b9c487caaa0c9f1309c724bb0c0a81267aeedfa51633a10175077b4029d0fdeec0db87bb2af2f924b390eb

C:\Windows\SysWOW64\msres\skin\riant\TabMid.bmp

MD5 38ea71acbf507f9eea264c3bd9da89f5
SHA1 9dd2db81ca080d5e50793ab3542efd85004c860a
SHA256 7d6df352a3d7be8133b88531c1872fdf4f038f69f8020366443ba01c2ca1593d
SHA512 1a849f24a26dc2d8f9660e01e367ca8c78cbb89e38527d1417b2897e0df1e8afd2d690636f940be5ed7392d7812feee1ca6b45572a72e977c0de5452d510acaa

C:\Windows\SysWOW64\msres\skin\riant\ScrollBarBk.bmp

MD5 c6bae882e47d7055ca4c1ac065c30300
SHA1 9a02bcf780078936db51270bee1fbcb8c8c32d10
SHA256 144bcb4b9a8aa98041c63802c97ee33b609f5a2ae2d6cbb5a019f08e24d3d5ac
SHA512 f16b12a9b592fe26f1d9f81860d3a3f2754481cdcf8de36d9f45c9976b25cec81d68fd3593ea44d5341d1cf23ae3fd2b6b19d352250233a0765d03419686397f

C:\Windows\SysWOW64\msres\skin\riant\RightArrow.bmp

MD5 b6882599fb2f33e6d293204a5d5afaa9
SHA1 a57bfbdfc37089de714377381bfde4e156c69c85
SHA256 36a1e4843f6ff82444c1cb436e402cd619b436560e8fe028835e667c96c0bdb8
SHA512 42acce61ea3bed23212f817725e4eb166e7bf5d41e1af7270249ea695aed9ff765abe8e98865cd30f4c366f75eee89c36cbd68efe09e51d7377d17173bbc3e46

C:\Windows\SysWOW64\msres\skin\riant\res_norm.bmp

MD5 07e7d0a663159bd49cc6fde2ae34996a
SHA1 d34e2b0578c83c17d39e6f20128b1512880f4f9b
SHA256 a073b1d4d93b953d47e145731ce9cadef603a3aeda10774903ecdf3fdf69cba9
SHA512 f4b5676404d0a6d4f4069e91c379d59482217ddf2c84cbedb596cc6b42da6312e061497581f3e95151eaa7d5740d9b11c88bc68ae545e6a20b57970083680e75

C:\Windows\SysWOW64\msres\skin\riant\res_focu.bmp

MD5 101ebb107d672a4a7018c407ef699f01
SHA1 998218a4b0db81e6c6157033777e25b86097e59b
SHA256 b6403fde007f43db12eebbc2ec0d0c531ff8c43f2ba0391f9f9a3214f0332951
SHA512 f7120928accd6b10ee7f37c43b3c3b41f3480bf7da7054ae93827f590c73a9176231eab2a7390373168f07edcfed2ca59765a703cb1337f9f4cf9aeb8b29754c

C:\Windows\SysWOW64\msres\skin\riant\res_down.bmp

MD5 bc3d3403aeca01b2a5a0e5870c3ba459
SHA1 99a321272c40fb2edbac1f5b758dac10a71c043a
SHA256 a8cddb95bd690733e242828620983242f4e999caf44365e936249631a969314d
SHA512 c27bddcfe1038e026f4a89b48b6d6cfd776413a37549da015a0de07c21c0aa44e836412a6184635e0c7d09dbf35de3831d092f281914cf0e509ad0245598d4b7

C:\Windows\SysWOW64\msres\skin\riant\new-TabHeadBtn.bmp

MD5 113771b51dc678ddcdc7b28b1251c524
SHA1 1b7ed71a628ebc6e51244a427b71edf7a4d94a8e
SHA256 9d96b3e5e8db8d46cd483f8e99b84e84da21462fab5e5324ac1d2f8eb91f40c0
SHA512 c68885bdc9377df8bb2f3199f44935082d14db3b99e5fd5bea1188a9347116e37afaf6bbe3f5fd996c3d99928b0a46bff5a398bfe50a972e315121346d88ccbc

C:\Windows\SysWOW64\msres\skin\riant\new-TabHeadBk.bmp

MD5 5fb047fb96e31a13a6953f2cc210f97f
SHA1 940412a521914aa25c084f77d76ad4c559d7b2f6
SHA256 7f9678d8047d1d4984f2976342931985afac37e87725241f87f6ae36753ce60f
SHA512 a262bb8457ce4ffd97e5cd7acfe0499beadaf3a8ed975f65125ff794973c7f2678005eabf7126a822dd208b7029f2910654648232b5b38457c679e995d9fbea1

C:\Windows\SysWOW64\msres\skin\riant\new-res_down.bmp

MD5 3d52b01d674d77f6ae5894011f00b9e0
SHA1 8423fd898735e5994e9f17f82bdbf7edcbee85ef
SHA256 2c40df5e2b3915c55430f62f5782d82646ba4ace328b125cd9b6a47e3a08761c
SHA512 1c739fc3ae21dd0b8be7933cdaab0c69d419737f7c205a54a8c3f2626c3270c5d38a0ae04ab5fe738e4c8bded68cb2d03ee39102feae5b43d6941f7cc0ce0374

C:\Windows\SysWOW64\msres\skin\riant\new-okbk.bmp

MD5 ad9c57a5fc88fb5f464a039d04440cb9
SHA1 4a31728193a0104b4102fd99ee4ad9f0f2ad1919
SHA256 598929f8ba0b317b59d2012c72eff86c3b61e69df27964d8db8d220e71b3a04c
SHA512 f769120e1cd5ebef9ab2c8c4dbfe7747b2a3565b909d355ede39ed7b2b13d089cbbfd86279f4a46b4149c188aefeda495b9bb2dc214fc6125b71c5fba1a75eaa

C:\Windows\SysWOW64\msres\skin\riant\new-min_norm.bmp

MD5 385bed648c6f3048828dc74629c31b6d
SHA1 49fc68925e646dc69417331edb332b5a7543bb70
SHA256 99a66f86392d76c12db4a015def530134e3a25acd7f849be8aa7bec0df6b5007
SHA512 4885b02cfc9245d5aa11d1bf5d762321dada8d01ec0f2685cb67691875d4c43bc99f30ba2cbfce94dafe75258acbb742764e58620cda939915c02b88ff3730f4

C:\Windows\SysWOW64\msres\skin\riant\new-MenuItemBack.bmp

MD5 28b5202254492842557cb03fe29d5cc1
SHA1 ff097a791f152584647cca99f49d8e007d85b358
SHA256 bcae9bbb4ccebb7a9147e8aaae43886a769e025d1c769b98dfe9da78a27b20d9
SHA512 db3d001f40b2ffe84461ceba3b81dd28857719492060d98283f045664c14eab7141b56311119f423452c5bbdc776105417ae2dd636cb965eace1c5718f365d46

C:\Windows\SysWOW64\msres\skin\riant\new-menubt.bmp

MD5 12bd08084be6406b68b0eeef850c896f
SHA1 807ba2ff56b393ce752f9f51b2c48f194c7fbea1
SHA256 897809704ed862a30abbe3ef0526aaa19ef296f7320e7a9c964dc2a3981f0b46
SHA512 b4a9944e7835f48190fca3e18d0924d955f1b3931cc3e5603a8c6eaf533d751f712cb4e0a62e02bda6c75a868e57d2ace3a9ec317d717d4a378ae8db51bbb074

C:\Windows\SysWOW64\msres\skin\riant\new-logintitlebk.bmp

MD5 0266e9107aa3e8e206e751e5e1734a61
SHA1 979ee5f1644b7b476fbad86ed7e7c8ee812a30d9
SHA256 9b28880ece3ebbc6b6f320cfa852a76aef99116d533733f1ddc69c670171537f
SHA512 b9754f70aa16b22251c9cddac636cc7e062bc9beef996648e4b7eefec174cc88cc35d680b340abe3957d99cef568084f3f167ffb37cd4c47526a2147b013f22a

C:\Windows\SysWOW64\msres\skin\riant\new-loginbodybk.bmp

MD5 8a33a3f78859092d3e3759a200ca6ed2
SHA1 c4739a287bd9c6da132e66f15142b44477b27d45
SHA256 d2f9a95e82bcc2f4a4601624aa8da7766d4eb2ca73e77dbdac2de7b05effee1e
SHA512 db4706b5e2ec8d12c733f6741f026867b4230365ea339932cc6c25909a363c25675fc5e206b99698316abb22ce07df3279db097414a350d62fc725e8e62a2ae8

C:\Windows\SysWOW64\msres\skin\riant\new-exit_nor.bmp

MD5 51c37f6a12df39d2e6f705abdac8dd91
SHA1 e6bfcca31c497b65879cf4933efa58ed57927371
SHA256 f0fd64f1223c79374683d79f50d6b0a687652d640266d7dbcd8ad1c79383dd84
SHA512 64b6e996121456cb3935cfa2acbfb483a1243e8f7eaf55a4d03a73e4ddef7f8d9682548103a9d01eb18aa0d631487e85dc8d8dc8b720850efdd587c845d3831a

C:\Windows\SysWOW64\msres\skin\riant\MenuItemDown.bmp

MD5 a9568a84dc895b9b4beb9457689e8846
SHA1 961f9044e4639ad19d84c7f916c9ca2235bbd20c
SHA256 cb223d346db24c4835926afc8cd349fc512cf201f4f4145856aedfffc13ddd74
SHA512 e2aa9793b2e736dffdeb8b997cdd4a9d9913448baf40884bfb88a2753e2613f9b4059e583d895c013dcc1c19a573992a1d13e7d6e73edf63394b15b4b6bfce79

C:\Windows\SysWOW64\msres\skin\riant\MenuFocus.bmp

MD5 1ffaf6c3c3346c8037ab59538b0ff455
SHA1 1c2ece08ea28762015bb27675c51ab8df2779fcb
SHA256 60a0913bcc4209361777cfabb2e32105feed8b1b84cfb827756e965dcde9aedc
SHA512 02c169c778349e4d47bed30849a282510f7474577a18ce4f3911f3599dfd331a0362af5cef023820dcf23125d8f8ced419fd75a235d0317178bd80257ad2746d

C:\Windows\SysWOW64\msres\skin\riant\MenuDown.bmp

MD5 309a4a97f450f01199cf6526192e27c6
SHA1 8e8b5139d01c99533a7eeaa65790693118e52c35
SHA256 f869a49dfccfed62542380536c5f934f3c0188cb6455e199c822dc788d145d0f
SHA512 b1d2ecfbfa5af8a350e98a9a2cfefad978ea19b5f57595e6dfd336cdd11e4fc2db5d2bfe4ddcf8e2772da0bd6a9a596373b7e153b534f311d20a4f61d4398bb5

C:\Windows\SysWOW64\msres\skin\riant\max_focu.bmp

MD5 afa141fbf2596286e5cf6eac39289efa
SHA1 6c75c923e2347195b319aea777b4ebcd1e582f49
SHA256 1de98291d3979137b8d6900130bea3ef297ec7df14848a2889f8f492093eadd2
SHA512 fd2610721d2dffa067aa744668a55bee86c6f6a064b740f6ee2bada9746e52e9b262c9b74c9f04c9a81900ce978fdf7948187b5f68028e1bea83a4d88091203c

C:\Windows\SysWOW64\msres\skin\riant\LeftArrow.bmp

MD5 6e864802af362f547dd22523deeb916c
SHA1 9357f46d93e84aa379ca4191705a8fe780277ba2
SHA256 1864035c8bb781864a72b84bcfdf35675642bcb8201b2b95de6a9625d982c3c2
SHA512 91136ffab7ae5842c01d6293db83a3af04562f28561e24d7f32f58b9858c2fc3641448e4575026d131a210ea2c698df82aabe8ff0608fa4f71159526b4b6da70

C:\Windows\SysWOW64\msres\skin\riant\InActiveCaption.bmp

MD5 16b769e6cee46d2f687ec83a921470c3
SHA1 4448d477ff186f486a5a4f8ce241ae184ea858ba
SHA256 7845c7f32da91d39712d7e02d01dac7c01407b65f70eb2f44fc6bd690263ddfc
SHA512 c93e10f6cc197cab17f9fb4b8b2f49a380f623cbbde56036b8c2aafee85d0ce67e96626fd8e72fb7091fb16fd5700b741f0248f68c94103dc628fd4cb9e9b468

C:\Windows\SysWOW64\msres\skin\riant\HorizontalThumb.bmp

MD5 c34e63cd2fae92fefa72ad40b14eaaf8
SHA1 c91432a763bd22a31354c6b3ebb7056556095589
SHA256 114b40bb2c3d093cc23b7b3e19751d92beba6628ef88c92e72b645a6ed83a5ef
SHA512 da1071be6205474aca7f89716a93392a8307dd0b627fb875a61c1ed0f0a1c6cbe80eba56aaed4b67dcfdd535a1e993ba510c38694b29b149952e358365a130e6

C:\Windows\SysWOW64\msres\skin\riant\HeaderCtrlNormal.bmp

MD5 aabaf6a71535d80772dd3d15eeb20186
SHA1 1a7391b4c1e882ecee24c43fc6f53d3964b3a99d
SHA256 8e06041022fef2c23fd7359029d0e4dfba990c3ab22dbd6c494f43351acfee5a
SHA512 a29c9ec30ca960c5b0f725ba08a976613ccf1423217fc440d2f2effc3815d047641c50805cf8ccab794fab6990785f5ece69dfdc4d5f653dec3aee239c9388d0

C:\Windows\SysWOW64\msres\skin\riant\FrameTopBorder.bmp

MD5 f544a7ff38fcbc314cbb8828f84d59e9
SHA1 4fa7fb36a645431d8c5e40cdc9d782864e452464
SHA256 87d150486d12132efc73c465b95a2d7235d31ff65330065597dd567e412944cf
SHA512 0bb66c3d5d1ef7c3d72f7d0f3f6c021beaa531aa97668abd9144ee09c01b71a4260843d2c49d553bf873f2a7b107751fde24702cd511f5e1fb0a74f0330f9faa

C:\Windows\SysWOW64\msres\skin\riant\FrameBorder.bmp

MD5 76f67eb872dc44a3954de8e6c5d0842b
SHA1 20189c2b35c6f79e9c4cd44eaf62828cc5efe0f9
SHA256 8333397dace0b296bc5d3c363d0ac35f6747abb353fcbea6973f10024278f2bc
SHA512 83bafaf910ba5e1dd876dc2d9c351c7cddea662b64ae26aff965b90165dda555e6b6255609bca519e35bcb2f8c04ed27347b1d870a7a43d3c20d42d08966b62e

C:\Windows\SysWOW64\msres\skin\riant\FormViewBk.bmp

MD5 712827a7ce2dafce1743e0f7a11ae37e
SHA1 91bcea5093f75aff8e5b69d9a2fd01a07a94d786
SHA256 4082393005e910a8cd3ef7e8b21b8fb706a46c91cbbc083d316a36958e19fd70
SHA512 18f584c32480b2c7cd1b9ea469278d79b65a0dafc452c314db978718bc8ee05caee07e23fd51a2c4d82ebbb4db161823e9111b76db4e95dc7a821eb09cad01ba

C:\Windows\SysWOW64\msres\skin\riant\exit_nor.bmp

MD5 79c07a8feb56048911953d9d5a9f293e
SHA1 e7eff580a900f01a4e5a8eb2bc31077e1a49173f
SHA256 12a4b8048ddeea62bcd34905c4e06530ff6db2a9a000f83de565daef534b2e1c
SHA512 2db826bc1e7b714ee8276dc00d5f4ac56e1a3aad51cfa65814546f2d6282b2628010651285930e4670418f6bc39ffe52e3d929e0cbe81ee1070570a2a17cc843

C:\Windows\SysWOW64\msres\skin\riant\exit_foc.bmp

MD5 e71c8a3ccf5bbb8dc0d3c24062293dda
SHA1 43dcefe52ecbfb2da1beb084378c749e2e2dda9f
SHA256 66ebfcfd18d7db2c4566e177109d7e27fd898ee440af3870ef493c36a91a2e12
SHA512 c653294798fd2c23db37732a47206fb2e6554c7091bacba69c8afc0b2a2eff6b1f5b20f8cbfa67e3ae66c59057a0f79f99d11c365535f123e5fbe735db881b5c

C:\Windows\SysWOW64\msres\skin\riant\exit_down.bmp

MD5 c79063224b7fd3e3c26cd530667cc15b
SHA1 5ab954821ff66ceb515cb7d19ece6e3a346acbcb
SHA256 37a6a10af5e0e53d00b019bd4a1dda76e77c2e72651a5cbac5be8fc95cb127b9
SHA512 b689952ca514692c6bcac40b20934488e8443448adbcfe96419a70ad999ee3880ca7473e9af9c27efd4a3d16fd225ee0c7133929bc692337abffa300af705f52

C:\Windows\SysWOW64\msres\skin\riant\DialogBk.bmp

MD5 b549e485dd0cef3642d90b210113d2f6
SHA1 904f7eeb832b759ec75bcbb534d1c91a98095c96
SHA256 5ff24ffd65a73004d22acce48c19d644513b119180c27f8e8585da20babbbacd
SHA512 2f07d692eba97d31ede06ac0189d33ebd060e48143e6541c59d763ebaa62bd6be7a335b5e41b998aa021eb422a5d7f70130c54fcfacafd8ecc81adbccd3fbf8f

C:\Windows\SysWOW64\msres\skin\riant\ActiveCaption.bmp

MD5 daae82e17930c88010f54f831e7d8063
SHA1 7703429772fafb69d90c368b9a7e7b627426fc1a
SHA256 0392e12209e3ef3a35e60bd8b082f2fa7c69bbb567fc34ba0c5cf736f2ac888e
SHA512 1210c2d9117676c29d6e1eae6c9bceec585610b905fab99f7fbc83093189913c5d3d2becd42f5a0d3840e8fb3232619887caebe504904dfecc5458b2429b2ecc

C:\Windows\SysWOW64\msres\skin\icon\wifi.png

MD5 9ca91f366daea7ee379b10e2fb780a12
SHA1 c91ecadd47236f1feae4a7afc50bbe1d1f538d88
SHA256 b44b14cac2a40e7bcd3e46afd7ddf23610634957e9598a9a10da55feb5d4855b
SHA512 86489b98fed9d02f6bcee75b779d35e32cbc0bb2d4c46b0bd67cd3571b7e4a6e86818d683ecd7e68619858875e722baea9e6ba83919150529b3e92426a54a552

C:\Windows\SysWOW64\msres\skin\icon\wifi-no.png

MD5 70298cb017ed16a49560bffdae01b572
SHA1 e4326fb63a69a2a87f36a670af92decb2498f114
SHA256 3928fa3178b1bbaf2ca1c24587bff9b890657433a1b665fec200f72f808b08f8
SHA512 62d042975482e562b4542b8310bdce1459568eb50bea241f6a2d1da91bc739401b8806f04e7a36f2b695a04f8c6de427d4759d3a507b3e80c6f45cd4301e918c

C:\Windows\SysWOW64\msres\skin\icon\usmall.png

MD5 592fdb02279dccbb5ad2aad8801b45c2
SHA1 120d778a66051f0e494c181c9cc30f8bab63298d
SHA256 56a65c67df886a34ac240f2a11a851abaeb55ac2559091025e7f62eab678742b
SHA512 e9326cf7e68b579f58b02512bc530faf91ef03fd8adbfe9af37a595e526e3994b4ad7de96ba7b2e759cc7fd1d85712ac9d7ab9011076efef7ad96846da6e0d47

C:\Windows\SysWOW64\msres\skin\icon\up.png

MD5 daa8c1a486c65557bba1b2715e5c5b46
SHA1 bf61136c9dff232866b17b1abf6a36b66a3b228e
SHA256 056342eecb0895a031be3ccf23b489b4c9a53466013743762a3cebf7a772d6cf
SHA512 1e30a283657e9731ee2237c7ec2e1d8a58982b09ec02050639ca1fef1de58b7b916e627e3d83f0927a34c555f1f224f028ad3cc7f41a13dee66cbe5d435b4488

C:\Windows\SysWOW64\msres\skin\icon\soft1.png

MD5 fafade16d6c08c7c322e8e92a358e0ca
SHA1 6c8f4d421f718768b796b7ba6ec7a6780b524ea1
SHA256 bfff144e58423053320e91b34f7477c1f51ec13c0468e2f77fc53862e9107cfd
SHA512 c00e8f3060de46662d51fedf0fd97d276a0274e4e2d9419e2cfc236a887b959049ffe689f53f17e1bb7ff665807493097411d529e3a84f8625406e93b21e6fda

C:\Windows\SysWOW64\msres\skin\icon\pNetDisk_1.png

MD5 328b209a4b30f6e3840f5edc22296acf
SHA1 fdab9e95a41e4dab67d7e61d4140f3bcecd89dd0
SHA256 dcdc502d8c11b209d86fef4638715fb712df45c54298cb869dce578c82e5d4ef
SHA512 4808aed2c5d330b97167b541f514a30c24e0b45d6b4543ad245ff636454f90b348900062926aee0c50c254ac5cb1e161858bc36e2ca51e975e717b5ef114fce6

C:\Windows\SysWOW64\msres\skin\icon\pNetDisk.png

MD5 28db2590ecea8478c6b1bfc37941f351
SHA1 884f1db9622c5466d3a76d9c49e967bfbc0c161c
SHA256 16d5b7cc4c81f2add22ad65616f01ba5488ec9ca3aed171bb946e64e454da866
SHA512 31b0c49ea827c1ffa82041e573836d50bdf0d213346d3547f43bdd5f597818b4218f707d820eaf418de2decb31210e04078b94fefc0aa7db6f1bc8004aee411f

C:\Windows\SysWOW64\msres\skin\icon\p7_1.png

MD5 74c97aa0c28d7acc8b3ac809a378ab43
SHA1 949e3a1dd67b47c96a90d0efc6120cfc6cdd908b
SHA256 50a73b7de9dce38010fbcaaac8f4b50038b34d5eab7d6764e1f8cc2c5388cfa6
SHA512 a4e208ef55c2fbab70a9240de0d546d0a48e7979136b3981e2a7cab8f405aa9ac64f93da2b9f9030729759b6ba1190b82877c2cce4d2a09baed3ab77a8709bf8

C:\Windows\SysWOW64\msres\skin\icon\p7.png

MD5 607197c8f8f1047876e6c9172ffab140
SHA1 0bdf36e3e1de642aeeda7c45377aeebab6681277
SHA256 51fd391eeadd4ee7ba07a24991b7446042362b035dff4638994eacf87de16e9d
SHA512 fa0c19db1562e75a736f6f155e4e5bf692657fa4c5575e103cc575c7afaff88701512ee186a6a4cb86ef8c3e9417e34ea7fefe37518fe2f250b528e087ec52c1

C:\Windows\SysWOW64\msres\skin\icon\p6_1.png

MD5 b80580567c2ea520173889a378474c92
SHA1 723a314e90ca992b1b95ef65eab0982bed1ac2f0
SHA256 ca012a9bb5fa4f001657ae9d55cf5c84b0e6dea65ecc4eb782e2561f2c5847d2
SHA512 0ec58325c1a09f2892287040527ae3a3c2fc442e0777cb673a48a5ed32c27ae8b9b8b09c10ec455e3cd6de4c6d92d5fa77163a78d08a612f57f264d4b703b1b2

C:\Windows\SysWOW64\msres\skin\icon\p5_1.png

MD5 432c09cc3195c20ee9ae292cbd703212
SHA1 53f6e1d78842bf6375ae10098f8abc4d54b7e70d
SHA256 736eaa15a7e7c76f53dd972f74a688a52a3a5f93a6eed3eac5eea45b29dd16bf
SHA512 131390422473182f2c698cc72cb93d45de0142213be59ed004e2c145dc6b5df0db99ff6d32d7d78aca95dc34938809d4b25ceb2da8d91e755c74eb7a386ddf23

C:\Windows\SysWOW64\msres\skin\icon\p5.png

MD5 ff7900b33cf8d309e3a61f45d64e7c91
SHA1 6334dc926661446b50429312474ed3a1051a9b8b
SHA256 03b4dff8b7b77fd8085ceb1dea006e1b10108ac69a49833dfc46893120b3a2cc
SHA512 81775d35a0a0ab58baad3970b75ee584f9a495af9019b53bdf6e3aa6f141b869881a07de60423b5b55afcc0c664c3454876a048b35376aac65ad691bec6bf74c

C:\Windows\SysWOW64\msres\skin\icon\p4_1.png

MD5 9a3f72316be8831a7268072ed0746895
SHA1 d0085afe59c72ef8dfa869807748691b40b46a0d
SHA256 1b735bd2d8187e7a9c4e1ab4162c2fcbb3cf70a2e2f5b304cd1ffde68984a2f8
SHA512 845c6181e428de514e2666a4f6e47b8c870d095932fdf84ac0a6a5a16fd68a13a21b1200a62e9e509fb9cc1b2e20049a70fb4ba7f2bb236aa5b6bc6c41a1dccf

C:\Windows\SysWOW64\msres\skin\icon\p4.png

MD5 b0e29af12e01523e3aebf2a244c20289
SHA1 887602a3c89b0d90a49be8b46ccca635526a11d0
SHA256 e45a156f8cff6f4532e4dc1a6e57a6295522d464a6d2a52c71ce4b634d40eac6
SHA512 9056fe48414351b55230e4899f349fd19cc2196252e963f4e9618f96688b72ef624aa16ec65df38f939601fbd41f13fdbf9d36392144bb4380a71b803a4f2226

C:\Windows\SysWOW64\msres\skin\icon\p3_1.png

MD5 d763d43de32a0de6de72b2a4104a3546
SHA1 329db196cfbedbfcf7a6c23eea4729a25aac38f9
SHA256 2d5aba1d3458b0af77e8affa448e043902fc251cf9cc1ad8599547dab4b2f24c
SHA512 082e6376c75a196c7e3cc938f6499cd82da1cbd7d99484a0dd87d8b745379ea5e88530b4a037fcabe2cd6a0e488e8a11d79968f68aaf4fc68accdd0e9100c05a

C:\Windows\SysWOW64\msres\skin\icon\p3.png

MD5 bb01e50abebced31e844287505aac23e
SHA1 804319b2afa1b8c2b7bfc5fe58397a72d00ead39
SHA256 f743324c2a0fcdb446a744ca90cf278e1bae2d6a1027aa75e6478eb469747bf1
SHA512 9b1097c0c8c64b3e20aac18f8e569cb50777e1f83ac5e16554d831555c586d5cda221a29bf4b2e7fc234682d3e2a352546b157d57bf9cd9f9d6ed1a57d0421d0

C:\Windows\SysWOW64\msres\skin\icon\p2_1.png

MD5 0afafab3923b8d82aa8f26c248d43c83
SHA1 af171cd36d438838f2b70f980cd27a8ab890db63
SHA256 8bc5907b8dce52d8e6b04db3e778f0e79e60c65034bd96f3ea9e5bd134961fe9
SHA512 001f232839b50fdbf7a18ac03fd763c1aaee782fcfea83147c027c72e6bcb75ddbc6aaf3487cd70d51688a2ab05f9c97d044d67c1e8b9b5a2813d25a8b7dfd31

C:\Windows\SysWOW64\msres\skin\icon\p2.png

MD5 9cf7266663ab86a3b22282e8857bb36b
SHA1 7cfb5615b254ee0890949674aae6d85e8337886a
SHA256 395713c6bda03d6b204fee18b118095ea2171c8ae528a4235d624a963abe4324
SHA512 84c0ab318d46b5836f22fa02eaf2cd4322c9fd035456b1076e819129366a935420d1685443fcc64124be9300c35dff9720430e43d28f3ebd0df58ba18b1d433f

C:\Windows\SysWOW64\msres\skin\icon\p1_1.png

MD5 29ef6447fd64b87ebb581945c13928bd
SHA1 ada100938a97b4451d475f5351552d16f60558f1
SHA256 8fb6f400a846c390f23b609fedeb7b91aab182d580d3019f3c27e3062d512bde
SHA512 42a67344d7ba22757205a3e03fada64f91a89cdb76fa51a545bbb14e06410434a883326fafbcae6ebd910b5c459292ee5b71e0f3fed49c98762a129e65f8dfa0

C:\Windows\SysWOW64\msres\skin\icon\p1.png

MD5 edb974624d24c9bcb4dcfd8d28d264ed
SHA1 f58a0c9dd42e1bed19b473cb5558dc8997d1627b
SHA256 68e1b29cc57ab61e90ced54d3152e85e28806e5723a650638def8c67050704f4
SHA512 1dbd513eed04a6e3f1a65ba4a4b3d9bc03c23d47401e812321d6050c5972094283129153270dc524e549ee7b3f088833a1779b0687ff2eb0ffd9c80154e6927f

C:\Windows\SysWOW64\msres\skin\icon\p0_1.png

MD5 94a7615f624c6e1743e9a7b1418a71d8
SHA1 da70a2a1118744c0de9fafb935f5a5be57156623
SHA256 bec6ab41af13b1ba41af43875681b1a1ce11fdbfb35b7e4c66c00c4f170a26cc
SHA512 9a4741e4630ecd33a647985fcff2d15a40218c78cc2e608fbb833163c5b19c5fa731310d55dc715049ec5def6442e5c478d152de1db3341314a1cc8a5cb3120f

C:\Windows\SysWOW64\msres\skin\icon\p0.png

MD5 4081330a91d4fa354924bbc56d1813e6
SHA1 d0c317d13947d24e13b6a51b1936a2191f1998bd
SHA256 08c2c80db2822a1192d1ddce0c4d2ef09d333eaa2a538f2624b8fb3dd9a41142
SHA512 8f30cfa19c6866787f9e37d5fb53717700f32277e3ab18871d08dacb68ed7853bb2ba960e2665dd42bb66bcdec97c28f99b834be55d18e33d633567a50bb496d

C:\Windows\SysWOW64\msres\skin\icon\jzai.gif

MD5 9e0adf17bc72f0e29fd6181ec56d491c
SHA1 b85e3c53200da84a68bbe32e55045ec8a927f2ed
SHA256 8e27d6d64df364cc62efc607fb08aa834891da819d70abedb30806001dae5da1
SHA512 27dbcfabf4397db8a789bc8ca99e446b42b59340c120eb369ae1193f2a7a39d2ce3c0af17eda273d0a66f586cbac933dca45c51c5a0d8c8e645ce717e3ec43f8

C:\Windows\SysWOW64\msres\skin\icon\ico_ture.png

MD5 b6664c8e59218355f6acbe0d37dd0c6d
SHA1 fe4b96e9997eab78e9b235691befe58b873abca1
SHA256 33ec109b04a70634863ca60f64181c1ba8c35ef84beeda3e164f48ba07736e23
SHA512 8a065cdf7e8921e3e873f82e531c024ffe1bec2cb3d91aa01155d565444643588078c0bdba6263a60b624d15b3f8d77791cb199bdf5b26fd778dbd0d9e86973c

C:\Windows\SysWOW64\msres\skin\icon\ico_force.png

MD5 6859cbd1c0f462b10021e96f7ab35761
SHA1 ff9ba6b9ce69745681f38bd3c4b760942c55d5d6
SHA256 5add4c8441be1b839955697fde7e79470a72d70547459312ae02d65a466a1994
SHA512 b8e07c176581dfae041f4e7509d053ec2fca5a5eb16b9258285befa004b417f4ae8795f4088477f6922ebc0d271dee7914ab17fc7550518c46b3bb789426e8a1

C:\Windows\SysWOW64\msres\skin\icon\ico7.png

MD5 0a881ae90de60ef3f4f187cc2019287e
SHA1 683c1b8cd656e7e97583147ed919d3deafd12be5
SHA256 6592a94b2743b388055ce3e18e5c432010bce49002d5c64f9950fb5d081b9d1e
SHA512 3db6cd2a497e6f0ef8f7efb9a6abb892ebd6fbf16d4d08ca65e4c595241260f33333f4a27727e0101e4480b26dea7f79821aa058e518aa8de92a68fd5f24c106

C:\Windows\SysWOW64\msres\skin\icon\ico6.png

MD5 ebc678da4190c9a0bdc5127928c0d0e5
SHA1 34ff8e4c3e1c69b92321c24b6b3c7205fa4e69f5
SHA256 20d7846ab7157785f4f5fb58e0c0a130f90475e6bb33c9c35317dc44bba67207
SHA512 4e75b2325b7cc4f10102e6508697fff9fc02405c1040a5c3f7e9da57b43b416d50d2003ecd59ac44d207be6b2e6c715922c1fae0616065d94aa05dab82281a86

C:\Windows\SysWOW64\msres\skin\icon\ico5.png

MD5 a72bc621ec69f6d076f24af43701225d
SHA1 931aedcefafb95e9ed07bfdcc33d9ae2dc9d41a2
SHA256 6efff1198fb3488889bebe792dca2794d7aa6d0e04a8c693a561065e6658de66
SHA512 c091b63162ac5cf3773db9c16689c39b51c1b718d3c2d3358d8bb3276a8f17178067d031d966b518663ea37d59d6a9a8da9e0674575dea0b08bf60908e546199

C:\Windows\SysWOW64\msres\skin\icon\ico4.png

MD5 4ff9f021ac4a7a57c5c1a0711ef2e914
SHA1 1d72805d315f36028996b6d1259271393a6dd383
SHA256 75e82832eab67f1e64fb571b98dacd9cad0440f32ebed46814bea85f43e8a586
SHA512 a44affa3b06c56d0fdfe0ae095581b9dc9437ba50e6701869eb420c21e3762141f71f129a46c7096518b375998a7fcac01aca2c58c6cb2dd76dfc9d39119628c

C:\Windows\SysWOW64\msres\skin\icon\ico3.png

MD5 6609c78a2756d90796f31e348247e325
SHA1 f70ca9c6b285366ecbaa2f6ff5cf646b570aee15
SHA256 ce86c3ee77807325bf0ea60ff6ad7168fb8d9ab98ac17f907fadddec4efed928
SHA512 dc429d295eee38364cbc9fdb331d521a6ad458e03af573d207cce73db980345a9ee63410feed0e763e77d2d149a22494de81ac1d4462bf0c6497cbcf9adbc1eb

C:\Windows\SysWOW64\msres\skin\icon\ico2.png

MD5 3b2adfa4279b9421546095989a42c29b
SHA1 efa0b2c66bafadec1277faa5b8636adc2eca05c1
SHA256 84eb72c4a70d4cb82e8d399db395363b037f7c69954ff3abf39918b586a77716
SHA512 0d328233010fed4d463955a1113d11b38960c20457199e65975a43eb3d0a7e9aee3047c67aa2c2a550ed04fb3fbeb1cec2aea1c447cfb2b5ce4a54c6267bed33

C:\Windows\SysWOW64\msres\skin\icon\ico1.png

MD5 8e3518321e329f5eecd82abe6a9a02e4
SHA1 03ab4c69d511daefc00854578d82f467f34df76c
SHA256 c88742bd594eeeb34ca9e761bd48712a291b887d6f98ca63a40c251816618237
SHA512 6f51aa0da8d6a6afe62a6ca06e49483bc3862ddcf37ff38e908d429a321cf361c4174cd0dbcfd8ff667185fbc40b64278ef25415e290ffce06daf0b94ec7fc0f

C:\Windows\SysWOW64\msres\skin\icon\gx01.png

MD5 2a260448e96a03cd4c8afe2f72809232
SHA1 9699249cf87a79e070191925f735b2a6b9e1f462
SHA256 48451401a347384b2404118b8b02cbfcd5b11923a3c099014c8a285a1c108684
SHA512 db5f7ec7039c9aa1b226dc6093c13ead84004079b946f3b6b212ad8bd4842cb1e662a03b59daadffc4103d0c5283c15b01552ce9b1d04eed5c6ca1d9e07bd743

C:\Windows\SysWOW64\msres\skin\icon\chat_1.png

MD5 b2a732609d7de098efd2be853ce45982
SHA1 0c352bb24f80929dd7fcd528b9c9b3ac823ef7cf
SHA256 bb2b5e55ae57c268ac1938afcb8b94c7495edd7f2b84b61eb5398a3c4482eb8d
SHA512 3f328d74774a319b4307fb8ad09154bbb92d621f6a082dfdbb556c1edd9b21604d0249bba84165677202139fa5645a8c04249b7eb43a419f2a5a3172d24af580

C:\Windows\SysWOW64\msres\skin\icon\chat.png

MD5 9b3f28bc022c51bf16aa758315eeda27
SHA1 c9162efba40795a7774b7eff804a9ce4a842b0f5
SHA256 3554a235a6583693018afda7dfee7781cdf9639068cd531bc44d4bd3d9ebf706
SHA512 87a7c4db1ca0499e13d453a2033631676f8d6b3e68dc2c615d02759227f6729e596aec79fec79c37173ca0f88ad652d106ef97a090313cfb75f3103a56533cff

C:\Windows\SysWOW64\msres\skin\dlp\wjj.bmp

MD5 fed2e552254a627da3ac3ba69bcd947f
SHA1 8b6914276a557c0627949371a866c75ee5de9b02
SHA256 41ddc657fc9c98a59fe66ee439e2b553c2da8cb796c5531365b6338f19d7558b
SHA512 5efdcada9cd9321f29366cc6d07785e958809b0d754c29833f45bcedee37cd18b917bc76098f856579046c82f48fdaaade87145f3f731ec60a2e8d91a9fc738f

C:\Windows\SysWOW64\msres\skin\dlp\search.bmp

MD5 aa3eb3caf37c2490cd54415e502159d9
SHA1 ca3ae832445e10f95e097664e091edb1b03cf53c
SHA256 7ee7e4f2729fe6444deedf75dca40c3a8ec707b10925173433f9bb51d6c60497
SHA512 1da7b970856b43d66eb9741aa01349148fb626cbe89643c5d781b5b382ede415e2c81b7ad02a9261b06e85872e74c7611d4a0651d4325cace05c43975259b1a5

C:\Windows\SysWOW64\msres\skin\dlp\safedisk.bmp

MD5 890327d9157ba4e419750df4475f8e8b
SHA1 194fdd81da5587624b32d2bbe195aa6878633b6c
SHA256 3302a9d005bef5ce049b8e35cce912d15725226097a5393d5b8c16ce1f76f2b9
SHA512 f05f7bbc33d4259233a18c06ed104524392bf685838b7a7732ebdc54e25ed555d75db8b6b0553bbe146dd1ced38a2475c30e2e999b9848de866adcf0ef86e478

C:\Windows\SysWOW64\msres\skin\dlp\ppt.bmp

MD5 818943abfb3e2f6a66bdf9aa1b60d598
SHA1 12f2ba06b4322a3beedfa6edb8ae0abe886f102e
SHA256 be2292ba642b8c2aeb04483366bfb85771bf4fdcbe498887b1385b3b4a00621f
SHA512 64b7a9e6af470a617472e5e818a691991003e9b1e436deb7285e65fe3f343e0b124027f8dfc63dcfd3e3087f161b2b279dfd29195b6402f8ec1ed2d83b3d4c9a

C:\Windows\SysWOW64\msres\skin\dlp\pdf.bmp

MD5 283b536288a9e2064c143d1e0d59799f
SHA1 97317faf27adc622dcfd23374017eb558cb2215d
SHA256 f9941e6e9846314895e88f5c8e7ef2bb6fdbbff737500456edbba2563d05d72e
SHA512 bfcb8b024fb2fa5188603a0e1c14487f9a8d5798f6d9df493b8235b431fc9d8189ed4a7b353c5c38bec6d318e796627ef26f7275fe4d19f2573dbb82aff215c0

C:\Windows\SysWOW64\msres\skin\dlp\jpg.bmp

MD5 c605eac0c8b14425df71f1a6a336ba74
SHA1 76ee8848e788bd3fd3867868530738eb0d803ec4
SHA256 ffcaa3814d233248aceddff26537388eeaf8121179796808e39fcc6578aabf8f
SHA512 d5e5bfed39a129f9dc996d2cf8a069b900965b927221fa3d02886b390293aabe871b42e2e074318834779287e79a342c1ca960e0b81710e487e012a997790d31

C:\Windows\SysWOW64\msres\skin\dlp\down.bmp

MD5 2be1b162b7206edcf6905d14fb3bb112
SHA1 4b0f6c9c03b0f800c619a653dace5fc77ad0e2dc
SHA256 dc2583c8db29ba15dbba7d94a529a6b7d5e4292bf771cc5343a7f2bf831528c0
SHA512 fc3fd805d268e3e05239c8825780a01f81452a17f240726f32252bb9ab18246689dd37bc1474b1070fad8e23338b5520f9880365de6cec7d7ac10e2eafdfa0c0

C:\Windows\SysWOW64\msres\skin\dlp\doc.bmp

MD5 4c880ed17e3bcc32376ffd6e26b95a6c
SHA1 595bb97686084b85985bc80deb3b1de438497b52
SHA256 06a9b983f1e6a5cb1f9fd06bea8871b12538639fb46bebc43711e7d168e00de7
SHA512 eeb6437bc365c0831e4a3c6b1129685ca6c2e3920792fe327053dadbbf6e714109e476ea15230c02d3d50c0807c5065e0f5a4b34e70ec807c7d09f3649a1afb2

C:\Windows\SysWOW64\msres\skin\dlp\dir_splite.bmp

MD5 bf3d7f9032429416a77b3f49fb9b20b8
SHA1 556d9d37a14897c26058f514caa1b7f6b5efc618
SHA256 6f22f362c80aad368be42d7f3427ae753222ba89255bee1f4144912e7114deed
SHA512 5efa66d4d09b447a0a22633276788daf9a12142ac657994448cfd4f3692186d14ffbff873101cea69d29e26994849d29687a3c63a40e638094fe7bb70d51a5fe

C:\Windows\SysWOW64\msres\skin\dlp\dir_bk.bmp

MD5 534a55ffbd781cf6ca85da7fc3dafb33
SHA1 c80bdb1290f6414d69f52dae8f88c041a80316ec
SHA256 5a61bdef0dda5f82b5c3a69c8ba7f455a44d3dee05bd9ec3f569090ef9392318
SHA512 033178492c86eb6c1ceeb2781b5d249443085abf7e9b639b185adb3108b4cd274fe3126ba45f398d8f64d8ed4b18eabff2de11a91533f36fa385d46045871c10

C:\Windows\SysWOW64\msres\skin\dlp\dir.bmp

MD5 724cda648a9fcd16f5e8ccc3f3a1151a
SHA1 bb364e9a4a90c1b0cc81b9539dc0083607d52db5
SHA256 2d2328e9496fb86306febcc763fc01dbde94dab837ccfb3c2203419c446b3c3d
SHA512 c57c851b698ef83f6aea33af7d502c3aae76bbe5a62b6a7f4bf28fa8543dd51468ffb210859cc691c329a8e7a2888ac8247dd6d632e6af9d51e00eaf63249d99

C:\Windows\SysWOW64\msres\skin\dlp\box_3.bmp

MD5 b77c1f2d7952d92cc476fb5e96683cfa
SHA1 7ac29300051fa68c93f9d0888c199e2f3e3244a9
SHA256 a45aafbb2bae30fcc6f4ad6c8f5a533205e5e045b87fcdfd8307ff6121e55c46
SHA512 db37629e2fafce25168bd035204de0e5bef8a8a8ac553c3044c0ea61b0d02dc4c0b553b814ce0e047d18b6d14b9ffc0913e7bc022bb79bfba733c0333dfa6a86

C:\Windows\SysWOW64\msres\skin\dlp\box_2.bmp

MD5 2d2e72fd1226b25fd6abd74409bb36ef
SHA1 912917dd801ddf3951c4bf0acdcfe4d63746dd35
SHA256 9df050c7bd026b540bc4b9c9bfe337611af85ec34dcc0a061f296c951b895e9b
SHA512 a5569789c81ade58b2417b2d83c3dbc09e7ca1f52063d44fa138def823a1beaedd008204591949e2e0d390c6488776c0b911a9cedf4bb1d9e4f625f417c01073

C:\Windows\SysWOW64\msres\skin\dlp\box_1.bmp

MD5 a29a325a7789d33df2cf7122578c1162
SHA1 6b6dcce3f93574766c493ae48399565fcb9d4faa
SHA256 7ba7b4720e213f1e8bab771f5885845c9d01daad737e90b947e7335816b32c5d
SHA512 0bd351e2fa0b7c14c0d01b1b9498865897135cb5d5c9e61785870117201a258f8ae79f6f77c49e2bc67781807d24a7456a182cbb6aef0aa92819063a5b287af5

C:\Windows\SysWOW64\msres\skin\btn\zhuce.png

MD5 14b19124b5ca404afee8b085fe0c3d65
SHA1 f9a88586e639c8cfa5acd9b109b7ad06084e67f6
SHA256 3b85f63ddeb0000544977b00eadf1f059732496518e8f870685e90d5b8de0ec6
SHA512 c672c03d5cbd645db447071b9f3a48faafbcae0bf8f57ac9655e76fe6d700a42127c932f0a0116cbc1b9aab62bdb3be498633c0cf2f7c01ca68b884c30142e9a

C:\Windows\SysWOW64\msres\skin\btn\yj_02.bmp

MD5 25a84b54ff340670998291321893fa1a
SHA1 85af36955dea5c6f17b9ba9a7fd977ab94f4685a
SHA256 f6f1d3214cb9af58bb45fd5ff866fb0e2b695c8758cac8ad86ac2ae77aac6a0c
SHA512 dc36fbb0b71b5261ae0fbf0de1d72e31f1bf7e001526c7a0818286c4f3584ad773fb242d90664b1abaf8588ebf8ca612895da3614382d9a6449fe7888c1db575

C:\Windows\SysWOW64\msres\skin\btn\yj_01.bmp

MD5 c48069874e1d34e5bba67e7f4e843bdc
SHA1 cbc84e5076f208e6951c14d618b47dfb94f393f5
SHA256 5dbdc330251b3f8e0178e61b61238e8294fe3eb32179abb2db5794cf4527b1f0
SHA512 a94cd9df3de5f66e1f078d85307c0d68d542819f8fb29d5961c0f3d5c6402d0a2aeac9e00a14ac29466a669ccb9529dfb741c83a2aa26fa82aa29ea97634af58

C:\Windows\SysWOW64\msres\skin\btn\xx_03.bmp

MD5 7e9d6969104fa9f0ad69fbca8aef68a7
SHA1 2632f13ef44f9f39d1eda1ec801c12e51a57ad27
SHA256 f1ac25e1552e08cebda9693c51388b9d47e1609ab8db964c60fe69dbb12efacc
SHA512 9aefe528f4cbdc85f5fb774ea8698b258a09cbc4474690b4e1be85d5f28739f730ce052adcc45438aa6b2cf69e871419fc3f1ac3e103a7802e14888c224dd06c

C:\Windows\SysWOW64\msres\skin\btn\xx_02.bmp

MD5 9f50254a0e250326e2fd8378a3e24937
SHA1 76412f98c86f1553624b29f5402e67e0fa51d94f
SHA256 91f513bbac064c5a4911f2ced5a31619c1681e895138715a4a361ba1cf649b90
SHA512 3b298e4d4857918fb7dd9a1f1d3090f95d73a72f4ed0b02db5e3b0ddbea5d212621e98cf5b7a044ee784aa77f0228bdbaa959afdbcd02b6dc2c1014d928e7a29

C:\Windows\SysWOW64\msres\skin\btn\xx_01.bmp

MD5 59c55b6efd99eac43e28e824e606f9e7
SHA1 e1507bc1d0a96762f108d47c9dd6bf806672ec28
SHA256 cf3658c067043599630d4298843a4031280fd729541d8dfa3b8f31bd1af07d80
SHA512 10a21820e4f60feaf3a6efb21f6408369d34c9a3aa0cf1973ce0b5c857af15dc29ec607da9ff1d586e03ad81ccbf5a36f159be8e62075ebeec719afb509bcea5

C:\Windows\SysWOW64\msres\skin\btn\xuan0.png

MD5 bb3a4405f2a9d5f4f6bd8ec8a22c0619
SHA1 28f7c5aaf5ebe2d7699b4d6692cca065dec0be57
SHA256 e04e7dce2d8fbebc36cf42dea4a431e89ad428e6c0899258f1fd2300964de6ef
SHA512 d74748af8bc5ad1a97294ecfda19b10bc448d83a9897ac340543b005000b9b35eeb60ddf158a70d5119a731c5a3168eb059325b591d50eddd525a81318e5b51e

C:\Windows\SysWOW64\msres\skin\btn\userregclose.png

MD5 eb6316b9c081a1a13ad16d4abe56e4b3
SHA1 3616267f1d154aceefff0fb553029975d6071df3
SHA256 b3feafd844a7c1d1ee41d3f1d916a3850a0f29b090fd4cb3be35eafe73158811
SHA512 9734681116214597465e948b426d5c75ae05e369a3bf5059f88740dbfac4b6c69d3a25138d095339e549c50fedea0b696b970f3bd14323eda59812004e6571b5

C:\Windows\SysWOW64\msres\skin\btn\userchange_02.bmp

MD5 872dae41681b751cd2ae89dd6c9a9bf6
SHA1 d2b5f63d61b342f68979789ec6bacee1871b20dc
SHA256 08e7e887a9f38de99f5d8ae1dfd580cddde27fa59f00e9b435604134847ba22b
SHA512 e623a923740be0264f3832dfeba8397d18936e6ecee99cb4c49d37bb6a6178b3091263113f391355399e0ed51b1ea69e30e02940690241be2ce1c874bebf8ba5

C:\Windows\SysWOW64\msres\skin\btn\userchange_01.bmp

MD5 639531d855e0e46a7c056f91afb66e18
SHA1 07640f05adedcb22f7ad967c441dd331888d37c4
SHA256 f2b974bf0c3fa8af1ea42243866379c7135ff3e8960f8228dbbbf8c44385b2c3
SHA512 5b55523672b42ce8505464e4004e39d4a8ab528978a2bec7aee71313ad024cb80ea17c0570a2e476695b0c831b00a666e1359fc1011ac2a1cf9f7616969933ed

C:\Windows\SysWOW64\msres\skin\btn\uploadbt_3.bmp

MD5 3c1b2646185ecf6223f35e417e68a4ce
SHA1 d3bc3a5d85c34a097a74f9f9b53632951756e983
SHA256 2c2b6b62dd705686946d17260ad5be4b773828f99e8582e7f553ae6caeee9d3d
SHA512 91b0d1b500eb15f71dd172639607f4ca60b4ccac40e8fd1e4e243182c1f41b466a914c369c2d33027482e5930aeb09f52d473018d283b12010fdadb7dfdf93e7

C:\Windows\SysWOW64\msres\skin\btn\uploadbt_2.bmp

MD5 a4de09d017b33570a7977edf5249a224
SHA1 ff6c242533e5c5883e13ed6b035c43913f3a49e3
SHA256 4c1615c0db1982e5379c4bd553d78a50a33725cd8cce21f52c98f320b68b22da
SHA512 4b7242dcf09b0b676db90e74306cdcf92509d08de96da79b67597730d58c8245e2734852e435f64db5087f8c5e6797f27e5cc67fa6f7edbf70de02742e62573c

C:\Windows\SysWOW64\msres\skin\btn\uploadbt_1.bmp

MD5 50bd861bd5f4aa22e2ee0f621da2b11f
SHA1 6884657dc9fdca3413d623ab3077c1ef10d39926
SHA256 4f7c9974dfe93fd95b395329e9db483d89ca53373da40ce369f4417f234ed397
SHA512 fabcc044977fac36d9102f24e22811d67f5d5152e5bc27c6a33b4b0f2fdb0c27ab319748dabe84669706b5816f19c8559232cc11c7ab15ad5a6c0a20f80f338b

C:\Windows\SysWOW64\msres\skin\btn\up.bmp

MD5 1be29229f704b365505d0d2d1d7fcfd6
SHA1 77625860c976683a556638c14821c4d5ff9ae69a
SHA256 432b9d7539db9f482916c5bf6b103e669963f4dbeedbe11d90af026cf6c41c3d
SHA512 7dbf910ce73756825ecffb561e090aca08d6eeee6f6bba94f266a73272e4a8c494b00dede8bd16e40d1f0633b8dcfa5733bf810b681e108e6a27322a59ecc188

C:\Windows\SysWOW64\msres\skin\btn\sz_03.png

MD5 6b1ede9faaf0db4ea08fdebf319e8e59
SHA1 6a6d14f3acedecf4794c9ffa04447a6374ff66a1
SHA256 1643fca462910c4b544c0d5dfb22543f93ca28ddbebfd9821b3a4d574449161a
SHA512 5825d59d401c7522d366a2cc3862e5d30f9cad0a7fd9a8537b114943c0f3a7b90cdab42cc3dd429b1fe9ee3d86eaefd0144cf82b09a81d205f970beedcd907f8

C:\Windows\SysWOW64\msres\skin\btn\sz_02.png

MD5 3861581579a3bd4b1c07640aa1da34b2
SHA1 2b5276fb821c024ff7ce516256f2a67311c9aebd
SHA256 ee013f1f23a8126286902d00d73cbde34a59b674d561815e8497bc032e323f6e
SHA512 cf94e5c564a29208655a4d3fd863fda4b0f72c1a7f4f675144b225763c2530696a282c53723446836b75d3c2f0354f265f335f0a21d09444f4b58efb62103e62

C:\Windows\SysWOW64\msres\skin\btn\sz_01.png

MD5 092c79a65691d95228f6928a5440d524
SHA1 8bbf1f9227ae694b6f72e63a1a1b9b537c69381d
SHA256 7f0f783c6e6467be3fdd6a001e0b09781b95722d56b7712c8ad27da01776a4e7
SHA512 30713f6f4e0de8f7331d70980f004a1336efa1d7096aa1662ffab8f8cb435088fc43081e05ae6ca3e154083d175d4d2a06fa3253fe3f18e237d4177b45af6e62

C:\Windows\SysWOW64\msres\skin\btn\sx_03.png

MD5 a31cbc0eb699e6bb087cc88940343210
SHA1 d0016a404420d011d73be1408795feadf042fbe2
SHA256 176a31a76492bd1d51acf5ede3051ccc0b828f3201b775dd8924aadebb5501c0
SHA512 e7db6fe5b3259b1b69cdbf38229c21a03cabbc283732f09411b4dc54f9ca392f464a2883622721a90f3fb0a340bc33dbcfc9c8ea04cf5dda8e7fdd21123e5f39

C:\Windows\SysWOW64\msres\skin\btn\sx_02.png

MD5 269eb2b79faa19f7b0367572cbf78ead
SHA1 bda43e7d138c67f14160ac3c56beac19a4ef6271
SHA256 7ef10953a6d5a9109508ea7966d8141bd8f010aace93c483e831dc317fd782c6
SHA512 3f6f437cf5b825cc4a6961ee3f8f597d849883d1cf9bf95291ac3ec6a1861455586705e68b85ec887540923128a5379b93a554372cfe46278a9d983b698a3416

C:\Windows\SysWOW64\msres\skin\btn\sx_01.png

MD5 f49a753b0b26805f7773b6315f7a9aa1
SHA1 4202ffb7360c842e4cad9914f94fe6ee704229f3
SHA256 ed06649a604de7ac22b1540a1f519a64b81c98b50995b1db97a159991718ddfa
SHA512 7489c87a906560a03d0b9770a699ba493f6684a7f0b89915f571834ccf945b7b772e0a953b1de3638be3d1912e03d9a4081407684eef5c3ed4a1a73fb99e9151

C:\Windows\SysWOW64\msres\skin\btn\sendbt_3.bmp

MD5 4965fdf59ae52ba9f3140e963de6fd52
SHA1 75a3d4c49bb7aa04c491723a1aaf0bd9550be859
SHA256 3096c5316080628eb34d6ed92d0e02cb60307f4e74300cb2314ea1b0b6a7b34f
SHA512 c0691e89cb4bbfeb9f7118ff36a187e5110a1bfd686b14c1c2b45730d23ca4bce49927995b1b1bd03a2353cadb7f0cde552e95beb65b9f717911061d89b1e68a

C:\Windows\SysWOW64\msres\skin\btn\sendbt_2.bmp

MD5 bf922d12e4d0fbbb4a41fc4727745340
SHA1 2a8482c9fc21b75f28976e8a05e52dfa6d9c29eb
SHA256 5137a053f646ed5108ddb02b55d4196eb1620857759c4ad044e1d3128240c6bb
SHA512 c731110e0f75f85a041bb0dcbc93d7ce8ed6afc3feceb9c5ece751ddca20a5c0613f82b167d835a8a87c16e5941c4f60f02c53372743ceaee35b700a07c62429

C:\Windows\SysWOW64\msres\skin\btn\sendbt_1.bmp

MD5 2c7cb691f96da3c0b9e0ac0ceb209000
SHA1 b820ff7f8db411b3e777e767643a52e71852bfd0
SHA256 7b9290419c263af60147b5ce019abb9ee642507caecaf13ff9868d9ef5bce9ab
SHA512 b2e3cc61f9333c2d31e76184c70c9f5191add7d9e219b145ee05f8d74de448672f9c39205509acedd86819e79572288d2b9fc834cde7c96291d4e9962de89b8b

C:\Windows\SysWOW64\msres\skin\btn\select_fan2.bmp

MD5 68c29a6a96f79d1752d4ed1b7e5fb468
SHA1 86a9e1dbe02844f100c6fd22552800f967bf35c4
SHA256 6e255e441067904d1638f2dba90213d770dd62511305cafec6a2883febfb7aa7
SHA512 42749893a2810b5054bcc1b1c6d38a2f7bce6c2d411b91b19b5fc3d3ec30cb55dd3071ec5ed08b57ed75991ebd05b264eb583ace339be1d467b50770771ff5de

C:\Windows\SysWOW64\msres\skin\btn\select_fan.bmp

MD5 3894c30bb204feb48e745b57c6cba45a
SHA1 9d09f877741198b952b7297b80d29f3ab906433d
SHA256 e63ca2fa2b0daee61de7561edc6b4a62e19f2c24eec834cc9e582f157f8ea5d2
SHA512 455705067b7de4989d45e8edec707a3fd20d495fb11c8dd09f72288624c53c7809e76e1af7192d55e58392571dc6134f8b116578ebe170ec7833228d117fb0ca

C:\Windows\SysWOW64\msres\skin\btn\select_all2.bmp

MD5 f4a8585f6ed37542345702b15dc2aa45
SHA1 b131b59bc155dbf64949849d353c717772b0aca2
SHA256 56c485657d3a2a4cf713d6623fa4827937646c5ba0d42c0c73ca9fd584dbd24e
SHA512 91ab53003dab39e9f06d5166588e303af410f7ebc3d1d6771c1aff0987c51581f5a9dd4322062b0cdc32da39ba5fbd13e78e5477ff6906a356337f1b887b28e6

C:\Windows\SysWOW64\msres\skin\btn\select_all.bmp

MD5 68dee43fa6dc2e191828d9e209ee93a7
SHA1 f3a6f36969f58ef154ee9336da815547e798e399
SHA256 ef8a06d01c11ccee7a39c86fcc06d4941a257c052190db57f2691d0e427b307d
SHA512 91921719eafe83afeefa847c416a355fa02302a5ca594107315e66fcbee78bcbe95eeb53c2395030997d85383bbbeac82d0c80e210749b0f96e982b217e62193

C:\Windows\SysWOW64\msres\skin\btn\repairall2.png

MD5 e364790acf16c00376d29976dfa7a90e
SHA1 e4c61ec21501262712605d9f0fb6737306bf0d19
SHA256 5de39de19ce92239192cc10ed6b3474c55abd28b42819542cdfc4ec0e75daaba
SHA512 096803a47f6b2a25802be52459e0a48b7026f1d0c4d8c92b9866d832d703c4d727a4a5e1155ea63432cc40748acf13854f4edca32e078d88687deb8e351ac391

C:\Windows\SysWOW64\msres\skin\btn\repairall.png

MD5 d1f09ef50929920922427e4117381c0d
SHA1 fd7c0ebaf54aaa355052eccc3a5eea9a7ad346c6
SHA256 0a9fe4977bae45e368d9ebf915ba7b3a847ffe2f292a4f43692e7bb4cd9a0391
SHA512 8f06d8f4e476fcbc92e34b4c0bc81ca1f481cd0f80e9d43832e30a3baa2ca1e615f828786d6eea702ad18890f14523e7d1e24081b5634021254168598390a415

C:\Windows\SysWOW64\msres\skin\btn\repair2.bmp

MD5 d258762d55c0dc9419b431f583e2972e
SHA1 3f25bd515f659f5fbaf8ae1c1d2acf1f7cc98258
SHA256 e3baad98b151b3c19d3e23776b394dede3cd7902752cdb232ac9a43314585e72
SHA512 6d05ab2493b955e3833999d9b1d6d2245522a8028a6f8bb0ec0743aa252d3e23e4ba7b1b7d6e26ed653f5cfa54b304fb1b4e367dcb5da6c7efbb20ad2bf10b5e

C:\Windows\SysWOW64\msres\skin\btn\repair.bmp

MD5 b0bc8ac7971e2807870545d58ef8d782
SHA1 1b941ae0affca0eef8b34823c475c408112437a5
SHA256 d5bcf05529b42da0889d46a67ba8c5ada093e9730751a7060e5cfb4f1f1cef91
SHA512 9dd83220bd222f68d77fda2fb9b094e7fae82d590a959985293104d6125cf38440623fe73cf804af8744227e085e7e48e646cac6898bf82d0f8821c1a14183e6

C:\Windows\SysWOW64\msres\skin\btn\refreshbt_1.bmp

MD5 1565d3abe9770a7e2d0cfc71f88e73a1
SHA1 14db4a099fe31064cf25f32bed305a781a83052f
SHA256 f6507ffe860cf7a459507bb0874019ce54500a79425780dbbfa0f2ecc0862ae5
SHA512 5ba612da1a06de53fa0d19f3cebbf634bbfb1bb96fb2971c906da7856b996274b3156285068ec0e5124419b24a51f284aedcad9bc2e5c773834693442e05c15d

C:\Windows\SysWOW64\msres\skin\btn\qhdl_01.bmp

MD5 ecf3856d9a7e72578e560f213834915d
SHA1 f6487978337c33a812253c4d97b2e5a3f9eddfca
SHA256 d0529702147e350dfc80ce3034e53b7a6ed6eab949f9ca804b85f1b39dd5e3a8
SHA512 b8a21941be839a08ef1ad512bb40d7c0672695e193981dc5dd5f5a4cc8fc09fe0e869a5037b3665cc26923342574d66a35b675cc1ad83d7cd86c6500c968ce55

C:\Windows\SysWOW64\msres\skin\btn\preview2.bmp

MD5 9c51d16cae97d8737791d8ee831dff00
SHA1 31cd403e1179adc53082a44de0b65e701ae92533
SHA256 1896570ae2b553204f298015d43c24e7e620368e55b3a2d254e90e6227690441
SHA512 eee5382c799973e13a6845a891d91daad78893ce7979c088e9c08ae3b1a1c2091cf387232874b8e01539278fdf31586f63895622dcfbc652a5c409e31e5f4876

C:\Windows\SysWOW64\msres\skin\btn\preview1.bmp

MD5 4dd794a2155253e372def01e7bea3019
SHA1 8f786e94515613065fc886b72c7cdf8a0679f221
SHA256 4983695a174a147ab6eb5a7e61ff2203054e69e993661d51f6f33c52a3c23e62
SHA512 1b8489dfa19b298c2af6ccaa8c8d4aa6083810daf5e4826d1fd010b4b944b84c60ef7be03a07ede0142fc4d2279df30848c2450f13f72f7ce52253e063b703de

C:\Windows\SysWOW64\msres\skin\btn\patchquery2.png

MD5 c1e991cee8ae756fd63cad582e17e25f
SHA1 e5d88027568850af2a573316355e2d26de3c4d48
SHA256 37f83716db6ede10e4b97aad78ab99a15ac73ac635e54d9d9e8773dd83a665cc
SHA512 e3199ee15fd132724f9e4504226e7f25c8038ac2462fa59aba737975f182714c8c062365803651ac0a6a76dc251f2e7d7b840e07d31e77475662178fb2de6e9f

C:\Windows\SysWOW64\msres\skin\btn\patchquery.png

MD5 0ce3819d97d15fe9087f6406a8f332ba
SHA1 04d28604e6c5531ba1dff3852dade03aec71e9fa
SHA256 8af41df17786316c9825f051190fd2db02692a80d4c5cc7b4d28e72d3f8de437
SHA512 7b5cce6e9c789108fe80347caedb8f799ae0c73f35bc2a9bf44af78678ff5dc288dd29a5ac2d235add4295badbaa056bf80ae86541dd8436462e3a1f2ec38342

C:\Windows\SysWOW64\msres\skin\btn\patchinfo.png

MD5 72b01e149a383a7db3aa316a25abca2f
SHA1 f5cbdcf36e2f6c2b7153b02c1b90919ecadb880d
SHA256 91311a2243a5b92ca27040bc4ce7518f1303a45aef67835183b0a520fa78c1d8
SHA512 d880da9edd42c51bb9166ce6b3da7c9efa65f0f1f12f4761a79f7768aa60b76c774c38bb23e10f1e0443b96d2c2133ed93a99e6773126a429d1ad721c92a6d2d

C:\Windows\SysWOW64\msres\skin\btn\patchbuttoncancel2.png

MD5 6775dae4bcf807872fb21d64aa31051c
SHA1 4633c6be9a3392fe86cd8138f92949bfe8e37976
SHA256 bbddf24e5ada1994f9b39b3adb2d507d972acec6c22d81b3772b10c8b887eae7
SHA512 f4744abecbc9d1270d8ad01fa8d774a9235045afb79ae3c645bbc29948fc1f5d16ba42b4c5a406a7da5512479c86db951b08319a52cf753e02521288e27ad24a

C:\Windows\SysWOW64\msres\skin\btn\patchbuttoncancel.png

MD5 d0ac51fbf4be1bffcb892c0df65d02d2
SHA1 00e6b93e0babab7e191d869a53eb16ff24ff7f79
SHA256 54f53a19672de5fb0de5b0963de24c83c7e66f9fe45a300b86b52d5974d180fc
SHA512 de2975af4442559820d0820085a6e9b57bcc193119f6aa173b121ea468121f8c65862d5e49797891ae2ed3d488dfb2d9512813dbf3ddf2d186ddb2e3170251a5

C:\Windows\SysWOW64\msres\skin\btn\patch_icon_left2.png

MD5 3d2d84320e1f7edac57db238716f75db
SHA1 a6a0c59ba69409585003f6342a248ab66cc4068b
SHA256 6686e617bd1a2987613e8f52030a8f838d7399e4045768dc33370ffc9ceeb3dd
SHA512 3b6f5a598a2a90aff7c0ec52cf384e862ebf6f7db2c1419eaf21d801556ea786ca43ff236bc57a9cbff002dca65b69071cbd365259bbc791d37da00ddacf4331

C:\Windows\SysWOW64\msres\skin\btn\patch_icon_left.png

MD5 41517aec8ab45827f2c85f2778ab9332
SHA1 79c90d38b2e35e17bb3349a4299b9d9110e72f63
SHA256 40e3184ea1eca7a7b9f6e503ffa5c42ac13035aea34499fc85758ffc09a4318a
SHA512 e5e6dec25f06e9a3654e775bfad30c3df27c369edd949700aee4553459c7ff19ed8ced78557b306313f5338a2d5583d6213235bd9d59a83ac943a589f254a7ed

C:\Windows\SysWOW64\msres\skin\btn\patch_icon_first.png

MD5 2b54d2fc9118644603d111c011866c1b
SHA1 a275f13188c078626aecd0ad7576c69e18d63416
SHA256 236876886f6828afeeb79ca10c1016e1aaccaad434bcd23a50af0b199ab6b55b
SHA512 8544bca59aa7b160a24503b9bee6404b9fcd6cc650e1e9cd284de6bd93791da4a58bfc8e235cd67c8d86b7ee9ac30771aca7378f6505b07e6f4a3abb69194b17

C:\Windows\SysWOW64\msres\skin\btn\patch_cancel2.png

MD5 355542a31f08db3c10f391d806fb2af0
SHA1 f9816c66e54711c683c4525972a4103816c1df7d
SHA256 c9fc7c1468f79d0c65e655396cfa0ab70929c1c69a3e4db97ffdc5cb372dec42
SHA512 2126dcf1b7e0b41f011177ad6e1ce54309be9d2d132c752828bf4bab7336f8f64ca7c9fadc40d5a93da8dd41ab30e3c5d410b6cf521be553f3f34905e8dc00ff

C:\Windows\SysWOW64\msres\skin\btn\patch_cancel1.png

MD5 721c6b4c704fc62714d95630118e9e29
SHA1 11eccbbc6981ba8ad4bfe55e07a5ddb82be7c1c6
SHA256 1cfa36df0bb7bf8c91cfd922f94dc17a14806405c4ff42590ce85da76c9235c0
SHA512 1634e97e21feb0d5481b54071f22b8902ad3b2f448bd90eeeee9f2426d8a256f47e2a9f88c481f03e54bc1e78c75884fe27cbf883a9ea536178b8c3dbba8c56e

C:\Windows\SysWOW64\msres\skin\btn\patch-win-icon.png

MD5 038976faa108743b17e5b6e9bf820b96
SHA1 e6f5ba75b6e39fd67550f2de1ed13b6dfd2212b0
SHA256 597fc32d7f778c6c1fc2b7a8930a86414ee2a7db544d8ae1acdc59bd9cf64fc2
SHA512 8c936130ff1aed46a4ff7a432b42a7822643341bfab098e8d5e20cfee6095d7b2980176e1670e47fd3c99c1fad6e1ad03ce2c7e308ec9af334c8e36e051f7248

C:\Windows\SysWOW64\msres\skin\btn\open_03_03.png

MD5 92c11f89a5a2a56f2724e6b7f691468f
SHA1 36bb669bf68770ddb20b376308e9b5203d84b46f
SHA256 e3b13eb2230b5d61f769fdf3c992413a34804847e2bf9fad3a029c3cee58bdce
SHA512 bb1d2414820ce76023c5e52497789aa65e8fdfb396ea41d1ab55977f067a90a3121e085c7979749cf96775f81662b7aca3988574e2df795660f2c21f96a554c8

C:\Windows\SysWOW64\msres\skin\btn\open_03_02.png

MD5 d1fe88d0c61375eabf447f188a69ffb8
SHA1 9b11df264d424d1b3d14a794fc41c23a2428f161
SHA256 9e2ab4ea5fb3655003403bb8e1f750c16eacc51cafe1c01c7134e0d2473e767f
SHA512 4e4c55f704965cc63716b26bcafd0a72d4f0698eb6e580060c2c5adf938621e1a0eca67b1c7e6b795de62ba7c956e72acdad46121824f30985940fb299a86620

C:\Windows\SysWOW64\msres\skin\btn\open_03_01.png

MD5 9d0f7c20a1260274c6c9e4a1d016f12f
SHA1 e0cd53fa0b93c86549518315080bdc2496440970
SHA256 bb05ef2dea2f58a60577641a1367314360fee9a64bbcab38ef21249624f610b7
SHA512 f2bb62cdf33e7bd1d0d215906519d11c9f4e2b6c5d909378955d8990f3578b47afefd9e5a26f29fa9dc1970cdeec853106a9ea48e713f00299b95597d46ead59

C:\Windows\SysWOW64\msres\skin\btn\ok.png

MD5 2a93cd427fc35a0069930c479496fc5e
SHA1 c8d3a543d8a331dc349c9221f26222c9deff54b5
SHA256 5c6e85e589bbdfec06ee683da0c128616faf6e0e87d43b90cb199f54fce5a207
SHA512 b1b0cb5c1f7085a99a89be3a57a1654d7bc064931fdb96f7f38e777bb713cf047634ad3a3a123bce5b79c5cb430dc93bcb77e2cf98257fc6e79ceda5ff2014c1

C:\Windows\SysWOW64\msres\skin\btn\myfix_2.bmp

MD5 3812d0346e31fd235b647583eee4a449
SHA1 02bb8dc42afc0dd84773bb6b98f08c6e3634c621
SHA256 052f0a7c743bb6a708f327b708a6ceeca0521565d5ef40e5c90742dde8011f64
SHA512 9e5dc92d17841696c4302675fc5121517fc9dfa5521ef011d56e7b7ea51c736b2add2aca59ff92a32355d2af01dd12e0535ef3b7ad9e8497267ed78c6c6d62d6

C:\Windows\SysWOW64\msres\skin\btn\myfix.bmp

MD5 94f2785aa8c438c57351d8c5808c936b
SHA1 96032935afb7444ac44d48b63764351e75ae59b5
SHA256 bd6616c28f16d5e22524bd47ad0e6c5901a71545423525d452f2475092eb8914
SHA512 48236c6a796e69c9de9f8a2038978dcdc204466cbb15bc10ec6cc7f048add55602c7cabe9e24fb6ded6b2e5bfccf141c22e870f0e2e4fc3cef27dadec408b0b7

C:\Windows\SysWOW64\msres\skin\btn\head_03.jpg

MD5 fc701d36ea65d0d1f193eb88b0b3dbce
SHA1 57c5de69f2d5999945c71ed650997519151d26df
SHA256 83e2d386b620a1960fe6751a1c2bfc6f044171d6e92be2a73dcba2b4891a4ce9
SHA512 1313fd7f5443b55ac94c495a3b147648ffd0f307c364aa8462ae93efd49f5d687a4b5c674fb1dcf61f1c0439d1c80dfa2f33b7a351eae3a0aa2fcdf40682170a

C:\Windows\SysWOW64\msres\skin\btn\gx_02.bmp

MD5 4e1e1cd70441abe7afc6521a69e45795
SHA1 b22f541397fdd910d7741dc615039dd2fcf41bc3
SHA256 34ce0a3541edbd97929c3db8fab35682876db6b2105f040a148b393db5bc4c22
SHA512 4b3fd367cdfdb4b45f4be179b7e6fcb264ac9645456fc0a0ba3a604d40316cefeb50c2ab16357edb46c6e9ece3a20ad44c1a255f0cf2c80be812d76ab197737e

C:\Windows\SysWOW64\msres\skin\btn\gx_01.bmp

MD5 4ff50af4c00ee5598881b61eb54bf895
SHA1 89487db80e10542bd35c73eb6f7a8ad03ad33865
SHA256 bc4ad2390e571fdc6f2d90a1eaaee70679e0071990da2cccfcd115c702b0a3f5
SHA512 05bef1fe903959f62e6b1c58caa8e200044c4e1b31eaa47b77652e53378e5aa32ad1abe54bffe468f017fb36b0b67025b3742cbfc1a9c048dc2654ed9a653b44

C:\Windows\SysWOW64\msres\skin\btn\gb_03.png

MD5 3937f39931d8216e91a6be74878ea5c1
SHA1 3bdaac4911cc8ad44ed0d2394c1fc25f0bbd7b04
SHA256 0244a1e349be736502b53c4b7a7376f298d224d510e6560f137c766c859f1d02
SHA512 43b6467ecf4527ee86c68fe5c5089a15cb6b31cac18be5689507441d9e3cf4bef5664bf6c2c2fc64dfa365862e16c318e274479bc232010e9ee293f5cf58538b

C:\Windows\SysWOW64\msres\skin\btn\gb_02.png

MD5 d757a68871c7d6f4f68d5af5c75ee24f
SHA1 a261eda4462ee1e7fec6521cf221d28ba4df7e19
SHA256 088aa4629b0542290985f49f5c7bae6fa173cff3dfe7571b689ddd690ee6b9d0
SHA512 5390ce8710ec42a94e96078c955d6b429635e478d4ccac1189caee21af95aff49d084191045981fd1afae33f65191aed284c41188fcfed9fb8c83c65703ce361

C:\Windows\SysWOW64\msres\skin\btn\gb_01.png

MD5 c25a0e7bedb2ead4f37d48c3763a6053
SHA1 583e5aaff8ba822d49d16b99eba936efec321609
SHA256 17a83252a7be40b246656e24378ba9a70e5a8372ace2c9090d3052bb553707fc
SHA512 b90afa6ec8a2802a2f80cf512ed494f19c89832d9d788ade40f668ba5b39bb2e02978fbf72571b177dae13c85d6a0f18e42a4abff794ce49252c437d17952523

C:\Windows\SysWOW64\msres\skin\btn\down2.bmp

MD5 e6f27e081f1c49257d0664917ffe35c2
SHA1 b8af018752731416b0743621275e027532010a81
SHA256 0505104e0f0e8999fd30645899a90a3260173d59fa9cbb6e4ea633af8be755f2
SHA512 50c25f8ba5aab3a7a66fb9d2f775870342fe73517d4f4212c9213e85f4262d42052b3b34b81d19d57899aefc1a051275c071d07c125b853eabef8690cb7a741a

C:\Windows\SysWOW64\msres\skin\btn\down1.bmp

MD5 a98d5599bbbead144cb23e9eda443474
SHA1 15defc8f3a0cea5776dd2e9ccfc36082ef9419f6
SHA256 36e8be716effe2e3fbfa0b334792c32100b3eae1fd8e477bd777473bfc5f0749
SHA512 ac1d567287078d2cdd2c956f19feeb548f9719268f67a04cd01b7ca90691b16116e8e18fa82d7b970357774049e73a41d9e39998c27b40579b5b3a46a09085d1

C:\Windows\SysWOW64\msres\skin\btn\down.bmp

MD5 9a00188eebee39a72e2e1d8206f89ddc
SHA1 1e94fbe330a2c13a4ea0d61ba253046ec3aea84d
SHA256 ba1c02fd1c6ecbd3435293d1b40c696b0407b225a3d8c60adb09378c9c908c8d
SHA512 d80e6bc8281dea03da39ddeb24199de20aef30f5b38a42573de91403725a994af9d7c6fb30df173ded4cea715cada942be3b2ecb5e463a9b2c8129f71c4fc128

C:\Windows\SysWOW64\msres\skin\btn\dengji.png

MD5 fa3424e212a6ab9c8b53994e092851d0
SHA1 fe59c67e518377575c480f8986439bbb1a28dd0a
SHA256 ab1c044e201fafd390537f399868a8fe67bad1e870b9c1a014844bcc066bbf26
SHA512 a59ebdb72eeff191fbf6d7237f6571d41efd90b563568524769a93da6ebf981cd1a8f824d5b070b67ca20b69606c9f402661e83c46fccdba882e62fa414468c6

C:\Windows\SysWOW64\msres\skin\btn\commit0.png

MD5 0cd6e5a4ed115f0f63263de3eee58451
SHA1 52bad0001866c055586b4c1b75f031305b825bd3
SHA256 ef4daa62d893ed006699499da3b9f64189995347d15e40e9df68cb853b036c7b
SHA512 f0bea18ee6fab0e0543c5e87428220e9688bdfef8119d983e2fa2507c82f50cfd67f48bcd0cc355ba49ac73cfb83bfc7980f977833c7a6a14f1cd4a9e3bd18a9

C:\Windows\SysWOW64\msres\skin\btn\close_user1.png

MD5 ca3418dc94cc9f697b6204229a8825ec
SHA1 d3eb922fdd2f20f4673485a898bda1893126c1d3
SHA256 fc895284d11cfcadba78b6484fc0d315f04952a4a7b60f0d9dd3deeebe24b6e0
SHA512 c352cd71e6c2a26e12cfe57c55adf29e60dc1b2f5da57c22292769b7f6e81d01a2a92455f4b0d26651992e039c876c78151808cea012f3b7c4b19cdfc66f917e

C:\Windows\SysWOW64\msres\skin\btn\close_user.png

MD5 2edd0cb4576d81ca994a6bbf878a55ee
SHA1 ef748cd07d659e40a6134ccf965e7341be72b13d
SHA256 2ccb149994b60afdfcf0f59ab212fa8f8e0641a9bb25ee148d5b0ead2af00a5a
SHA512 c70f267cd6df9f154c892236c631e2dd20586461522226d4d940f92034f3a2919d95067adf20768692cd72020b6c08ce41873ca8ffd39362b494f23b98260247

C:\Windows\SysWOW64\msres\skin\btn\close_1.bmp

MD5 9bf47cda3da8837eb527b8ee2921c6b1
SHA1 1bd0abfac7d0631a96bb80c0de6d4cbc9d0be60f
SHA256 387e04a0790ec61033be87e03628ed16c59668f7a0fdb04df508459131fa2799
SHA512 bae06d70b374cd72c95c0b0cedf8c1067c6567d3434dcdf3abe9a9217bac6c0030023b00eee4d70c6ebd0d884c0b79f3f457cd1dc63dc4db06e9119d36628578

C:\Windows\SysWOW64\msres\skin\btn\close_05.png

MD5 20d2dd746d4b0914a31f7d49e6d3e656
SHA1 42e801163575c5c4e5fdce0e1ba778d635684bb6
SHA256 81f45dc6783f758ccf11365733ab9b981e1a8e68447a1971ac366b424f7d2c8e
SHA512 25ded2284c790f089b1768085cc0e447fb5eb9ff9e20289ed135e3f00636846d53fc8c46fd9c56caaee7ced29c85d13b541e2d22fe54d565d68820cdd07c2987

C:\Windows\SysWOW64\msres\skin\btn\close_03.png

MD5 0b7171fe342b678a58d23aa12cc7e588
SHA1 cb351059d9856b9f99d791962407c8d8ba24f5b7
SHA256 add826bfa64351aa756b8de5ed252ebf148a5412c32640d1fac1937fcd5b3b00
SHA512 ba6bb714b090de008c342e7663df2457199cbe9100b77989071d66e6ee286b9b8c1595d6fcc8728f5dc2f0af35357c9c1c54908f6c2cc5a3e04c4201e4924706

C:\Windows\SysWOW64\msres\skin\btn\close2.bmp

MD5 a54cefc12437e2428656c0b203f5da7b
SHA1 17be083df58cc3d8fab7b5e97e3ba4311ca0598f
SHA256 4ea142b3ae9accc85f37513a071d1c6965a4dd711f3bcc3025f8ccca5cf2225a
SHA512 dfc60582691ea79a31f27b735bf814e52750f3d4e563d9d173e7e8aad725832fefb4d63b3999080fc8538f4139f2339299357d0a7c19d64edce7e300dcaa33a6

C:\Windows\SysWOW64\msres\skin\btn\close1.bmp

MD5 8259c23ba6c9c96d100d95edbaa8a766
SHA1 f84403a0a1af64a43200d6af56f606966482d791
SHA256 9373098ea17dcc56f46e5be5125787d6b2c9709aa45e0703acd6a9ad45c617e6
SHA512 02ef7c29a66c20c12943179c5388f340a907aaf92736d6954e1115fbb5f5a5570bb8f93809bc7f2801834c4b035f4b368a50445fc37422feb54e6462459a1c27

C:\Windows\SysWOW64\msres\skin\btn\clientlogo.png

MD5 50a9d8788f2f6c6149307230274369db
SHA1 082b8377ac0a0bbe592390f4e0d8ae66eff0c523
SHA256 e0dd0660bbf3f953daa1baf7894a615f9c29ac00abbaf3673fe6fdc5765da6bc
SHA512 f9d57d4a00645c68762e16c3ae315066b678f76801d5e054058b69b18554225bb7993d88a4ac41d27abeccf9823ed315db1a9264090a0938eab899f325f49158

C:\Windows\SysWOW64\msres\skin\btn\circul2.bmp

MD5 0019758ebf2c89cd162e0724263c0c49
SHA1 409c03ebfbd0efba5641de7c3939e004bf805a4f
SHA256 e1fbf8789dc5113dc33131ddd6c959b210809ef0fadd819b0b185ae1815b9053
SHA512 70993c1902357587b55d5b56c87ee5c2a7c2906b33c252dd5e10c916bec2ab32a30865d641db3954a3e9678b6c406afe2b783de54aada8c7495c93488a803297

C:\Windows\SysWOW64\msres\skin\btn\circul1.bmp

MD5 4afeeec0ac14ffc3043c1038b90a1fec
SHA1 ff5549834bc962d8e020dae3f840bc78617087ef
SHA256 659cbd55df5971710caad0ad30feaedcd826cc1cd4ea43fa382357580de7b43d
SHA512 9dddc7eea4a1b9cfd42ac2dffd5f0427ccfdbe590343f19d0f6cd1dc7ef6fff33138399decb3db6d79df8a2c32fcda96b9790964e339bb086771a72ec21bdb2b

C:\Windows\SysWOW64\msres\skin\btn\btnuser.bmp

MD5 9c6fac86da2ca4e29307c5412522811b
SHA1 5896dac46950707d4988aaa2e142874918a4956d
SHA256 ef3bcbce2a5061e5d673fc37683c167555bc107e05b66603fbf271dada9a770b
SHA512 d03cb267bc4f6bb25ecd290962eddac14ea4c18f2d28070d3cc607f87c5f2233e488558f4f2b1538fdee0e5b1486ca9ed6779263a43d2ea3218e5603771f0ab9

C:\Windows\SysWOW64\msres\skin\btn\btnmin3.bmp

MD5 ae138f6f4fcb20587ce6afca33f8bd3d
SHA1 722c3408282e944071bbf4f0109965d46e5045c4
SHA256 bfda49bbd053b32d3191799eda972df3f1a6615a7f799d6c295e09696c95345c
SHA512 8dc5b4cfbd815de63d355e7ded3af0bd72cb207b6eee9da83b5d88f19f4ad4061323f02db0255f540835b5068ffa22f614e8554cf439e8821c44af97fd39ddf9

C:\Windows\SysWOW64\msres\skin\btn\btnmin2.bmp

MD5 43d5d898cf2c51a4eeff5eeb19b6a943
SHA1 8d9d1b4405cca152c84b51116760dbabea4e5447
SHA256 887fca8af95986d26f5fae6cc8251185ed49b51184eb2f52b2798cff1fcd05d4
SHA512 e06cdae352ae7490051fe46d625a262a99e93ae4b3e2ad9da3511619f1d2a08f5aa97ed674d4db75311b5caf7f7aa802ddbcfca5f1a68c3935e58b32759bd55e

C:\Windows\SysWOW64\msres\skin\btn\btnmin1.bmp

MD5 7629821d39e9ac4afe60285d007d29c4
SHA1 75818cb5cdacca6c04b91b152383692a01bc2647
SHA256 a3125174235aca3fa2fa41bca8363070f7f0dc4aa4a5f60f6e1ca1c0780a8f48
SHA512 23508503e3f7e31b3d0eec5cbd31bdaec700c31a66d052038dde6095c1a100a5391b23c431da58c91933d0c10fba3afdeb002ddcb0fdff0e411ca7f7070a68d6

C:\Windows\SysWOW64\msres\skin\btn\btnmin.bmp

MD5 1e1ee84b49078e7bd4b769b0731ee1ea
SHA1 0ebfb572db3416f17266c71e377a2b5920bd7d5f
SHA256 d514863ae5e7ad13c023e75931526192f83917cd54a6e8200e398ba4a7401f4a
SHA512 9761cb38e5acbc75d58cf5d4c503e6d60cd2ece7d59901dc7b1e0d13becd4c753aab48be0d83fa6477fa4c7ffee76dc492bab79ae2a2fb4a96fcefc22245920e

C:\Windows\SysWOW64\msres\skin\btn\btnclose2.bmp

MD5 287f76d882833c7a610bf5b49c4aeecd
SHA1 4baf4006fd1ecf06333bddb85502ef2e3f18b828
SHA256 9ebf24c095e13036c81891aba99a8f1318919260adc3847271feb5cff432b106
SHA512 ab404afb4625d365564df057563206f44f54fb886b96d3822156754962a5f97b8a9a1848d3960b681cd0ecaca97d2e8ba5ab60e894244ec507af4e4049fef3e2

C:\Windows\SysWOW64\msres\skin\btn\btnclose1.bmp

MD5 3c4c6b113b45c24bad62cf31bf4a6ab4
SHA1 d1bc7b2421761a22b301881f57663cd8bed47a01
SHA256 d5cdf3e89365709228b18ddad76ce9e6f82f251db174b02f78bc24558c9c8c36
SHA512 bd3e4830312ae5ab64b3a325ba4e77002863e96a8353f5a890821e6030ee225ff064668c782f61bc8e982f822777b46bccfa44e4ad4fa69c035134263166f460

C:\Windows\SysWOW64\msres\skin\btn\btnclose.bmp

MD5 5c8b7c06c88cb68bac6284aa4220101c
SHA1 79be14d2398a5e39e4c449d9311442ee97e31806
SHA256 24f0ee456a937ccaf612bcf5f8a4d0f77a64b5a0b875dc9f0c19b509166069f4
SHA512 06ec65c5567c9b1235f956068b33f2db171c13a8182054a47dc92011daf4d6128ba06d44e29e31043e6d05b52e55b041ec96bada29cd88c428dde23811fa22f3

C:\Windows\SysWOW64\msres\skin\bk\topbg.jpg

MD5 958ed7a29981ccfee518270d95293c73
SHA1 e6a25f572d8136a886a18815a5b040744d2d7822
SHA256 4c9459fe26aa315cbe40d6bcf673dc78d5918c370310177d0e9d9caa64d6c1b4
SHA512 f5bef43dab1451eb6fa8a4731052abe6b795745de591c39ce385cbeb96cce5ba44ae0495f00e777f5e8d768b7bc2f7ddd16d4e0bafa78bf5fa5da87ab75de23c

C:\Windows\SysWOW64\msres\skin\bk\patch_repairall_bk_clicked.png

MD5 0ece7f60b8472bc9ae817fc9d8818705
SHA1 0bc9d89e8c0b45b4c2271bf1e1ecf555f802d06d
SHA256 8875894af167d094a9ec8b885d5ad70167a7e410608f76aa25b1f7d42467c610
SHA512 2b32efb4560232815a978f3e8115647b8a1a97549a6ca0c73d300eed2397e6853f7671e645785db10cadf47349d71cd7ea8b231598af01116c2068c39173f477

C:\Windows\SysWOW64\msres\skin\bk\patch_repairall_bk.png

MD5 a6decb9550f182260fe29fcc23523c07
SHA1 3946e9c9595ffb4a3259789b37155bb96dc82922
SHA256 ad59eb3ff430734f42c5f4e9892ca854cc01d2533d3c6d70f577ba38ce2b307e
SHA512 3c4c7d433d45339102b537fdfe85845b0af0ea557f5365adcb90a4c00273cf81e75856af8b702c8949e2a42406e8524bc69719e9d9f43d134232df528cdbcc6c

C:\Windows\SysWOW64\msres\skin\bk\mapbg.png

MD5 eca869729ecbb0821b3d469985621bf7
SHA1 45254b86854b02c37d55a0dfc6bccd8a3d0972c9
SHA256 9c4e6c63fce43542809ece8ebdd7f8e8c5843833d6b13beb8a3905da3a74c656
SHA512 d38135b14c2cb963c8fe90f76bdcbe412893f8f03d9687946b00017704800018250fbe863b99c550c7b9f0c6b990de10cb159c3f8b2a17edf13dc79e477c74c3

C:\Windows\SysWOW64\msres\skin\bk\BK_Assist.png

MD5 425cb23a66e983803a003c85ccca9ff3
SHA1 5e7af765c12ad5fc49380d5136ec2f7daa2b8ac3
SHA256 3fad38e867aac6db38b93380a78da1f606182d54bc170d1ce950af761ffead38
SHA512 c1cd119e8f7b2da9767577319affc5b7294f57aeb23b3bb9d56320efb7b509711c84bf92eb7fba7f69d56ae2342b262287cb5e86166df7f172f762fc02e1531e

C:\Windows\SysWOW64\msres\skin\bk\bk123.jpg

MD5 ca09dc76c6ad2ebd2e681a1e84c447a6
SHA1 06ba74c9b3e7967c4b6cbbcef07b275dd08ed7c2
SHA256 aa9144c36be91bdabd0f32e550f9101fd183e8faac3285e23ea69822ed4d896b
SHA512 c8f39bbed9cd1fdf23477f8b6081290b8ca61e646cc392676993d05fa249f07ae784aecdd88cb64b825cb7677894ed72b3496f69e3b4e0a699cb60e8eae0752d

C:\Windows\SysWOW64\msres\skin\background\images\zip.png

MD5 a4c2911a39fcf7e062b50e822724528f
SHA1 9ad144737818c6d019a05b17e43856a85886a2f1
SHA256 4d2d4c168a03c71202053522877552b4625797c47ed5904d843bd34becd10015
SHA512 81c250ccc59500ef9c22002edd03950aa97be5dce40de6bc93b3a0d97388be9c5df07844bff5196fa198386f967b808fe53d324c1cb11c4568f7c625f258602c

C:\Windows\SysWOW64\msres\skin\background\images\yp.png

MD5 b57e3b8ab4036026821e42b665a3ce03
SHA1 522ae403767e7a03d446067e2e272cf49223c97a
SHA256 35824df6ab7da9551dacf15e1bab8967a6aa0a027c8ab85858ba041b926ae75e
SHA512 51437068ea46863742006e2b3433e69cb1a57eb8a2908129d5f3edeb26b35f77a006865853db8f78c6ffc136bad270dde01476f9f0ad2c117d1525e6de3667b2

C:\Windows\SysWOW64\msres\skin\background\images\xz.png

MD5 5004a79b83d8acd02ac18c91f5275379
SHA1 c77eee4a34541274a0d965f166e63a9c0b8fc240
SHA256 11ee187348ac2a48dc3f7054130d1274c7793e993d8765d5109738945bb5fb88
SHA512 665d0e60aa616cffa7e3ab7fd48bd8dce025131f549ba187597e6bb188b65c35e4e2114823c75898321fa80f114cbc4db7b9f158d654cd06294587419b380892

C:\Windows\SysWOW64\msres\skin\background\images\xx.png

MD5 7a26af41cf4a70426ae32f62b0e448c8
SHA1 695b31f0985e5a1e259e4ec5c51fb2aa090c10b3
SHA256 ef080f439bda13cb2fb74d48a476df99119ba338ccb57a7a3332dbb14c773eef
SHA512 bb501ff9f46fd7b84d45014f7ce06574554b2e6a4829dbb10e92a4c7744c53007eba110390cb909b3970dc652056a0d0611658aa49d798eeb77d1e1e190de7ec

C:\Windows\SysWOW64\msres\skin\background\images\xx.bmp

MD5 489a1958a73d961032c41c8ee7109baf
SHA1 b3fffde41392bba5b319b586f310e1e91b182300
SHA256 d963206f12242d307e0f3c38b3c9193592888d85fc9ea20c96131dccd6e9500a
SHA512 a167aa0a1815f94e39de8f5864f4725036bcc241984d5b70ea57071a66afc08945f0241edf5fce25d82a97f127d1b17907f29ad65ea1d4567f2798e235a5187a

C:\Windows\SysWOW64\msres\skin\background\images\xk_03.png

MD5 079896123dc719fa0c207a34c44d70ad
SHA1 28b8a012bc9e39f6a171bde7768118c561b37a42
SHA256 6c4bfa08e128c2b2eb32b4126649a9bf292c9641e78815c6a202b350c11f95c6
SHA512 1c536a149fda296af7b57b6149eb661e6016ae166157626011dc9cfb07cba5bb04d6100c28e5395415b423e8449ab78234b9485d47ed988501740bec838df684

C:\Windows\SysWOW64\msres\skin\background\images\xk_02.png

MD5 1f57c6d8dfd1ed766d910aee6465a9b7
SHA1 79051383a3b6555ef7b8dc0ce219cb30aefd1611
SHA256 e3d6828e4e45542df045126664fa3b6879b62e5838b25b9233c2f8bc6c5b63c3
SHA512 766c0eae0165eff18bdf3bd261314f9105b9274e6d44a17f74c89fb2960a5e2a88dc30c3644897be30053238029de1531844ea106c4cb2a79e2447f19bbdd0c5

C:\Windows\SysWOW64\msres\skin\background\images\xk_01.png

MD5 044624821577ff2bd8bc1613f25db61f
SHA1 a49fbcb16f8ca923fbf5319e6d6582807e8d3b60
SHA256 3bcfdf9bbe038982e098a28b3ed5d8e3cf803534b25b81ab69114ca1303b9533
SHA512 69eaced038caeab3e20c2ba67bddfb722666f3d57e8a2ace184451e39fae19afd7600813ce0122b4b18f44b5e1246a94ea1bb5b0e1a4d91e73db25be6ae97726

C:\Windows\SysWOW64\msres\skin\background\images\wp.png

MD5 f14425cf2749b41c4099f58b2ee70f21
SHA1 7df65d3d40ba5e093549bfb049cbc56102e833cf
SHA256 0558dd51431ab128caa6af3ff41216d4c0bcba0f59839baa305a737889b8558d
SHA512 be9ac80752a2bb39b1772095d215c18c64c39687847bd5ad3bdd3f93a37c774a9052777914ef018b1ef5631b42fefdf06104fcd0fc08e83c17ecff575333cdf0

C:\Windows\SysWOW64\msres\skin\background\images\wjj.png

MD5 f5f56e28d6e4f78f46785d2efa107e12
SHA1 afaaae10f315b09f6b50e1f9821159db07d1c7e2
SHA256 0a68b4595fd5da92746a69258ecb5c9b4d86c66413b433b4d79b100057cb02f9
SHA512 d86a186d5246361b236a343eeb69c0d9ad860d4f07aef58bda800b571dfb081d294b8aa2dc463cf13a915379d611dbd2042e9c28cabd5ef615f891bbb168ec6b

C:\Windows\SysWOW64\msres\skin\background\images\wj_01.png

MD5 e7e0142e6df524605deec972890dda13
SHA1 50229594532e99160958dd45870fad17fd92ad6f
SHA256 0bcde301af3901fab73b452a26f635fad725d20cecc366d52aa0e9762c0b914d
SHA512 8f00d9933dbc86f3a877117f330b894b15e985319baf3de18ce129931be17531cffe3961b2c6c118fc4bb3a83b71b700fe39b0ba0ea4b1d49f459ec13bb47c38

C:\Windows\SysWOW64\msres\skin\background\images\sx_01.png

MD5 7df1ab6c1b90967bd0e61f3826d19d77
SHA1 4231008899b9824d5f8b309f24d6375d5da6f6b4
SHA256 8469747bb28deff28a382026a10311bff9c22cbff4556dff428e6b9748cdc26b
SHA512 529de144218a46b011a4fdd00566b7f70e92658a0d633c220ef67c426b42dfe7a34654c68b4223d23ee1f388a99260193b90a54fd13356cea555ef1668ca685f

C:\Windows\SysWOW64\msres\skin\background\images\ss.png

MD5 3e062490071758d8188e99dc45a36f37
SHA1 4b485b69d986137878ce2ea2dbac42198e54b8cc
SHA256 6acd80b49f48b3819064f0f68fe7a3cb83a4dacc28cf2632d2f41e7c87744bc9
SHA512 a0fbe199ee93e7d0fa9b3accc01f64f6c95119f5ab3bccebe72f053ed43e7ccfc91f11135679b64c44b15c4d34fbeaab7609ca92b80cea62bebd5382e7f2e15e

C:\Windows\SysWOW64\msres\skin\background\images\scyp_03.png

MD5 26ac237bd4e7b327d8050cefaf78425a
SHA1 047eb1c3bda32eb7aad2ac5cd6e0a02a4a3ca3c7
SHA256 380bb765bd333b8d9fec14dd7c1a1c6081ac748c1e79e3c7fb1ca62db2bae99e
SHA512 e0419f5b6fb38a8886f6431376de2a46a192ea5f0a39f0d4865453cbe503e04a9950edf5a988834bd47e081a93e7e9067ce8d69df47b2ea3d69acf13d20b50ba

C:\Windows\SysWOW64\msres\skin\background\images\scyp_02.png

MD5 9192bf1c4803f057e3bad878d4c4b98c
SHA1 618c195592a87511fc2f1c4f87921ae68e776708
SHA256 17e338eed5abf795fc14c38b14a287a1c80a5d8ca1af7f40e38d449b539db8a0
SHA512 1d5451384e72c4103995d50770df7a078e44d93c39b7f64cbdcfcb63c0051e05f3e96738f17855c5524ab41e04d62bfa81a0383e1abea0b528c0962b8a13667c

C:\Windows\SysWOW64\msres\skin\background\images\scyp_01.png

MD5 db579a5d47b079e353e91789b551400c
SHA1 8a230314258d19e8dab2c154a29ab4c536aef647
SHA256 737a5d9ca8f7be693d98500c838b64979a1d145b971bbb89b7ee24e4f31dc48b
SHA512 1d3155a91a8ea8c65c292d2ec6bf53c906a10d648ffebe83f00ce1baef346eb472cd99a6595c30188c1f324d1f0688aedeb85bc671e2acc17b6e2067cd03122e

C:\Windows\SysWOW64\msres\skin\background\images\sc.png

MD5 98bdcad618b4cb920bf54bd33ea4d155
SHA1 14d6536d1195b8e88b617be3143f7cd1f814d4a8
SHA256 dd968bcaac8cc61d035d6991da9a6e790506eb1f608ac4904677a0d32ab0cb34
SHA512 1b7483c32c4ed7ebb0dd32b620232ebceb76d839321929c27a07cf0088641466ab14f3260803ddf049505e247237311966824bbae1f8a43b4cee7b900e8ef257

C:\Windows\SysWOW64\msres\skin\background\images\qxan2_09.png

MD5 893d369df5fd9caeacf2821d94329f57
SHA1 4f6952745d578f3d5b9cd686f142f9445c4111cc
SHA256 f65f338310f60e12f7d5a2af54e6ec21134044d4445f17588892bbbb3e0ea6df
SHA512 68b1450561382179869092e042b641b420d5c1df59e1383828ee07ba974d5e58a24b0af1b9a49cb528a08a070dd5614a1a659fe26e7146f20229466feb317747

C:\Windows\SysWOW64\msres\skin\background\images\qdan_03.png

MD5 63cdca90e49946058e529cecd981e160
SHA1 80ec3d4a4730d94a6d3908cfa4454224e65b8b66
SHA256 8c56f8c68c010d110b44c48e786bbd68d5650c44a0ed49b9b57f42e7ac1a345f
SHA512 d52ef043a0faf4b70af4902f41c3a0e4d4284880e4cc66b33da394c86024e7b6d9d484ef9d8227e37327a412af21ed0e1298429d894e42acb05e2aacf85057d4

C:\Windows\SysWOW64\msres\skin\background\images\qdan_02.png

MD5 8ca0e25e03dc574a7765beaf09320c39
SHA1 d5cb7ac0b99148a33a942f0ab058c38f61d31a9d
SHA256 71f0bff9922ac59edc4a676404b025535b6231457784327ba4f899303f5cc016
SHA512 f349b0ea0454bba8010fa85cfd0d81da4b41d8298e7f9d00a099b222957f6e5fad540acb6540f24dcada92f2716f9b665dffcbe285edd317011ac881fe6cd92b

C:\Windows\SysWOW64\msres\skin\background\images\qdan_01.png

MD5 79672eb2594fc01a89a8e8a06dcc50a0
SHA1 0bc02bbfd2412afa1bee759012c88f13c63f892f
SHA256 0424f26beae781d0af18c205063fc813c18ac44ce6b655dddee1eedf3bcd7f3d
SHA512 1aacbedb167a71bc4b750ea3ab94c9e0430daa33ac6da7ed0cb90e9e14ba38b16d1281ad768f65e3b98f485908c7e274c2b331a7fddaa86b7db7aacf992b31f9

C:\Windows\SysWOW64\msres\skin\background\images\ppt.png

MD5 cb58d93a152c97ce3286b9fb72bbb714
SHA1 4f0c4ef4bda9caab80c754978c3857a10dce7db1
SHA256 a19b81196546469e88fe13b992e211b1e9dbea52bd216a0be66a09c8b81da1e2
SHA512 c0a0488b56ec5ce22942b1ffdf54909138cb4a38839b5c48ece4a3393edc92a1bdcd2be83f68a1945df480eb681efa1460659499007cf1f405841693c7a0d7d8

C:\Windows\SysWOW64\msres\skin\background\images\pdf.png

MD5 db83ce73c96a4bd930644858bf6e1275
SHA1 186607aa3dc547c0f60941bde0da9ae02865d17c
SHA256 e36b67c17eb0e720f8190252a3592e62e5d9c56939142271ef574e539f587df9
SHA512 8d10288e184f1063484831d5af86a6d390b6fa3d3b445d519a163b8f9f696c518859b35531b27c4344e64ad96a14698be2bc46245d0f5d2ba11c99aac8322885

C:\Windows\SysWOW64\msres\skin\background\images\more.png

MD5 6311dc9133ffba689862a514a55ad1ab
SHA1 cf9de205d25c225b50b2acec3d0a24c39f838bc6
SHA256 de68842941638b770e3320c11eca4bebfbeafad200a15b6b32fb6a1c4cd01ec0
SHA512 99ca2294c82e5c0cfd0603067be1f7a6a5013d21806ad352dbe1a620d3f1990c02670ee6269c743f91e1de33c92edd2c37a3df89705673f060e9746824337615

C:\Windows\SysWOW64\msres\skin\background\images\jpg.png

MD5 f8c6977c80615e1104c7f3b5f307189e
SHA1 01ceda9894abb7f5b03ec484e7d05803db4b838b
SHA256 a208bc14aebc489a30565da20729a6c2b604da175f4dad41030969551f9e9503
SHA512 f270a7b2490413a31d4fed090efa41be365b2a44a1ef44e50be7020948e2bf185f7fd43c9c744db0ab26a374e59e2877de1bdc572db22cf5d3eba09757ffbf17

C:\Windows\SysWOW64\msres\skin\background\images\gxz.png

MD5 56116feed8b9d0c4017a44f4a57c27a2
SHA1 535ba6b212bb256e0a24567453fb811b0005af24
SHA256 26087c7fd28f49b6258b8613562901f485c979f296c5a49a61be8ba9285e991d
SHA512 73fcea35a97682c27be2851c96acd42b3de748262a6441b0ee0402bf91876d8815a87eae28ffb6b76c0e090985c94a616c9873dced403ac0824d1a914708a21b

C:\Windows\SysWOW64\msres\skin\background\images\gwxz.png

MD5 9fb8ffd16038106577928eecbf1f62a9
SHA1 2ea1b28f306a3a531a1d03ba83f3fb57b3672c97
SHA256 b5ee86c475e7a56d81441aa4d3bad4da0f0886732aab249547e1a021916f37be
SHA512 128a999e3e814b11643aa8af090ab85f94d54a7139f15d19cc2fc41a75d5d7d2b6dfba90109f7fcefac861ab0e81377815e40c27d831f54c2ad1c78b7b360a99

C:\Windows\SysWOW64\msres\skin\background\images\fswj_03.png

MD5 a00040fe94f92efbdfd1c289eccd09cb
SHA1 9c68bbf2049341f13a6efbacba13b7d790dae9d2
SHA256 56711399e9f10f65764b160838592f052840a79a75fb7c954cb24d6ae18b9aea
SHA512 1a6f21d3eb7b6ad2902574fd748ef17355e2ed0444eeb4b04e645d9bbfbe141990f183d9d0585f33ec06788a50f481088ba567fcecc81ab0fdd5bbbd3aba88af

C:\Windows\SysWOW64\msres\skin\background\images\fswj_02.png

MD5 8eb19e91df40bbfd57bc1021686da264
SHA1 81aac816fd5f664745f46d213ef6c8dbb9d22662
SHA256 ee4250645f2c98cc4f071af63cfb99856bd5f6f2c7281a09bb1329660a2cde80
SHA512 4153b339f3b2e832863cc0a80ebd7da5a0fe8dab12c86fb82988e68111c57ec5ec62b3ca43d30bf1810338de139a9a36ec6ec3d5a7c10f450f5819f8513f8b33

C:\Windows\SysWOW64\msres\skin\background\images\fswj_01.png

MD5 b506ae56b9e7ffd2e4a7771109830f05
SHA1 72b0c680b3bd4b28e7b432f41dbee1d5833bbd26
SHA256 8aa828517002dcebcc448873b1d957a3f02c881161d6331d4b4ba7d234427fac
SHA512 78722be6bcba62c9f8130bb140ddf94c9e47c113c45bbf6c158e19284df73cf907f08053b1608eef14692f88977d660c718fd62d1fac9a4c33231965eaf5e484

C:\Windows\SysWOW64\msres\skin\background\images\down.png

MD5 0c90ebb1caf0505de7a96ab29d893fe4
SHA1 43ade853940637d0c9cd2574bdf599bd90f65a86
SHA256 e0ff6e28a3ab6bbaf88f510b80c0305b1a97daee23205dc4764a91f6aa73c46e
SHA512 90e06983002b3efe4eece50625f44ede7d23fb54d79296588baed7fad4c8726febf4f33c4b2a18bc7ad25f4bb26603eca45501e0f50f5eecf1753ea30f491f3a

C:\Windows\SysWOW64\msres\skin\background\images\doc.png

MD5 850b3946aa9857f6afc3610af8769d14
SHA1 e35a26f7808a7ef7d7646f72d5ce25a6b664b25c
SHA256 f4c9a502571ff715d6cfa85a9b53520a113e003d3337bd57bb81f898dd3ff39a
SHA512 49ff4e322210606e3ffab65a9dec1bc350376bb54cab105ffe9b064e3434e35fde1680b8edaf4a5bc8e18e94043517bb5e781775094d1aff91ef5339f27387a6

C:\Windows\SysWOW64\msres\skin\background\images\dh_01.png

MD5 015bf2c485cebf8ade6fb8857409a5fc
SHA1 935580cce2ae9466eeef7475121d081d5814bbeb
SHA256 6fe0fe9153fd320329d33b77f56c3c37c4fbde465310ea0efd60c3206bd67dd0
SHA512 00f9c246a74709b45bf17963f29088c890d622379001e313099cd616b3c030230b1be124d8596fdab5d266abcf626dc4b81456638fd6bb5e669504aeece74642

C:\Windows\SysWOW64\msres\skin\background\images\dh2_01.png

MD5 8d16f1059d39f2fcb8c45211caab1e29
SHA1 9d183bd6ebfa40c180bcde2465dbf9d4336538c8
SHA256 bc73b83826b6f9ad44c063bd6363b37e5e11e51488df4277d4b55252b990ff6c
SHA512 0c66d7cb47f844b17a8fb21854736f9bc242d3fb77054bd18e581c980f40e7d64faa9c4f393a1ab02b1fdb58c22a48fb05213bb3ddcc686a4693ad2d9d1d6e12

C:\Windows\SysWOW64\msres\skin\background\userreg3.png

MD5 5bbdb5c183ebb74c4ada9d6b4e084043
SHA1 62c0fe7226a664e9c6f34f727cb11118185feff1
SHA256 f49f438971daf7b5549f38952017a6e1d6dd726faa5c835de90f1668824fcf28
SHA512 8a5d2d25ddf9d8ec57b5af3b8dadfb9f77586dbcab26f2f70374761fc5b81db12094e77e41c24dc99eda1fe421bc1112d695e2ab7c468733ae3bb20386a839f3

C:\Windows\SysWOW64\msres\skin\background\userreg2.png

MD5 be522a89dd38de5d1c9629f479b7966b
SHA1 00059dafebffb2ef15a6f095dc1eac5d195da170
SHA256 d015b82033d8d2d90ed4082195a28d6475831f44f7cc7d01a56489d0a25d990e
SHA512 f724ac7a4a43b5e83fd988dba854df7f16e1ef40c9c6bdda80d6f181e5d931be2171635b7a53cbdea35ca445a08ad41e8616cab4e91eb135bcf3fa2ebb99ba2a

C:\Windows\SysWOW64\msres\skin\background\userreg002.png

MD5 8da79d821305d93d472e76b3b14b548b
SHA1 e7e10d2cdc76525ad216c3a1639a66da61a8cda7
SHA256 08ece1fbf23281b5754e6408403334bc86353a097e7424b8d062a3f9d534905a
SHA512 02b4bd33f40d770e146310a11d81562a810c6dcb2c51f7623f4be9aecb045e8948ed3f31c2fb81e811a901674977b82c24460610d4fff30c298efcc00faf814a

C:\Windows\SysWOW64\msres\skin\background\userreg001.png

MD5 a750dfec49a809d10cd7260723e2b013
SHA1 3df8e911aef74395d2973dbe9a26cfb443e14194
SHA256 cf5fcafc317aa30279db660ce48faddd2ab9ac8714325f413d2248331cf38c4a
SHA512 b357635f8d9a77d749eb8e28c27008efd139ea190f9bdd3f78b0ef122cf31d58c59d868c8cc3d5f53c32416bbacae0ef3aef93d9d37de2e1fb23c149b9a8cd26

C:\Windows\SysWOW64\msres\skin\background\userreg.png

MD5 b4cfa488a79dbfbbef2cc6266f216687
SHA1 56f0342465dc6c4ce6edcdcd42e8d2cb60c56c49
SHA256 bbabf4500311ce059094eeb5f72f5ea87929f1e4a4bd874b741752234de6b49a
SHA512 4471c007cbd6186361d72e6ae19798c10cba1089dfdb2e13503109b89910565648a34595bfb39b21f426ca46515a636ff567609fa4c4857c3bcff0db4e5600d0

C:\Windows\SysWOW64\msres\skin\background\userchange_bk.bmp

MD5 92ff4c569e52582555fbdea97c00e62e
SHA1 a46f23b60d55e4d3a2eda2e45f1bad6db565cbd4
SHA256 8b5ddec3d62be67c74d9bd744081f549b6b46b53bf2527ee847da644fc907243
SHA512 356b9ae703a96d69b7065d0a3f74c2e9f999950fabee26c933a47b4185a51aeb6cacf4bfa49de888d02769e75fcb51d660ad95aed6de2af9d140f5d3ea2f287e

C:\Windows\SysWOW64\msres\skin\background\upload.png

MD5 8a1b59e21e7114518aeace49c0d57938
SHA1 a17ac9a6c4ca75d4a6d5e05a6d7ebed584689fe7
SHA256 fb5708872e987e315ceae31bef098be713484644fcf934ab76c7fa8d8da71a4a
SHA512 28dfc6fc3678d7312c32de906e1c78d0a9d48a87aa27801881ef632bcdf698d6dc4be53c344423e3a2077d060ca92454e1b4fe3700c5f0f1327d66b628afaecb

C:\Windows\SysWOW64\msres\skin\background\search.bmp

MD5 27926408a1adcc8ba2ca95ff459b63fa
SHA1 768654a0369170c629d2e3bfe11dea58fc25eec4
SHA256 4f1808f3977effa67dc0fc06dcd1d52fa47fde99bc69e5671da5bab0b68982bd
SHA512 2d94f507ce06948e21041922aa3b698f78bb433d65943f37ff21b7cdba609520d87a2b71b33a7cafb6bda060382eee5e6a27a13f5dcef030a13a5357a0ab502b

C:\Windows\SysWOW64\msres\skin\background\pack_head2.bmp

MD5 f9874a0049623b95ce0c072275bebcab
SHA1 b7e026ed49810dbf457b77218e5ca5d82f4c5d6f
SHA256 4cf5a152a2b4526c58a38c5adb7e70575dac27dfbd4945320b890c0e840ac83d
SHA512 1bc51c246d5036e0bf11d95ba6ffa8d7694be24c9ed7a7bfde7cb7ab7127dc13fb050e9d3081b9f3324148a3c12ba396fef85bdd07d0f74099f4525fc38170a7

C:\Windows\SysWOW64\msres\skin\background\pack_head1.bmp

MD5 597cd1f472b6b296119c6ea37fa8f787
SHA1 07fa18c6c75843a8ee9ee06a77645c53454ad594
SHA256 cd86f8ae97bd64469ff52e897485dcce63c42fc278d463f9f4ea2c037b8a2464
SHA512 f6a08a33bec92822562a72fb4409f6d1966aec0a221cf53ffedcde15ca9bb02430383e2c89cf92200c43ab062b9ef1af35f47fd240383a1aba2ea96bf8092a62

C:\Windows\SysWOW64\msres\skin\background\pack_bg.bmp

MD5 aa051e68c05589d2ef9d879a025209af
SHA1 453aca3fbe1bf952edbc00e178a3f2237e3abd3e
SHA256 b3db981306af0902f5b8e5b4ceef88741f010162df365544f73502b9091590b3
SHA512 55392f2cda65f360ea67eb7c6adcf9b906b7ada291b1740136f1461848deb0bcb7a93691e7c1aea37e98fae76e0732d6e113d7581c56a51ece20381fa3b5d41a

C:\Windows\SysWOW64\msres\skin\background\depsel1.png

MD5 5c52f4d50fafdba43ba764999c885a78
SHA1 755b04397c3d13f23c9716a43b60753f4c9f9254
SHA256 d91853fb55d637c84971bf430768f2477be3b03e14ad440c743d413be00818d8
SHA512 93cb1e0e5e52192a0b898f224b7f2d644b0d31a775e3adafbe04402c975d67c20a833b1923a3ac930b2fab54dc304510510e05910a02484c907ee2512487b734

C:\Windows\SysWOW64\msres\skin\background\depsel.png

MD5 d4f675353ac72c37ad4e56184b808499
SHA1 dfc3b452590ae92d0d7a5ced91f2a053e1dd3d0f
SHA256 06113b7f974aa2c7444c511f66f37ba16fbbe5c2d6af22f22deeab6550b0e924
SHA512 147c7f95479cd8f31267f0d2faaac6c06a43ea1767d3b318d54dfa7a383cdcad30838c5374792a41fd33304e5ab776ae5c054ffca64faf741eaf0bbe9b654e51

C:\Windows\SysWOW64\msres\skin\background\cwts_03.bmp

MD5 2abb6aca016706e73e1c7d718c9f5cfa
SHA1 d9866eb0f512469ac7d6ac3a6496ee9416c364b5
SHA256 c27922ff1ba09643947a5b1552e87276a78b4c3e9dc841d253e3d97e04b7e463
SHA512 198a401f54ba31ff2ba5a178253a1e1b9be03783d1dadcd2e34b2b49e2f273e59d59254bb570311691dc8a1e3876cde5484f56c0c891f88387cc88c5175e2cf0

C:\Windows\SysWOW64\msres\skin\background\cancel2.png

MD5 031d3c2fd360359edb815b4510c53e88
SHA1 ac04b5f7e92fa909eb3bbc9042ec1396a02f0884
SHA256 698765b2c55765cfe66f981ef34ba2874d3cc1f09ae505d07912563f994f4387
SHA512 ec4d96b16d95272682e249d82f995dd4ebfbd974c5d12b338588bafabd68f4de7fa428f099e53dece6a564b455f967410f6227140443c88ad6e70cc0ae05d368

C:\Windows\SysWOW64\msres\skin\background\cancel1.png

MD5 801cb2f718c4def9f916d18569258cee
SHA1 e64be4a03c50191e2ed2c3600c7d48b38e05b2ce
SHA256 07e7bba06ef7e21ec41875f7c44e62f30803d72ab1fe5bb308d79540df6e9fee
SHA512 4caa369f46bfd4211c5f134296b30f74ca02e8e098936381c02c1bc2260cd20ce1ddd272cae168881cad262063b707c85a87d568933dc25d96f64da18e42be90

C:\Windows\SysWOW64\msres\skin\background\cancel.png

MD5 3040cbfec66c55c185ba26a194ec0c11
SHA1 3d3ca98f9767b41e92488607b94f42704d82f420
SHA256 3335c18277485db66f1e83c2a9f818442e75fdc3872b163de065a79a121fb51a
SHA512 a9b8dd12168a5dcf7473c19aaf9904f1e1880999665f490a88847b8d03693f1a22e560e38912bdb6ace78642f00fcf6f5a81c6f902d27b01bc90349b1cf4624a

C:\Windows\SysWOW64\msres\skin\background\bk.png

MD5 76ab4cffe491101921901543f12172f4
SHA1 b4e5c4f4cc34824093d6b47e7abfc65589004c3c
SHA256 b63be74bc359e51b4fedb0fd13698d27e18e6b0d8057e4476d7e20437842cf52
SHA512 ada7cdbe99027333cdcad2064ad2800c7c8e90c011b6180e3fdb2e97ff6d0361710eace1eb4db58eebb00ad31a995835fa573c7ddf4d9013a737f8b98d08a3c2

C:\Windows\SysWOW64\msres\protect\STDMBR.BIN

MD5 526310d6b6734d0959c7ecfd0bf97e0d
SHA1 6a83060573c0c37c5aad54935338d6e9fa492d2c
SHA256 ace0fb7a119a776657a9b761e757cf2780e3ded807e4c3c7701fa5f0e5621ff3
SHA512 ec215e789d4cb8534faea7eb6b407784aca202ac93196ab24bc65812456b6595ac311a2d93af2c7885b3f60e6017d9b89bc79404e115da9c9293d31b3b5906e0

C:\Windows\SysWOW64\msres\protect\RSTDATA.BIN

MD5 30dc769658414e48f42a9ba278713fb4
SHA1 cd86581e75e0bdf1f9a0de08b43f2b4d197af013
SHA256 a2c797c5ee1575fbfb727eb4159340c7787357112d1dbc46be0c704556f085f1
SHA512 df1ceeae1fb6fd01051a293d57370cd4cc0cf8fdba1319d7871293f8fe552ada53000acc81ac14e3b1e308883d1e0e2e199539c4c17f26c2577884f20afbd28c

C:\Windows\SysWOW64\msres\protect\Restore.dll

MD5 4db693748baaee9505d14e1b43749e91
SHA1 f98b07bfd5b2e3b133cfe8e81c2b694c3e692d0c
SHA256 1d38ef1fe6363c73e98e6f6fe90897864d9c842333d87ad7bc052c2fc08dcc9a
SHA512 6f4fa41c9e5ec2d2d4e45af0e9cb8429885d444a1696794448087b80e9184b2042b9e19285fd3eadd2dc8a7cd4ca54be30a1021b1c124e276f7a8a9eae17f4d0

C:\Windows\SysWOW64\msres\protect\ReadMe.txt

MD5 691e62028337a522d4211102b91e4ced
SHA1 decf5396f555c35a762bf7d877171a7234ea0585
SHA256 1a7c5d13a03e897ff810b87ff4eb1b641b182c4703967c47b9df163510e2a934
SHA512 b8047d969ff2735570e5cecc45603daf68876d18e473f53b8b1cdf59625ebda4538a7bef4368e4394c6c6896c185c7b28c368672224306523484dc25e10aaa14

C:\Windows\SysWOW64\msres\protect\License.txt

MD5 539add8b63c12fcd42bfbda80465965e
SHA1 a4be331dc60f79c6b805a21edfa7bc1d695250a8
SHA256 21199badf0521ddf637e75cb2bd6dfc1c1b409f165f1a89982cf30ef0fe38edd
SHA512 c12a7ef1d4fdb0f7fb228d540135c41139b729a286c01754ceefe5cdf6402ec2a70f2f1449748f3321af1135afb2762ab2df1e5c1cc9b14cdfec875031fd6dcc

C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe

MD5 58128d77088760f9c96f7597dbf4ad94
SHA1 05d94bd4140cbe424d8ede66aabd5e7f726c7a4f
SHA256 f2c4ad6d9a4c89200586743017a326bf01fa2cbea5760eec023a18645a167dd2
SHA512 2277fbd981e75e77f81a7ca524888a5d2b15c3e66853e1e495e3ad574e1799559aaf71eed09694d148ed41b71da1249f318b8c0d9cf88133f6c065001109afd5

C:\Windows\SysWOW64\msres\protect\FRSDKTest-2020.10.14 bak.exe

MD5 9fa14df908bec6ec466c92d5b90f4923
SHA1 a8111ac7bacd780c44f987b603c8dd3f1e67bab4
SHA256 490f6bdcd7b80e5c3063b48333ce8e7d842e2899e8f228f14d6a10ff0267effd
SHA512 adfaf0d29e4c1a743e4f858b51abce468b19f77168e64343a99787508aa161758ea73d97ebeff74cd46dd616a210e8ad2b045227a419416e4f3e5df3efec97af

C:\Windows\SysWOW64\msres\protect\FRSDK.INI

MD5 15d054280e6d5dbfca5218f3c84a4a9a
SHA1 9b7463c228fa20d44297f5eebc9bacb5309f1cae
SHA256 456ce3a371b1946d1985f6a89f7c40585fc5010b345328b725fe90ab43f10817
SHA512 28a73729298fa43e42a48b509d19e49a8795af5e1c6061620170e0bf64ae0235064dc9b2f2970fb948d26d6f60cfd405aa8b996512bd1dea483976024cf00d5f

C:\Windows\SysWOW64\msres\protect\FRSDK.dll

MD5 75310adb4f364176d64b28c5ab128fc6
SHA1 6e4ee07f96359b4f7ab29f5a5112169e001a8033
SHA256 928db8309813a11b850c3769656673785cec21ce51a8f33e5069fd114be1c8c5
SHA512 aa11e0d8df508b01357defb2b9e91d661ecfa24ea65f8987fec069a0e254095125721a40e94ad8ac424f1c3686f47508855968e0aa0a7872a28aa601bab61afc

C:\Windows\SysWOW64\msres\protect\FASTMNT_x64.sys

MD5 7df8caf8a3585e504fecbb3217711234
SHA1 850f951f02ffad02cb2f757ef295fd230c9f5a78
SHA256 7e999ad2fd0c1ad9cef68daff129d3eed82dad265cf79b9b7eb15eae2d647e4a
SHA512 acd69cb5efddea25257cad64f38caba887f7b531084a8e97bef7e006b18861edd92d4ee8500ea0c67eaf507451eaf805727389d5a9da58a033498c0f35214a77

C:\Windows\SysWOW64\msres\protect\FASTMNT.sys

MD5 23ab93987a34deb15e9ce5d6728b39ca
SHA1 881073b68c7ddae34990ea4843d2ec8167eee51f
SHA256 d219c0d74d6e961b5e9b202a79e36bf60844954a9732d81eb99d8c07c2daad41
SHA512 6cd89b1ed8086454fba7ca0978315b8f1756f19e2b53fd42b1424c40182269403705b9d43832cc0212c553e31b3019f1298267f7a5716769926354a88c0b73a9

C:\Windows\SysWOW64\msres\protect\FastMnt.dll

MD5 1b03e5fc6232981cec8d04986efd63ef
SHA1 b39108470df11fa4b1f9b088764e1e8f281c118c
SHA256 fd11d2da6d878c378fcb51c6603639d405ab9c9594836cd495b7edfbfd8e8892
SHA512 cd814c0b70445f4c31113964e7399277eb498cdd8d0b91e795d509320f71fc76c9d9e2038ab7ae4502ac0d6817b688237d1f9a1f8483de254ef2e2c6e1036ba4

C:\Windows\SysWOW64\msres\protect\fadisk_x64.sys

MD5 a2ffe985c45b4833ba8f725f6268aa45
SHA1 dba050fc164c6b38192cb1955a13c6209a969e68
SHA256 afbc7d48a0cad54eefb88b5d93c2e392f7d6a21de6d46f2a7c36754a02b6c2f3
SHA512 9aebdde2f8df141020e49e246d5aaf74d697f66300a5d056cc69a04602e748e1aba1cd22463e16e7acfddef5a9d03f08f9440e1ae16ae7ec2af3ee4f002cd717

C:\Windows\SysWOW64\msres\protect\fadisk.sys

MD5 aee9e961266058ffa52e1510e5fd7fbd
SHA1 c2363f619706e3528e080b4df0fddba78ca2f09e
SHA256 3a8f998c86365cb4c3b318f48085a021d80421dd5c85abbf2cfa0ab3d0b86e23
SHA512 537936bf0f69b12891713d0f321212505280d98dac543f27abcbab650e84d86f65b6b6a9ad3ca02a38f5a4751559c7b9891487f88b4b56e6aec8ad7b0e310095

C:\Windows\SysWOW64\msres\protect\Detection.dll

MD5 8c62ef18b5e4e084eba23551eb265fcd
SHA1 22b961cb466e77cb5a14e6e2d41bd5bb12950c6b
SHA256 dbf02ecb4c64d240fa15b42b84844ecc8a1c8509e090edea36764e05dd8312f8
SHA512 8e4548dcad78cb5124837f486aabfbb01d31e461647db398363dee15cecd1ad8038afb8c3c17d3004e071394b97145b49e30cefec791187c5b39daf975ffeb17

C:\Windows\SysWOW64\msres\language\English.ytf

MD5 db48f4be21f97aacbc247cab0439805c
SHA1 41a6d8e09bd829cc5e90dd0fddf662fb12f7cbbc
SHA256 ce10266745e259632f0e1824cc681c4d701513e14fe055b8034f1bc46b9ff066
SHA512 a2db1de6779bd10a8be8f21441aae693fdd89119ed840dec68a361c13f711b2c5fe4cf2399d2eba6e22c748ceb2f42da98d0693fcd904225684871587c069a39

C:\Windows\SysWOW64\msres\config\USBConfig.DAT

MD5 39c33a46105131a5fdf5373cd83f7403
SHA1 5497b0911b3f5772723def3b360a2e654327c19b
SHA256 097328e8c957de2428283954f6a1ee8ff7ad7def12e100a600178407f5decf24
SHA512 720036675e1262edc23ace394aea5632e01a84be675acc64af60554d33a541afde61c56a6cddb98659bf2a77c48ab23ce38b178a95413d495827b857c75ecab3

C:\Windows\SysWOW64\msres\config\ScanFullDB.db

MD5 20d30b97765c709cd80d3a5788abf157
SHA1 a0d1f40a20b0907733652d9a34dbc99e78d02b67
SHA256 2dd8db96d8f31636f404d072b39925ef30b033230dd44b1b3c23ccbe2f0cd722
SHA512 ce9449eebcf5e8fe7a66ce26a8a53f278714ff92f8072c5b09e6f9f7ff45d072f3350f0428d17af17406e7d55a0a88b79df11e4de32c8be010663cbdc491c648

C:\Windows\SysWOW64\msres\config\ScanAuditDB.db

MD5 fb6d18199a3c28746bb6ce95a41c9585
SHA1 fb667293377bfe6c4343b1cd2f30d0252a1a4529
SHA256 471d30d234558a1b4d2c6a16e0b065c7a32a324c6f9c9b4def1d9a0f6599678d
SHA512 586ac97ddd9e7aad4acdd485cbe6a9abab5812adeb3a31e4acae7e608587d2dfda1b8f5bec6d9c384eb58ddb981bbe31669d9ab69b16009be1e81722ce72fcbf

C:\Windows\SysWOW64\msres\config\riben.ytf

MD5 c0a475f8feb3e9a92a117ba0df4705d8
SHA1 8088b2831dfece8f38221274ea791a300ed7de3e
SHA256 47d2994494b732ca89385d218c55fb762ec36e7bf5487f6ba42791088940f9aa
SHA512 efe2b394b1eb6e9cde049d3259bee165a29ef6c03e35fc661759022f4ddd2328439be26356a98656ca866009f0d92fa83225c26b656c6f3e2622f4bcb55895aa

C:\Windows\SysWOW64\msres\config\ChatRecord.db

MD5 a9f4cfb172d413cfdd81de0598ba82d0
SHA1 749339c778e896b393318fd0ee6ec34f05d3e2fe
SHA256 79bb8c3c91638997e5ba5eb5526b3b11e4aa2deb1569c5f6cfdbbe0d00167064
SHA512 2e4a0a709ccaa2bb2c2473269fb863b9497736c50aad995dfaf6e2a910f08700582abcec2975cb93dc3245a511e6683899370cdcfcdba23dbabd203bd91d9935

C:\Windows\SysWOW64\msres\zip.dll

MD5 0e5d5e39973479d84fea27b480d6ef74
SHA1 9f467a0c681e56c5793216a4cb01127b9c1848d6
SHA256 79b43e1a8bd6880c3dbb7bc5558c3c345918cfbac151ceb08a70f04cc3e38e97
SHA512 803a7d49fcf89ffaad3a5510e972805c53a5da44b3b56f670776049b1567445ff60c6a459f8225f096eb88180816a8bab6871e847a44e0f45bfa016b701e0065

C:\Windows\SysWOW64\msres\yunoper.dll

MD5 84cef7ea8a1ede402f5b01de45671c45
SHA1 6d77b571031f4012f0f241d8881478060eafde2e
SHA256 8e52804d68dfb0a4e5edeeb26bf5d3c3849e66dfb4500e3c271633376023e6d8
SHA512 6fe7e694d44bb4475e0726a89939f0d4815747b36e259c0c6197fcd8332d2723d07163110ac6fa623ed88e29321f7dde9ad87e73bcc8651c167ddf1efabc3a3f

C:\Windows\SysWOW64\msres\ytuiafun.dll

MD5 d12ab4385df88db5b8c306f0c31dd916
SHA1 caad6f70965f3e5407fc383150e70e7fbc5f0ef3
SHA256 57dd9353ac36678b9b34eea1171205157ba2964952e66e29bbfff914081f16af
SHA512 401ff731680b8464f0a560adf560aeb6b0fe8ba630ac367caa39de9dfda9cf5f21f94ae5a1363d0c134a6d390912f79b71806057f3d054c369769babdc360c51

C:\Windows\SysWOW64\msres\YTSysConfigBak.ytf

MD5 cada4898331568cef2b8fb760ee0670b
SHA1 c907bd823a56f19bc759df8f39fc7045b2fcc48a
SHA256 8bedbc8cd3dded1d12fe8229c8173583a2a0d4197ac284e7d85d727cf03f0005
SHA512 ce738a1133bc1db6b199929f3c339274f38d89374a74ce76eabe02a2f70fdafadeafc6fce2d4de9d1bc608ed192828268ab9a1877a50b36d237dcdd7f37c109e

C:\Windows\SysWOW64\msres\YTShellExt64.dll

MD5 0db3ebe71cf3a166329d8640d1da32d0
SHA1 a93f47c89409a5e99e5026af219e157cbf2281cc
SHA256 a9ba9d8cd5604f059575ce1010baa3e62958c39cea71feff0afc40c7942cd1d1
SHA512 e8cdd24c6c2460e7ef617ab80a24289af20afc8b931a4a79279ee777dc49dffd74603f3dca64168619978554c9afce53e65d4596eeb81e7945a600e9f58e3cf3

C:\Windows\SysWOW64\msres\YTShellExt32.dll

MD5 ee0d3d887efbb12e1155dc86ed8b10cb
SHA1 20a083a9a120d38d5c12f7297c3bf4e06308d901
SHA256 a2e70678709f90fede8a3474505362fe2bfec25f7eccbafb9296650ab2089635
SHA512 66c8fa4374724eb047e1416c0f2f131bcff9f8d24bfcf72db9f7391c08436b27886df888fe1ebd1d3ff4a699b5033f9bb9e18c6a59b60ec110a306aa59f3acca

C:\Windows\SysWOW64\msres\YtMiniFilter.sys

MD5 b05849dca3b08846c9b2e1e20e62f8d0
SHA1 1cbde7dfb7bc105eff0dac56d8fa439a7bef0e6c
SHA256 a7670d15ad1833e9f2bcee60c2318b40e747c97f2f96658c1c68a20e0f73da27
SHA512 e60aab79b7c0eb17b832e1b73e4873e2739e3968c5e0dfc3a35f361c0e89ac2d0cc5432b3fb1f9c6bf9bec1772a2afbe891acd38d211edfbad0d9c11175b31c1

C:\Windows\SysWOW64\msres\YtMiniFilter.inf

MD5 93076ededd41da9cd404edee12fa9795
SHA1 66c34e356ae6946bc2e19a0c14376d2d78b16d7e
SHA256 bdb919abfcb2a4d5a05717db73ed6034e28edf8a530ff55a76d167394eec6c89
SHA512 199361bdd22f0c64027f76e5b0f20e0e24f06728e6a4d34d4453bba7324791734a0674d374c6f7d8755243a5adabc79439504a12ecb098a51b062ef89deaaff2

C:\Windows\SysWOW64\msres\YTFunDll32.dll

MD5 0640f6055ed42b426bc7764e0f038dcc
SHA1 d6cd21251c84f697662adc4a8298e7fca8711cf7
SHA256 32272eb9b639c138be652a5206630815634b98daee4290df708a5c2654bdb22a
SHA512 6d350dbde8e6cf9f523cd1a1ce084e7267efe7dccdc63710a9945b13882d5d2a111d09ccba8392470ee002cb2c3de36b7dcb1772f167e2e99b87285ec685039f

C:\Windows\SysWOW64\msres\ytDisk2_64.sys

MD5 257119af819314ace39e0a95cfbf70fa
SHA1 0dad13d8491b2c859f550958a58b0056f72d663e
SHA256 f6268d2f89c826f8f0ab4c165fb324672e0e00d198c3b43bc1ad6b2c9e0f65e0
SHA512 ce183a3cbcd60c2d6e260fc721b5ba079ea9f383ab3aae1a6907387b59a8652231b898858a5ea07522b6cd1938b59c736a50a138536ab17983f7f7eeaf18cb3b

C:\Windows\SysWOW64\msres\ytDisk2_32.sys

MD5 89c4e0fdc3853b511a2cfc43aaad4189
SHA1 ff8064e6e0b9bd571a84f7eeedd4efd770f9ca04
SHA256 577bc08f78e11bb23322f25166a7ca048f3f4c80b0fddefa673c430d80302fb3
SHA512 0e8fdb2d34dbfd8988da74f8bef73900c5357f04468883719a7e848dea41445e3e24d5ac708f7b3d1073ab1f3f15a725c893b10c228c26a197f78774b1aa644a

C:\Windows\SysWOW64\msres\ytdisk.sys

MD5 a8ade889c57069e5582b2cc8a7ce85cc
SHA1 6933b933de1dfdacaa262881ef06ec9f83ed7a58
SHA256 b2c4e83bc892f065496cb6321411fd0318622f5b89796e68e16b8d5d67736e1d
SHA512 dea05bec0ca7c8a7ea159fc8268d96648c82a40903ba44d52d28ed7b46445df5ea7e239ee208143111b0567c634c150133b49a107c268a865dc65e724d94bdf8

C:\Windows\SysWOW64\msres\Xz.bat

MD5 c8758711951079cdb5f2e9918b35b5d4
SHA1 2e6cd6760d19036a04496976ae824b8386497321
SHA256 3e4130104f14733a5fd9b1f2c75e8be976aa15bdd693382ce902cd33b0a3bb12
SHA512 192b4da18abd9117c2efaf59c86a007de32c6552e3af0712d1b777f4f55f54b9fcc1a229b5332a39361ad7a8a663276668299e3670ee720946de2fd526925e36

C:\Windows\SysWOW64\msres\XFMainTh.dll

MD5 7c0ba520eff1174ac7c8122c630a0793
SHA1 f7f1acf035f508350ffaefce630934c4d5a3320d
SHA256 24b22085bcfe011329eca31f78b6546f55097245e8bc3fcb4177bb714948b1a9
SHA512 62ab4d0ec13541b932379be9df7396fabcd1785758e6d8583aff4eb448c65811aed7b6fa29e5df5e47b8b9c6c07efe4a5442cdb6bf3645f20f20e825b50cb551

C:\Windows\SysWOW64\msres\wni.ytf

MD5 6bb4955d7e1050b3f19c7ea4246ffd9b
SHA1 6c502332a14f1791e7549d5469d3497ed5ce2d9f
SHA256 5cb06a70268d0062ada41957628ad9270ffc29836dcb2c0e24dfbb3169c4c673
SHA512 cf5b53e0070ce756cce8da4f06e194373d2c5f8d7ab870dcfee27acb5a5cf0fa45b84677fc8ce0ac62aa2bd37a6a5f95935193a73f712a911cc1df29f4312573

C:\Windows\SysWOW64\msres\WifiPolicyDLL.dll

MD5 7719e2232f60a6d94e3c1d0e87037d75
SHA1 a1e741402d50cfd583384cfbef6e78d00ba2d478
SHA256 f3084ad72375c6b91691178805ff89c638f4266dfbd31ea9d2b82bac0d1a3710
SHA512 2ee704f81b61dca8c4b4fe589692018915f15d3c545326ceb8f87891d78f13c2eb39c8a1980a1136f51f793ab8afad929b6813bcaa9536419b880ed448737f5d

C:\Windows\SysWOW64\msres\VSetup.exe

MD5 5e242a871251963dd5d0929d07d3d5a2
SHA1 853a9b3b05712311a75ab126ecfb98441feae545
SHA256 eb0504ae1dea3fb6a4db2d705196d7f94b0111d365825e53194f64af3e71c8c0
SHA512 eb73289b78668d1049cb30336fb64ce25313d23a28babc5a543bcfe7b8f78225a921636f75e9be76c460203bdcbf14399addd98e83b046e6a83d1900237bb1d9

C:\Windows\SysWOW64\msres\VSComLib.dll

MD5 271190eff252587d0894a5cf6dea7831
SHA1 4096b2950ed10f4af5838ac718b5b07775dcacf5
SHA256 620a0fd67167ec855c62e48d13a8059c1c90b4d57e3d2cc77be655fc3c53b18e
SHA512 eeb2369f3865ba3c5edecede09e833b41e645eb00388240a5d8df412468efc77a372f29afe80e260d3214974e4a362f9d6aa78d8fcdb231c8c6805232ba2fe62

C:\Windows\SysWOW64\msres\viewRect64.dll

MD5 e42f2fdea9fe6eea71c598cd62bc475b
SHA1 47265769aaace1aff0a0c4cf41f37543e303a894
SHA256 fed1bf695cb11b0fe1f9f726dcfcbfafdb3ef9fc813bfa30cdfc2a90745fa369
SHA512 315b45b0d1a463cb1fdeefb53624880350c2de9fbb3f13ee13f0f195898fb9eb761dd9eb3b0d0502c562f5e56ad428b078089326dd95f9c6e5052ccea03521c7

C:\Windows\SysWOW64\msres\viewrect.dll

MD5 bf33b1a2559d66d56db8bedc94e5bceb
SHA1 fb05cd60f40660da76343b2b155c3adcd451ba4e
SHA256 6cc77760933cf843493d827ca1b558622c9d2354e267914c8a00f727e3ccbec6
SHA512 ed9fa24dc9fae221878dadf6ac164f029747fdb27b860edcd149617176b39bddbd56b03e9073d52d8d88500dff555da3a06fd4fa1c6916d40ace7fb6ebf0e576

C:\Windows\SysWOW64\msres\ViewRecording.dll

MD5 0e43acf4648ed58b371ff4a1db02d557
SHA1 ae2d9a616c25811d55b01e3ee8d15ed311012363
SHA256 b0060a1ee06899cfa23d5dcea0271f0f876edb6f970fb43a1138dfd3a30de7b8
SHA512 536fdf1769c328ef24e8b4c9f778186a78a9aa3a44a3794eb3a64b5bc2c5b346609ff769a8333cc6bddbaa92921276f97f3ab97e1d4fcbe5bdd5b5874c776aa9

C:\Windows\SysWOW64\msres\ViewC.dll

MD5 5c56678149e77a59eef758fba4da7aae
SHA1 46a0f27be63240aeb9cc7d1bb70b99148482da8d
SHA256 f306faea2b7979fa68f4df0996942f3bd727b794f99224d7c70031e20940411d
SHA512 a37cda656f35f443c0adcd7fc669be5593a529180d8bd7d12613cf5b29eb4f3aa3e6f82fbf33240944cbfa6488d18c96500c9e90b7a5b53adbf3aa99a0d4c14e

C:\Windows\SysWOW64\msres\vgwdrv.sys

MD5 5a12522a6ac480dc1668e4ecb470e3e4
SHA1 66461816cee4ff92b8d75aa9ec62e234a974a6bc
SHA256 fd18c523ab72276834b5988288edd194315653081c418d9c509be589d0aa392b
SHA512 12584840c5da99f33c0af3d5b4554cbbd4cdf1588ac880da08cf037f20808f82035b22bae6cefd0d22595832db9a4cc1f7c64ff87cd0e864590425fbff2cfe69

C:\Windows\SysWOW64\msres\vgwdrv.dll

MD5 faf5ae9075b85af3244a8c3ec9d83d9e
SHA1 7bc6c9c5f61165ceda6e670f7591e6366add77c0
SHA256 0be721df03ac9378d1a9901c268b2b41e21d4be551313ea86d3f578215c28e61
SHA512 80ae75924a34738e68594d6850afe8181795c3f09a1b1dc55a2d74c45e7c9bb0d8e25d4325b05b1de3feed592300dd8d35ca4bb48ead45e2f96c041664e193a7

C:\Windows\SysWOW64\msres\vfsd_fre_wxp_x86.sys

MD5 e976449ca5ebb3cbff8ca444e4625fa4
SHA1 2efaf45fcbda84597a306464141b66a9a9149104
SHA256 105a21cd7bcc57f9f586eb1068ea3cfa00052eca3d5ce6d5270111e1ade42767
SHA512 b6860292513a8ab8ce3d81976ca568055026980a5cd10f677829dc53fd71390520e15fe58d36b64b85096a95081d73318d7a500f8c37c7ede592925f1d3d271e

C:\Windows\SysWOW64\msres\vfsd_fre_wnet_x86.sys

MD5 2fe7f00b7cd4f92cc42ddb4f78bcba2b
SHA1 97099221be63bbfa7f4e4498197f652f4dfaa09b
SHA256 447d3d1517802755cc06fc6e34e80ddd29df49241ec68c0ccff18e32d342a4f5
SHA512 e64bbd3b2b654c5850dab3feff15f4de793a85573c090975f986865cb32c843fbbbd2ecb5959ce6f483434978b7541bedd17974223298c6ce609aee09b34cb34

C:\Windows\SysWOW64\msres\vfsd_fre_wnet_AMD64.sys

MD5 f2585a8f4ba8ddc008f348729bb0fb23
SHA1 b6cb5fe25698c51696fa19c840ee929bd23a2082
SHA256 893d941a24b63983681b59194097ded2219e8950188711e706636b6eb057bdae
SHA512 20a010fb204eb18b064978aec139fbcf43fa479f33de0de5369e4fd245c22af21b92a9f8f105736e989c4ed209979dc6167904e3222f20fbcf02955f90fa7c40

C:\Windows\SysWOW64\msres\vfsd_fre_wlh_x86.sys

MD5 ef9f5989a40128d40be798b17ce55cd5
SHA1 5f92f37dae7d3257b588e42155fc095dc4f97b5a
SHA256 47214f7aad8cd0058eb34229e8a29157ca14dbf2e905dc921f09653f27fb6b58
SHA512 08e6e0c52de912ec2fe98a1923ef87811f850afe2e2821812603029f88e27375de57c77f79e5d1fb7cc4b9fe7695a9df83b928a24bda1ca1fe9b87450dd87dfb

C:\Windows\SysWOW64\msres\vfsd_fre_wlh_AMD64.sys

MD5 bec5c469d4b712070040ffa99c92a565
SHA1 bdfb212534de60381fa616b8abd438772673de41
SHA256 a8ec90c0d4dc1afd4fd9d2c41319e677ef1fc407b19866ec2250a62b1ef689b2
SHA512 7a914e1eac6bd85c4705e561b7df98d43e9f4a929eb74b43e543bfdec2310ed9efa5f642aca6d9a2bd70fbca4704c341d4f235abb1cc8d2b8520d539e408d685

C:\Windows\SysWOW64\msres\vfsd_fre_win7_AMD64.sys

MD5 ec585437ef994f817d1c8fb333d578d3
SHA1 851ce494f13fac3b866c5e55f6e61309fc2bd039
SHA256 e8794ff0a18102845b3e09df143d0bdcb408c1ce51440ff436233488899a3f30
SHA512 2e42c5725e98ebbbc0ccb52e7b13376520b96fa0cb328d0246aaeed44b02c35aa0449ff80893f2657a6046b9504380ec8bf95febf0a78e1faca254a1fff1f5fa

C:\Windows\SysWOW64\msres\vfsd_fre_win7_AMD64-Replace.sys

MD5 1eb27ce27e9f86e70253ef065a77e94c
SHA1 9741ccd82f8035fe0c8e4c7066f1fe440f56a7cc
SHA256 71a2225e57602376dbe5b88db0d005291535052efa3bfb5c5b9a924766f19eb9
SHA512 406542ab2286498efcdde58ac03d4c0378b03f0243533df14a13815a87227f9bb69eb0dd7de0c11aed42aacb37c98e4468c427d9a1f336ce63877f563c6def1e

C:\Windows\SysWOW64\msres\vfsd_fre_win10_AMD64.Sys

MD5 166989f0c8b64e0e1be5597434ebd1a1
SHA1 80e68237472a28726f802c8f2b2731993ae77243
SHA256 bf32737eb2e7599a58e677966d73dc942bc15a962002418a1bb779cb255ad0f5
SHA512 4842566cab3801cab66aaa6404932a42048cce98ecc2415943520dfbb095d5235bf5c2895679dbc8c4032010b804fa0a83e8b2d971c7446152534092316e9f4e

C:\Windows\SysWOW64\msres\VerCtrl.dll

MD5 967c9a4c906847669fb4c4a257217218
SHA1 17bbf3eac168feb9fcd8d15e7070009616a2cbc0
SHA256 1ad6995037571b3532765b366d757c2493617da2899d69886576df7aa13a3fba
SHA512 899ef3a80d06d28ba8ee3875361032ce2dd537d043e3a6e4b3514bc3cbf7f41b5802f90a0475156f880f76e4ff999c0a9ad9455eb3e36729ff23c161b871458a

C:\Windows\SysWOW64\msres\UserCtrl64.dll

MD5 6b6a4fb57f8437896a42af53b051fd27
SHA1 15327a2ac71a405539f6b999ffbc449eac3d8aca
SHA256 15f43e0fe5d9664171e092be805dd6450aaf08099536fee0a2432e4e139dde11
SHA512 97753fa59b35b45fd60f2875b69f872a9f9c528bad5e5dcf4e0ae5ff1228a8c674c35962e5778e9d7b57d8f8dae97f70d71a95b1a2fdee8e8d79882a249df298

C:\Windows\SysWOW64\msres\USBManage.dll

MD5 f18cee1b2538e428d2fc78d276ff2bb8
SHA1 904365140a30b82b1387da95a19781dd6e87239e
SHA256 e0cc2d9775b267dbfb1566b4d8dfec43bf23c9e1e808d4da74c80c8e7da19aa3
SHA512 a5a3f2a53c973306ad2dd301436d48d0f97f1b9853db38be6eff86424caa49d9ed75003f49a7bc77b38eed560caa6ee4bc435eb9716adb0f6ab58ca3c36c52a0

C:\Windows\SysWOW64\msres\UnicodeDLL.dll

MD5 36933a5fe7f45746f42c9723774a776e
SHA1 7e1afd70f201f52e9b57c4062116c04f6cc11901
SHA256 cbe552e4f8bb64aff155f1298623f4e1fa18d7e719a519e0ebae1a7692c3b934
SHA512 fac024727d0b2fdac1bf9a66a6bc0fd0208d572ef9e16e67a1e20f3eca31cf228e7395e293e329e0a78211902cd40dfda38639f0e6b03a1d3d1eeb4a62cb9392

C:\Windows\SysWOW64\msres\ufsdicon64.dll

MD5 2001b48fe1a435fc5bd35923b83935e2
SHA1 4616c349762ff0b121722c0e20009ca2159b7838
SHA256 bc898384f963a1f3910c8d9d58b0a5c26ae4c47fe738e63b8f1c6c2c1e813ff2
SHA512 a6feee56df0025a2677729e83bab76ee78c031f445e20b64e7967ed4e6d12bac7ca837a67188012bddfbcd141a93218e65509574e72219c7672807ecb46bfe00

C:\Windows\SysWOW64\msres\UfsdCrypto64.dll

MD5 83f9b6dc3c1b23c884a63369ed7e349b
SHA1 ff199b0b7a6937bd9e46ea8c6e98980a3c4e5bf3
SHA256 b3e07f8dcd8e6af2196853dfaff1e7e570b0cb391d81efb2226248aacfe04ef5
SHA512 9a9fd44447d21a140f77ab75a26883adea46ef97e7034908fd096b8394f35ea0bc167a12601972c1d78ea02e805e1db975166afb8d57fd219d8083eb477ff20f

C:\Windows\SysWOW64\msres\UfsdCrypto32.dll

MD5 977902d06338ec52794ac3447e297c92
SHA1 2f03d08baa5b3ebecd9561a8bc1a36207bd83e5a
SHA256 8e25aa6dcef80e3a20c6a0ed8f55321f8e4b245cfd7762c95398b8de7f39f40f
SHA512 ae006fb659b1af678216d99af7d58093ac9639fb953d5d84c68ea0e5f3fb349082dec115e5b0115e25ae1e14997d0b09437365beb6602280abdc2299dff74ec5

C:\Windows\SysWOW64\msres\ufsd64.dll

MD5 6bfbcfef404dfc9075950a49b6fe8f2f
SHA1 c756e0a239c5b7c0f90c06a3f8c544c5a2a49990
SHA256 f209c335499c9f06a89b32015bcaddce138a58eddba1c03a567ce7054de8363e
SHA512 33dec79eb131a0ebc65229b25444715059411ab4e59124e49132877947977c6271996fc3b4dba50993136ccb70228add10daeb2a1ab0eb49d01dd4200102a96b

C:\Windows\SysWOW64\msres\ufsd32.dll

MD5 ea2c494e88a990f8dea47ad09a730ae6
SHA1 b8cbe90b54ca4c4a6ef6f7ed2e376c6a6fb49e4a
SHA256 066771464bb301a3164fbb0b4a65b55e01ec3bdbaee6975dc418741bbc5bb78c
SHA512 30caef4b2c5f86444b60393b47f09bdee248af11ab71576e9f574cba9820bc71953bdadac2563f24c7ca03650ea94ed5dd2bba7a82766b8331eec08b3bf6197b

C:\Windows\SysWOW64\msres\UCommon.exe

MD5 0f8ef2a22aab4d607979ecdc5c92de17
SHA1 dae1600a0fe0a0be56cbbf2a235899f7a0929427
SHA256 a892e0d0fa0dbf01f6e590b323aa17888d8ba2a6cb3473d7e59bea72eced50b8
SHA512 a0204be8261530cca64514a2ed0c6f774d69042b9d72433e515707e643c466dfc765ae10a98863d595367195598f2c13d623bf961d5a13cba53ad72acfb5d4ae

C:\Windows\SysWOW64\msres\TurboDLL.dll

MD5 9a9b87f524fa36dfa52c0b9957577f1d
SHA1 f46f8b07c911a8827d8e94bef6cfaa7558934ba9
SHA256 189b03db826c2318a91782c12b069c58a05a1535530f5d0f7161e1fecff88a0e
SHA512 e690f28b1477870e06cc6e584e5bc5783061a963b4dcb45251113e963da8bff7c6b32acb607acda43c6dca602da1a5c9c79f0884f6836fc3ef973e3027853398

C:\Windows\SysWOW64\msres\trayicon.exe

MD5 ac7b21072089f94ca90f3f0ba503ac7a
SHA1 f3f379edc2e1fc65f8f602694ab0951188d79f4b
SHA256 ec767ad75bf55658696041d3857a6fa385cbb2255d9ad0470daff9efe677cf76
SHA512 fa893ca9662406a0ee364477d20df5a81628d435579f279bfece5c98e0745a858e94c53eecefb7e2916ec77b75c0851a42c01dc702b463f94ce64fbd30cc0ca1

C:\Windows\SysWOW64\msres\TaskSend.dll

MD5 be52ecac5b3ea07918d76ee8e2e1967b
SHA1 e6a61085da84fb36d997f2e0245356c301b31c30
SHA256 6aefb65e263cea3a0cf64336ff72b38f04d317080113f2dc9e1d89ea6f8ba94d
SHA512 717350fedfcc13a4fdb44d093278034f285bddc4f47dff890de4b16672429f9f374de2e4992c1203c46cd7d77b81a4a64745c5caf304dd2d4a7eec6a1d830f4e

C:\Windows\SysWOW64\msres\SystemInfo.dll

MD5 7083a1687e0c92f682e7283109a63519
SHA1 3f1bc7e9c86cc2dbdcda469eb89932ac6c54bf84
SHA256 a64afcf309de50a2912159210639e464f85548b3046c8ff485ce09d8d603e856
SHA512 808eb88d28abefbb992c428ea88d173cefbd2e87fa329579fcea5e0962943de0d750b972c618ae9ba640979d2fef40e5d8a7e5d896c4e6c95c0962f5b4565fbf

C:\Windows\SysWOW64\msres\SysData.DAT

MD5 467c77d42dfd1b24f3dfcf2cf394057e
SHA1 011b2c003ca97f521a8f3b89da66ba4be7500e4a
SHA256 83e02ca0fa14adc2d2c1f315b9db7b290d9d58501ff1bd8c50369f8a400ce4cd
SHA512 1f4f3a1ca992c081651481200bf62178709f4ee43bfdbd850561bcfb119d01dab416af8976ced7fd7239ed74c26b8a217684fb94706f3ef45d1184381144b950

C:\Windows\SysWOW64\msres\sysaid.exe

MD5 a111604e0fce302bc71ecbb314ac1a1d
SHA1 2a56217341868ec3dbf8d272646f03627e9bf0fc
SHA256 c35041d6dc9e2bfd9d924d7b205f49f2132388e834d832aad42ab63d245eae86
SHA512 3b45fe0d3ee9fbe10b3d840e156481cf4d242bc08437a49c714ac9056aba7448e6989e8d4d064a5ea824b1ee884e20daffa73ea25a552c4ad45976d2c8017a51

C:\Windows\SysWOW64\msres\sys_config.ytf

MD5 302ff4e1186d887cd3a45b5558ce8465
SHA1 41e13eba039387a7f39a6ed60521815464184456
SHA256 73821bd3d6c21580fe7f1c4943179ae06d7b50ea7bd7e356bbfe9e0f0c30cfd7
SHA512 42fdec91d89fd7c175da3ccc51046447749709644b7b0dba278acbed5cde3caf84a49c45af2abf6b8c3a03e1eddf1ad8985d95b296308a6ff3b84e38fe16b223

C:\Windows\SysWOW64\msres\swscale-4.dll

MD5 eb53cb93384ae5f87120066c10fca605
SHA1 49a93c6e580c57f2b9894acbfed2ecca4a2013f7
SHA256 a75532c4162ec1219713057b6d8a1d00cbc65c33ae59ea3977c4e795aa120d11
SHA512 1dd701260873cf136718668e80103ec56007631c49130130125788c2afab456ef9929517c72443b0a933b7c5f9757809be8d0c4f27aa9748be42c64ae1291ae2

C:\Windows\SysWOW64\msres\swresample-2.dll

MD5 31806fc2b8c0e0be86465c70021622a4
SHA1 a68e168e144c34a266ba8bd518c1177ce06eb26e
SHA256 55527e84f99edf4a9a42ed514612077d8e84af28427d8751944d384016526db6
SHA512 b851de2393294fac2d385ff4d104ba75053a1faae44485bea2122e467d830799cce85244d6f6682cccf2984795d30c9f7f6a2fbb1ef872dbb7f78ce6c6455441

C:\Windows\SysWOW64\msres\svcvpd.exe

MD5 f2fd5cdc313a4abee681c1a18d75f566
SHA1 3af962d6700a0f731cbc8ea949f783590e8a6297
SHA256 6bcfde9998ba5aef0092233625a8ccf6347488898415c56329a77051863f794c
SHA512 4e1dedf4f00781c254847930b97d9c0ec96d98d3c4cfe9c47dac73b3c627a05895248084fd30092f4281704858ded1203e2ea4d1c85fa1b74006ea2688d4ce5a

C:\Windows\SysWOW64\msres\svcnet.exe

MD5 79650be2b3b6512ce4bfd0378c704062
SHA1 78e2e56845746cbb359ae9b57f75cbddbb5fc5d3
SHA256 f87946f5093c2a378b34b67355a17e79147d03aa0c31820d34fd037b3830143b
SHA512 6dbc4fc15ae2367fec7b3da0a81f7900899d3728cb1a113108bd35a9e2e8327e03cebe04544cc54adeabcaa2da3d44c5ac1db00f44d93bed6ded6269793af7a6

C:\Windows\SysWOW64\msres\svchost.exe

MD5 94c660a25dcb34afa31bc01886a337c8
SHA1 dbdf7ed39cd4d954eb03a46a4d9b715a7f5c9717
SHA256 04a765b047a765289c8e9f79878ec703c25c891f3f8ab1a2ec1af1d2ddfbc74e
SHA512 d05846d8e70ecfc018c23560eff1f86e01b11954ef22f9eb07c3a1b9c4c64490a411e4df3815ef80a352be44f84f674ddab0c330ffbd31293cfc228f93a7fdd2

C:\Windows\SysWOW64\msres\svcCom.exe

MD5 ba2aec28170c34dc20484f873a48e5b6
SHA1 45f6756c98be0c389ece882ac10596b2eb42d9ea
SHA256 86c7ea63f7c6d88bed22373158b11fc36afd7759475c8113a5df0e65c8e94309
SHA512 23a955a26fb95a99407289d0a2026d02597b5761516c49db7b147bf9d7901c69c5abe99bd4e33d44b30968150137e4df16fe14b8c23877a1f1fa964fbb7144b5

C:\Windows\SysWOW64\msres\StopLog.bat

MD5 d46cdca9c1c4ff36cf0a9787dd0ddbbc
SHA1 edfc8b4bb1491b8cc0376c59f2a3a1d6405b6166
SHA256 4b0522a703d92e5d6138898f91b9e5c959b7d27c07524612525f2114b9ec9e8a
SHA512 2eac2dd5eb2d769a7630fc00470602a18a2ea1348c58f94772b19b663c0d28f9064cbbb1cefbc49078eedfecd995331676b3eeb43bdb371f81be7d19adde029d

C:\Windows\SysWOW64\msres\ssleay32.dll

MD5 9be86831858566c0e89d071399ac0ed4
SHA1 01e09d2a2ba3ced6e883d7648495109110bc776f
SHA256 abce97440cb27e899e3b014da2256aa0dc2eda7a96d8be543fbb959bb7712c7e
SHA512 a0c0a15977c65928b06069447914d3a5df8868312586b55b35f66a0e42f823221ac3ca87b62598cf0a09666ee795aea308eb8e75f907c49ab3e8185903619b91

C:\Windows\SysWOW64\msres\sqlite64.dll

MD5 723cf406f2243221b2f8063d178cb2e0
SHA1 0a435868a172dd2ceb418f4610ba3506b8c60b8a
SHA256 75a8f39ad9787268090c3ce04c18cfb13314be394ec838c740a3a419ac74706c
SHA512 2fc93a600946f894087ec1921a2febd2f76d3b39e0f2cbb019b3173eabd6f0213d7f20e8cbe8315e3fadecff28d4711d50e365adebee4e27c762be9c9e6de897

C:\Windows\SysWOW64\msres\sqlite3.dll

MD5 3196863b7bbd6be5536c2ddb9293bde9
SHA1 56f3e5fef154aa89b5655f98fc1c3320de0ac1e7
SHA256 cb8687b931ee0f8f5f804d5c19db094f3645bae496d278e772072dea532a5421
SHA512 9a7cdb8d96c2f133ebc26531f10d75efb6c379a4e2c4b189d01d304df00712f5ca459ae1b30b90d905101be994c73dbe12cd9e639ceecbb0957a8d64431aa1e7

C:\Windows\SysWOW64\msres\Special.ini

MD5 eac8a9ee99f80fd68dcbf12ce6feb4d0
SHA1 8551f220fc310af90fb6baceacf25b46432bd401
SHA256 cfda7b43fd016281d1745c5c4bfa1a3064c7f2ff70da3d248afbabfcc1004580
SHA512 8c954ff0a64195a2b4b17ea8e73caa71396c70a5a101c50b96b79feb63e25d4e7d924e95b5e04d0bdf491c1cf99eb3fccd754b77597d0220465f153c6c035034

C:\Windows\SysWOW64\msres\SMSS.exe

MD5 aff410e185fd5dc4638c9714e5350dfa
SHA1 4971b43ad62679f95de07d6d475de3b004e8dbf1
SHA256 865c7f85b6e8f12d132cc6bb519426134fe07e9c6e388acdd1905923f97e2656
SHA512 24ac31aa75b5b66de929a7dd5206676d72e450abd20114141c0451b71d91b1e4bb912e8607b185817742de9f07019ea810bde67c5d930b67e836a082f0e9d60b

C:\Windows\SysWOW64\msres\skin.ini

MD5 fa08251013a91537e802a0e7fa15f531
SHA1 b6cec5ddddb41ead9d7922834c7dfcc64e0e9c2c
SHA256 2ae8efce6b27f462622bfd4681dc24205ee93ef44c08cc4265a280baca41a948
SHA512 6e80e83213634322322984dda7bfa000ac55fbf820dcfc615f48e6a1bb7450e769bf6e8f0324e2afbecbcbf5534fbe62512bfcc89b8edc6d987d046d82f22dab

C:\Windows\SysWOW64\msres\SetPermissions.bat

MD5 8466536955f19c74f1981f4eca320d37
SHA1 4e0b5dd25e3a7447d10a32f993bbd7b1f96639d8
SHA256 e21e34bf3622617f2a573afd7e52c2683d2ebd0f38fa284cfb594fa15b5ced43
SHA512 5b0dd7c30a1120b72ae7b86a69e6d81322a89b8db4040ebfc6a5ed199826fb8eefd7d0742f5ba76cf6754fb9080624ce1ea1bc8a9fb74144e7bb7534e74de057

C:\Windows\SysWOW64\msres\sedisk.sys

MD5 e9efd01150e7a38815a9e41c8b03de01
SHA1 1c9f7eb1067309637e70944c92c83b5d80908bad
SHA256 462a576ca834d3061ea14b9bc8fa75107a9863597a48a7b3aaf6b208fa5dad81
SHA512 7fb965d636bbf542b8674016b567d799b8c62925f342d9b5b5b1e799616c0a584cecf41281f6aac6a63aa94058cf36292142ff4098d17006efc4cec34b236bab

C:\Windows\SysWOW64\msres\scwnew.dll

MD5 acd5d34a3b9004a4f5504619e1c52b72
SHA1 cd73de0c3962fa866e6ba8abb781f5c77f895d9d
SHA256 3c7c1706aa82cb0c5df0a9b19401a9e246db9bb0aa8d4de8afc9f98705dee9f7
SHA512 87dfc23ca00143160de1428da5dd22a638bf465a7991419171d6496805758d46e19deb262fb3d19a98260b29320b79fbfc5e7d856e615eeda5e614f6345f58b8

C:\Windows\SysWOW64\msres\SCW64.dll

MD5 f81c99a43fb1bf6b06b5b1e9ae1bcfec
SHA1 8a116541d499aa41d23cb4b70c6ec497e662cad4
SHA256 e35393e0094811f4bb7148ccbee06da9df854dd29123612f3e81b98984fac81e
SHA512 430ea53a5ed8d814c18706ef70917f1a3098f9aef850968063092dd1a61287aa49a43ace7a2b90d9e0e4369cc9fd3ffc9b6f9a8f8ee96c4f575a34e472ade0a0

C:\Windows\SysWOW64\msres\SCW32.dll

MD5 ef975ffcb54968bee3fff3bcf540a329
SHA1 935dfbe93aeae48fbb52b2affe55624a57236142
SHA256 6feedf3fae114b3e9cdd0ea9ef01312aaf579c03f387c748d646aa97ebcf9b3f
SHA512 9448bc739d60cb660993f0be7292b89d2dc11ffd1fe0feb406635cb16ddb333beffaeaeb1e61979d4beebb59b18cbde47ef128ee189de93248d3812143a71ecc

C:\Windows\SysWOW64\msres\ScreenLock.exe

MD5 2114ee736f7312dbf140c2da77bb0bc0
SHA1 d929d7e3b5649819d5525466527c854213044436
SHA256 8b30ffa66b2370175bdbfe902870f4fef18bd959eb6c12545b84b2ade817ca97
SHA512 552b77ee025d86212422690ba68804262429060ee753b494fbd669be111aaf7ad60d5d3586987e322131e52b5800b5018e2d2e76ef379b192a024a612e836b5a

C:\Windows\SysWOW64\msres\safeport.ytf

MD5 1b49efe2be1a332ff69740fe79e5eb16
SHA1 8ea7c758106ed8df4cf1187fdefd717e1f01ff5b
SHA256 e4adce7ed5df86e7bf5c98ed95eefe6f94ce05eccfef3e6aeed47c2eb170d614
SHA512 c808729c816af5f20f967a8abb8008fdcaa5144efb8688b7b468b10ffe326683c77064098c86d833ec7bb3f2a75f3ab137e988f6389f7924fa2d60b897b63e54

C:\Windows\SysWOW64\msres\restoreKrl.dll

MD5 516529ff3b5d51c59b9ff8e8cc574756
SHA1 75a7446d03838d3c11fc501631cf960b54c7af72
SHA256 57ea7d17563262db0ad276b234db5a1db433d14c272ffebf3e62ab8a7aa860b1
SHA512 58886e44dc3bed79a766ff57611fa81d3ca5a86baa05518be649c5c480dfe51cf6dfd26bf49cad72478b86fcf8e891cd7a60f70fcd05e6c067d012630f2a98c2

C:\Windows\SysWOW64\msres\rdt.ytf

MD5 c4e5affb1dfea34bedf9fd518a96919f
SHA1 477ffdf60d812cf6c38163681c91bb7d36cad2a0
SHA256 fb76b1a0f281a6b917beebb85edb8ac844c3b2d4bd910988d0b844c1ed88b29d
SHA512 9b7d7a82a3cc4819b46366e7624b8efbd56a2c544c6ec8e0130762d8f11a8714b2bc1d0b33e999ab662d56204418ae1cd2722b3a3bf8d5a965c9a0bec459b64d

C:\Windows\SysWOW64\msres\rdf.ytf

MD5 ca6e95b72182054f0ced62699e8eeea4
SHA1 5397e33d7e424cff95ab0f7f561ed51f327ed44f
SHA256 9e6b1cd851e9de4edd4d8bdccf75fc0cff65a05818285cfb2ecf071b1d8c2617
SHA512 c7491f63a267d781bc96d0a459bc1724e3e4addedc597678a1e597b9051d6df33bfd537086e0fc61abc4119f1fea33650595ae19b5778e3840b241b41de39ab5

C:\Windows\SysWOW64\msres\Rar.exe

MD5 d2c0870392366d7512ff9e8eaa90b677
SHA1 19f648e6a0093ba50cc75259ff18ff1674f5fef4
SHA256 58bbe2d40ad2f9881d0883fc5aa72d2e25000f77b9559d7a75e4a7620502c6c2
SHA512 41ae3b6e4486299d8ad77d1e7737ebe4b3be015a69d8f2ac78ab3f4554edb160e91db7b030ca774e1f2251696cc0f6c20d5f1cd9e1f8a88ddb6bca5d624ad8ed

C:\Windows\SysWOW64\msres\ProtocolFilters.dll

MD5 da8106757cb1c4a089f236df09f8afb6
SHA1 bac82db0aadc7b76a02a978538cc11817d262f8f
SHA256 91794153ea78e4823b12bd60f8929eb251ee1b0cd39dc2b01e41c83bc0a8e6b4
SHA512 08cf1c35bc7d8aa3f704ae4a903efa75cb3dbe5e32ecffa242717fa6689d85a1dc2ad164fa0d2e767f5ce28d07387b07b6a2294cbc6d18380a1a90166db675fa

C:\Windows\SysWOW64\msres\procW.ytf

MD5 c0746fb68ae692d994665be34d830fd4
SHA1 da09627150cd3e2f4d745fb78459ece14788d2de
SHA256 48d314472108656f653c13c14030b68cd02e5cf7373261462ee98b1596c7761b
SHA512 efb0b52679cae4d531178def403aac7821dfdbb1097f2d91bb633a1836ce5aabc24a3c150178e0964d229f6ceed3fb2a7b4f034a475d02ceb5f2e4a5a59eebb3

C:\Windows\SysWOW64\msres\ParaSet.ytf

MD5 c407effa3d6121579dd4772db7f909d5
SHA1 530e7545f262b2f9d7196bfaf8ee655f088494ba
SHA256 01aefa0e161d12e2c3c60f347015bf3d19e70fde76597f012d20b432a6272368
SHA512 ab4112ee4942b307ab2ecb20e346c21a5435e2ca9bdf08d97e61f29465d1812b9a6d8935d630d9c6fc7d967374eb466f07ace015b767aac7bdffbc090c1c0613

C:\Windows\SysWOW64\msres\PacketUpdate.dll

MD5 65dccf77755cd1f8cdc970ad2ee286f7
SHA1 95b6597ffccd3aa07ed48c40cb1a87fcb8ab76b3
SHA256 cd705a15cd6175d428266ddf5b2f3b48a9edf5fb1b3d994ca5866f59a69e6c53
SHA512 cff8b0b765c0ff22a10caa4edacdb8cbf258902dd48570135529c517d237d6380e5d54168cb3f265ccad8c05bc423bd1411e2b6cc408d7009d1f49b49fbef360

C:\Windows\SysWOW64\msres\nfapi.dll

MD5 5807ddca5570d4e13e420c3ffbb41dd0
SHA1 c6515ba03150cebddb40ddf7beeefdc028234df8
SHA256 57eb61219499a328474a6a2bbf129baa9809c0a8a1bd376b8a614344509a9abd
SHA512 62eab36fd6980682ba16ba60de94657a5f6c1563ee1653fc9de057036a8cd1b0201c773385c0882915a0e1fd5a98cfcb07b607332cf774754cdee1571cd265d9

C:\Windows\SysWOW64\msres\NewLockDesk.dll

MD5 7bfb0b43672beea22de81d562e58b9af
SHA1 def751b67cb7b8e2cd1eb2f047975cf15c249c48
SHA256 99399ea32524b49d9468078a7579c476e9ce732a94e83ff25caa8ec7682eb940
SHA512 a102fa9ad56e60c92894a11e2b8d7a5dda03aab64d0af430b184aea3e07f72c7a8179212d06fd46ce646f9841eb553dbdbe791607dad27240c377ef9c901f48c

C:\Windows\SysWOW64\msres\newicon.ico

MD5 5b5155eb1ff718bae7b3530cc5480d80
SHA1 12561278ca6bf6bdc91a637abf5bb7626101e69b
SHA256 6b4e8674be3f4e804c02439f7d96cf510f1e77dc87d745f31dfb1a502d8115ba
SHA512 8db6834022a64936f8f7d4174dff7ace5d7a087449d34cdd4abb37d0cbbe79c66c1c16b3b2abaa328be829cc59f53d49611710cf7d086892565589ac323ec774

C:\Windows\SysWOW64\msres\NetTran.dll

MD5 4122874d356a486648376497dd4e2167
SHA1 99ace6b8b97b9b868cb14efdc91a0ec1a4ebd56d
SHA256 0ad13019aa809b8a5bf46da8b05bba1b5a509c03c5dd70f1566dfbe870b25d9f
SHA512 52f61539385c9521376edcd41450f2813f72a1c27459a6634c614b04e81c84e081fcde7fc1cd545202b0bc77b099a06bc8c68e8fbf73f776e9275d3f921a1aef

C:\Windows\SysWOW64\msres\NetJMFile64.dll

MD5 9af32ae2d28add612082dfd1016a2f75
SHA1 022de6c73f24f81484531bae7b1196b3b06ecd66
SHA256 4bd949919778ef055a8003fc6ebc7c49b422921530bdd5935480fc4cc17682d4
SHA512 d313e537a39c403da14960b39666ec1e5bbd92acae79ac6d329715f2e1652a99b107af788898389140f1cddce95125367d4d87cf40a626abbc3d0da517a9cf9b

C:\Windows\SysWOW64\msres\NetJMFile32.dll

MD5 de623b00727bf0b7185fbefab75d3581
SHA1 c4f7f289e65ac5e61831696004308c76989322b5
SHA256 6f4c4188c07a35e87878648a3d8f96cb5c75fff593ac540b9db85e500f96059e
SHA512 654815a348cb625538a093587876485432d90a00056a5a0be5ff1d4aaa6bed2ebf80ef0ce345a2b347601f1ca86d631ce616ef0c0107f4874a902e4ec0d85f75

C:\Windows\SysWOW64\msres\netft.sys

MD5 8d8ccbddf5a86bdc3c64c1b857f3bbcb
SHA1 7638efd77e9a158b37f96551f9870f0fac5ea249
SHA256 cb14876a406f59ef94ff5531f8f4a1bfe42b503fe219007c82a2718a2ede2cb5
SHA512 4b79efafb9c1d2eb90fb0c66ffb218fc3a25d09a27ca51d024e5bf81f180067db0698570fa43f1691b3200eeb2e203a98106ece7c3fe0d67b4796427baccdb6a

C:\Windows\SysWOW64\msres\NETConfig.ytf

MD5 51380bcc0cfdc5aa18c20476a21c9f31
SHA1 d380a35111f4855630e47ea715b095fef4b41ec6
SHA256 71233838af45f6c01715f3dfb4115a2a81c0dec1bf2943d4b127fefedd8c1f76
SHA512 28bc216e6e8150cf49ebf425f3c1fa43baa0e51caca2cda3f8a56aa1093d51a76030df28ce5d3e74342df04bc52bfbf3b0c6802561c213bc4ffcd1bd9a5156b7

C:\Windows\SysWOW64\msres\NetClass.dll

MD5 f34e3315efa93aa4ff03ca86c241027c
SHA1 e245918191582647477f7d957e518f487fa5b40f
SHA256 88c60a80d94c2a24637983fa1981937efc78f74270fa60a8aa08753581a67466
SHA512 fe05994a68f5cce7f34f5418661e27b53db89fc7b1c56b4fc96b83ecee83e2bb08049ca0f249ad90827416eb7492022fbb307bd44333d3c56be3a8ac8db075d0

C:\Windows\SysWOW64\msres\msproc.dll

MD5 96a15a8b8eed530afcfd877664445935
SHA1 496de99e72a0e10ca1983b1edb9f5fdd421d271b
SHA256 a0181bbd93b6c8bb812034870ba10fd775ba4c966856cd9b105c93d611e71f1d
SHA512 9fe11194d219511a4d14eeaa4b5d818c7a4053b711e617f43af4f8b58913aaf5a05ab4f2d4f2ac65472b7f5d94aecefad0d5523becde1005b39aa30904bc4f81

C:\Windows\SysWOW64\msres\mspm64.dll

MD5 c067011817bb63aeb3fd36b7af2fa7dd
SHA1 9592ec56b165091bde06e5b848c9b39b6f5a5e2a
SHA256 314edbc1586de4b59983984ce850b7e8f22b7e3dc44f109f5192234ff5569260
SHA512 a2ff5340853e6a9933513c4f53556e69c921f9637150c84722b82bdce9ceebc7c4413b3cc0b786b96391f3b37e7cf06e866d3c3df0e1b002cd6ea5fd6018005d

C:\Windows\SysWOW64\msres\MSPARAINFO.ytf

MD5 ee0b8e017b81da0ea4626316edfa7244
SHA1 a0bbb91a538869405cf8d49ebb4355013c5f2c53
SHA256 c474458905532d0e1fb92b99319e25ecacdfbda60783a1c21d9a292caac432cf
SHA512 a1048d50254cba4304ab40d166af3eae62469ec71fda4f524dce8dc405099a321eab78069170a89e1f542e1b592ca6739fd5c574c0f4b3bf355a4a59820d4afe

C:\Windows\SysWOW64\msres\msch64.dll

MD5 82659c40f5ae6ac6d0fa3f00bf0eb0ac
SHA1 c8d0d192d3ef7b305909e52aa5adfecdd078e3dd
SHA256 8bf06ce8f7503ea80b7363842194a3378d3fae602a9469ba7c21d98b9b36da10
SHA512 2a590b2d434f5114ba86e25b643ac9e861a7d4a39bc9b14659b4b126009545e195980427e3e293f5aecb3feea114d129db825ee66789ebeb0190393dbd33b48c

C:\Windows\SysWOW64\msres\msch.dll

MD5 73007115059442b549007d056a524eb1
SHA1 5903a93d824661d047148ac3a900b8d8a548574c
SHA256 f7f4953a9ab301e8be4a9a144c5fb2e110e58c6b37075a0f1b6793eddd7d21b1
SHA512 7f296379516e4c39a911cab1fd046b933ee8931b924540378a80b25b40f1ccb8f1c947d983be1af59244a344879a1395267799e66a35c7f8a221b2d89065755a

C:\Windows\SysWOW64\msres\mfc140u.dll

MD5 118f2bc2314ab6ea8a64d86162e38582
SHA1 ab5ebcd6b064dee8020979be2d6c836fe1167e31
SHA256 35cdb1e79f7d65c4a0bb7e01bc8baaaab58e6413e6876029b32865b8564d2f9f
SHA512 63a127908d783bdf64f77bf6fce26f69a7e82bbcdc0dd0c9098f146912979b7ea8351ed44c9195faf3e2320884535278e76eebcf4f28713b6766bfdc18d97e5e

C:\Windows\SysWOW64\msres\local.ini

MD5 ec0a874dc089d20eeaeeb9f4a3e5aa57
SHA1 095ad7dd49fa33e0baf51db6a51306409d3eb3de
SHA256 070e3e4915293bf7958a263ea59bf239e6a3b43063c38eac966d723d5728099f
SHA512 994817091e324476471f478f4fe657f5043b3509bcd2997603835485dbe368c268098da2dd099fe2d564135eefea318949d4982079250b9fc3540e63cea73561

C:\Windows\SysWOW64\msres\libsedisk.dll

MD5 9f05c6288fa97551e4cefd87a7b5422d
SHA1 7baee78c953937f5f9c50dc81d8184105eb7c4aa
SHA256 78b8a14a8951684442cfbbc5a01576de595957bbbc8d2cdfc8240f34b93892bd
SHA512 afb8edb706eea464c57c32965fbbe078dbadb046d7b5ca2142c8ee2de0b54b3c9c2ff821e2af08261b67cf85267d96b6a4fd22545e69552770834fe6b467fa5b

C:\Windows\SysWOW64\msres\libeay32.dll

MD5 dfd4b6ee0c8194de8562630845e00137
SHA1 705a7af22af8de5df47adf9bd8aa6a9542f33cee
SHA256 1df7766e84d1293495f22087d19785aa7cd761e13d7895157807cc22ceccf6f5
SHA512 3098e803fd9455d3e43da0400c192d5e60120eb45f0fb8130a96c66579b6985de1c098c07a97fe09ef8b18ca3cf8b5bc3ee24fc62a8c78099290cb566b3f1877

C:\Windows\SysWOW64\msres\itp.ytf

MD5 0d1d8846205c2d3cf80b1da6d304ad9e
SHA1 0e8ad84cbf6241fcf561cacc71af5480e40a7b6b
SHA256 47d5daaffdc3dcce3ca48f192faca8c739eb07fe6fcd43695ef2c537e288bcff
SHA512 e682c1dcf521bc28d5295e615613d681d5dba22647aaeb6594c1b679b9aabe9f1b102da28a217f3a57263f11af45496606ac0b2f424119b43effb4b24ee0721a

C:\Windows\SysWOW64\msres\InstallEx.exe

MD5 127a1b81b81cdc9e7bd36de9c8682f77
SHA1 36f8095787cad214c5863b2a76e19acb0c69c68b
SHA256 ef1eb9dc0d1653ea2e0a6f22e5914504464539158a81a89c88e4d7c86ed2bb9e
SHA512 e247056aee0c45661d4b6dfa42f5c97bf4ebacd2549b125d8302378d39f9bc1401ed7f51610cf00341c5cd012b0ea6215c4a9ba59bebf067c9854d8eaff6f350

C:\Windows\SysWOW64\msres\imageocr.dll

MD5 f0a9bd46ada6b1b29875d29f2939a11a
SHA1 979957ae238b983e6002d6aba312aae91efa22d0
SHA256 eb818b4c6bf4fa277de19bd5a094d954b39b49695fe37a87dcbd697a4b7b239a
SHA512 8e3290b64ee22d7f87e2f62ea7b123bd995244086137a83b053ab95feadd5a99541de0108cfdb84e6f4b96beef2febf7e0e3773105cf37ea0bb50a24f4b45002

C:\Windows\SysWOW64\msres\iconTray.ico

MD5 56822a7200e5182c72728644430e27ec
SHA1 c8eee470d007f3530ea4c5137769245e02071e8f
SHA256 870209bce5d9994d3d03f5709476b2ec732073d3d36ca4d21f1047566f90fc26
SHA512 fdc2ea5de62d2724638f34fbfcd61dcf9915d39e203d506fc92612f7f72a025af303a9936aaeb51ce36d820a799461a9cac2511d69e9a2d620e3210062b488a1

C:\Windows\SysWOW64\msres\HKSock64.dll

MD5 109e0d67d79b4cc8887cbf6a3c689dad
SHA1 d27be35cf777811a15a55c2a29b4aed5f283499f
SHA256 4b007c5be27a67d89e4c8b397d7085accbff8573650a93af629765d3897fc813
SHA512 eb873c946dac83c8875418a7bcbb98e232c0a2b14f43460a092e5fdefd837801ba6c6aabc347ddb2ac6077fad759334dcdc80a84fa6ff84b232c43651f6b0f4b

C:\Windows\SysWOW64\msres\HKForbit.dll

MD5 907a1de63bd2c4d4393598df19b13ea4
SHA1 e837a21da0ae3b662e24593a3ceca1b7ce96781f
SHA256 ac4fe65c52a0c69cfb69a3553f16879e0fab862973013080ed885d720e62663b
SHA512 5cf0b92dc53b98edb32cc397361fcd881bd437ab79600772348224357377d94277eb72935e5bf328bc680df09dbae1e4d64ea88cb02c91a61a310b0e6213b9a3

C:\Windows\SysWOW64\msres\GUI.dll

MD5 6c76345204c3f954e9825d7a63abdae8
SHA1 1f8374c59b74b202220546c15cc32389596e5ac6
SHA256 412b29b657c4d1a41d3be6678a506cbd2392044150d2ed207410d57b0bfcfb34
SHA512 24f150c29bda60885375d64be9c16649ea4ee15f9ae9290a6558157b45d72bb156d045ffa6d2d60bde3196293f2f830ece5fc2e969991d7f4b4074eeee3d9e1f

memory/1380-2970-0x0000000002410000-0x0000000002454000-memory.dmp

memory/1380-2975-0x0000000002460000-0x00000000024C6000-memory.dmp

memory/2060-3005-0x0000000001E70000-0x0000000001EB4000-memory.dmp

memory/2060-3008-0x0000000001EC0000-0x0000000001F26000-memory.dmp

memory/1712-3635-0x0000000001E90000-0x0000000001EF6000-memory.dmp

memory/1712-3633-0x0000000001E40000-0x0000000001E84000-memory.dmp

memory/1540-3650-0x0000000000290000-0x00000000002B7000-memory.dmp

memory/1540-3672-0x0000000002B60000-0x0000000002B82000-memory.dmp

C:\Windows\SysWOW64\msres\YTSysConfig.ytf

MD5 55040949981bec8f9ff2d25e05449a60
SHA1 c41ba7c9e69b160de72b109a020c6a5992626a67
SHA256 707a4c45605c3a445aad5aab436ab6a73cddea8b607a9382bc6cf26f417f39d3
SHA512 f895b5c6927ddfde563c2ca031fdb3dc06f686358fe0d4d8d97eca0dcc31ddd5b8eafe96d5a6c49f0bbe81fb18ebc42861abd6ec0183b1ab836fb81484a08c28

memory/2672-3678-0x0000000001E80000-0x0000000001EC4000-memory.dmp

memory/2672-3680-0x0000000002030000-0x0000000002096000-memory.dmp

memory/2396-3682-0x0000000000020000-0x0000000000033000-memory.dmp

memory/2396-3683-0x00000000001C0000-0x00000000001EC000-memory.dmp

C:\Windows\Temp\RestoreDll.LOG

MD5 9b38b32073d77e48248ef7d6e26bb402
SHA1 33eb5b8200b58a24572f5a8ff58260c4f8549944
SHA256 939c80b0780689f2c57a5b742656b688f35d3085c9802bb12bab5af4973d6ded
SHA512 ea5b79acb867cf72aaac8d5a4087265c3bd2e1041f901e3a21f19f86d38a4ebec5273c6d3d35d6e81527f6df1987394a48db087d4899207f8d79402f240f7856

memory/2540-3708-0x0000000002040000-0x00000000020A6000-memory.dmp

memory/2540-3706-0x0000000001FF0000-0x0000000002034000-memory.dmp

C:\Windows\SysWOW64\msres\sys_config.ytf

MD5 fc2393ce59b5e4076eebd9dc3d0974fb
SHA1 45acad0c42cfc4c1ff684a6695f60bd3baa070ef
SHA256 22407d1bff0b869c87529c55372a47f901fc6fe47cc13483a2c4c2b6f6f6af54
SHA512 f8755afd0501cdfeaa9758af366e2787affaa731c57408eeca2767eb275e639adfaf64795c4277ae437a8c095f289ae89fe0e66309d05ef153b515f43f513e75

memory/2328-3726-0x00000000003D0000-0x00000000003FE000-memory.dmp

memory/1540-3728-0x0000000002CD0000-0x0000000002E73000-memory.dmp

memory/1540-3734-0x0000000002F50000-0x0000000002F7A000-memory.dmp

memory/1540-3733-0x0000000002F30000-0x0000000002F46000-memory.dmp

memory/1540-3732-0x0000000002F10000-0x0000000002F1E000-memory.dmp

memory/1540-3731-0x0000000002EE0000-0x0000000002F02000-memory.dmp

memory/1540-3730-0x0000000002EA0000-0x0000000002EC5000-memory.dmp

memory/1540-3729-0x0000000002E80000-0x0000000002E9D000-memory.dmp

C:\log\XFMainTh.log

MD5 d5bd49bbd3877725f8a81e0a06bdb4f9
SHA1 6fc90fb0ee410ed9157b626e0adcdd59b4495439
SHA256 ae21136b8be9cc4ae4d04c4627a07536a78a9adf20a85e7a54bf8258c97d4d45
SHA512 f3405e95e6982789543a8734bbd7870ffef0b1447ad3f8e11613bf89337dcd8bd98ca3e407fc2af13fa828ce8250efd52998dca0ae71b0f4168ae3de43c57ce8

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 bf48a5fb9a4f2e8618d3485f673a38bc
SHA1 8eb49a1963f33f3e99d0674ce6f81dbb19a3b721
SHA256 df6ad1fe10d4451d195e2140b94aaa50368fe4c4b413075c519004a25501a51c
SHA512 748d2b9fadf604fdf99087c2b3d6ea3cb6ee0b640ee6ba51957f084dee42f5482bb7c5ce71727e7b021889910ab183a4e12956cf641cabc66ab789219189e97a

C:\Windows\SysWOW64\msres\YTSysConfig.ytf

MD5 f11d158efa9b0ce8528fb4f925fee478
SHA1 4d0b93f1340599b40142ad19ff59735c55b965dc
SHA256 940778dc610e1c1c03ac660012d4a3aa7f51eebe155a38bbec5d155d71e13514
SHA512 e50bc8aa5442878d45766e3066ca077499ee92d41f7503949d9bd45c77d6f5fa0d37d4239fde6194c7ce907af0079a918e282d67c1e6c248d09657a26dcf25a2

C:\log\comFun.log

MD5 3ebe5391dd2576a9c875a6f97fed1562
SHA1 5c174944f0cf14927612b015ff61e86f4dcf203e
SHA256 0681a7e2279d985d14b3c5bfbec91f59f340668b336fb05b3f96fd4a2976d641
SHA512 ad7b05f3c5c97780265f365a9af1171cfe1564c9b4191ab8a15016e8ace2c76e30b7aecf27c22f1277165d36f85cdb9d29f036ecf4aa69ac7334ec2e5a03791b

memory/1540-3850-0x0000000003CF0000-0x0000000003D3C000-memory.dmp

C:\log\comFun.log

MD5 e436732e46c31de8adec4548ad2c4e1f
SHA1 a714d6835279ce76ec9b4e7197d357e9fb590213
SHA256 519b45aee979dd42d757fcf6032e327a79a6b2536e70539cd9e86e84b553d5b2
SHA512 bbae7d61cbd2be92c17f2976b07a6c32cad8ad0ac351b2ad121c49cec6608ac157fd4c2a63bced6ce8edee0b8597d56168624090aa4300bdd199c688c9b9f854

C:\log\XFMainTh.log

MD5 41fdeeaaab8fc7862021da8cf5eefa67
SHA1 d0e4a47c5d252e7f1eff11e6edf7d6c39e616e1b
SHA256 45f152aa1b1d9bdbd18f993c694a3b8255120cc1b74e54ed6cbce80e76ec0eca
SHA512 2383400e48011150e4bba1280f3a09f28cc056e125b9b73a9a36bd5e61d67a7174ef1ace65611fa91369d41a58f591a58bed426a4713a6ba3e9f634b65d04ada

memory/1540-3918-0x0000000003F80000-0x0000000003F97000-memory.dmp

memory/1540-3919-0x0000000003FA0000-0x0000000004006000-memory.dmp

C:\Windows\SysWOW64\Setup\msback1\LOCAL.DAT

MD5 365f92790ab6a76d83d431993646b14d
SHA1 db5b8946d4d9bb2c13b00c6ffe2180d46698012e
SHA256 ad97bb9bda4a9356b0272f38b01ed5c9a0e5cd72278c570b052cfe04e9b42557
SHA512 7faccfb1a8226ae4f50ca7951eeb0f3e0de2f5871b473dbb1c361f062230960c2bea6e80a786eb27f4d54ea2b69f6013c6ffc719a4767c40d75a789cd4a63e3d

C:\Windows\SysWOW64\msres\sysinfo\OpenClose.ini

MD5 df830c5faf12844ae7e3bfb84dfc7735
SHA1 43bd9f00d4356adc47fc137a76d3ca96ea9b4826
SHA256 78e45f2c2581eea1f7fdf5a3c782db9259a9d603632fe8aad2393087dbae2f31
SHA512 1f73a47e6e21f459392f1372643e3e845ec31548b26ddfcf621ea8847c18a78f0452e6eaf7104890f079e1f30eb1fee99d12a38b0c01c2aea0a3190daf561f2b

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 d7786a491588e1df9cd67a1383cb8aef
SHA1 d3e1f203d25498252a01f16665b7a68056efce88
SHA256 233590107d78e9e1429a14446bd157da027cb023c5d5d47ae2e66f8765ca5b27
SHA512 aa8e0c27c47bf8ca93e40e8c42033ea4b6231398ff80a5d0c23aab7c40ce4cbb358addb1446231b40ddd6caae320657e9d61ec1af1490c269fe0bd1ea7503563

memory/1540-4029-0x0000000060900000-0x0000000060982000-memory.dmp

memory/1540-4046-0x0000000004770000-0x00000000047C6000-memory.dmp

C:\log\AssistantThC.log

MD5 8f548235a580649cc6440e240327316e
SHA1 49eff25b8b5df21c3320d07a70f650de7e9035f0
SHA256 7b6d6ed50bed60888827f5db023d9d6b3392b1fb1a96368abc84db37c9f2f0fa
SHA512 dcfda586be3c8ecbc611d82dbdc19ad79c7148d00f15d177e681a5e1652ef8511a2a210269e3a5452ad4b3d41bad991e6582743ecf1b01d048710bf25d7e0550

C:\Windows\SysWOW64\msres\MSPARAINFO.ytf

MD5 6ea3bd248a9da2d80e6838f52353ceb4
SHA1 cff6453e80bd362f95060e6d923a312ef47d3d40
SHA256 b22ce036b20b33eeaeacbf61e5d747a2efd83489db6c29608ea3a8ed2011e10a
SHA512 fcdfdf37ad6d4ae74bdd495ced409a4657c97f878bc1737ee9dda35f8ca0d1528a43aeaa0303b82d817fe73fb2a599d29336050e5c70d0c2e3f1726c1ac9cbfc

memory/1540-4078-0x0000000004430000-0x0000000004450000-memory.dmp

memory/1540-4079-0x0000000004CC0000-0x0000000004D04000-memory.dmp

memory/1876-4105-0x00000000031A0000-0x000000000324A000-memory.dmp

memory/1876-4111-0x0000000003270000-0x00000000032B4000-memory.dmp

memory/1876-4110-0x00000000024E0000-0x00000000024F6000-memory.dmp

memory/1876-4109-0x0000000003160000-0x0000000003185000-memory.dmp

memory/1876-4107-0x0000000002680000-0x00000000026A7000-memory.dmp

C:\Windows\SysWOW64\msres\config\policytmp_p_water_m.ini

MD5 8f2dc8d37f8dcf17804e9d1638126545
SHA1 1e7912ca1fc0d3d61737e4de328ed0541ffca823
SHA256 b235c2c5e0faddde86675994cbbbd389931eb2885ea318633f9e3b8a7d1b2a97
SHA512 ba366df869afe27754d4fbf0e85d717b07260434a0e840280fc775581cf097b1f18f1efff35e07d0acabe6de53c814051b12145508577111642430cb8dc71ccf

C:\Windows\SysWOW64\msres\config\policytmp_p_log.ini

MD5 0887ae4f2e7d2a08f591ff5a62888c94
SHA1 25af9a9a5916e8a81556f47a6e0c3f4784a22bc3
SHA256 768fb38311d69d9a680d7ff27e7e07ff7b137e61b6773d329fd2e2f4a2a1411d
SHA512 21a735a45dc93a6f0e873cf8114e2cb7df1d12df392d844eda0221ab60dcb1092219e312716ecb5ebd6d4949c3e45f36a45db135d4991ec46cc79fa53705e828

C:\Windows\SysWOW64\msres\FilterCfg.ytf

MD5 5592f7feba93bd600e606d6d446b1da0
SHA1 298da6d2e316b744b5ed2a9d31696120197c89cf
SHA256 2b213b33e19c86ee39d2836e604ac835bdec5f2c9fc44057f6a6198758bc3241
SHA512 521ecf600843b75bae7d651d988734f2d57c700d2fdd092fe57380c8fabd2dff4836a213b991339df1342bb919d11dafa12b59bb8b2814b28b80a8c2e98ded4c

C:\Windows\SysWOW64\msres\config\policytmp_p_system.ini

MD5 ba3c1719ea0bd1ae14ae059b3e86e0a3
SHA1 2bfac639ae5667f4bdc90bb7d6ceb6e1a8ded51f
SHA256 736ca0e71048ddcb7de1e9c189bdbacb3bcb43c85d87d5fa3a97d9eaf3d8fea0
SHA512 c993bb93a1cc745f7f8e8b86b1c48fdc56aeb57cbcfd3c816ce869ee1af3d348e0c5642312a8d5aa3113856c64530514cde4b586e2c71c30e01da6140e407208

C:\Windows\SysWOW64\msres\config\policytmp_p_global.ini

MD5 1a4b0b831cdf2fe180289efdaf23b581
SHA1 21f29a2f229d93fe2b9287145cdccb9ada032bcd
SHA256 a5da8c67b98f1e247d9a152dea9989116fb53a9d8741c128e5c9dbcc40b79e33
SHA512 433eb7d8981326b83649dd0963ec91e01970b9b92a0b8a31abdf1cfac4590a58ab266d51c9122f7ee4128ead74b9b21e623434fc7d7c6d612b05903bfc94cd38

C:\Windows\SysWOW64\msres\PolicyInfo.ytf

MD5 7d8d27b88ade75274d00047022c5c4e2
SHA1 578dc8f57039917af7aa9cf469e6e61b3cf1549f
SHA256 33225a2376f66cf2e6a1d52d883f1ccbed5e32826585a887ad801e5482baf2ec
SHA512 fb7504e7b0b41f3bb7b6878c8f20214de5636ea0c53b36a3457b8e0843b86a6fa57f51621cde9efc0e873781ab43b2697b37aa78160d1ae8b7a7230bc3322ffb

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 34aae2a2ae29e3508987965d005cf3bf
SHA1 7e4a601d8b0873f17d7f65df1bb6531212704761
SHA256 b8c531cab729d4c32cdcf5c710b89a4b768ebb5cc239169d0dbbe212bc9e6e9b
SHA512 8ee332ac245cda07c4fa1eb4d89ae34be941e9526e352499d63a0fbe930068a2642325c58b9b4c065778aec10a8f4630157fc1e61789233edefd27dd58434fe2

C:\log\Filter.log

MD5 64ac41baa5ed82f0a7ba653db5cb4ecc
SHA1 8323ae3fe628f5aa5dd1660f04f13364bfd7089c
SHA256 d2666b8a2fee9cbae3069bb04a59d6872e724b1c17d7c33901a959a9526e2700
SHA512 6a5864d2024c502dbb4d98778e9ebf81ad51c4fbfd0de009d5b161ec348ce3df7e72af267132284b0db81e02b4f8d5a8a2eaba626782ef65575e1f936e45377e

C:\Windows\SysWOW64\msres\FilterCfg.ytf

MD5 8a1d31341cb50c24522ee68168237119
SHA1 bdb77f88c291d37af99dc93e6c774f0319b38293
SHA256 de4397881fa07961b2403ce80914c28ecd29f9650cf625d003e1938fa4497eeb
SHA512 22d93fca01eca76829bf2fa247abcbfe3e6dff01c7220d44f13ca389dc18079d4a553c433c629ac976ff4cf91184358155cd55ef395ca34859971d84b2d5d98f

C:\log\ucommon.log

MD5 a8bcbdf455748c9ecffeba4cf4a9f790
SHA1 c473ccd0dd6eb3903fdec2b36c4b40af68f091f1
SHA256 1eb7a482b3a76ddfb49744d85d51d39eeed2259afde6d8db8fd02bc19d13c011
SHA512 965898055016fad6033901fd58c01d1e1ef3bc0a769592ad2a2eef957fde59270bd589a616195afa9bdce5bc00b940a29718ef1ef6032bb86fb6e5c925efeeb0

C:\log\ucommon.log

MD5 550fc860999bd95a3f1953a55222457b
SHA1 91397a6d7f3260fbd1f20ff3f440ff70b9a2eda7
SHA256 60db21b3f383f11595075a7b630849a1229b049ec04394d5ab11c663fe3a4d18
SHA512 5fd409e0f0ad1a9ec5a6f1cd76694055755e7d1766700399005a8a623ba2a4fac974f96dec29d6686cca02889df7279ec20fe1358cfe0f01d99f115b3469ad31

C:\Windows\SysWOW64\msres\MSPARAINFO.ytf

MD5 60efecfa93d5dc661bb4f5811ec8aa22
SHA1 01123e6cd59c075addc5b5077408a6b12ede9b6a
SHA256 99fb5d0b361bf986173e3dc71bb168f904dbbbef7b55f538063d20d8cb9d0d8a
SHA512 07ea5a40adbd7ac545731155ef6a3ea4eb715a7d7d4dec7afc8e26c61cca8d73c996105ac3894959ea8443da55ff55cc13b7da9ec8795488118cf35c76606553

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 33a76bcbd77dcc7d1cb77212c20e2b3a
SHA1 b5aea298af047b237bfeafe464367390bd4b9d78
SHA256 d3ccd1436a56b89551617e458f4e1e63c8db1536e874fb587dc5dd1e9044fb51
SHA512 46fb624598c06c90a98dba4e02c9cc9c695c2d4f95ba559310799d53859d26ce18a2d44ae015a0ecf4a026a5bd61ac612a502c2ef385440032c8f4b115f4f05f

C:\log\AssistantThC.log

MD5 81d0a85a0b1677f11a0ec66954a2e326
SHA1 1225a11198384e46d67bad71a4c16342e7134513
SHA256 42a35361b94f90abb76ae7d81f106e6bf6d6fab871a61c6dda5afdbf2a8a293c
SHA512 335c8bbc4da24cd382d7088c62cd35aefcdfe011db9ca1e2373f8e66e6785e22e5fc06685439e4b6882f0d22327f7744e51703b96e8dc529e02898563c53fe7f

C:\log\YTFunDLL.log

MD5 96a4359414687371ac5fb72ffc06354e
SHA1 f6a936c0dcbd3427ffaaae7e5e3b8201f0854dfb
SHA256 b6ed5d6ff5349faad0d3c611cf24f949fb483c09b449ddb85d93a9d603a3e86a
SHA512 1e4e80c7bd89bd762a7ffff3cbfb53b19a77a4c44c066b66ae7707c8483c23f601ffab52de8220064652db7ffd42150893d3bbe6c0f7747532901894893e5c9b

C:\Windows\SysWOW64\msres\PacketC\PacketUpdate.ini

MD5 25dc5dd57d5410ded94002d4526e0041
SHA1 70c20e897a632018c3bdf1ced153e7f61af30df6
SHA256 d1359916637119b32837c4fe21a90bc53533c96f9fb07e89696d84ec23e0d0af
SHA512 2c4cf46b4d33480b49d8f4b2f125589a1c479a0cafd5a1a44c610725de8e1a98c010dc64a27df527ec60a14f2847a4e15801776723d1d600073da10d330722fb

memory/1876-5264-0x0000000060900000-0x0000000060982000-memory.dmp

C:\log\Packetupdate_C[2024-10-16]_0.log

MD5 8419d7681c1a5f614114749e2362c08b
SHA1 2526aa7e2fef63806d627bed6d3870efb5c51759
SHA256 c9c7c5bf95b2fcb98c07049f959d12d56e7bf3885b4b8042daa5d8dee6a175a4
SHA512 20b5bc3a5369d6d862f52b62b642fb0284972080eb74863b24881e4f86cad9d7bbaec18feb7e126088687742adcdf496366e11998d095568c867b20c59c046b9

C:\log\YTFunDLL.log

MD5 e27b97362ab3abd013525818ce534088
SHA1 278bfcea76760295d597df2e2dbf573d5e07590c
SHA256 a933fa09c6448f34220d3a9f9ebc8192836f109044e3721d831947ca68f937b5
SHA512 5f5f35e9a1c618ba85bb170e33dd4e07b0046071cafb1d0a24d02686a69144549f4886661fe7229352d73718c1f351c13924f5a665cca94e8472bed30d817ead

C:\Windows\SysWOW64\msres\PacketC\NoInstall.ini

MD5 217cb2e5835353f0fbd9982d143b2649
SHA1 b949fb8fb7f92e6e203492ee6ac7977ec7ddc0f2
SHA256 a9c81b1b382fabd6a1cfab940646aa994658e136a1927e14c30c96dfe90b45b3
SHA512 2d855a4cc0caf5625062c08bdde75a724255743d7fe4fc2ae96d09606ba780223e0911fbcbb8aa27386549c61932d63415f54ae84ea58c60e1a64a628e3054a9

C:\Windows\SysWOW64\msres\sys_config.ytf

MD5 39782c335353273b5884ddbfeb67f610
SHA1 93edc54b91e9ed8a2212d0451e8e460182a38c12
SHA256 787faa3e88b5f1b958fc7db7ac64f1c4e074192390e6ebaf0fa279445b28e571
SHA512 ee772d3a1ada6138b3b5db7f87cce20c210924901eedb745faee6214b88dfdde9257f80de0669294633030a04860425926e40cfd6e0ee78eb3f2ae2c3fafa4fc

memory/2360-6817-0x0000000000300000-0x0000000000327000-memory.dmp

memory/2360-6816-0x00000000002E0000-0x00000000002F6000-memory.dmp

C:\log\ViewC.log

MD5 8bef0354e41f366e7daf5b08580eb52f
SHA1 c311ddef98b35e6cfc19c115c46c214838a89555
SHA256 f6f33fedced79a2b4960b332bf4930b1c4bdb72628f286609ed9254aa25f7483
SHA512 f9f19ec8069190e4ca25e9dcd42112ed6eeccae551ba3365c8d1d6bec7d44a664d866c87af5a858265f603f3423f7e4f35e903b72e58fd07a1b15b37e3c9550f

C:\log\svcView.log

MD5 5847f4050408cc51955ef2b2d1175492
SHA1 03010ea41ae994a025d17d68cc2926f5c3f0553a
SHA256 f9d543f1b8d87af1562ced4f752b26466cb1d44981ea1354006c53b4f88d9f58
SHA512 bc89d47855100aac34358a23c3085b137819950897e56a7a388fa3e3bd7041fab8e4c40c67c18de73451d0bf27b43b582c754ca989e19721b9880f3e70b4150f

C:\log\VSetup.txt

MD5 534ad5bf326b9dd9aed1b033ed20593a
SHA1 88797384681c0861ecb41abd60a13f788dd00a50
SHA256 8ab0589bb803b03110b28fb05b781fd414021bcd1f9cb62e0f445c9b0315b0ba
SHA512 d42512f2886a8efba24ec341287bd34394a4975a9165155f88c08d448db919e8d49ccb20ffbec72b2c0ae3a642258ad5f77211dc09f2619697bda38b47f88a6a

C:\log\EncodeH264.log

MD5 ddf325e1fd7e9cc8f3d9521ef772e230
SHA1 e7cac2d04db2fbb650698ee9eb178fed28612bb0
SHA256 49e4ff13716d755320979243e93db969c9d6e741d4d22b194e145ca49dbef747
SHA512 563c87dab1daed343478250c3e58522566e032b341c94c8117a3c837230bca5ba6d5e0545973a89cf4816f1486aef0a76eb7cee9c18c596e3ba73e54227051eb

C:\log\dotimer.log

MD5 a2fc3a4d2cf6b8f0fa640d462ea58439
SHA1 374fd49d70071b588c62f8383bb56049a5d8652e
SHA256 0b7bb85498352c4a3c857883fc128d42d08b260f27611935d45525cb6ba0ac6b
SHA512 c8f1706b5ba1a2d955685aedbe09bc0e0eaea118f2772e33152583b279dbcf637cab7488d578b32e7badcd7f5d013255b249dd147ebaa72982ab0a8cca2f0465

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 35f370e33ff5cceb4b2ffdefca4148fc
SHA1 6b6d5bfb77a5ccccc5ad8c362c418da9292fb1c6
SHA256 172f3be2242cf4465f2d65f3882fea810d39393cd985704d716df54e3640ac6a
SHA512 622332c47ab64ffc54d7914770720fbce1401567811edefd913bfbbd869bf8a44f76d7bdf939720d44800381c923d3fbcb8c0269652e724c7691cfc9107988c0

C:\log\ucommon.log

MD5 35b5e1e4373668f9cad8dd97c91d8e52
SHA1 2e8ea85f6320619b0a4936940caaae2d8edb49c6
SHA256 af15331c869fa5effcc7927f171cbba8e67efd6b15324abbe3e18a4987ba1626
SHA512 6248d00e870370cf02b068c7cb04e351281eeaf2bfc02003c739a28d8ad279233d8e8cbb6b7c02a54e41b2d54dceba7e1aa424674c45dcd75dbf6be85759af42

C:\Windows\SysWOW64\msres\sysinfo\vir.DAT

MD5 1803bea9ede45cbefe986d0cf21acd48
SHA1 2dd14319ddea77a59adc8710b4a25772b4275e75
SHA256 0faf2b58cb5d5670b624453b3ba4eae2a9176e4017c2d63e22e544549388d0c4
SHA512 e8e3db5f25f82f8b3911d01a0722b992c0b62f388baac6023f2c347f47b9bb404e270f093d886cc589b0b185b2a2b132d57d7c51db7d921cf7fc9f77c9906ddb

C:\Windows\SysWOW64\msres\sysinfo\shareDir.dat

MD5 defc080e24f426a3fab40001053c16cb
SHA1 9af55f5a7e7429945b222b234120c97f23aba1d0
SHA256 9873bd75d21eb68c26ba0f616e3952f8ba885f2f4c6aac13ef0e82fb71e28226
SHA512 1e5ad46b74b8cf1326e94cb80193feae1e24f0152bf53bf980aabdc33a30f6e930c740f7eb179bc87c1f0b72c1c5287610c6d8d21f4d4274e5028b7712329a34

C:\Windows\SysWOW64\msres\sysinfo\OpenClose.ini

MD5 29714c543a827621fd75806370ed4647
SHA1 e2a3e719e2ec4e00450cb362ad625d4160d7a3db
SHA256 c706f061749b2c90c8247c1d04efa2dd92bd0208aa32107bb14e2f62203224c5
SHA512 4cee4b8e7478f668db43200b4d7ac2b3e29b9e293aec7f1b5e91b8e8a9838e9646620d5f32d7653e5ccd0fbab58cb50f092f0d86f50e3847110928b7db74c367

C:\log\AdoBase.log

MD5 c3b02ea1bc12db516de8aab9b60d6da4
SHA1 5e392b7cab2e6901936adffdf6982c499d1a6148
SHA256 f5aa4906fc9a613c9532eb718421a127bf9b6cbc55dd77166fa037efc2ca613a
SHA512 9b4df4e6d008d0390130c30a5aa900c0e58cf2c96068a1b7d9ec17eb489d5b14b73a45dc157cb36ce87d2feba48068a152ce7bda7d5552c543bab0d9b9e86301

C:\log\dotimer.log

MD5 da7b049bf4bb6311e296121a356e83fe
SHA1 34952376a510217c237f15aa4fd70eac28f56540
SHA256 bbc37a5a245d3d775598a8fad574822f282544ebb793404cb808293cf374a533
SHA512 25a8dd54cfd035df235ae9464c912acef58684cba7589545b61941a390f4a632aadc29c0e36634826473db12c9afc7c2a56f1f99f538bc6349315c7b90d34467

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-16 01:37

Reported

2024-10-16 01:40

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\sgfp.sys C:\Windows\SysWOW64\msres\setup.exe N/A
File opened for modification C:\Windows\system32\drivers\sgfp.sys C:\Windows\SysWOW64\msres\setup.exe N/A
File created C:\Windows\system32\drivers\YtMiniFilter.sys C:\Windows\SysWOW64\msres\setup.exe N/A
File created C:\Windows\system32\Drivers\netft.sys C:\Windows\SysWOW64\msres\svchost.exe N/A

Sets service image path in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MANC\ImagePath = "C:\\Windows\\sysWOW64\\MANC.exe" C:\Windows\SysWOW64\msres\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\msres\Setup.exe N/A

Impair Defenses: Safe Mode Boot

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Manc C:\Windows\SysWOW64\MANC.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Manc\(ĬÈÏ) = "Service" C:\Windows\SysWOW64\MANC.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A N/A N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\F: C:\Windows\SysWOW64\msres\svchost.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Windows\SysWOW64\msres\svchost.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\msres\yundisk\skin\images\c1-06.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File opened for modification C:\Windows\SysWOW64\msres\YTSysConfigBak.ytf C:\Windows\SysWOW64\MANC.exe N/A
File created C:\Windows\SysWOW64\msres\skin\riant\TabRightSel.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File opened for modification C:\Windows\SysWOW64\msres\sysinfo\winPackUpdate.ytf C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\SysWOW64\msres\skin\riant\min_norm.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-icon_58.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\images\dh_01.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\Special.ini C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\images\c2-05.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\myreceive3.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\protect\STDMBR.BIN C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\icon\chat.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype15.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\protect\Restore.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File opened for modification C:\Windows\SysWOW64\MANC.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\CJ60Lib.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\avcodec-57.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\icon\p3.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\riant\new-logintitlebk.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\protect\Detection.ini C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\LOCAL.DAT C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\SysWOW64\msres\mfc140u.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\trayicon.exe C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\dlp\box_2.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\PacketC\PacketUpdate.ini C:\Windows\SysWOW64\msres\sysaid.exe N/A
File created C:\Windows\SysWOW64\msres\mspm64.dll C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\riant\max_norm.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\imageocr.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\btnclose2.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\icon\ico_ture.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\btndownload2.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\fxz.bat C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\background\cancel.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\dlp\dir_splite.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\images\qxan2_09.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\icon\p5.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\riant\new-loginbodybk.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\icon\documenttype36.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\protect\fadisk.sys C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\HKForbit.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\xx_01.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\riant\new-TabHeadBtn.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\fanhui.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\userreg.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\sqlite3.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File opened for modification C:\Windows\SysWOW64\msres\LocalSet.ytf C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\patchquery2.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\skin\btn\select_all2.bmp C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\iconTray.ico C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\close_user1.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\protect\License.txt C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\desktopDuplication.dll C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\depsel1.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\btn\btnclose3.bmp C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-excel.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\cancel.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\skin\background\images\scyp_02.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\images\c3-04.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\yundisk\skin\images\mainBack.png C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\chi_sim.traineddata C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\protect\FASTMNT_x64.sys C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\msres\yundisk\skin\btnsearch2.png C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
File created C:\Windows\SysWOW64\Setup\msback1\newicon.ico C:\Windows\SysWOW64\msres\Setup.exe N/A
File created C:\Windows\SysWOW64\msres\64.bat C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\INF\rawsilo.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsantivirus.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsinfrastructure.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_media.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_monitor.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_camera.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_proximity.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\ts_generic.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_extension.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_computeaccelerator.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\sedisk.sys C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\INF\c_fssystem.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsactivitymonitor.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_holographic.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\oposdrv.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\PerceptionSimulationSixDof.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsencryption.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_mcx.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_display.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_receiptprinter.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fscfsmetadataserver.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_volume.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\rdcameradriver.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_scmdisk.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_netdriver.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\xusb22.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File opened for modification C:\Windows\sedisk.sys C:\Windows\SysWOW64\msres\svchost.exe N/A
File created C:\Windows\INF\c_fscontentscreener.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_scmvolume.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_apo.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fscontinuousbackup.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fscopyprotection.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fssecurityenhancer.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\dc1-controller.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsreplication.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsvirtualization.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsundelete.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_diskdrive.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_processor.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_magneticstripereader.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fssystemrecovery.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_smrdisk.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_smrvolume.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsquotamgmt.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fscompression.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\digitalmediadevice.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_sslaccel.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_barcodescanner.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\miradisp.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_firmware.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_linedisplay.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_cashdrawer.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fsopenfilebackup.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\remoteposdrv.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_ucm.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_fshsm.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\c_swcomponent.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A
File created C:\Windows\INF\wsdprint.PNF C:\Windows\SysWOW64\msres\SMSS.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\VSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\svcdsk.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\7z.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\MANC.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\UCommon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msres\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\SysWOW64\msres\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Windows\SysWOW64\msres\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\SysWOW64\msres\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\msres\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Windows\SysWOW64\msres\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\msres\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor C:\Windows\SysWOW64\msres\svchost.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\SMSS\Recent File List C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\MANC.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\msres\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\SMSS C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications C:\Windows\SysWOW64\msres\sysaid.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\MANC.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\msres\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\msres\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\msres\svchost.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\msres\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\SMSS\Settings C:\Windows\SysWOW64\msres\SMSS.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\CHelper C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\CHelper\Recent File List C:\Windows\SysWOW64\msres\sysaid.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Local AppWizard-Generated Applications\CHelper\Settings C:\Windows\SysWOW64\msres\sysaid.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\NetworkCVSIcon.DLL\AppID = "{DB271980-7374-4ABA-B5A5-A5F619B33816}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict.1\CLSID C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\ = "Conflict Class" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict\CurVer C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\VersionIndependentProgID\ = "NetworkCVSIcon.Conflict" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\msres\\ufsdicon32.dll" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ = "IChanged" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\msres" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\FLAGS C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict.1 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\TypeLib C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict.1\ = "Conflict Class" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\InprocServer32\ = "C:\\Windows\\SysWow64\\msres\\ufsdicon32.dll" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ = "IAdded" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\AppID C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BE68C082-6657-4110-8688-15CCFB246CAA}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ = "IConflict" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\HELPDIR\ C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{DB271980-7374-4ABA-B5A5-A5F619B33816} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\NetworkCVSIcon.DLL C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkCVSIcon.Conflict\CLSID\ = "{2F0B3348-0AD1-4229-B825-38A88142F2BF}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{87637F0E-57A9-4873-BEAC-60D11A84E844}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2F0B3348-0AD1-4229-B825-38A88142F2BF}\Programmable C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\0 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ = "IInCVS" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\ = "{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF14CCD9-6675-44B4-B632-00F9A9AAF5FE}\1.0\HELPDIR C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ = "IAdded" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\ProxyStubClsid32 C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52}\TypeLib\Version = "1.0" C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEC1534E-AF07-405F-98EF-91912397BD52} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240} C:\Windows\SysWOW64\msres\FSHost32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{337E4907-DE0C-4E6C-88F6-A2F795089240}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Windows\SysWOW64\msres\FSHost32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\MANC.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\MANC.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 31 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 31 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\msres\7z.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 31 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: 31 N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\Wbem\wmic.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\VSetup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\SMSS.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\INSTAL~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\FSHost32.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\sysaid.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\INSTAL~1.EXE N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\svcdsk.exe N/A
N/A N/A C:\Windows\SysWOW64\msres\UCommon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 9076 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 2924 wrote to memory of 9076 N/A C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe C:\Windows\system32\cmd.exe
PID 9076 wrote to memory of 9176 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 9176 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 9176 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 5168 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 5168 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 5168 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 5168 wrote to memory of 5316 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 5168 wrote to memory of 5316 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 5168 wrote to memory of 5316 N/A C:\Windows\SysWOW64\msres\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 6020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 6020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 6020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 6828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 6828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 6828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 6856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 6856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 6856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 4936 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 7552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 7552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 7552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 7644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 7644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 7644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 8080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 8080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 8080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 5316 wrote to memory of 8092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 8092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 5316 wrote to memory of 8092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 9076 wrote to memory of 8148 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\VSetup.exe
PID 9076 wrote to memory of 8148 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\VSetup.exe
PID 9076 wrote to memory of 8148 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\VSetup.exe
PID 9076 wrote to memory of 8172 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 8172 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 8172 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 1744 wrote to memory of 4432 N/A C:\Windows\SysWOW64\MANC.exe C:\Windows\SysWOW64\msres\sysaid.exe
PID 1744 wrote to memory of 4432 N/A C:\Windows\SysWOW64\MANC.exe C:\Windows\SysWOW64\msres\sysaid.exe
PID 1744 wrote to memory of 4432 N/A C:\Windows\SysWOW64\MANC.exe C:\Windows\SysWOW64\msres\sysaid.exe
PID 1744 wrote to memory of 8448 N/A C:\Windows\SysWOW64\MANC.exe C:\Windows\SysWOW64\msres\svchost.exe
PID 1744 wrote to memory of 8448 N/A C:\Windows\SysWOW64\MANC.exe C:\Windows\SysWOW64\msres\svchost.exe
PID 1744 wrote to memory of 8448 N/A C:\Windows\SysWOW64\MANC.exe C:\Windows\SysWOW64\msres\svchost.exe
PID 8448 wrote to memory of 3504 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\setup.exe
PID 8448 wrote to memory of 3504 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\setup.exe
PID 8448 wrote to memory of 3504 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\setup.exe
PID 8448 wrote to memory of 8752 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\SMSS.exe
PID 8448 wrote to memory of 8752 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\SMSS.exe
PID 8448 wrote to memory of 8776 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe
PID 8448 wrote to memory of 8776 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe
PID 8448 wrote to memory of 8776 N/A C:\Windows\SysWOW64\msres\svchost.exe C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe
PID 9076 wrote to memory of 8940 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 8940 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe
PID 9076 wrote to memory of 8940 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\msres\Setup.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\SysWOW64\msres\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-10-16_d3e80676315f36ebd805caeba83406b0_ryuk.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\SysWOW64\msres\Setup.bat" "

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /Serv

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /InstallC

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Windows\system32\msres\64.bat" "

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres\log /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres\log\OutFile /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres\log\OutFile\File /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\Program Files\Common Files\ytcommon /G system:f everyone:f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo y"

C:\Windows\SysWOW64\cacls.exe

cacls c:\windows\syswow64\msres /G system:f everyone:f

C:\Windows\SysWOW64\msres\VSetup.exe

VSetup.exe /VideoSetup

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /Commit

C:\Windows\SysWOW64\MANC.exe

C:\Windows\SysWOW64\MANC.exe

C:\Windows\SysWOW64\msres\sysaid.exe

"C:\Windows\SysWOW64\msres\sysaid.exe" /QuickStart

C:\Windows\SysWOW64\msres\svchost.exe

"C:\Windows\system32\msres\svchost.exe"

C:\Windows\SysWOW64\msres\setup.exe

"C:\Windows\system32\msres\setup.exe" /CopyeVersionFile

C:\Windows\SysWOW64\msres\SMSS.exe

2100

C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe

"C:\Windows\system32\msres\protect\FRSDKTest.exe" /status

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /other

C:\Windows\SysWOW64\msres\Setup.exe

Setup.exe /Reboot

C:\Windows\system32\icacls.exe

icacls "Setup.exe" /deny Everyone:(F)

C:\Windows\SysWOW64\msres\INSTAL~1.EXE

/USPI

C:\Windows\SysWOW64\msres\sysaid.exe

"C:\Windows\system32\msres\sysaid.exe"

C:\Windows\SysWOW64\msres\FSHost32.exe

"C:\Windows\system32\msres\FSHost32.exe" -installicon

C:\Windows\SysWOW64\msres\INSTAL~1.EXE

/USPI

C:\Windows\SysWOW64\msres\UCommon.exe

INI /ClientRunTimeIni

C:\Windows\SysWOW64\msres\UCommon.exe

INI /SetScreentProtect

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic bios get serialnumber

C:\Windows\SysWOW64\msres\7z.exe

C:\Windows\SysWOW64\msres\7z.exe x -oC:\Windows\SysWOW64\msres\PacketC\ C:\Windows\SysWOW64\msres\PacketC\patchconfig.zip -Y

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get vendor

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get name

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get vendor

C:\Windows\SysWOW64\Wbem\wmic.exe

wmic csproduct get name

C:\Windows\SysWOW64\msres\UCommon.exe

/GetSoftListFromCurrentUser

C:\Windows\SysWOW64\msres\UCommon.exe

/GetSoftListFromCurrentUser

C:\Windows\SysWOW64\msres\svcdsk.exe

"C:\Windows\system32\msres\svcdsk.exe"

C:\Windows\SysWOW64\msres\UCommon.exe

/SetWallPaper

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
HK 206.238.178.116:6671 tcp
US 8.8.8.8:53 116.178.238.206.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
HK 206.238.178.116:6681 tcp
HK 206.238.178.116:6679 tcp
HK 206.238.178.116:6683 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
HK 206.238.178.116:6683 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\7za.dll.bak

MD5 65dee16df82191784797dfc46728d689
SHA1 8a931eb391c247827ef64c8307d0a1b4561ea013
SHA256 cde7464eb0b7885a59a9b5b7444bb4d1a5ae0a5018997b5e90af459c3e7bee66
SHA512 64c2e79699a5018de873d37fd8d38ef7f66fd5fa413f2ccbf28b79ea892b4cb8ca9238004b57cbd595e456c0b51003369d08beedc031a7d0b00a7d840bff085c

C:\Users\Admin\AppData\Local\Temp\L9qmhCrVkv.7z.bak

MD5 329dc54390be231cdc107f4fdea72044
SHA1 226a98d0bf987225e74a4baf1bb7448a7eeea15d
SHA256 34a2e1b2bef5da5bf131aa7f75c4edb2a42202eb1303def90f8021ab780e92c8
SHA512 ee7918357955f5427c6dccea1ed265319c1d437d1ddfddc3af90bca4a4db9bfaa614cca277cb5f6d0b880826eb54d50d99de6c0eface3ccbac9789e1262fb84d

C:\Users\Admin\AppData\Local\Temp\7za.dll

MD5 bda80d260ee69e6075e68f8c34f328e3
SHA1 b8b0a6b5ba2ee79a3d4e2b2ca2de0c44b92d8116
SHA256 c4e3f8f2852314864b2b51c049c327f399395acf52f1bb8ca18b358bcedb4143
SHA512 7ead2dc0fd89772c49e19897007a682b69c1c2e5f0ad5921a7a9e4278228ca4305318d170bc0524c6b7a495bc8c935dc031acc9546ccc0c35d007fbfe61709fe

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\btn\qhdl_04.bmp

MD5 f40286a3b4a4b549a927abab8fe32ea2
SHA1 4192fa430921c3265a00d5fc9a77ef7e6253ff23
SHA256 192d30e40a0b9592c31e757311e8d9f86bd50023b86928082c49b2b9ee8cb9d1
SHA512 a6b088d4ed41a72c6b74334f1867794cdba24121903530644f19854d5bc034697d98f5c7518a08fd3eb7960521af96e24776015960eb672793c65123e4de4e88

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\new-BtnMid.bmp

MD5 e909c29d9f0d08e50f72a809a3d0ca88
SHA1 c3814bfc32ad5912f97df87217c4a9969f02f91b
SHA256 471b4898508f8c209a92c668d28793d538b561d646eb22ad01fe10cd17dda4d5
SHA512 141b97d878f249b6347462231d3b4507cd57d9125e18c0fc443d9ebd1026232fab931384c44c452a5309dc119e5b412cc53d72628d8c818d5688dafd288b34d2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\min_norm.bmp

MD5 f1f4f94cfc05ca1684e077a74168867e
SHA1 efcea742f13608f6d29f5086c2a78ab2af37e3c4
SHA256 303dccc16b4c9ce21a6d63cd8c89e4a6d5494fc958ab1425c42bbb7aa57fc472
SHA512 2314f354cc54c56a7b0fdf3de04f5463435b197935e3c93b4d7b4c7a98f9669c4e4ab4e58db43346ba209ec2def7d4d211cf2b29bab86421cbf45d0813f245e2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\max_norm.bmp

MD5 61c58f47c99b4ea32104df13e165deb6
SHA1 282d94b18cb798408e35c3c9719d3255050d78dc
SHA256 c72b4f625082857c9e26f350bf4874d45f0bed0c6ae57cc69e3cba48535469a3
SHA512 9b556928d9ac8ef6135a84e717756bc42a683b937062637fd33313c92da651307e373aa29c77574eccb41d31f28766c3e8397f936a983e9d8b8837fed25bf724

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\TabLeftSel.bmp

MD5 2594a024a2aae22b105298d0954e18d8
SHA1 834ecf11cad8986d61f4a06e5a262e86a2503622
SHA256 02c67d2b27a369142b55ef86b8fd2eefe01858a1eee3e1f549d97be5c7d317d2
SHA512 2509578c838f4f7441c39f95d94a6ed2ce8cfa34caee694df8e8f41909df455ba9ec27ee3b91231bd514bdcc12c7f4a52a2a705a12876cfdc014c347f345acef

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\skin\riant\TabRightSel.bmp

MD5 afb692f04d78d4bc6c64c761dcc120a5
SHA1 8bcd93a749b4103922701f26aa3f124b4e8ea271
SHA256 9175f8901497a326ce07ccb15b3ac2959235625dc5261763ed5981285540e289
SHA512 d09b48216d48bd13fbca37797bed8bc90c6c96ff0fbdd191e657a5510c3386508af30e9a9706da109dfa9a8f46febf12b62fb561d5aa54d73a3c7bc0ce74abc2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\x64drivers\vgwdrv.inf

MD5 67fa111ee285b491f05efe2b7aa2b5c6
SHA1 7628efc482e81865cdc4a393a5c9c8908cf7197d
SHA256 dc41417edd4a2819fbbea8f0294e1533bbfd10249df651bb9a0aec0a33ce3086
SHA512 136e4d0dad17efe56ba6d9f0f0a20ea9701d07627b01a4481d9ae466b342056ce01f9aa5095cecd99a105b660bec843f7f15024bd1b9f192a4ec35cdaed85207

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\yundisk\skin\images\AccIcon.png

MD5 fc2dad3da2ea91356925d548f4a8f4e0
SHA1 6c3c0dc85c8305df9a4dbba62e89038b4000ddef
SHA256 15096b3498809990fec36661f9dc6cfde967ee231ea4b18a0d5b8be6ad309769
SHA512 e9b0dc4d81c92525bbfe587523f84ebfc25fb7b64c2a9c9dc1fa135aee0eda0756de94fa1e9403d1551b7ca319cbaab69500b1ee38cf3bc1945354f8d5b644fc

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\sedisk64.sys

MD5 0f1bcf9c6bd8d3bcfc6f0ee2d20d416d
SHA1 86e4b8df9f7a49d3f807b3d251838532aa97e7a6
SHA256 bb98eb7d6525ab575cb8307489ed2b5bde3ba762c7734e222f1c999cff97116f
SHA512 35cb8179cdc5405b60d7526e4d39683cb4c8b45df8ea7eafc0ed802ea00a824ee8a477f4e58e2194e7de15704a4ca1e3645ecff5934eef53c03c3906b751a58c

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\vfsd_fre_win7_x86.sys

MD5 0d836e4f0b9566ea4737f9fa60e5fc06
SHA1 364915405550dbbe0ac9c21569a9525ed3d87cac
SHA256 93223c8c15681ed4845a547867c924c1ca04b72ae1bde60be8a6023613e4a085
SHA512 cbec6d3cf96340fea031554f3111baea968f6f2054cb6324b850be40a31833fdd5d66b6957ba298148a588111689927b3c697a6cea90ced719a9d10ce64a74b6

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\x64drivers\vgwdrv64.sys

MD5 934a9fc5468c24331d62bbd1f703d228
SHA1 364a24bbb654fca187e1c1c41e8b2e0056abf0b3
SHA256 2634d8dc1fe3a415ce566101e25ecf08bb94c9353891cbc5afae2a8f16e97619
SHA512 c259d75e578fa202db8a8c2e00e23030d419fc248a70c559acd4bb0457f4fca0cba342cd24e84a7cbade8dda98623aca7fe24b3c5030948b453b57a376cc8f8c

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\x64drivers\vgwdrv64-win7.dll

MD5 36e921c65f6ffc1c2113ad372c02bbfc
SHA1 e2deb5ee0225a1711c72e8b7574158c77348df5f
SHA256 0ef28a2a79f70b01664470fd345c4f08a3aef8cd36a850a2e58b297c5ff2a456
SHA512 39445c111cf5284c09f2721736e446a555c11e4ca03e32aabb64bc8887a7eb2610b67464f716b6b01c87a01e45c94b0c8911dfb6e2f948381c16b5c89acf9d98

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\msres\YtMiniFilter64.sys

MD5 c7e0aa3a6f1c52afe3a7b3e79b24662c
SHA1 45a828269dc3727bd7983ca4c2ad25c348a8b2d9
SHA256 613b327fcbc283656f9fa7aee5563775dc758ea657b03d22a7802698c6c269e8
SHA512 bb30f40b6f811c2a0a4663525d64af7e2d2656a284619d5648a372bc4f1937f097187fc1b72b11b57ee312f434a26e3bc4272b12ebae4fb6ef733799cde890d2

C:\Users\Admin\AppData\Local\Temp\Windows\SysWOW64\MANC.exe

MD5 d10c8018922c211653b8f86fddc3ffd5
SHA1 c5901156b038e87f1a3a25201b9ac306b157f6b9
SHA256 8e8156c5a8be682dac3b5d867031e8d5cbae031ffeb4c0ddd5e5a6b41ca76555
SHA512 b978ef2533c52d1681da613d9668505220c01803775818949fb97a5cfe679000261bc278da854588ef2d3e314933a5cb9b306961be262be64c3e49541f1c42ca

C:\Windows\SysWOW64\ProcMon.sys

MD5 e4d052f5a377debac03a760872e8f013
SHA1 43ef94ab0842d7c1473123a8cb66bac3edd7ae28
SHA256 6bdfaacd0116cbc17386409faaee51e7a9adbdfd61dbc1f2a36338fbbdcbac52
SHA512 fc640b3fb5270f826f0350307fcda5108b629aeb198fa389492609dc8d171fc369343c480348bb0b97836ffe75fc5d48f8a193dd52ee0616503607077cfa9d99

C:\Windows\SysWOW64\MsgTrack.dll

MD5 52255ae42fe4800dbfcbd39e614650d5
SHA1 f0c61cddaa35765a7c92d336c0bbf533ab82a819
SHA256 ddeba97be23eb2469dd890657e2eb5154c5294dd399fa4ece5b4a0db5a0c5d72
SHA512 92bf52a65203cc6c06f052b9d1ec2191df8479c2b5f7db51059879507ef5c98b7f1f3a663fd32d8bef1f1221d3397e8b37525ae5f96c521a719f5e602a7fdd58

C:\Windows\SysWOW64\msres\7zSD.sfx

MD5 7417e9e3225dc6d8769e05d056fde688
SHA1 839301d5ee0a7e973520fd757edadfcf634cbad4
SHA256 f0c427908563ed7d248717cc1f94fb57a2c047fd108e0395a403d19bc503c5d1
SHA512 1b318a85bbc22f7b7b2e336b7ed4936e61693e1a1706f8a4b076dbefc7aa16c98580df20bbbca9e325a430b4ec810bb65066b2d44897096ddc3147156b100acc

C:\Windows\SysWOW64\msres\7z.exe

MD5 36a3807a11df584777165172c71797ee
SHA1 fa588a65041d8947fa98e9507c69e43d11b450d2
SHA256 26d550366491ee0fe14f6cbb67c9bac55300a04b34e92f973a96d00cef071e5e
SHA512 8d265cfe5abcdb6b627414786763b1b7099e8dee52f79b99e768dfc77995ee1139177c5bc26abae219216d0540a3c5dae9aca8aabe322d737a0509f94d269779

C:\Windows\SysWOW64\msres\AuditorViewWaitList.exe

MD5 4f2b063e7369c836403ea27e305d2c54
SHA1 55cb63ad57507089eb9b1579fb631eb3f5e7450d
SHA256 b0525fb84cde0405461a9be559b1875e0a65018b232f6e206b6a8b5caa76825b
SHA512 9ca368d3a244a115cc245406a37ecd44e98219c1ac4c117b9115c1743c446554006c32363bbe73357ea8613f9708e38fbdf24e566dfbf6ac994686965055ef94

C:\Windows\SysWOW64\msres\AssistantThC.dll

MD5 88210439224cc84faf46a2f79bb2fd36
SHA1 551da3a9efc85868a8d7787921fbea4b6110a1aa
SHA256 1ea78d0a4b16162aaca59e25e516831ae8208da17b6a50f566074544292571bc
SHA512 859c15566f1d4de79d09e22c3fb20ef62d19d39612feb919f5bafa63f216d00e770d4d4873b41a8450fd0164e754d441b47831bea446d30630f3aa7e731d9bd3

C:\Windows\SysWOW64\msres\AnsiDLL.dll

MD5 2f8e26e74a8abb465a3828ca9855e5b4
SHA1 bf6c767e9e12380c1e2631079a46586c5fee1c40
SHA256 eee55a11f553fbf058d07301bf0a68a000d93288d755b997fa96a454e2f10582
SHA512 aba9abae18c219ce33593b2916763b9b666fadb148a62bfedc0201444fc0e41a4bc206841bb13c7d7b5f232f003e525022278f6ef137325f22fb280ff71da94b

C:\Windows\SysWOW64\msres\AdoBase.dll

MD5 14f1f01a40c663f59caf95e0d44ffe81
SHA1 cb265aa854781ad5f8be604670480f73a4dfe385
SHA256 2a84586c30d1b8101ddd816492407e97c60183301e5b73fce89272fca6dd18e1
SHA512 13d84f8d6417d95d289b9e86533fe2b86882d1913a448978dc8f6874fbfb7c0617c5efbce384ebf50235618a702d77f46ceeb06edd32a5927bba0a808aa6d5b9

C:\Windows\SysWOW64\msres\8021xClient.dll

MD5 a40681338269bcd7eddac97c5549f0e6
SHA1 e48585f27b0a50b056d468cd33754816437b842f
SHA256 9c373efedebc010de1aee393471ad7ef5246db3310fba53147e535833e5a709c
SHA512 60befc5b11b3b6ea96a71cfc8ad9ed7cb06b762549561b1fdb67e39458b324dd0e8157598ee9ed2a8f1aeb04c40e09df5cd68aceaa3bd497e87e293030f267dd

C:\Windows\SysWOW64\msres\7z.dll

MD5 3f78c51a0a5cb5e0536ff63ef3d75e11
SHA1 557e55064b161841da857fc6bc6f408963f82e07
SHA256 4200b6b656c3c7b6447a42632451e2402245815eccd6f9a3baff60585fbb0b0f
SHA512 f4b485a27341e8c163c704bea4624cc3a9c4c8215790f83b290ce59526e0515a3f4a96bb17623a404f42a7b47a05ad6f912d61d6cd7bf6ad370a2004ae7c48fd

C:\Windows\SysWOW64\msres\64.bat

MD5 9691797adcdf7babcd6c31867c96258d
SHA1 7714f250a773647c0c3633103b0f94e202a4573b
SHA256 81b824464c9ef5a338d78dbad2e65101fe6a8dc48de096bd89b0bc14fd5fa475
SHA512 9da92ec73bc350d006b7c6cfbb793a23bd06d8ed6a83367559091c20da3ae7d7e5f6dca02382fd2063f663e8ad96b0d41bc130d1b91d46886d236d05c819c5bf

C:\Windows\SysWOW64\msres\32.bat

MD5 0ce2a43f5762b693678b09c072ea0f7a
SHA1 bdcd35586fc5c51975d65d858c139c45887b22ac
SHA256 e2fe1a6be8388716c83a8f112bfc37d768c638793fa6044f1f74239f2ebc9809
SHA512 5afe3c773585ea01dca106f4f3c7e8b012a4f6ff1a0f7addc6c5a6db83a3af4d0e3d70f67d16f1ae3a5c087dd79b2c14b61d786c826680332ca68317bab6f125

C:\Windows\SysWOW64\msres\avdevice-57.dll

MD5 735b64f69b9c3abde04cfc87164772ef
SHA1 e15846912b4fe059aa6f45342d196e674cb8300e
SHA256 0e7eb7f0bcbc3a067613d88a9c9d44466de7d6dbcbdf0139eab5a46e6df99a72
SHA512 6c38ee22b3f8260c65cc07fe28d2d358d2952a0a1c10a97877906944fe1df080b211563f137f507d6619f621ca4237b235c64989d163ca40bba0ffc400254032

C:\Windows\SysWOW64\msres\CleanPermissions.bat

MD5 cb5e28e0aaacac4ab0a23afd8c57ae78
SHA1 ee227589c6faba9017341fc35f82c21ad3927ba5
SHA256 1fea25eb2950b3726c6dfc21b25a44a78ea2e3d47565b11ffb877659ab3436e7
SHA512 778193a29f056847195625d8fa5ca56adaf41efc4feb00c6c02c133a1991d28121a02ec2ee44f19ca2c9dff69104e1d3bb6b10023d8ee8080673a2414a683bf2

C:\Windows\SysWOW64\msres\fxz.bat

MD5 afa1de87daaa01e7106093bad89df0c4
SHA1 f6d7fe53082ba63f61e552e4238279cf88876be8
SHA256 39e9eb45aee17681d0ac3ef5d9599f028a3ebd4c41f82bee4c6f0438813c5400
SHA512 d93be67b2b8beb4160014776d7edd1e3794e086d14cbeb9b27b9f387a48c7057e8daf5eb2031bc8da85a85d74752f93c5f7123251b3d663e8a7a35e37726fa91

C:\Windows\SysWOW64\msres\GlobalUserCtrl32.dll

MD5 fc178a9f3d4ee7405d1c60310959b1fe
SHA1 ce58c5d2fe5415be1d2580b0fe718716ca3264b2
SHA256 489c3f7081f6e33516f15070b07e24d0891d3604de146aae57f78e062f6f9d52
SHA512 139426ce5746ac00a304af7ec15f206388dfb4d977e0d776e18cadc57203c3dd1680bf6e3a040e1fb219b25237c6128adb86e606f7e6c55ae5117373a47635b6

C:\Windows\SysWOW64\msres\GFunLib64.dll

MD5 6409466cdaac9468d09bbcdf03a4bfa6
SHA1 8702c08905ee543377507d5eaf4b16db7d4ad84c
SHA256 c1e723f58169fd4e5499d0d750bd2b153eb8bdc0c1b451b39f290cc33c314edf
SHA512 c8d8bd18b20aeff83be4f976810982d1e7582704d237f84e04aa6dad07893d8dc9a17710436fa2837fda60c1e99344486dc8b751c66a5719d301bf807f97f18a

C:\Windows\SysWOW64\msres\GFunLib32.dll

MD5 7587f2cd023e467109904aa777ca81ff
SHA1 d7c556f59d2f68c17dc78f8105bb17770bd4ad7d
SHA256 ac3434dddd73e45ca49c1df6126ae933a7dfb1e7551ce9c252259e5086ac5c66
SHA512 8611353335043b7afba3a817aaa848662edf71593d88003448af78786de9d482dbbf7b091c336291f9c530b8578debc8ff413440948b06a6b29b5c4949dcaaa6

C:\Windows\SysWOW64\msres\GenEwm.exe

MD5 b7147748dd23b30455225d1f524c8379
SHA1 00d7e08788e2881540964cfb5583af3729623037
SHA256 e1239180e1c8ba9210ae0a5d5a8f6ffd531cdbc7bde93723de69d657517e5d06
SHA512 8ebbb47e62981b8ff131583129e7ae3d422a33b98108383294c2bf41987a6c606ef4e4c8e5248d4fbdee8341917c60428493efe144af43f22088b49ea9e799e9

C:\Windows\SysWOW64\msres\FSHost64.exe

MD5 25f13ffbcf41c0d71b884944723fb804
SHA1 c80bb883966bf71c4906dfc9cf3989fedf7520ce
SHA256 f66a17bd793919f5427a1888860b102446f85ff18530bface26cf49420f6b89a
SHA512 1c2ee196605c04b953cac96b61cd2901a8e07ab833eeb0bc13e34fe9f8a39405077790f4622505aea09d77311ebdb34aecf7faf9919c750c7be93f39a2bf3c34

C:\Windows\SysWOW64\msres\FSHost32.exe

MD5 541d41703971ed57fe2b29d8f41dd09c
SHA1 c28e9408a45b9f3b3639568f4a05a6a2b986a10a
SHA256 529b0c0daa3b32e02e92d2d76763508544e8e7eb2f0124872e3d0adec4528102
SHA512 94433f45c2e05e080a2258959515d9e000abe6a0e95d103db91b0bfd010930e9a8389b507ae0f6334fb6b65e87b27130a3d16b23da7bae85d9dd97f5952e1ce7

C:\Windows\SysWOW64\msres\FSConfig.ytf

MD5 d5a3a02d1fd8a43c8905064fa9c1cc2d
SHA1 cf2dce40595bcb48c8a2b299f6f3aba83d3bdc5f
SHA256 2d48b2e56236f3f915e3c9cc4516afd8be10b3512ac51f025aed496c6abc3378
SHA512 b5ecc39150647051c2eab431d01a32a7eba0b81684f11e35eda8be82978f190e2b36cb000389d39599ad555496c56b5892b4e386a0feb764527ccd92226f5d9d

C:\Windows\SysWOW64\msres\FileTransport.dll

MD5 d51ce31187371a8340b4d33c0571ed5c
SHA1 95a5a737dbab124285f98cffb3e69d0b041439c8
SHA256 2b6ce275665dbce73c6a7b83233c3c04a69fa89b116560d10ba9fdc618274ac0
SHA512 0b175454e287e353021b3891c7a02db04466e9d3f15cb06af9db179ca3b91d5d25aed1c5bced67e643108408b363f139cc70a60bea6e6b48fe325daf15c5b530

C:\Windows\SysWOW64\msres\FileEncrypt.dll

MD5 fee3a36b746c86725bb707617f363a43
SHA1 c84b3456515b207e556155063727c1613d35e891
SHA256 b1dff7a1202f0d0a45e93280551689666ec1546b5fa469011c8de9721e1c64bc
SHA512 3499c1cdfe2d71d60e422d6d308190a6b2c381235ce2171469c69e9ec75913a4cfd26b90a855f9ecbc2c10374d76302ee78bc07f83352403998e6f01046cf22b

C:\Windows\SysWOW64\msres\exit.bat

MD5 67ba5ec790f53e1f481b68492bfd8688
SHA1 eda057cd4d0b5f111b02db4a2deb114918ff894c
SHA256 37575840eceab458fcec26803083b60405054b26924c84668e3a8002619c17ab
SHA512 c2594f14a1f49063913ca437d8c9f984fa5129ee6ef54f74e1278a50ef54a6daf3ae813272efa3dd35937e52e1207785584a47824e5d9a5cf94b49fc4dea9988

C:\Windows\SysWOW64\msres\ImageLib.dll

MD5 a58bdf7ff96b2087aad3b23608094d6f
SHA1 a1f4be21079fc148a3dff4f8f90d5adc60819dd0
SHA256 2ec996d57779ba2a41c5b78a1dbc06791b8d6ca03fc269206d0a03a6e3842728
SHA512 4e77c62cfde3e616e00d9ca230a90d3bf0a38638f4c3e59e15b429f5d95a179591e8d4d9239178c16c73718b7cad8118b80d89537c40d12bd0691c9f19334399

C:\Windows\SysWOW64\msres\netft.sys

MD5 8d8ccbddf5a86bdc3c64c1b857f3bbcb
SHA1 7638efd77e9a158b37f96551f9870f0fac5ea249
SHA256 cb14876a406f59ef94ff5531f8f4a1bfe42b503fe219007c82a2718a2ede2cb5
SHA512 4b79efafb9c1d2eb90fb0c66ffb218fc3a25d09a27ca51d024e5bf81f180067db0698570fa43f1691b3200eeb2e203a98106ece7c3fe0d67b4796427baccdb6a

C:\Windows\SysWOW64\msres\NewUIShortCut.exe

MD5 54be12393fca842a33f070175722d59a
SHA1 6c90afd8ceab16577fd5d34284177b1ee5a687f7
SHA256 fa9403fa3e02b39575a9e65b2a8ea5aa3c57acc6cc7153edc663b11334d1a20a
SHA512 d97582146485e42ee81053c80da4cf7d48d45141317e946c73823a63070a2d4481ffc429838334aae9e04bb21f249e836c69e4d73d9ba733ac8640d434614803

C:\Windows\SysWOW64\msres\postproc-54.dll

MD5 409be8b3004e6b3fc9c02c0194579ba0
SHA1 e8c0a324e8ffbce5bc87fffb0650f422260567bc
SHA256 72351bdf4cbbad4f9dbb49db4d05944a78e4c326e812d70f6f5b2380e5253121
SHA512 a8dfee8ed5cc079b4bf4786195b73c0cb67509c8e1985e6eb6c06bf8a5ccb0b2f92865d54be033c5f5d16774b12a6e8404c603fa59990cd1fd6af06f3e3a9227

C:\Windows\SysWOW64\msres\WifiPolicyDLL.dll

MD5 7719e2232f60a6d94e3c1d0e87037d75
SHA1 a1e741402d50cfd583384cfbef6e78d00ba2d478
SHA256 f3084ad72375c6b91691178805ff89c638f4266dfbd31ea9d2b82bac0d1a3710
SHA512 2ee704f81b61dca8c4b4fe589692018915f15d3c545326ceb8f87891d78f13c2eb39c8a1980a1136f51f793ab8afad929b6813bcaa9536419b880ed448737f5d

C:\Windows\SysWOW64\msres\skin\bk\patch_repairall_bk.png

MD5 a6decb9550f182260fe29fcc23523c07
SHA1 3946e9c9595ffb4a3259789b37155bb96dc82922
SHA256 ad59eb3ff430734f42c5f4e9892ca854cc01d2533d3c6d70f577ba38ce2b307e
SHA512 3c4c7d433d45339102b537fdfe85845b0af0ea557f5365adcb90a4c00273cf81e75856af8b702c8949e2a42406e8524bc69719e9d9f43d134232df528cdbcc6c

C:\Windows\SysWOW64\msres\skin\riant\new-MenuItemBack.bmp

MD5 28b5202254492842557cb03fe29d5cc1
SHA1 ff097a791f152584647cca99f49d8e007d85b358
SHA256 bcae9bbb4ccebb7a9147e8aaae43886a769e025d1c769b98dfe9da78a27b20d9
SHA512 db3d001f40b2ffe84461ceba3b81dd28857719492060d98283f045664c14eab7141b56311119f423452c5bbdc776105417ae2dd636cb965eace1c5718f365d46

C:\Windows\SysWOW64\msres\yundisk\skin\images\yh2.png

MD5 a084ff95bc7d3528c4b5d9a26f9cbb64
SHA1 0b335b75e5767a8c97cb33795c8bd6539a0a547f
SHA256 638e0fb95095758bb3b147e8d0444634be6a69e1beb78a42f3e49aad4e5c3738
SHA512 07b0ecbe24a3a18de0de31153aa81ddcffd15b165b9ba2fac120b1f9541d8b0925ad33b706250441a50954e7e55a9b8cd5a2d1343c83d307f1e29cf4a3250e90

memory/9176-3549-0x00000000024A0000-0x00000000024E4000-memory.dmp

C:\Windows\SysWOW64\msres\chi_sim.traineddata

MD5 4eb930bcc52867e79c953fc0fe52bbde
SHA1 3960dad0d17ece03bc8de3aa6a0cb86ca9a57984
SHA256 a5fcb6f0db1e1d6d8522f39db4e848f05984669172e584e8d76b6b3141e1f730
SHA512 384895a4c6f6c523437e2f934f9f12c96fb42aa63958ff6473d04c79f6ce919c46412f6c0143c0e061c0198e9c4d9898b6734f7f18cfc30d427b644f0a089397

C:\Windows\SysWOW64\msres\change.dll

MD5 f4c1572e081e8855eb1b332008f61f5b
SHA1 9c4e09f67c5985940b90b41e9c0970e6fa11e73a
SHA256 c3d4be166c848b7e4eecd973579ab85311f707548fd2cc1ca0de6f894ed937c4
SHA512 ed6007e9ebcd3674281335dcf24fdc0833b7c1f2159f2f0c7663cc61075c475fe7e2728432030bc152855a768313521ed7d5de202c6d9392afc65bf9d5dfe926

C:\Windows\SysWOW64\msres\BeginLog.bat

MD5 cb1fadc5ee3bd2aebbb3d18458ef3dd3
SHA1 12b5fd4f26db42df49ec11c2dff87b3aa0179002
SHA256 ab36cb3e4190c25a9070152eca55a7d4deca4f8c893b6753b1bb45c7a48145b8
SHA512 b5560efb652bb1ef60930b0bb3c093f7bd55c99651edaf64c660c6e5a5bfc442cafa3a7a2003ea7b5e618072e1321b19b4cd0f3d6afdca677f4c500229436c27

C:\Windows\SysWOW64\msres\avutil-55.dll

MD5 798698d99a114118e5d026624a3e6d55
SHA1 29371ee61fc748ace9fd71c43a4bc6584bc116ed
SHA256 87f4f3c05f1b7bae4308cdf25fbf77fb16e91ed5f476103edc55bd12a4613e4b
SHA512 233a44a4f9592171b84982960858dcf5c34721cad6e4d29782932a2511bf5c841117e1b2788b00953c430717ed96e728ed4bcca5170d74dc30846668dd1549a4

C:\Windows\SysWOW64\msres\avformat-57.dll

MD5 d68f601b1f900b4062032d41597aebf5
SHA1 92e14512888dcd9a8eebb6e11e0db6bb90d26406
SHA256 60d37ccace3ae32bffa1bbec6220c5c91b8c41d0cfb851d024016294e70c1688
SHA512 cffbf50e80462ded21521f718367e8abef0f0f927b56b5bc999387d1ef532881388ef130cb685cdad22dc014f10fa50101164063785fe9c75d604be2a3604450

memory/8172-4172-0x0000000002350000-0x00000000023B6000-memory.dmp

memory/8172-4170-0x0000000002300000-0x0000000002344000-memory.dmp

C:\Windows\SysWOW64\msres\avfilter-6.dll

MD5 9f1842cb605ce27f9c0818fcfb23e50c
SHA1 ada4f136539904054207e8a0a8afbc8eb9a60efb
SHA256 55ce7664f5c572c57cdf9176131610d0ad173f662d8c4d048a02207cd21aeb1e
SHA512 726c09a482b879f042a9c1a88beb3d27511912c145a66becc98d4a2036f4024fb63e98c78b8bbc2312cbb7116fa43b4e2ab81c002df7052cb1b53a298f935b03

C:\Windows\SysWOW64\msres\avcodec-57.dll

MD5 170192d9ddc056cf942c7ecabca8f48b
SHA1 89199875f555531aa2dbf9a0ebaaeed7a9612540
SHA256 fcc27aa0aad45d8b144a0271c744941b7476d96149265d6ac4695ce89f36897b
SHA512 58af3aeb11af1571cf1f43a5f3a67b09247a93f8aa007dbabcf7c55091a71a0874a90fc4195a993ba765d0ef5d70c07a94c26b699b1017fc2673418ba077de82

C:\Windows\SysWOW64\msres\local.ini

MD5 ec0a874dc089d20eeaeeb9f4a3e5aa57
SHA1 095ad7dd49fa33e0baf51db6a51306409d3eb3de
SHA256 070e3e4915293bf7958a263ea59bf239e6a3b43063c38eac966d723d5728099f
SHA512 994817091e324476471f478f4fe657f5043b3509bcd2997603835485dbe368c268098da2dd099fe2d564135eefea318949d4982079250b9fc3540e63cea73561

memory/5168-3583-0x0000000002220000-0x0000000002286000-memory.dmp

C:\Windows\SysWOW64\msres\GUI.dll

MD5 6c76345204c3f954e9825d7a63abdae8
SHA1 1f8374c59b74b202220546c15cc32389596e5ac6
SHA256 412b29b657c4d1a41d3be6678a506cbd2392044150d2ed207410d57b0bfcfb34
SHA512 24f150c29bda60885375d64be9c16649ea4ee15f9ae9290a6558157b45d72bb156d045ffa6d2d60bde3196293f2f830ece5fc2e969991d7f4b4074eeee3d9e1f

memory/5168-3580-0x00000000021D0000-0x0000000002214000-memory.dmp

C:\Windows\SysWOW64\msres\CJ60Lib.dll

MD5 5e9d3bb28e9412d1eec451f96dd0e947
SHA1 824eea5c3493bf042b56948addc5c02aa647941e
SHA256 c1a060f44e8cc5d4dadc67dd22799ac6c3a8c7bd7d01273e6da6d250e2e6ce80
SHA512 c7df4315ab7e290bce5ef0af4d147073fff267a792d4c670b990957dee8b2573e1033795e865d34fd9cf4f3d763bff7477bf1f0cc2f23e5cec6c021f93160aba

C:\Windows\SysWOW64\msres\VerCtrl.dll

MD5 967c9a4c906847669fb4c4a257217218
SHA1 17bbf3eac168feb9fcd8d15e7070009616a2cbc0
SHA256 1ad6995037571b3532765b366d757c2493617da2899d69886576df7aa13a3fba
SHA512 899ef3a80d06d28ba8ee3875361032ce2dd537d043e3a6e4b3514bc3cbf7f41b5802f90a0475156f880f76e4ff999c0a9ad9455eb3e36729ff23c161b871458a

C:\Windows\SysWOW64\msres\LanMap.dll

MD5 78b649accb64fc9874f56e322d4eb206
SHA1 4781b2a89ec1edcd69f12df1a4d93dde2e374dfb
SHA256 ea65c4abdedce21905668dc8198cc7612a4132482a17e0dcba9a533db426d711
SHA512 782821f0d0ecb0549d2f9ad318280a850c5338ca5d7f4b0fd2ea91b290c32d741bf15d0e927b1addac018b589cbeb85d01b1428c41a3b33f0664d1cd1128b884

C:\Windows\SysWOW64\msres\Setup.exe

MD5 cf3dc562a1fbf2d3c94a152b368b621a
SHA1 8df486165156800970a031aee21270e2a7b4fdc0
SHA256 7f830176240aacd9ee1baf568f9f26c65dc2de36142c125922c73be8587abbef
SHA512 ceb21a8f837c21ebc0047c29da650583de8127ce9893348ae85ad2aa5bf01fe962db6e68253491a3a3565a96b9b00906d33b728653b8631e21af8c6539e585d2

C:\Windows\SysWOW64\msres\Skin\Riant\min_focu.bmp

MD5 7d097be5f7336ecc11f3e0f9e75b8234
SHA1 55b1e552075b01a2f0d84374bf5f16df1cfd98a3
SHA256 c3226ccb0f3d57e255c66cda6671d1cf6eeb18f914b618805c393abcc473aa1c
SHA512 6fccb4276cb690f1b3b094af3982fd9cdf59a714ee8560b3f4c989fbc68e8cf072185e0e0334646b8477936107916d7fad903ca6d7053d15b64f86062efd5d90

C:\Windows\SysWOW64\msres\Skin\Riant\max_focu.bmp

MD5 afa141fbf2596286e5cf6eac39289efa
SHA1 6c75c923e2347195b319aea777b4ebcd1e582f49
SHA256 1de98291d3979137b8d6900130bea3ef297ec7df14848a2889f8f492093eadd2
SHA512 fd2610721d2dffa067aa744668a55bee86c6f6a064b740f6ee2bada9746e52e9b262c9b74c9f04c9a81900ce978fdf7948187b5f68028e1bea83a4d88091203c

C:\Windows\SysWOW64\msres\Skin\Riant\res_down.bmp

MD5 bc3d3403aeca01b2a5a0e5870c3ba459
SHA1 99a321272c40fb2edbac1f5b758dac10a71c043a
SHA256 a8cddb95bd690733e242828620983242f4e999caf44365e936249631a969314d
SHA512 c27bddcfe1038e026f4a89b48b6d6cfd776413a37549da015a0de07c21c0aa44e836412a6184635e0c7d09dbf35de3831d092f281914cf0e509ad0245598d4b7

C:\Windows\SysWOW64\msres\Skin\Riant\res_focu.bmp

MD5 101ebb107d672a4a7018c407ef699f01
SHA1 998218a4b0db81e6c6157033777e25b86097e59b
SHA256 b6403fde007f43db12eebbc2ec0d0c531ff8c43f2ba0391f9f9a3214f0332951
SHA512 f7120928accd6b10ee7f37c43b3c3b41f3480bf7da7054ae93827f590c73a9176231eab2a7390373168f07edcfed2ca59765a703cb1337f9f4cf9aeb8b29754c

C:\Windows\SysWOW64\msres\Skin\Riant\res_norm.bmp

MD5 07e7d0a663159bd49cc6fde2ae34996a
SHA1 d34e2b0578c83c17d39e6f20128b1512880f4f9b
SHA256 a073b1d4d93b953d47e145731ce9cadef603a3aeda10774903ecdf3fdf69cba9
SHA512 f4b5676404d0a6d4f4069e91c379d59482217ddf2c84cbedb596cc6b42da6312e061497581f3e95151eaa7d5740d9b11c88bc68ae545e6a20b57970083680e75

C:\Windows\SysWOW64\msres\Skin\Riant\exit_down.bmp

MD5 c79063224b7fd3e3c26cd530667cc15b
SHA1 5ab954821ff66ceb515cb7d19ece6e3a346acbcb
SHA256 37a6a10af5e0e53d00b019bd4a1dda76e77c2e72651a5cbac5be8fc95cb127b9
SHA512 b689952ca514692c6bcac40b20934488e8443448adbcfe96419a70ad999ee3880ca7473e9af9c27efd4a3d16fd225ee0c7133929bc692337abffa300af705f52

C:\Windows\SysWOW64\msres\Skin\Riant\exit_foc.bmp

MD5 e71c8a3ccf5bbb8dc0d3c24062293dda
SHA1 43dcefe52ecbfb2da1beb084378c749e2e2dda9f
SHA256 66ebfcfd18d7db2c4566e177109d7e27fd898ee440af3870ef493c36a91a2e12
SHA512 c653294798fd2c23db37732a47206fb2e6554c7091bacba69c8afc0b2a2eff6b1f5b20f8cbfa67e3ae66c59057a0f79f99d11c365535f123e5fbe735db881b5c

memory/8448-4185-0x0000000002420000-0x0000000002447000-memory.dmp

C:\Windows\SysWOW64\msres\YTSysConfig.ytf

MD5 55040949981bec8f9ff2d25e05449a60
SHA1 c41ba7c9e69b160de72b109a020c6a5992626a67
SHA256 707a4c45605c3a445aad5aab436ab6a73cddea8b607a9382bc6cf26f417f39d3
SHA512 f895b5c6927ddfde563c2ca031fdb3dc06f686358fe0d4d8d97eca0dcc31ddd5b8eafe96d5a6c49f0bbe81fb18ebc42861abd6ec0183b1ab836fb81484a08c28

memory/8448-4207-0x0000000003910000-0x0000000003932000-memory.dmp

memory/3504-4214-0x0000000002370000-0x00000000023D6000-memory.dmp

memory/8776-4217-0x0000000000890000-0x00000000008BC000-memory.dmp

memory/8776-4218-0x00000000008C0000-0x00000000008D3000-memory.dmp

memory/3504-4212-0x0000000002320000-0x0000000002364000-memory.dmp

C:\Windows\SysWOW64\msres\Skin\Riant\exit_nor.bmp

MD5 79c07a8feb56048911953d9d5a9f293e
SHA1 e7eff580a900f01a4e5a8eb2bc31077e1a49173f
SHA256 12a4b8048ddeea62bcd34905c4e06530ff6db2a9a000f83de565daef534b2e1c
SHA512 2db826bc1e7b714ee8276dc00d5f4ac56e1a3aad51cfa65814546f2d6282b2628010651285930e4670418f6bc39ffe52e3d929e0cbe81ee1070570a2a17cc843

C:\Windows\SysWOW64\msres\Skin\Riant\ToolBarFocus.bmp

MD5 55a59abd1834226278cab73975430814
SHA1 4d5f6813d3716d0bbca030bf74539fef93947e05
SHA256 c64780197504541e53288b63b3652e68ece3b5ceaa50090d76c9753fd6760f2d
SHA512 f85c8abe2b05a1cfac8d47561074c74f139ccf9e10a0e0a341e1b49a4dd10cd0983cd172ca3d4caa3d0cd93c3da21999b53196406859cc031f2c5b8d64c03fa3

C:\Windows\SysWOW64\msres\Skin\Riant\ToolBarBack.bmp

MD5 88003094441e7603ffe3876e94bd7155
SHA1 9acc449957457d8af7fe9bfb6a88d404ff6636c8
SHA256 4c3b15effd9e490a8e42a496fd3fa2091ac3985f22204a963bdb6f6803743d7a
SHA512 6503ae277e6934b048181e859856dca00e9d4a2a5712791db8eff3cf7149616fc5c5044a343402bfb0fb466b7bc4aa9ad8f23f2826ee7bc2658d812f60700e8f

C:\Windows\SysWOW64\msres\Skin\Riant\MenuDown.bmp

MD5 309a4a97f450f01199cf6526192e27c6
SHA1 8e8b5139d01c99533a7eeaa65790693118e52c35
SHA256 f869a49dfccfed62542380536c5f934f3c0188cb6455e199c822dc788d145d0f
SHA512 b1d2ecfbfa5af8a350e98a9a2cfefad978ea19b5f57595e6dfd336cdd11e4fc2db5d2bfe4ddcf8e2772da0bd6a9a596373b7e153b534f311d20a4f61d4398bb5

C:\Windows\SysWOW64\msres\Skin\Riant\MenuFocus.bmp

MD5 1ffaf6c3c3346c8037ab59538b0ff455
SHA1 1c2ece08ea28762015bb27675c51ab8df2779fcb
SHA256 60a0913bcc4209361777cfabb2e32105feed8b1b84cfb827756e965dcde9aedc
SHA512 02c169c778349e4d47bed30849a282510f7474577a18ce4f3911f3599dfd331a0362af5cef023820dcf23125d8f8ced419fd75a235d0317178bd80257ad2746d

C:\Windows\SysWOW64\msres\Skin\Riant\ActiveCaption.bmp

MD5 daae82e17930c88010f54f831e7d8063
SHA1 7703429772fafb69d90c368b9a7e7b627426fc1a
SHA256 0392e12209e3ef3a35e60bd8b082f2fa7c69bbb567fc34ba0c5cf736f2ac888e
SHA512 1210c2d9117676c29d6e1eae6c9bceec585610b905fab99f7fbc83093189913c5d3d2becd42f5a0d3840e8fb3232619887caebe504904dfecc5458b2429b2ecc

C:\Windows\SysWOW64\msres\Skin\Riant\FormViewBk.bmp

MD5 712827a7ce2dafce1743e0f7a11ae37e
SHA1 91bcea5093f75aff8e5b69d9a2fd01a07a94d786
SHA256 4082393005e910a8cd3ef7e8b21b8fb706a46c91cbbc083d316a36958e19fd70
SHA512 18f584c32480b2c7cd1b9ea469278d79b65a0dafc452c314db978718bc8ee05caee07e23fd51a2c4d82ebbb4db161823e9111b76db4e95dc7a821eb09cad01ba

C:\Windows\SysWOW64\msres\Skin\Riant\ViewBk.bmp

MD5 ae85d00f5df8e9ea1374442dcb86be62
SHA1 ea8fe77ee26b6f4d3f188c77faaa6e6997e84198
SHA256 837bf8d4d5e6558fb60a8991de5604c9af21fc6820e5fc28d7b92f5e901d2781
SHA512 6eb0ae6feb007c663a3de5de92f9ed97fa0034d8d3d7b644295995581a49259d21fdc7c74ca601052fafc4de868e25100c867bce609399e32fefdc94e0edd4b4

C:\Windows\SysWOW64\msres\Skin\Riant\DialogBk.bmp

MD5 b549e485dd0cef3642d90b210113d2f6
SHA1 904f7eeb832b759ec75bcbb534d1c91a98095c96
SHA256 5ff24ffd65a73004d22acce48c19d644513b119180c27f8e8585da20babbbacd
SHA512 2f07d692eba97d31ede06ac0189d33ebd060e48143e6541c59d763ebaa62bd6be7a335b5e41b998aa021eb422a5d7f70130c54fcfacafd8ecc81adbccd3fbf8f

C:\Windows\SysWOW64\msres\Skin\Riant\skin.ini

MD5 46a320e23b0c0e12f72f9c3aa5bd22ec
SHA1 f1f6c2000a3a69525417ff80365401f1e2543c30
SHA256 a12f7b0a03a5c279044281a7805e685671887f9bd01e1238c99dd57abf3ea957
SHA512 cd3a064bc078da673044e185082a828cabe7c53f44a35b209fdac8f0deaf9e82bf0a5e52a8f0361f36480ffd60827a23ca79f85e887a169e92e1c6bbceb95acc

C:\Windows\SysWOW64\msres\skin.ini

MD5 fa08251013a91537e802a0e7fa15f531
SHA1 b6cec5ddddb41ead9d7922834c7dfcc64e0e9c2c
SHA256 2ae8efce6b27f462622bfd4681dc24205ee93ef44c08cc4265a280baca41a948
SHA512 6e80e83213634322322984dda7bfa000ac55fbf820dcfc615f48e6a1bb7450e769bf6e8f0324e2afbecbcbf5534fbe62512bfcc89b8edc6d987d046d82f22dab

memory/9176-3546-0x0000000002430000-0x0000000002496000-memory.dmp

memory/8940-4241-0x00000000022F0000-0x0000000002334000-memory.dmp

memory/8940-4243-0x0000000002340000-0x00000000023A6000-memory.dmp

C:\Windows\SysWOW64\msres\setup.bat

MD5 ca4a6dd96e8e0913d52d03b85b00d458
SHA1 dfead962798530a74442eab9a51d5f2e76282046
SHA256 69320f35c81cfb61c0f0b02cca7047ae77a2f2804f21705735b5bc85bf8be188
SHA512 f07698d32596324e97ab5e74c79f6fe790eab697a3db2535039d30524dd660c6aaf76caf3e2a4e83d8035b42726be869fa4982245f90e1f2423eef6996f72df8

C:\Windows\SysWOW64\msres\yundisk\skin\images\yh1.png

MD5 f6136fa01c0f17dc297f377ac6c9c3fe
SHA1 50dee26b90e6a2f34fea6c3af18c99f2bcde97c4
SHA256 b8ab9b753e9096669bdec5b9f7b9aafa3bce219413987f678fd9687017f6bdd5
SHA512 3792f39cc712befa3b42d9698204a17d213a0b468729031b19db8ced158c6e03eb04b05f6a48ddc2ee5aa8bfd8b3b906f9b122ec824895cf1e6e4b3f89c9dce0

C:\Windows\SysWOW64\msres\yundisk\skin\images\modpwd.png

MD5 b33470b08fb9a37db4cb439a75420095
SHA1 999e56dd777f2f5a5efd6559921cf100e790c136
SHA256 7afe25581521b8bf6f02aa36cfe504b8f3f6ae43fcbddfc178659d73e84efee8
SHA512 229225665c8a8a3a6d03ac961982d4c09911a70a1506e2eebad4f0d3efe4e5250d6f13e359c55b8e91b35e33502da116c9e46f158668465104c16f9105e0509f

C:\Windows\SysWOW64\msres\yundisk\skin\images\mainBack.png

MD5 a809110903cfbed72168f8c131d9ce57
SHA1 dbb872793bd262188fd32a669a7bbaebd331ade0
SHA256 e2bb274f566570bb96fd286d29930722b91521b5f6eae659731e471ebe6b06b5
SHA512 9c5be95354d91abb9917560c7bf5fda14357379eef6a53691db1572d372dffb339ae5881d8b063bf5f9d6b309c0a270caea4924f863c7d4137704d9a43f2f457

C:\Windows\SysWOW64\msres\yundisk\skin\images\logout.png

MD5 608710b97e382e30634c61f1ee0bb983
SHA1 a87c4a1af92cc9dabcec054f4a3f7047d9cbfb2c
SHA256 cf70ad1daa7279f7da7619fbd1e75a605d5395de9b225aedc840dbe6d6268e90
SHA512 f0a9bb2867ad20b1e918e32009fa38d5ace8c4f55970984cdb119e70dbc7402047e171c851a15e999516eee2a631f7ca0a637647bc38263b5b530d6c004d4bed

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-menu_11.png

MD5 c11375c454f178fa2bf908b1959316bf
SHA1 b80442738428024f86027ec950ca0bc92f1d1042
SHA256 37e0d8839a0e011eae5387185ad8cbbc04b30f5e1f58b0ec0ff74f8fa0c2cf6c
SHA512 3a920dffc8cc97a3661f21ff1d4da93219aa033834eb1a1ce34671bddd1918b8f6f5291ed8f85929752558c73d0b539ed7af9ad4996c31fc6f96f1c7d018c4dc

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-menu_11-02.png

MD5 8a41f8b3ef3b41a3806263769b62cd34
SHA1 850705192c903ce44e0b41e8b599bf4830c7ab6f
SHA256 714c39cca87965f9db8abdd0412af0a7a2d8bb1067c8a5d416c6f5fa9f057b89
SHA512 7377bc320869996f6f7e7be15f967e09eb3becc4b216422c1e0bb78592fd37273788e274b6d55e8d78ba9a2345faf5fee86b125504e13fb718d8d4f6743234d9

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-icon_58.png

MD5 5388212b9efe20e2a23458850eb1190f
SHA1 0ea7b0a67446533430cd4535b32965e3711727e4
SHA256 9a5408f63711e65634e0a8148a698561b4beea31ddf0bd6d07c074bc345ff603
SHA512 2645e2c5f0fa3c39b6ec97de5fdaf42b1709ccc43f0c332b838bafb3fa2b61f33d69aa959dd2aac3d51363cfd2734b0db796441b8c6e34a6d58ae47fc9edecc2

C:\Windows\SysWOW64\msres\yundisk\skin\images\efs-icon_53.png

MD5 919a1ff115e9d6fba630cb04c747a5e6
SHA1 eff09b8d6de0be4d134e338c53d9eeaabbb47c9e
SHA256 6d7d0b60ec375d0d06053f319f1b5d7a6487d9a4be46ce1ed2bd0e720b744a57
SHA512 cde0589a9e592200c23f660f5439873fc9a4e30d283305d1d58193d5e261ed2b74f119ae2e53822bc2c93fba84a5603ad298e07310e4678a95ba72b4802290e8

C:\Windows\SysWOW64\msres\yundisk\skin\images\c3.png

MD5 a920fe7e4290878054b946a7905468a6
SHA1 8eec943205f58a2cbeb4b46a2a05b769193ae322
SHA256 dcc22524fce29fbd8549f2a1a58cc8fdcd8fea3bfba8d0cfb20f31664fb295ab
SHA512 828e55b6dd3d499b1b9eb26812e43b818e68e7c0473cbaa0ff4cfc54a082cdddbb8e0be8e43def2dee323806b2cff7670873fd103864edc51ab6d4b3a35689aa

C:\Windows\SysWOW64\msres\yundisk\skin\images\c3-07.png

MD5 7acb5ce2861e12e38c179e76333477a1
SHA1 0cceadd416626cd695c86285e768a2b258ad4849
SHA256 8b93d01d49666d1675922465bc4e5ceea22fb75ee5617e9d028afad24945e804
SHA512 ce7e2b300436f19a2ae475fd605c42d2563d095f7539a4298e558172d7ccb8bd005995215312dacd75c543348eb194f6de9cf6c0712153408e413db63be71644

C:\Windows\SysWOW64\msres\yundisk\skin\images\c3-04.png

MD5 71b0309fd965f4c350bb67c01f2e3744
SHA1 0d15ab1ceea1ef0cd58692d5bad890c8ac5be53e
SHA256 4c006f3e6ddbb66bc4f0189fbeb91bf31f140b6108d00b059b5357627a7d4d97
SHA512 6bde0327befd980d3aa9d33e9a5b59dfa56fe28261f2a70be3b5148bf599abc187be20406583c0efdedb79eae1f98f7d6cecbc0f42ddba2997e0e59e7216694d

C:\Windows\SysWOW64\msres\yundisk\skin\images\c2.png

MD5 d059203d853efc6360c58fd895178c0c
SHA1 439557cb0ecb6c2fd66a79190d9ab65b8af20786
SHA256 8ec8f7881043a5c23b79cb49af6e6a9fd5fbd81a371dcba2eb337f1e2e8105ef
SHA512 f1b08739917f6ee9f27556f5cb2efa7269e6409ff194eea86d4830333f6e05a786662c051ea6e2376d4d0469861ae06818e1f53c3416b958d6c65b1449ffe909

C:\Windows\SysWOW64\msres\yundisk\skin\images\c2-08.png

MD5 cba085d875b0ccf3611220ced1d3d74d
SHA1 0aea5b6aef91466577f4015819f303e2c71817b6
SHA256 01587185c260c24e0cd9e5b50a4973a6031b0a9a5a07cb0b89ed3d49a05a8d9a
SHA512 5741fa8c1cb3cc3e3d7ad8558f25cb6977776156c412ebf54d9d1d9051d4b337272063b4a56407bf2ec208cce39bfa3e0deaf6782295391b4a2034ac0fda1a60

C:\Windows\SysWOW64\msres\yundisk\skin\images\c2-05.png

MD5 0c8803b187ead9f2b7c45fe9093bebce
SHA1 82aba777aa18675a6e08d0d4b668d1435c421f8d
SHA256 527bcb0957d60ea738bde19448a0f1c37431488926220df9fe77921c8c1faa84
SHA512 9e8654896862d98758b08e75c51c3cb8983db44966bde6e4a2d0eb7d159306d9e3618cecfe40d29e4655a3e49b0914e7dc9c086d7c9b1de8b5ebe2854610db3c

C:\Windows\SysWOW64\msres\yundisk\skin\images\c1.png

MD5 a827595179a5604cfca4ac7dc5092850
SHA1 630df0259abad4ba37a9213762bd2a4de744a54f
SHA256 4bab0f2a81e639bbd1d8fb7138ee39032ad830eb757fb5d6cc9fc38f3e0d55b3
SHA512 c51385b82230c22b4c0070a495a9a8608f7f4e26772072107f89a19ee5f0893e264a5522f953a4c5be710a37af6b2f45f5880f2542649a428bf46a507d8c8201

C:\Windows\SysWOW64\msres\yundisk\skin\images\c1-09.png

MD5 6e4bb82925b6a5763ac32c6a8a517142
SHA1 e24ee14ad64f635688e487e2796def3360eda2a8
SHA256 5b27fed80ca7bd0675fa002e22ab1fb676876cd5aba67e7fe9e833bb94b780c9
SHA512 e8a5426f3c810d72e19195fd88d839e9d867a80a9a03bfd192d2b6d164fd9e05f2ed99da58c9e66cd0df263e553c0a89c94e8fc9afc7778ff899517774ac4c17

C:\Windows\SysWOW64\msres\yundisk\skin\images\c1-06.png

MD5 6b62639549df77036dce9101e4fddbf2
SHA1 01df5b237626e4590baf7e5dfa0bfa3c9469027b
SHA256 82c1645e1b55e1b5c2964d556c808523b12e58e86ae87d59ea30c158576d2bae
SHA512 a510890a90478ae2f189b47982fbcda622ba39eec0af59325750c67b605d38dce8cf146cc6053a2c1eaeeadec3ddab8da6ac9a046cd6f44fbc38a1519e1bcf7f

C:\Windows\SysWOW64\msres\yundisk\skin\images\btn.png

MD5 d69d49f1172ea8a26f65a21d5b5c8886
SHA1 2d035ef76f9a72f84e49a4efe79eb7330f4fc46a
SHA256 9ece0fb9a7cc5aab19462973bee7cd3911f6c1a0c4885b2032e85f4ecef715f7
SHA512 d5e7f5e3c0f91e24b7d8f225062e4b32ad8eba61668c60357008d6cf2f5922661a396dcfa8cf088ae38034995a8fd4e8f3cde6a29de311b920d259279f42e297

C:\Windows\SysWOW64\msres\yundisk\skin\images\btn-24.png

MD5 361532bef508941ab4426ec4dd7010c4
SHA1 10b90fcaf96ed5a1f4f2b11f05c6169fff243f18
SHA256 b6b7e4b798b3f7f5343fce34185cd25104260778c867808be94388f280f0cbbd
SHA512 588fd78bd5d26e3ac9b3483103a88b6a873a7667fd29155325cbf1b856b3013ad47a4dad03ccf49ba99ae5a947a1085f6722cd1c7ceec680c10a9e473066458e

C:\Windows\SysWOW64\msres\yundisk\skin\images\btn-19.png

MD5 4b4783428657f2037f993869bdc3ab66
SHA1 2f1cb20b92e2cfd5666a0a00869fd3ce3e449d71
SHA256 281b441ea3a31fee96410a7830522ffde8ea552688f080ecf23a39703b20d977
SHA512 c3a75691cfe9634d448a4731cda7af05878137a8d645229191012fbd618fe588ec3647f98a38b6ab1763fdd6c3d7c71c0f128d8fa06142d3b4d6e915a5209f7c

C:\Windows\SysWOW64\msres\yundisk\skin\images\Account.png

MD5 a15a623599d960264d2404b2d9d6ace1
SHA1 469f6376d1739df232d009150afbe05643e1cfe2
SHA256 17b3bf2e22e78df4ebca1e326e7dad0dff7d03511239a01b41f1ae81fc1aff0a
SHA512 148c9172e7c3241b1cbe0a69552dc07b3ef6012e1aae7c5d4645dbaabd2fa1e99b1b980e062030d05ec5a036fd2b55162abb5580e3f69304ebec06de053490f0

C:\Windows\SysWOW64\msres\yundisk\skin\images\accBkg2.png

MD5 721f4595b5812ce44ef3fa85b9837b8a
SHA1 7eea8a934921c3fbdb1b4471fa19152676b6ebc7
SHA256 658e046bef65469aa4e36582a3eea2f0bd0f65f014ab028ad6ee14eac975d44b
SHA512 675ba730ed95c6b8217dbbc6155397b379a5a20333530d00480c7ad18bcfe86787cbadc0f8a0071c857800383248d71aa32c21c57d86d15a75db5e780b585d31

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-word.png

MD5 38076e19c710742a9706e5125698d934
SHA1 ad6884a97d069b560399bf88e141c6b745b4a85c
SHA256 751cc3a4c50021f324c8c8272d897afa16b33efae56bdfd0948c630c14eee8fe
SHA512 65ff06caeed56c8061ed821c786ea64834c04d4a0469bea6d07f355a8b8a46a16a545d99574354a48ec247d1f12b57bbb91492ea7f6c3fab23f636d460054ee8

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-ppt.png

MD5 fc91447360ec71fcefd301af13c75e06
SHA1 e5025db1d6ea0280222c3ab31045404aaf58fb56
SHA256 070e52863eeada175cf250b4d7ea15e302006f0fd252618bb9dd4e920cdcaf78
SHA512 5da1f8e3c7adb24719acc7269078b85a2da5fcbbc06ced16d9af38010f548d8da80cd32e51966332493378ef75510968406b2f145eab32be1aa0747a37db1fad

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-pdf.png

MD5 bc4ac07b70b6fa26d0cbcd5df224d128
SHA1 a1b8654b3b034d320bfae9424b38d88332f36463
SHA256 0d2a1824ed13f3ed4154ed6ae02fe53eaaadade0a9c20c3efeaac09be1f3cae1
SHA512 715699a7ed18ad2d9330f3569c2dc9bd46a611af5cb4d7bcb9e2f792dd2479afeca9d008cc674a5e0ce96ead933ab5a4714a01d8bfc11a4f014b028ea7ea6e1e

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-folder.png

MD5 4d06cf3042032c2d577cb232cfccb83c
SHA1 3f5c9aa1af1bdcf5de3e24c6cd6014ae56a7d16c
SHA256 bdcf0c2ad71973558455c18f8913a4478c19dd863a47381544f43ac6ed2be68a
SHA512 1f69e7607347dc21d50d254fd71c84a243c65f91f0017725a88994d55c07054bd928c16a0b421d13b3bff7a57ef47a479fd7b0436203f2705b8f9289553c65be

C:\Windows\SysWOW64\msres\yundisk\skin\icon\icon-excel.png

MD5 41e98816204325516d7c3a2c4a41a377
SHA1 1109c8114bd3ffcc81f49f26e48c3c2634c3c7ae
SHA256 214dd341132d5d5419a56a158092a0a175b3e693187be38e847f8fb9ca9a3e65
SHA512 b04347f8141f0271cc078be5bfb33db463089edefbf25384f87c4342c7b71de7f973d8154583532006b0931867a34b376ce5c948e8930468f10ebe1258660fb9

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype43.png

MD5 9f682a904efc9280949c246b4c1905c9
SHA1 e4469a625887e591ec0916d656490b17cba77338
SHA256 bc27f02d4b2522a1c1d81fc855541198355825953bab30b41906b584993e9532
SHA512 bd441651b0809463c2c08f3ee4fb398083b72ae0a60015b1695631c9fbcc1ba6079da2f3210e32d84e3978eb0a0a43f9da8e0e654bdcf60cac680f82253db4fc

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype36.png

MD5 2ea0195db9801a7c5175dd32920a2a9c
SHA1 c6ab78993701821470db780298a3abc63b05d1d4
SHA256 afb7d15669147f14864d7cf0b35a58aa73a9a178d44dc5bcb7adbcf768dc3981
SHA512 b11fd3472cbfeda1296ddd08c347f152b85e8fce3440d70b41ca0c6fb859026cc14f0c8973982ea9640139efd56a45ec8944c53a83679d712333c239aa6b4653

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype3.png

MD5 390fecefe786908a2290be42513f1a0a
SHA1 e57fb63e8d2b2670d5acc9248eaca2c112ffb31d
SHA256 11f837facf92d1888f9786c12cef5e26c1e6692b4577bd1b80d8737240618323
SHA512 794347b587919b63c46f83155cf65c60cb9a2c203e55cb2efd87105514b37f6cad1c93c6577c59ca79fb5b59c54e01cf5c21c86754d1488d892778194421d381

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype20_1.png

MD5 57fb50bbe97605fbb856d687e8aca9c1
SHA1 41210149c7b7b27a111e7a47e100a5c71d1db0ed
SHA256 41982417a24de7fefad4cb7a075d05e7d611e7c4a400f688147cbf3114b1af25
SHA512 e2803de78143b3198202922b5b04171af18059354b49898f59bc7ba982fa49fa1a27723611d65633ca414e58116398b22dbf7512bd216237ffab51d7d26bbd6c

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype20.png

MD5 c4e24db9fa4de7a5b55a274831a8b0cb
SHA1 299578b28b77144e054e31ad44f777c6a97b3336
SHA256 b6a601f2062eaa3aff0bc4199594bc3298599eb194b8b3c7970d2959b9b42b5c
SHA512 e5b4ee572bd2b8bb858f984891126d2e0ebab858961799cae8fcf79da026a63e0429133f40ce74ab8811b0caeeddd5e51ffc0dac881d380d7e6689e1580f7ad5

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype17.png

MD5 6e25cf599166eca44d1dd3424c2579c7
SHA1 dc4a57d4aa4bf8b16644b188b121df9572766d55
SHA256 9296ca657dad54b534f33c31e2411a5880ef0dcd1f43d5042a4c5ba04781d886
SHA512 647a02227763fee6afef6aa52e787de8b98fae2df13a7a8b0d53998368b966db5ea0ee9dd5333b9fbea9b37523b59d362823dd03df4b785117201bb52c88e4ab

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype15.png

MD5 b4ab8bffbcf0b1fa0cda5439cb03c5ac
SHA1 50e069c357ef2268cd7f26592ea1ef7d1c69fe54
SHA256 58fefec974bc6fc5ab359e2cc771972d0851d199cb18742bb5a2a23ace489774
SHA512 0c2cefc1700d837f5bd31ce53151e229fa83b4b79774b68196131b695f54b509b36864373bc6ccce17861322e4b31f6dd4ba18ee2c06536ea9e2a3bbfaf8e2c9

C:\Windows\SysWOW64\msres\yundisk\skin\icon\documenttype1.png

MD5 391fc72fc14b6f70e67ee4cd08048649
SHA1 45428cbb4cf2b8ef44df4e64e1fa5b1710973f31
SHA256 2aa26139b57a7012adb2694e57fbeb1e999faea213be5ad7801843917fd4b39c
SHA512 aa44cca5824ec93ca62b17a979c750c59c8a9cddfe6f77187f86626cfc1e05524c5cff161c2c2299ade1c233923501ff4022b3a002aa4cc3b2504a1efd366d5f

C:\Windows\SysWOW64\msres\yundisk\skin\Thumbs.db

MD5 cb8e4405f998fc143e156483b746b0d2
SHA1 422ad7577656aa1770d32a4ab07feaa329caed42
SHA256 2062e15136763cdb6c24cec7a2346fe90a59f703612aeb5d3ce400fb4a686e22
SHA512 30c3095cb0a50a068a53de1ac64569441e67335bf2c7b25b9cf7e93bff332f43cf56e8997631c02f8a189eeac845016040a5ff8605d71df5650964ff373d4e1b

C:\Windows\SysWOW64\msres\yundisk\skin\recycle3.png

MD5 f572c6e90d4af616241c20042b7aa6ff
SHA1 8ab6138848f7bce60bada316490a989a8bbb0807
SHA256 26f91bebebf59e2c43c1fd415ccc3d11a63adcb420899a0a576b13d67379fe2d
SHA512 cef03ee72ed76c8adc8ec47545ea4c6bf8de413272b558d06bd401c0fd662842295463ca3d713866bee7aa22731fdbd2447a380ee3a963106ebb838cfd968445

C:\Windows\SysWOW64\msres\yundisk\skin\recycle2.png

MD5 5c74e6fe9478ab705e7d6e79cce0adb0
SHA1 595ce6ac3140767ea7e3ad8681e499afc3e4126a
SHA256 85c5b8096b2b3ad4006e730afba0922b0378e014877feadd607c9a18f3f2fd36
SHA512 12adefb79a2d3bc6a79cbdbb916ad631abb61c340f048ccd3e6de57f8e7075b0c14b5eac0f9ff7ccffab01995b79b0d76fa47fc8a998a20663e50450ceedd117

C:\Windows\SysWOW64\msres\yundisk\skin\recycle1.png

MD5 92a8e7d79c595c9f5fdf95152f08706d
SHA1 d70de623434ce9301e814cd44a15a37658c2a567
SHA256 40d5b8c1c5cd4ab0969631295a97addf897a1fa4e219dd31314eff1825f57858
SHA512 75af0be9f4045dbfdbbb9431aa63e9845eaa887d38c79b7df99fae16ab3dd8ef0bc6d2336e9cf7f178ae012b1a544c7497c8b0639bc0c9ccc34964e85c0bb357

C:\Windows\SysWOW64\msres\yundisk\skin\ourspace3.png

MD5 6a9d2f8f8ad2c3225174f920ac7ad85f
SHA1 fdd038bdc6212ddbcf88795fe9d4752a603790f2
SHA256 ed0bf95aa91b4a4de028d110c140eb5772b8af71dc17d57e9dfbc90102814276
SHA512 ae604d1a00197cb7018c799d59d00a1b99967d83563c0c22732e8d28ef261e2d8e5b0b549c0d2f8dfcefd5d33a34af4ce6f8332bfc7b76ad25346d65af7a2f78

C:\Windows\SysWOW64\msres\yundisk\skin\ourspace2.png

MD5 fc5c98411443cbbb7cd3af312f12147e
SHA1 c43271abd004b816778f60bf44ae06dfd26e8cdd
SHA256 d0105b6c3ce113f797b3c677a1e270edae7fcfb59342946036397de76a1ef26d
SHA512 8dea9a1a365ff286e060d063a6b776154146d44773f96921acc4e584fe4c39791c58737ec3aa505a34c074ffb35449688bfbc7e843aa70f97cf768b8b7719ada

C:\Windows\SysWOW64\msres\yundisk\skin\ourspace1.png

MD5 d0e53260e7afef9f02c20874c0d45984
SHA1 08a6d18a7734de62a3dbe460849600f42bdef67a
SHA256 46995dc6fd4055c57cd98064b904530317ab8d97e15e0b3fb126548d6ffe6f9c
SHA512 1c083bce35143e99de4e05589c3c0a0830b39865a9caad8e8f8e8a9a679c8369bc4675c9a9b7dd0b2685a718ee5abda5b014b332e8db2342978298a73e79cf3e

C:\Windows\SysWOW64\msres\yundisk\skin\myspace3.png

MD5 53379362ae99f9ecd091fb56a2fc2228
SHA1 1d8a0dcafa2e2d75979e85328749be0d8f5975a8
SHA256 2b6388ee8d7fb00718176730b43911bdb9f427122192b2abbebc8f8e131ae6f2
SHA512 a418095a54c853331b5dfbcc5fe541cc05cf55371e11d51b14fbfe6def48721a043df07931b706704c1e3bbc4b3b0ba8c5ccce5de2f203b6afde4b7d7a4b519a

C:\Windows\SysWOW64\msres\yundisk\skin\myspace2.png

MD5 86c5663d7a128672bb5a129bed7190d2
SHA1 cd08c7bca66f463b1f5b5561994fcf5114188035
SHA256 a416f3040e345dc8abb160a313757ca194b2b7ca0927f1172784bdf5361818fa
SHA512 c703fad692bb0264a6d48af45cf4e7f9d54f87a39aeef6967d95cbe5f2a7d96517817be77449b76251b6410002ee83c09265f64363f9a42aa944dbb92260f31b

C:\Windows\SysWOW64\msres\yundisk\skin\myspace1.png

MD5 56877e120f717c6ea311e59c4ed3480d
SHA1 3ea3819a19a90307bd8a05cb43ede12b4d819c00
SHA256 724cd6175fa1ddda7b7fa0abfd79610f00cbc816a24990fd9302e233e1993873
SHA512 4d8f09ff83fea8ea9632c2d8ba77fee8a85d421ecd280ced8e55a120fb571d775c905f61a54e2c63b77dd3da619f0df5a97e32ade47831359bdd097b7d9ab8be

C:\Windows\SysWOW64\msres\yundisk\skin\myreceive3.png

MD5 d83b67c008f1a0b2adf7371f7cbd9130
SHA1 f2dd9eda02ce1ed280fb4579c6af2a66d57f67b8
SHA256 ba62e9dbc1daf96a2b682d1e51cd2d3a90c34dccec787959d083d53a566bf7cb
SHA512 b9a546490a7d45e5bee4ad572d71677b3130cf75f3db18e8ec81b9ea696fa8aa8602801f492e38b7d372df811ee55ebd8341881a831b0b16c1c13dfb7df2ac6b

C:\Windows\SysWOW64\msres\yundisk\skin\myreceive2.png

MD5 64faf4a699e0323ebe03b1bc7504c19d
SHA1 3c24b2bbde105e4c9e2df7c4f214fcfe96fc0704
SHA256 0b1774374bb3dab92b68079b5f990ba5d9097fa1c951ab054c0046724f80da56
SHA512 ba9f76ee9a8c6b16e23835d173bfb26d969ae5bedde64d3be135e1d8dbdacf0c4c0412fbe9a9abf7f4e85604fd441cd2f0b343dc2534c0afb814571f6717461e

C:\Windows\SysWOW64\msres\yundisk\skin\myreceive1.png

MD5 aeb1ecce60f04c6a00872bdd6eba78ec
SHA1 abee2c40af932c7b7135d208f64989494922396b
SHA256 30aea50138eef92ffd580d9f5502f2a9c4b481136f412063a78ff841eb038807
SHA512 a4f72cacb23eefe39e26355911a6796dec05a8dbe4b6e3fbbcb0b799307d378d93fe90b0231fbe05db341647ccbca45fc08bdaf254b6554ea10f2fc3ec54ff67

C:\Windows\SysWOW64\msres\yundisk\skin\logo.png

MD5 2b1c1ceb972cbe8c70139d8ede4f1655
SHA1 eb7391a2f61bd09c64834d2a8f2e022c8a72809d
SHA256 afb5096823324c72d382f6c14e5887c1882f48cd3ad24eae6a0046d38b1a7097
SHA512 61b4990c45a9b2a25f3d8b5b21184151da25a6f150408a728b0d039dc7a5f8b12394779d000fc606281490c85ab5a4a9e21e4328870f53977a7bbc6f06a98558

C:\Windows\SysWOW64\msres\yundisk\skin\fanhui.png

MD5 7ce1887e646081faa303284810f2f5cb
SHA1 1d817366c34c376363124b88aaf1ae72b7db62c0
SHA256 bb5ed411b1054b0cbe5a941597bfdd5e0ef3c00046357e1d817ad0f0e4734ed2
SHA512 7437a4bd6651baf10ea0a829f5ce3f71db2d255689f14ab9c18799a0f14cba9d28fa73f4bf8311dac043845acba8a0e7539dee10c4234dd5aee9702a52c03e89

C:\Windows\SysWOW64\msres\yundisk\skin\collect3.png

MD5 eb29276cfe9b5d40be4c4c6a9a12e03a
SHA1 1a4cd7728b322d264e07d186b130f9e8d8ada544
SHA256 ead3cf146b13292d28de4316b7b0d7681861d53061ab93ddfdec72e1fff0151e
SHA512 a790b497851dfb63cf52de15c5d6031a7596c6018dada5a13115c33a9312c25a21dad280ce9b29235ec9d4965fa8a83691f24924e4e98dd1b812d809996227e5

C:\Windows\SysWOW64\msres\yundisk\skin\collect2.png

MD5 3375d83ad492f3c7299edef1d2c6cd93
SHA1 cbcffa9495389a0005a496819bfd6078aa08a6bc
SHA256 51f879f5062b678e244de1a1548e85304554297bb598c090863470cd863beac1
SHA512 8ea6b3acbbe5d9cdf12f807f590d738a875eb11a5713345c7cb2d438748459640a2e28164894f3146067167651379fc92530040136119a8187eec717dc2e0255

C:\Windows\SysWOW64\msres\yundisk\skin\collect1.png

MD5 8db8caeb6f280471df45d5dd9c90beb7
SHA1 3d3de60eaaa71e9ba76456c76ba8371d0503e2f7
SHA256 aa31e8cb1a63bc2d55d46875352688a297e1cc648082034002b50fbb51018823
SHA512 4b97e99ee90bcd9ad2325993a3542ad5a4fd37ce6f6019429e5edfe1ecfe7e02c7e5cd7959b32005a2a6e060afe76bf670ce09eaa27b4cde8ac503c3776eb3a9

C:\Windows\SysWOW64\msres\yundisk\skin\btnupload2.png

MD5 0d615c855011ab531748448660ea84c5
SHA1 ed81c5651652dfb8a1bf37123672a1a0a21f9699
SHA256 8630669f24c3bee94cb591a9e9ccc2fe799168aa18ac64c37bcf1951cac6d5ce
SHA512 9e0e33e55e034a3883b1352cf9d6df43f6a3c3107669905be54a0bbcf15ffce48d166b3d4be074a393067295dc28cc86fadcce2b6153059c6155adb540a1c77a

C:\Windows\SysWOW64\msres\yundisk\skin\btnupload1.png

MD5 395473cb0d88fecb8469e8896dc34d55
SHA1 a209551ebc30b12357eaaa8c2ff24547faf67fd2
SHA256 9909313cee40e9e31e7f9635c61c1df37f8bf7477a4c222592808ee6429533ec
SHA512 2fa42d51f414fcf650b8a4e0bc1aafa2e8525cfa20263839490804ef05b9ccc8f89d6955b19ee0497178c850b3a901ebed547da5df1222c5bf392ba5c1884bdd

C:\Windows\SysWOW64\msres\yundisk\skin\btnsearch2.png

MD5 81473fe5d3c832d1315f0fa3b77d0e1d
SHA1 774e71325520a910e16241749e870b07c071a907
SHA256 3c6125d35b77d74b33a14cb947283987afa03cf12a0b396e63479d8c92f8cae7
SHA512 810462a2359aa504b649266675cabe7bdd72a245854bbf4f8081097fedd0a179494ec904395b88a2a1ca49598156736595b3cb483d840f6aa28c21da3d2c8be4

C:\Windows\SysWOW64\msres\yundisk\skin\btnsearch1.png

MD5 3153f9ae0b43e82a491f9fbe4c8bf66a
SHA1 28841b33f4da242614fb116c3a081eb885914cd5
SHA256 c8962ca32730b8916c74eb8c4bced1a6310b77c6f5ef6309603b8c1836c00dad
SHA512 e42c74825170d9427718c2cf6138ebaa8067311ec032ed079c5c73ceba44c355a0a98b3fd17cfed72aecc3621746c553a0cca8940e243ca956e7073ee5e43f2e

C:\Windows\SysWOW64\msres\yundisk\skin\btnrecovery2.png

MD5 e89951e19dbe34e3e3c5c041ee2b0500
SHA1 6fe94a2c8b007fd6229d7670f4d295440ac6bd2c
SHA256 6c78f01a5ab00db1ccc74aeef9545a0a9eb842b9378d9dcb0b722645b39b8917
SHA512 ec4d487cc3bd885732d7b1c9b9a614216e812ccc0493bff2be92ff38e4b2a6f6afaef3811b00ef08a968627995e9a233ce9d0dc0a69c7419b89548de59774cf4

C:\Windows\SysWOW64\msres\yundisk\skin\btnrecovery1.png

MD5 0147525537e84b1f21c2c1973bdd3208
SHA1 94c489e5e5126b77674a9e08a2ae431d09b5564a
SHA256 1ce69cee7569fad14c4741bd893fc0e6e251873a619b246a07f92ae0a3d184f4
SHA512 68f3473962cbe2ef4826f2c7fa5ba6cc59a09a0aa5af1c65b04397fe48a79ee8de13d2181d43603a2c159b4c793b6febdfecc820bb30ae56df6f7134b505b668

C:\Windows\SysWOW64\msres\yundisk\skin\btnnext3.png

MD5 b2611935a891cdb75b8380bff58c4aa3
SHA1 9159995705dc21b69e614470f7410dc4c742532a
SHA256 1b3c572a3b20d5e36dd019cf1ef1bf3051cc83a2a5cfcf8c3e9d234933a0003c
SHA512 3eaadbd150ed0141f872a6f1f90d979f481174d329146fa219a74390ade29936f5744eb21bdf4313276e4a506c35770b1c8c69cb0be44ef87a9e17bdbc361d07

C:\Windows\SysWOW64\msres\yundisk\skin\btnnext2.png

MD5 49495b34e1896de6ed1c94cf8ed8e4af
SHA1 f66df8dd3e0d92aa7ffd5a7372fd3a79b8dd42d9
SHA256 0b3adb73db3da8bc39e38deb357a6e7c61314200a680d496f9189437728f9f23
SHA512 b336c8e314e43035792d43ff32451ec9a84b503389c0eea69295caf8c0bdca3c86f86ee982fd378484cbe532cc27bd2596a9148e805ec3d84c8a92dd02cc35c4

C:\Windows\SysWOW64\msres\yundisk\skin\btnnext1.png

MD5 41c29e1caff250506d563c7da9ce81bf
SHA1 b1fbcdd6b1c4c3143c27646d22967ff012e984d5
SHA256 0c3880bdc3f2e619c02e2544abb51c346c79202039cdef6be4aebea2723d5ad1
SHA512 86a9871f9cf7dd8b64436d534cbca2a81d0e5e98c05f2c2759f4d3c87c9ff8da7de37201cb5cfb84400e1600cb83e07cd6d835d6d2dda3464af33cfb7705a68a

C:\Windows\SysWOW64\msres\yundisk\skin\btnnew2.png

MD5 a3dbf3f554079b53ff96a642a560077c
SHA1 6b1384440bb5d7dd43f050cc861faa5111b0e061
SHA256 6854bb8aed8c46f11414e00c934ec2a1d48242fdd05940d33ab5fb1c8b1e08a7
SHA512 bcca62778588e78c972d5e06d7d766c97276892f9a729985d6c1d698c49f6930284ed7d5876b31b1e70a6884340fb7e5c9c2c1038ef575ac8257ab2c04217531

memory/8752-4261-0x0000000002730000-0x000000000275E000-memory.dmp

C:\Windows\SysWOW64\msres\yundisk\skin\btnnew1.png

MD5 21704c32569605cb4d6b2b2ecb5843d8
SHA1 2d7c31c77379fd037c5797db0f01240c3826e44c
SHA256 76e4af8f643117370b7ccd9a0ff9b27423060c3a17375ba25fc7015b3fa4dcdc
SHA512 7c3918666e9e05636244ff04cbbf55d97f75b0340e6720037091a7361b3b990e9e9323be0c124ba024c5a0260e62626c785f7c0f2b01f31d033b231558377a63

C:\Windows\SysWOW64\msres\yundisk\skin\btnlast3.png

MD5 13fadca53d6d31e4fcc7ca0738a4fc18
SHA1 7f9eea54a5266a4ccdc824e782b5765c28803e64
SHA256 3b673537a3c786a4086a32d250d1ea65f735e9f8fe0168b907dcc712edd3aad1
SHA512 917e0d29445064f56f1b4810b3063468408228f0ce2bd64b2ab30819413e0f73c2299a610aaee965e718e0c4afa2dec4f2155ddc3b22d54472dbaa6d0b118060

C:\Windows\SysWOW64\msres\yundisk\skin\btnlast2.png

MD5 98fcf82073cda8f6773c9a71802e7a5a
SHA1 04f82c223b96d8307b81b0312bfb42e369fec12c
SHA256 d31df4af8f90ef7d75ae30cd652b8d2be23e7481f1b94ee54d31c6758149dcf3
SHA512 79ca4519b61e934b111180825f3354d7d5278d0d8e0f5b398ec9e94106f23384e7ca31a2372ad2f3a03295f22f899499315f03fdaddd8abfb2de3bfcacd852cf

C:\Windows\SysWOW64\msres\yundisk\skin\btnlast1.png

MD5 7593a8ae7f9b647f002b052fe171b503
SHA1 c22de966ee81864b42660f0dbed9e20d54bb1e58
SHA256 a7fc55a829960fe5a9cfe8368d33396d58e2ee2191d693085ca303d928220184
SHA512 5908d3585c0d7b6e76a68cb1a920d4cf65901ee80997feb7487040eac41840c8db7348cec8c34a2cb0e6f06287ce569cf75f3268e6307a7a19824cc43bf2379e

C:\Windows\SysWOW64\msres\yundisk\skin\btnjump3.png

MD5 3e8e18a7b012182ea48421a8fee27b89
SHA1 efe932086ce7821c8ee4e309db57863bde015fd3
SHA256 df4b68743f291708211951a092b68ca0a16e28e5bec1cb51162684d93d44aab1
SHA512 50f4a29f4bd402aa98d154a37d6698082627f24969ccf05a39bcf6dc236460dab539b08c2d28407eb5d4fe0e397d65696e3657572f02cf28e855d421c6978e9a

C:\Windows\SysWOW64\msres\yundisk\skin\btnjump2.png

MD5 33eb6fa03728132847c1877007229b26
SHA1 530287219ab515d77e991c2fa7ee231c48e12623
SHA256 fd3a038563d6e701462564c013aad4a873f488ae2f5c1e2584184c268ba7b2ec
SHA512 be0cf2b64bd3274f9e2b028924dd065447800ebabe59e3febea05db7a685871955831cb7da176b4eb58bcb6bfcde22d6c684051879f4da40f7ff5a417c7eb1a7

C:\Windows\SysWOW64\msres\yundisk\skin\btnjump1.png

MD5 8935c96a352e01c80afa9a62fc1e3b62
SHA1 cf96f7dfc833573c2d258362a56d41b4a91e1317
SHA256 c6758a0f9ef2ecc5e418d805b7ac020b839e353d720649b7cc9d6fc08ad61624
SHA512 722426a7b48ca4347d07a362d1acdf9024e1d6e25e26be59d71bf9651fc6c16165c96f5f1d92fb0998718c72c2b023caa9af99e96cb27f5943db63aa8443ce6c

C:\Windows\SysWOW64\msres\yundisk\skin\btndownload2.png

MD5 13c454a0c102050f7b9ef60f6a6faabe
SHA1 5d2670680bbe0ccac18076bf25b32251888c2b95
SHA256 23d62c9dcfcec3562614a2a5c57331f53fe6da7cafc7c5ad79551d6925771c6f
SHA512 9e98068fe422d63f11201fccbb8870ab1ee114f67f51bac839084d3c22cdcc492a3efc3b8d7c4253021e4921b76fdb980d83073b62b0dbd3dc491875e2fd4e5a

C:\Windows\SysWOW64\msres\yundisk\skin\btndownload1.png

MD5 a30a7e95dd4b6ba1a8235023885ca1aa
SHA1 8fa2cc4a0c5bddcf726ceef7d307520fba5413a4
SHA256 cbda138570324929d5c72231f306b6a9920029da70df63b399c107e8f254247d
SHA512 9b71851b7b9a8b001c557cfb55f97ffca81d693581773a9eedb88c939317110fe732fb03345f52f875ef7d0c61f6002931ede4da1de3653df7828abaeb434fb2

C:\Windows\SysWOW64\msres\yundisk\skin\btndel2.png

MD5 b515dc37ca6d914f2cc231b684024b89
SHA1 dafde763f1f43caccd94efd864e178e581e6235a
SHA256 63155fb166659f48e1394fdb0a0626b00868cb96e84ec9b2869ae571f2e370e5
SHA512 e5d06e2c682cc73f05f34429bf1af7e8a2a562db6fbf83a0d617818bddbbc0e5a339732c2915142027c914b9e1b340913c282790d3343d222b90dac011840815

C:\Windows\SysWOW64\msres\yundisk\skin\btndel1.png

MD5 b768089722adaaabc3f0d2f4df93727a
SHA1 7d2b678f334a877257814603a2437d49c6cad092
SHA256 96a9a82d4ebd6a30cf27f2f103ada253abda38780209e122d40e820c8e3acffb
SHA512 9227dc272f516f1563d9e38c0cec8b227378b614feca40f198524b9f66442acad78780adef1332ab7490ef872cc692c0f34d140648f8919bf4977c883c2af710

C:\Windows\SysWOW64\msres\yundisk\skin\btnclose2.png

MD5 be057c2cc3a4e70668bc78d25983b2c7
SHA1 c8f5395cb7dc70fb0c7c11036110dd70cf3f2e48
SHA256 4655d620d56fe1a790c4cfb5e6484dac5ea1898b1653972b695232996657f9ad
SHA512 6f05e6a892bf612954fc4f29bc78bd711b6ec0e239d3be6a0dc2ac9228228af42df89b45186af6e532102000ef236889b52c98ac3dfaf39d1c1b0fe8b7c37a1f

C:\Windows\SysWOW64\msres\yundisk\skin\btnclose1.png

MD5 bd086caa43b1f83e52d975a71dc8dbcf
SHA1 6f8778953bd4119e28a65baa75845167e6b5d6e0
SHA256 9aa7fc666a63e0cd54acd4db1cb6358bcd32f2ad17f58d08da95f7f27632c125
SHA512 51d84b8ef9ed47c052939005180e5f66cb59499b58afc38ce8166caefa75e635e6b3e499c93690afec5caa3dd8375aa8203576c2677be6d1cd0c9de235ddf686

C:\Windows\SysWOW64\msres\yundisk\skin\approval3.png

MD5 83d4219d788eeb8854667cb608cc1fcd
SHA1 06d20a0c5ceb8e011ab306d98cfe9ac4d8052764
SHA256 b8871aea9f2ee21ff6488d487fe5c638f4cae3488565e551991d8c2ffc349e99
SHA512 40193a7bc19f338bcbbe086c363b2cb5315df169ec1339e37bbd9a852351fb2c11b8b3db1d5b2261c28089a6cd741a01553691965a7a743f1444934b9454669d

C:\Windows\SysWOW64\msres\yundisk\skin\approval2.png

MD5 057c3b5e5b9f5d22ce02761321f3840e
SHA1 a5dcdbb4c1b0ca99a078645c089d42d05d899947
SHA256 778de6f1d3e96acba7cdfc75b5e26f473b18d1c6212d3248124d80d775315f02
SHA512 2c826cd26c7f1bf2781fc7678211a5689feb2a00223e05902bc1ca89385f485e3ee8a8c40a79ad88f96d56529b2db88219e21c453052548ec22ec74d91037acf

C:\Windows\SysWOW64\msres\yundisk\skin\approval1.png

MD5 de20e0ef172d8e83e023c1964b0ee91b
SHA1 2eef608ceeb82039f42236ec5bd4578b45af3b3e
SHA256 8935bbbd7dc8bdb4742a59c671a4cba0c946f788f6b92c2ebaf0059444e09f40
SHA512 adc719466bcd52bc23ddbfb79ec05d35993bcb98afe663efe6de6a2817144775d3797da10b5bb82069ac7a6c704990246869a9cc7d94df4e045b18ea9d2bdee5

C:\Windows\SysWOW64\msres\yundisk\VSCommon.dll

MD5 128ba663539ee7627f578f7a77bf0ec4
SHA1 d89ac41d6698b156688a75138e4b39c2a188cecf
SHA256 91170a8bf80097baf519f36983a05ce6f73b1bad3449c9433cf4b46e769eb882
SHA512 2d9e796a39d4d937affbd689e65be87b4732d6651f1ad1462e9055a741043f04c66926157ba52a495668f4c805d33d630c097085288e5663b94325e292950641

C:\Windows\SysWOW64\msres\yundisk\TurboDLL.dll

MD5 dbb89a5d2795b338c7be376187106927
SHA1 40e88a5531462eff7dbe55605ee9d8f914f69d17
SHA256 ff8a5f18c262d6aa9452a910ecdd7d361ee8bdaacc79283f5ce263bf97b8a7db
SHA512 4b65de7971da34775a7bf13ca3617cebcc0c3e7c1f7b2c0d9c3a811f6ed7a89bc18b18b18cfb154e3e10a9e054523cf86ea5e0457c842fbf3598845ce2fc3c9e

C:\Windows\SysWOW64\msres\yundisk\svcYun.exe

MD5 b545a91246cc13f775475025c3558833
SHA1 793bbe9f57dd5d432d45c48c82e1037fe7cab623
SHA256 358b66c1b6bbf0e020b85f204d54b9e9be17a859525c6035f439d2563d55eb1a
SHA512 fcd683cbf225b0ed821ea99ecaccca28fb2dc0e0f29edbe68688c9024badec460e5d6e1e33d8634e3197449409590efffbefdcae24882cd12924f64b512992eb

C:\Windows\SysWOW64\msres\yundisk\local.ini

MD5 6478b70c86538a843b98e550f6660609
SHA1 ccfdc3afafd7f44fe710a455c5c15660a3f839a3
SHA256 a565ad6bfba5ad40d6be6cb8e175b8087afbe47e560faf855d23dc20f42ad545
SHA512 f4eb7aaa85939ecdeda58c8536282258ec1db29198cd58568b6109c73fb07f6b3bb99fa99cc4fbd5ebdbbd1deb85747bf542b3f411a0e42919377029a0042808

C:\Windows\SysWOW64\msres\yundisk\libeay32.dll

MD5 56b2a5e176937f333627ee5a71328ad5
SHA1 d4c9343f4396fda7d6ca112f19df8a59f72e25ff
SHA256 fcd987fdcccf64ef1eb8782ef5f9ff2df58c9ee1f8641f3f85715240faf1484a
SHA512 6684421f9cb91322be595e99d1ed35dcc68ddb945841b3a966593a60f44184c7b2a772c4b8bf33aa323c513bfaeb5dcd3bad70812424ff0a0564c83838378ec6

C:\Windows\SysWOW64\msres\yundisk\LanMap.dll

MD5 b9b4c64c214eb2d2bd3004443dbc53e5
SHA1 8d4878ea67a1f5ebfa44b4bd96ca71681d6b8ccd
SHA256 fc7184c525ec9983090b24d4e0b4d28d47db8f22ab3728b864c9814352a1b8b8
SHA512 b4039bcfa05a2da60ef6a8a8ff910e0ea1849b8868b971530a6489858796841fce60cb00f6b887e353d3f1ecd6d2d2cf24540478eada70fc5c2affdde2d1f330

C:\Windows\SysWOW64\msres\yundisk\curl.exe

MD5 f4e9398f8fc198c5308a4a9589ad665b
SHA1 c92ca1f0010484daed38a055a6f217364fbe458d
SHA256 7744b5f9e24a5810bedbf4e32f03d40f1c0595a7c89a12e0ff0302b4ef07f250
SHA512 cefaa722747c6b411f20dd0f3452dde08acf4fca9fcacea17d1f86f816959448a9deb6413fcda2e16a3f6a0cdf94ecad112549d28a049b7f4cd38bd3e2c05dea

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\vgwdrv\vgwdrv.dll

MD5 af8b9fee15b00886ca491e56884d08c0
SHA1 3360df18e0b2b4c9ff4efbcd3478f160b0d0ab56
SHA256 9db8d6ad565354f58534aba14456373f4f9c26283c48567ac6e30d55e99da7b0
SHA512 f83d839afbbea7d55dfbec7ad8f908c6955e229346ed9aba9a808c58936e35171247d03ed389ab34904c3015984cdb19c0b9a4835904e64f205ad444958823a1

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\vgwdrv\test.ddf

MD5 f921b080a29cd0131bdbd43df7f904b1
SHA1 03fe4829d3dee7eaea205d6d00f0eb74543965ed
SHA256 3c5ff1f20ed2e96482df35b1b49fa9add4d3dc6591c0e0bd98cba71ade7b5cc5
SHA512 463eeff86ccb365b7c8adf7c43963ea9f257659fc0f8134322c565af9a036ac93e2c89318b6e7c1f322ff01c7e8d71ec72804872fc7da2ff6ca7e2fce4aec34e

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\disk1\minifs.cab

MD5 d315fb0a2c9dc687f0a06e0183d23799
SHA1 89754caa1af629f7b401f29111eb710b890e3094
SHA256 a0a883f245f81885e6601250f0babba0d1d5178bf36e0db51a5cb38397d4dc3c
SHA512 a8997594208f11be33330545e8b863402b5573ce4bad00ef964cbcefe4962f0eceb1cb0c1354b1e231d21d1b393fe01484fb616847a0a39bb46fdc1ab1c87bd1

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\test.ddf

MD5 1209503f90a7bb427b6f7e8f22fefb62
SHA1 4b1bc37dc674a41a0bb5872c7d06b5ad86b8884c
SHA256 9caa83f2f1aa92361b9591e2fa0f34d2cfb5f372d71fbbb4a8bb0f03e162e2bb
SHA512 a879a57f2d011823a5b2d145ffee09aa61fd9981be9985f2346d3c451df71159b489f4266a128b3e0b73b383c02047a7dbc35b95d8eefe228cfb7525b1202b43

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\minifs.sys

MD5 d3cf3260d86ceccd875ec73bb33279ab
SHA1 2404069ef7953388c18a7a19dd075860aa3adfbf
SHA256 0bca4a66e93f56c293e102dfdc0f1a7b2dd8bcbd68cad161dae915e404a9ae7e
SHA512 516cae03049226589397208db81321f7f3cdfa4f1ea6fb128a6837417a2174ce509bed1084a8eb4eebcba691a3b614e544a419eb559a356e0366158b2e96940a

C:\Windows\SysWOW64\msres\x64drivers\microsoft sign\minifs\minifs.Inf

MD5 ce4687667502c280cb1d072ebbeb4200
SHA1 32a030e31f3b34755bc963821c1e49721d0f3d1b
SHA256 8e7de9d96cfcb19d4f1e77210da33b940e6c6acd329ee7988ab16b4c18a9234f
SHA512 ad48e2ba3aa2dc1e735c0c82ed375af1960aaf03d022c8114db86f1feb05d86c217d80759751653ce4c8997fae875bbc913b96f819e6f9fa849905b550d7030e

C:\Windows\SysWOW64\msres\x64drivers\ytminifilterdrvx64.cat

MD5 45c16877db14f420aefef2aa91a8a8c0
SHA1 7f9a232ddf872173661fb08aa4130a14aec3d0b1
SHA256 d87ea364761705b50960335a90c3fc1964ce183e210ea6515ad8f91af7162519
SHA512 d2d389f793a201ce5cff4be19bcb336c467e25bb6765c82d8d3eef4f516449fb99bb866070e368a051bd93d905b5e16a716bc438f2b5e46c1b746d3c265c0fd0

C:\Windows\SysWOW64\msres\x64drivers\YtMiniFilter.inf

MD5 c9bf1ae355048620052ddaaf04cd6888
SHA1 9575cd9bd445597837b825bc582e4c4a515a0ce2
SHA256 9d43d0d5f3832531247090dd5825ab202dbb457e371375ea67d2506cb931ec3e
SHA512 3caf1cf74b0f4b6872b3101e0f523960a6b6e715fb56e310b0ac6d01d0903c0c73b28ef8066b9806ac5cb9738a5b98c16d1394a0b811f30452ec68cfa50484fb

C:\Windows\SysWOW64\msres\x64drivers\ytdisk64.sys

MD5 1e7999ddb01c7cfdd75fe204ecbce38b
SHA1 fd82d428adf236c2f6ab5209923cb55c5d45d856
SHA256 02693582f2a63a7492d6aa7437a679dc01fb6471357b199de1db9978cfa5fde3
SHA512 5d19b709ea5ff83fc6fe6a34c3a6013d5975d6d5bf5265e9d63f7d32100a836137cbaac8a0647ac1589999357ff0f5429c9d4de2f674ab6371ff8f000fb36915

C:\Windows\SysWOW64\msres\x64drivers\VSetup64.exe

MD5 ec3f2de5a8180a5fcca1eeed56ab9a7c
SHA1 fe97836ea6ef3cf9d389e2e6c606fdc8d3d44b67
SHA256 65a6e8c28364a24d63a251e2809eeeb7533bd6c7de88a270aab7950c7d59802f
SHA512 ac87c6de3505c0c31b242dd06f502da8cdd8e05c717f6b5cdd2196333030adeddc1ed3a1553303e87a42125b0ec5301c30cbbe9bd04d17dbcd9d965a7f2f53b2

C:\Windows\SysWOW64\msres\x64drivers\vgwdrvx64.cat

MD5 868d5896b8c527407e62f52fd47695c5
SHA1 6b3e6b49a1e8b82f207777d63140aced360a2fa5
SHA256 25ecbab37a3ce635040f161cb51d3129882b0fe4a34ed0289e0be262afd0a615
SHA512 449211d5e8c2b5b61b39b536d0119298977bfb97b5c922dea6389a7879f1d8fac023851480952a7b432b9f31634d413c410b2959c81346af1822b6d081977faa

C:\Windows\SysWOW64\msres\x64drivers\vgwdrv64-win10.dll

MD5 c65dad0baae86cbcdc3b15bb1cc87f42
SHA1 9fc585f8e56572b096188805afb325ba2c913abe
SHA256 ddbc012a24a600cd0f4857b304f122ab58b6ad570ee1cc2022cdd8d51d712cdb
SHA512 7f99c646dbe121db9785b9408c9a8c993d447c3549f574e3fb8635a729d38d56ee9396e82fb0e1ad8abdc9610c4af89e700a57c4085aad3e69003ea651ac53bd

C:\Windows\SysWOW64\msres\x64drivers\test.ddf

MD5 2f78bd9e6753f2c710c096d4ad2018c3
SHA1 9fc01f74538558eb347e5602b9684392b26850ac
SHA256 359d9de832c63146c91e952af2389ea655bf2f4afd03be301a9ae1881896f227
SHA512 c3706cdc1a354b0b8fddd0903703e872eb47782b7581adf8f3c4fc197969d28745be763c184e46cafb5482f62a8036e160d01bb1249154b5ad9ac24a44c4125d

C:\Windows\SysWOW64\msres\x64drivers\sgfp64_win10.sys

MD5 e0e361343c2d2032133c2fed2192a01d
SHA1 86f5894a8784c79b77e42d4a836e155ec9cdc5cb
SHA256 c5b0f045a283aa0a550a92a53fdea316437decc1352c8cfb1e0b05ddb2c1594a
SHA512 2ff52b5cb20d510520f7a1f3526ebc4d20e4a6ec2c786019c47518524150b4f6ad99f2796d972ececa4620c49b2899577bf0e5fd841814b7309d448d1e8b38ab

C:\Windows\SysWOW64\msres\x64drivers\sgfp64.sys

MD5 c81546040f8cfb05ec7b0fb6ef7e794a
SHA1 b43618e1efaa16cb7501453a75b58c7f976bcf2b
SHA256 fabb5e79ff0aab237a0a3626ca60bd08852426ca1e58d628d2e99a05dddedf90
SHA512 8c1ff67728207bf339a491a1c05c443447e26ba8411eac494dd626e2b0d066271cdac6a5f42a5c056d0d7199d16e80f0734c425bda05d222fe4338bd9a783b9b

C:\Windows\SysWOW64\msres\x64drivers\ProcMon64.sys

MD5 29400e78cea86d8a750cb5184f376ab1
SHA1 af00f453783dc90333db698d2d8e9fc6ac2f48f1
SHA256 36d2da5acdab7b7941ab63b08cd0f2b6d6b11d3d8be4b98b6dbd18593bf87137
SHA512 3a2331c2c0e0ad8fcee29e590ac13f9e72a947985fdeff1b8e49a78e37b04a1a8afff7fd229442ac484a4e4a048fd78dc90d9a98532546594ddeba68410424a5

C:\Windows\SysWOW64\msres\x64drivers\netftxp64.sys

MD5 648ec4c1b056577300ec5315678a563a
SHA1 c61f1053a2c994298fbda675f73b2b4670aa11c4
SHA256 bed732c6dba1912556d7255c856eb682477a831435d9569fc97ffec47d749c9d
SHA512 53fdb3f752005b8c41b9733568bae40a3c3dd5e69a7d1275a95b114efb66fa6622c73d3a02c0bc3d9f81f78719b2f2bb7811f977770fcd9e444d506f738cb50c

C:\Windows\SysWOW64\msres\x64drivers\netft64.sys

MD5 c9217b97cc7fb297cc640f683ad764ef
SHA1 52f28dd5268ae0042d355048f600443dfbd9cff8
SHA256 96e305378195ece2bd0322528fd0fcc6f4c5cee5b13ec32e65521e1a2946e82a
SHA512 5d6f9c2021572b775ccf5890d3aa7c6b7c13dd309219f31ad4b84c67086d62538062dbdd08ee8ba9c3a9a46244b79cd771c333c3d7541610c388c76dba83c2d9

C:\Windows\SysWOW64\msres\x64drivers\dismapi.dll

MD5 7c4ff9b0302c59cb00087589a90d2a38
SHA1 8f4c022afdfb30c072a2e71939824ad9b2fdb0e8
SHA256 03a6644eb95c448a56177e5f38ab8ec1f2295089f0802b3f7f8a2607c76f4fd0
SHA512 c73922f9dca064716de4bab02b0130bdc23f16d47ec6529306e36620ca0322ab63aa9a3564724ae8fe432ba48b757eda497d6761941316380df6fdd544871d46

C:\Windows\SysWOW64\msres\tools\setuptool.exe

MD5 1e5ebb0561439c65d78fd651013263de
SHA1 83076134120fa56c110809dd39daf60644bc1c26
SHA256 a5927aede0fcdb9e2b45a0f62de8adf803accae612324f68f4b44ce40aff0cf4
SHA512 c78f8cad97b519528b8b8cf97b7908a9af853141f974391339188c21b31236853639ab3e641ed76ad590afa53f6179a3d44a6515c3e66458b14cef972d74bcc8

C:\Windows\SysWOW64\msres\sysinfo\windowsPatch.db

MD5 e4749a9fd1bf804dbf0a3ce5a5a3cc40
SHA1 23a69c3fa98db88e224eee3240ca28ffb57cb8ba
SHA256 18cc35b61fb7b5de9a1cc2dc44a0fdf928c9e5ada905d5a4dc36c6821b62e137
SHA512 d12bb8eeccc88d777d7eb08ffecde177eea1b6b7c0e6f0f6b877feda697a88f73cccd4dc7c28e158becd0233ab2a265eac09e76ad22cfb4324799b0b6f136ad2

C:\Windows\SysWOW64\msres\sysinfo\OpenClose.ini

MD5 b9ff663fee817d0a030a36f3151ffeaf
SHA1 76789ce988e8d71395c8d772e110d1c59721476e
SHA256 4d9872c5adc925dfd9207983fe306e153684684c07ab1bf019952ef58b26c235
SHA512 a84b2bb127d677a51fcdb4ae2fe397c4b82e16dbb3e1d0f426896be5c1b77ce4b89eb2247055e1da7514f367540f5461a2cdd9314f2b043b442a09cf1df8c1b1

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 2a3aea4fe9a0b9476e322f003b0b69c8
SHA1 3b4a52e16dcd11c372e067bc07c6979e27e45076
SHA256 b848ef594ec9970c8876645ed48e7081e7a97dbef72bdbd2f6e6394105a52405
SHA512 e5330a26fc64e55d853350a16800d18d6c132a54ca4f6ff4c7af898b825a3201aa8d6d82cd87d598bb4a40f5a450bf6ba0015bb0044cb0836dd257a8f660f8d9

C:\Windows\SysWOW64\msres\skin\riant2019\选中1.png

MD5 08a9e005c2b3c33f0e8dabe1834e66c5
SHA1 ed1542dd5a6cfecea735bd5a98d7174f7ae84ef6
SHA256 f2c482e6f6e8c1c877c10246394ea44d6727f85d04ca73dae14ba49dbe784283
SHA512 39cc42e79c747bae4828172f41ea317f838c3239da85d30470c5e910d16094f75a8948a9d5c28ead8d92b23e1d385f7bd3fe27ea391034fac2f67ded02aeab63

C:\Windows\SysWOW64\msres\skin\riant2019\查询.png

MD5 cf76658b0a235d7fd1c632862acd380c
SHA1 c4607f4cd3ca4b743b7e9f360fd8a7b9a1e34c6a
SHA256 904e7899581ae4fbb862b37151f3953979868f5d2240de7f6fb2d518cb0f94d8
SHA512 2209f900c1a5bfa7bbc8e36ad1181697823edcdb03238317e402bbd927a21baec83d41af4de2a712a81251d2198b7ab7a06d8df0fa6bed85c4e73e539ce31c7d

C:\Windows\SysWOW64\msres\skin\riant2019\未选中1.png

MD5 a54109302a50ac727e40f058e8753623
SHA1 20cdd9d1080f9b8bb0ee9d3a92efd805d258738e
SHA256 f401ebb1a2d1622329e8a023e8a21461733186e0f2acd93f8fdaccb8e422390d
SHA512 a72de48560ce40ca75ca7d1bf697a27e1b8c0e20be125826a1d6d996b538d08f5b943cc8cca693a67d7ba5baef498c25f2ef308e4906bff8671cf19f39c67d3c

C:\Windows\SysWOW64\msres\skin\riant2019\snapshot1.png

MD5 e817df8af67f7aeeac49eb2b38823ff6
SHA1 34a36a624559a151109ee99591ddedc44fdb7d61
SHA256 352ad4b713f892dbeec60440052aa014ab18235494a1293fb993f5508bc5a544
SHA512 6f3843c53cc02a5205197032827aea753b35ce9550a8fd9d9130fb76cdcfd3b5ba2fe53109a571368b0ccfa8a94e63a71b898a20b3d9541498aaed9adb45b905

C:\Windows\SysWOW64\msres\skin\riant2019\snapshot.png

MD5 dbd88688258b0d125f7add7db13d4ed1
SHA1 6fdffaf5ccbf160a0d0c048ecdef39d23c8f9072
SHA256 939a51cd16e607b31df20c1f3b7d73326a36560b0e6efe775dea482b3fa1e809
SHA512 04565fc84aab14c2a52d6ddde023c24d1a2c64c1da5a04a7745a36f75ac0c1ac3047583d674905acb1a926896eed298fc2da6afe9943147eb63a81392477bdec

C:\Windows\SysWOW64\msres\skin\riant2019\smallChoice.png

MD5 3cf4510664c659b5cb3c0b4e74e69b89
SHA1 086642d32d95c16ca04b337d565c0cde93ce3cc8
SHA256 97c6415344483db7bac3551ede9047bd7f5cfd22e5de0161754489cb15e0462b
SHA512 1c248e70293cff5dabf8496e70955b6a8ff4b66ede52355e3f5169f56a263215bd64c3d634342bfe0a94c38800853729e5df4c9b68d758b09795f3d6f5ffc80b

C:\Windows\SysWOW64\msres\skin\riant2019\small.png

MD5 4ff26b376ddb07c30b7ada21a4654549
SHA1 8b78b2941071e523479eeaca63e9c21683b6ee70
SHA256 c55adf8da8ede4ce55846660d5439e037d5486d176c69f11fb4331041a218a21
SHA512 bc315dea899b52a653226bdedb66f4f33552efe0f0c8d46c44d83ff5a69416727cb13fbe945f859b9617984db4c4d1295f9137ac681e3f8a0f16ae3dcc3a728a

C:\Windows\SysWOW64\msres\skin\riant2019\sendmsg1.png

MD5 7883bb39d3b8c608228168273742a301
SHA1 07e1152aaf60297b6d8c3ddea99fdf9cf45d4c79
SHA256 0cf9d578d5578790ab24440855712312da66f1fd5fb8963f089e9ef1c64475fc
SHA512 c0997b23e8e337d4611693ed6b47ffd8513a854bbceb557fe3b46b618eb5c8bd0ba3255512b08dc2e50978a3fbc3a6d0feb8d2bffbe19f9239c9ef92d9df9b3d

C:\Windows\SysWOW64\msres\skin\riant2019\sendmsg.png

MD5 e8c04554d6d183ab6f66b43885dc5cab
SHA1 bb2d42903ab2f50ec74ddae7de3d07d2240a6572
SHA256 2683fd4c52870a1c2ad0f621229cfcf03f9ee7f858ac7ffc56b5129e90acfefc
SHA512 d1cc93f82bb35b5f0f0591c70f4afc2cdcc9d0aa0b525220ff4de8537cb8c4ea5b771b287c80334390e63040360a17a7e178c09cc376da3edeb3f9f7d8616461

C:\Windows\SysWOW64\msres\skin\riant2019\sendfile1.png

MD5 91937e8539b0403c147cbebc1bc6da52
SHA1 bfaedeb4d58adf0ec970a309a983dca02696bf05
SHA256 1c6f1585a8ee8c74882d988a1a3ba2d4cbf0b69dae6ea4f7dea1bebf25e9026a
SHA512 35f8e76b6fd59fdb9d9a2eaf0203d248735c04d0d5dc486aca132a92ae8cf1c7ecd5e492b31760764c0c2e48060a631313ccffa2cc6f69b2158961c7d54d6a6a

C:\Windows\SysWOW64\msres\skin\riant2019\sendfile.png

MD5 c28768cf3f20f81cda761a4af3cbab45
SHA1 c9a3950b7a78413c705abfb9639811ad9d9116ea
SHA256 12bfab2aa72bcf19b74ac031eb6faffd97411961c4dd37529656064f644d8d8b
SHA512 72bd1a84076546145b817d0307767c851e66459e15fbae80ba3c115b987b2955aa9f64caf39577c442646974afd31ed264958fea77f77671389850eb2a343f15

C:\Windows\SysWOW64\msres\skin\riant2019\qdan_03.png

MD5 bd6a522fb26cf39dbf1027325ac697a0
SHA1 b299fd0a7bdebbded94da25afe04af0833e5253b
SHA256 7f358dae2392108a94e769aff0f5450b6d2303c8b17b69d411936e76f8649f2a
SHA512 b670fd1f97d690c104027c2e999f42353f22ab68a057e01e8264ffb0de2605d978721c2a457ada03ed91350f6cd4454246340cd704cdb3aa1e5f9cd15c9fbd34

C:\Windows\SysWOW64\msres\skin\riant2019\qdan_02.png

MD5 fbb4845cb67554460dcc50c5a2ccc9ad
SHA1 6e14d4343d6944a172a05678294e3ce842771527
SHA256 2dae0dad3ffd36cefa6521b450b62e85739024291f344b140ce7b8d7b7d88d5f
SHA512 dba532bc2391dee4fb1cddc61db944a741ce74c98fc2c668041d60d539320939535a5659afdb5ae9db4f9ea5f7386731df7bb5557af94a432d21567ba5da2c6a

C:\Windows\SysWOW64\msres\skin\riant2019\qdan_01.png

MD5 201b4595d0a7a1346b3ed3db1c98b279
SHA1 8b8965fcdc41402708bc5ed03e827a51ad6cd63f
SHA256 eb83cdb44e9c338828c562c7d0c56d08651b019e8bef222a6f20ef989221d18d
SHA512 f50b6edf0a2a944393282406351e6ce22aa3197a3994cf3346e4950fea78beb0523ddfcaa20f3e149abc9ed6cf90ff6fb28c77d4c69afa633cb26fa5d6c8bd23

C:\Windows\SysWOW64\msres\skin\riant2019\depbtnhold.png

MD5 d3a0cb351beb618c9b115eefd9a0a5e7
SHA1 d0bc49ccd8abbbff5063035b5fcd9d4fd0c80e41
SHA256 6aa55fd3a2d67afc02c73201d6f1c3d017e35bc0209d6c98fdc41cd54d7f6f2d
SHA512 cf07c77f5d4498205bcfaf999b3ee53b974ea86aa88f1fe3ebd50df36e5eb095dd8b07b0831454c023182f2b54abda90f1a6bd00aa2a8aeff02c0c8b2ec5f1a3

C:\Windows\SysWOW64\msres\skin\riant2019\depbtn.png

MD5 74c77345a6623e8c104d8a12a000f36e
SHA1 fb03c546cbe0e583e53fe63a1cc96cb55991e806
SHA256 8079c30d1b87893d74f247a73942ba0623d49fa2aea2e2c7c8e181a3f7bbddb4
SHA512 52ba563960d97c22f0d74c225f7a831c7c35fddca30f9f119637b204ce98136afd9fd771a6fa0615295a6e3d6e3fb589128349e1e7c7dd95ecde75d86b6331b3

C:\Windows\SysWOW64\msres\skin\riant2019\closeChoice.png

MD5 4726a9aec052c380e26671a469015f42
SHA1 fae3eed64f74bb66e1bb382267174669d81395e5
SHA256 90f6a8aa3c21c14a057e017226dd41bb6a3b2e91a3b2da8bd3455a4137be71db
SHA512 3491dcb5efd0dd491036b4f6f1a6c383f2dd343a57a38f3d9a427526df33ae9ae7b7f18edc214a211f44da3493fff412d01aa644603602db3777a961fefcc60f

C:\Windows\SysWOW64\msres\skin\riant2019\close.png

MD5 f3ae3b7482b2188b38a4f30bb5f25f66
SHA1 7acc3d4f4a2590ec4af1d337bff3f96134acd6f6
SHA256 a42648958da47067a0b1fc4d384eefa0fd7e6f6a57ae286bba33c05d511e8e36
SHA512 dd2c537c786a8a35b3b7246a8fc3e043dd1204b17c369a7de7e6476fad2f068c83a1f080c9712bc860f3f7b7bbdcdfa7adf363e6ce97ad3313235d3cbf5fa73d

C:\Windows\SysWOW64\msres\skin\riant2019\chatbtnhold.png

MD5 a28731e81b5d65b1a6b5a9d135ea0521
SHA1 40b44161a0b5326e2aa8ea5919e99115df6017d9
SHA256 7e3d19c117cec19b62624918cc473af4969ec62537e9144dbfd0c1abc6b75e7a
SHA512 f6a0c93a32bf6b4419c12ba7070a405b7ae393bdcfe9a86128d4ce1b977aa793ce0f77a885fd0736e784c35c3c1c563ee36d9db783b8fa6bc60adf7623dd4465

C:\Windows\SysWOW64\msres\skin\riant2019\chatbtn.png

MD5 eaf68c767dc0ca3efc5066d8513a6d8f
SHA1 3b1cdc18d7c0590e2582a2c190f0114d2f73cd2d
SHA256 4f8e39d1c2cd592dcae800624e71b7b2238c81862f64c14ee38f8bcf0dfc7bba
SHA512 f8bc83637f916906e08de215ca0df331b90b034e61d4f7bea89c2fd1d0f0f94fb8af129941510d1192c930ac6e7dd64457d10f3aa61339dc90d1ecc37124aade

C:\Windows\SysWOW64\msres\skin\riant\TabMidSel.bmp

MD5 035d69ea81bff0e13c9615d70f2dea3b
SHA1 3051502b461bb21aa2a23eb9fb4c6baf0ed4278e
SHA256 a8d5bcf20171923ebf7186b028546f6547f88befe49983fb44a4f775932c6efb
SHA512 2489fdcc98dfadab488d621caa9a7795bd615a5c31b9c487caaa0c9f1309c724bb0c0a81267aeedfa51633a10175077b4029d0fdeec0db87bb2af2f924b390eb

C:\Windows\SysWOW64\msres\skin\riant\TabMid.bmp

MD5 38ea71acbf507f9eea264c3bd9da89f5
SHA1 9dd2db81ca080d5e50793ab3542efd85004c860a
SHA256 7d6df352a3d7be8133b88531c1872fdf4f038f69f8020366443ba01c2ca1593d
SHA512 1a849f24a26dc2d8f9660e01e367ca8c78cbb89e38527d1417b2897e0df1e8afd2d690636f940be5ed7392d7812feee1ca6b45572a72e977c0de5452d510acaa

C:\Windows\SysWOW64\msres\skin\riant\ScrollBarBk.bmp

MD5 c6bae882e47d7055ca4c1ac065c30300
SHA1 9a02bcf780078936db51270bee1fbcb8c8c32d10
SHA256 144bcb4b9a8aa98041c63802c97ee33b609f5a2ae2d6cbb5a019f08e24d3d5ac
SHA512 f16b12a9b592fe26f1d9f81860d3a3f2754481cdcf8de36d9f45c9976b25cec81d68fd3593ea44d5341d1cf23ae3fd2b6b19d352250233a0765d03419686397f

C:\Windows\SysWOW64\msres\skin\riant\RightArrow.bmp

MD5 b6882599fb2f33e6d293204a5d5afaa9
SHA1 a57bfbdfc37089de714377381bfde4e156c69c85
SHA256 36a1e4843f6ff82444c1cb436e402cd619b436560e8fe028835e667c96c0bdb8
SHA512 42acce61ea3bed23212f817725e4eb166e7bf5d41e1af7270249ea695aed9ff765abe8e98865cd30f4c366f75eee89c36cbd68efe09e51d7377d17173bbc3e46

C:\Windows\SysWOW64\msres\skin\riant\new-TabHeadBtn.bmp

MD5 113771b51dc678ddcdc7b28b1251c524
SHA1 1b7ed71a628ebc6e51244a427b71edf7a4d94a8e
SHA256 9d96b3e5e8db8d46cd483f8e99b84e84da21462fab5e5324ac1d2f8eb91f40c0
SHA512 c68885bdc9377df8bb2f3199f44935082d14db3b99e5fd5bea1188a9347116e37afaf6bbe3f5fd996c3d99928b0a46bff5a398bfe50a972e315121346d88ccbc

C:\Windows\SysWOW64\msres\skin\riant\new-TabHeadBk.bmp

MD5 5fb047fb96e31a13a6953f2cc210f97f
SHA1 940412a521914aa25c084f77d76ad4c559d7b2f6
SHA256 7f9678d8047d1d4984f2976342931985afac37e87725241f87f6ae36753ce60f
SHA512 a262bb8457ce4ffd97e5cd7acfe0499beadaf3a8ed975f65125ff794973c7f2678005eabf7126a822dd208b7029f2910654648232b5b38457c679e995d9fbea1

C:\Windows\SysWOW64\msres\skin\riant\new-res_down.bmp

MD5 3d52b01d674d77f6ae5894011f00b9e0
SHA1 8423fd898735e5994e9f17f82bdbf7edcbee85ef
SHA256 2c40df5e2b3915c55430f62f5782d82646ba4ace328b125cd9b6a47e3a08761c
SHA512 1c739fc3ae21dd0b8be7933cdaab0c69d419737f7c205a54a8c3f2626c3270c5d38a0ae04ab5fe738e4c8bded68cb2d03ee39102feae5b43d6941f7cc0ce0374

C:\Windows\SysWOW64\msres\skin\riant\new-okbk.bmp

MD5 ad9c57a5fc88fb5f464a039d04440cb9
SHA1 4a31728193a0104b4102fd99ee4ad9f0f2ad1919
SHA256 598929f8ba0b317b59d2012c72eff86c3b61e69df27964d8db8d220e71b3a04c
SHA512 f769120e1cd5ebef9ab2c8c4dbfe7747b2a3565b909d355ede39ed7b2b13d089cbbfd86279f4a46b4149c188aefeda495b9bb2dc214fc6125b71c5fba1a75eaa

C:\Windows\SysWOW64\msres\skin\riant\new-min_norm.bmp

MD5 385bed648c6f3048828dc74629c31b6d
SHA1 49fc68925e646dc69417331edb332b5a7543bb70
SHA256 99a66f86392d76c12db4a015def530134e3a25acd7f849be8aa7bec0df6b5007
SHA512 4885b02cfc9245d5aa11d1bf5d762321dada8d01ec0f2685cb67691875d4c43bc99f30ba2cbfce94dafe75258acbb742764e58620cda939915c02b88ff3730f4

C:\Windows\SysWOW64\msres\skin\riant\new-menubt.bmp

MD5 12bd08084be6406b68b0eeef850c896f
SHA1 807ba2ff56b393ce752f9f51b2c48f194c7fbea1
SHA256 897809704ed862a30abbe3ef0526aaa19ef296f7320e7a9c964dc2a3981f0b46
SHA512 b4a9944e7835f48190fca3e18d0924d955f1b3931cc3e5603a8c6eaf533d751f712cb4e0a62e02bda6c75a868e57d2ace3a9ec317d717d4a378ae8db51bbb074

C:\Windows\SysWOW64\msres\skin\riant\new-logintitlebk.bmp

MD5 0266e9107aa3e8e206e751e5e1734a61
SHA1 979ee5f1644b7b476fbad86ed7e7c8ee812a30d9
SHA256 9b28880ece3ebbc6b6f320cfa852a76aef99116d533733f1ddc69c670171537f
SHA512 b9754f70aa16b22251c9cddac636cc7e062bc9beef996648e4b7eefec174cc88cc35d680b340abe3957d99cef568084f3f167ffb37cd4c47526a2147b013f22a

C:\Windows\SysWOW64\msres\skin\riant\new-loginbodybk.bmp

MD5 8a33a3f78859092d3e3759a200ca6ed2
SHA1 c4739a287bd9c6da132e66f15142b44477b27d45
SHA256 d2f9a95e82bcc2f4a4601624aa8da7766d4eb2ca73e77dbdac2de7b05effee1e
SHA512 db4706b5e2ec8d12c733f6741f026867b4230365ea339932cc6c25909a363c25675fc5e206b99698316abb22ce07df3279db097414a350d62fc725e8e62a2ae8

C:\Windows\SysWOW64\msres\skin\riant\new-exit_nor.bmp

MD5 51c37f6a12df39d2e6f705abdac8dd91
SHA1 e6bfcca31c497b65879cf4933efa58ed57927371
SHA256 f0fd64f1223c79374683d79f50d6b0a687652d640266d7dbcd8ad1c79383dd84
SHA512 64b6e996121456cb3935cfa2acbfb483a1243e8f7eaf55a4d03a73e4ddef7f8d9682548103a9d01eb18aa0d631487e85dc8d8dc8b720850efdd587c845d3831a

C:\Windows\SysWOW64\msres\skin\riant\new-cancelbk.bmp

MD5 f21d1d73b2ad2f293975fe746543b31f
SHA1 e444a3eb5797b5c545cb9ddd28cd16f77261ee8a
SHA256 708c65d53651360f75a2a2d40409e77d0998c5c1dcbff4e14a6511a7351b611d
SHA512 d4b88f1f9f316455523d131a07ef87dd3d9e79374dfb9ae9f32b584cdadcc72cbf078babe2bd4f4f82353a33ef0d9b72525e3ce77903d05cb5ac5dd3d8a74f5b

C:\Windows\SysWOW64\msres\skin\riant\new-BarExpand.bmp

MD5 d8c3875896af1f5ce511851fb5e89b63
SHA1 a01245710a1014b2d0eb3ec258cfc23c696c15d2
SHA256 e93db47e0310db65f41a49fd3e978c5140a15b76610f636bbae61d7d93d1e281
SHA512 99bbda261dd8cc20b7de5d4dd84917a753610d91e87b8293f201df9286c880b7d9d58fb988b4e8f6a8ebd079bef4be5bc9da9716a2a309e9724bb339038ea594

C:\Windows\SysWOW64\msres\skin\riant\MenuItemDown.bmp

MD5 a9568a84dc895b9b4beb9457689e8846
SHA1 961f9044e4639ad19d84c7f916c9ca2235bbd20c
SHA256 cb223d346db24c4835926afc8cd349fc512cf201f4f4145856aedfffc13ddd74
SHA512 e2aa9793b2e736dffdeb8b997cdd4a9d9913448baf40884bfb88a2753e2613f9b4059e583d895c013dcc1c19a573992a1d13e7d6e73edf63394b15b4b6bfce79

C:\Windows\SysWOW64\msres\skin\riant\LeftArrow.bmp

MD5 6e864802af362f547dd22523deeb916c
SHA1 9357f46d93e84aa379ca4191705a8fe780277ba2
SHA256 1864035c8bb781864a72b84bcfdf35675642bcb8201b2b95de6a9625d982c3c2
SHA512 91136ffab7ae5842c01d6293db83a3af04562f28561e24d7f32f58b9858c2fc3641448e4575026d131a210ea2c698df82aabe8ff0608fa4f71159526b4b6da70

C:\Windows\SysWOW64\msres\skin\riant\InActiveCaption.bmp

MD5 16b769e6cee46d2f687ec83a921470c3
SHA1 4448d477ff186f486a5a4f8ce241ae184ea858ba
SHA256 7845c7f32da91d39712d7e02d01dac7c01407b65f70eb2f44fc6bd690263ddfc
SHA512 c93e10f6cc197cab17f9fb4b8b2f49a380f623cbbde56036b8c2aafee85d0ce67e96626fd8e72fb7091fb16fd5700b741f0248f68c94103dc628fd4cb9e9b468

C:\Windows\SysWOW64\msres\skin\riant\HorizontalThumb.bmp

MD5 c34e63cd2fae92fefa72ad40b14eaaf8
SHA1 c91432a763bd22a31354c6b3ebb7056556095589
SHA256 114b40bb2c3d093cc23b7b3e19751d92beba6628ef88c92e72b645a6ed83a5ef
SHA512 da1071be6205474aca7f89716a93392a8307dd0b627fb875a61c1ed0f0a1c6cbe80eba56aaed4b67dcfdd535a1e993ba510c38694b29b149952e358365a130e6

C:\Windows\SysWOW64\msres\skin\riant\HeaderCtrlNormal.bmp

MD5 aabaf6a71535d80772dd3d15eeb20186
SHA1 1a7391b4c1e882ecee24c43fc6f53d3964b3a99d
SHA256 8e06041022fef2c23fd7359029d0e4dfba990c3ab22dbd6c494f43351acfee5a
SHA512 a29c9ec30ca960c5b0f725ba08a976613ccf1423217fc440d2f2effc3815d047641c50805cf8ccab794fab6990785f5ece69dfdc4d5f653dec3aee239c9388d0

C:\Windows\SysWOW64\msres\skin\riant\FrameTopBorder.bmp

MD5 f544a7ff38fcbc314cbb8828f84d59e9
SHA1 4fa7fb36a645431d8c5e40cdc9d782864e452464
SHA256 87d150486d12132efc73c465b95a2d7235d31ff65330065597dd567e412944cf
SHA512 0bb66c3d5d1ef7c3d72f7d0f3f6c021beaa531aa97668abd9144ee09c01b71a4260843d2c49d553bf873f2a7b107751fde24702cd511f5e1fb0a74f0330f9faa

C:\Windows\SysWOW64\msres\skin\riant\FrameBorder.bmp

MD5 76f67eb872dc44a3954de8e6c5d0842b
SHA1 20189c2b35c6f79e9c4cd44eaf62828cc5efe0f9
SHA256 8333397dace0b296bc5d3c363d0ac35f6747abb353fcbea6973f10024278f2bc
SHA512 83bafaf910ba5e1dd876dc2d9c351c7cddea662b64ae26aff965b90165dda555e6b6255609bca519e35bcb2f8c04ed27347b1d870a7a43d3c20d42d08966b62e

C:\Windows\SysWOW64\msres\skin\icon\wifi.png

MD5 9ca91f366daea7ee379b10e2fb780a12
SHA1 c91ecadd47236f1feae4a7afc50bbe1d1f538d88
SHA256 b44b14cac2a40e7bcd3e46afd7ddf23610634957e9598a9a10da55feb5d4855b
SHA512 86489b98fed9d02f6bcee75b779d35e32cbc0bb2d4c46b0bd67cd3571b7e4a6e86818d683ecd7e68619858875e722baea9e6ba83919150529b3e92426a54a552

C:\Windows\SysWOW64\msres\skin\icon\wifi-no.png

MD5 70298cb017ed16a49560bffdae01b572
SHA1 e4326fb63a69a2a87f36a670af92decb2498f114
SHA256 3928fa3178b1bbaf2ca1c24587bff9b890657433a1b665fec200f72f808b08f8
SHA512 62d042975482e562b4542b8310bdce1459568eb50bea241f6a2d1da91bc739401b8806f04e7a36f2b695a04f8c6de427d4759d3a507b3e80c6f45cd4301e918c

C:\Windows\SysWOW64\msres\skin\icon\usmall.png

MD5 592fdb02279dccbb5ad2aad8801b45c2
SHA1 120d778a66051f0e494c181c9cc30f8bab63298d
SHA256 56a65c67df886a34ac240f2a11a851abaeb55ac2559091025e7f62eab678742b
SHA512 e9326cf7e68b579f58b02512bc530faf91ef03fd8adbfe9af37a595e526e3994b4ad7de96ba7b2e759cc7fd1d85712ac9d7ab9011076efef7ad96846da6e0d47

C:\Windows\SysWOW64\msres\skin\icon\up.png

MD5 daa8c1a486c65557bba1b2715e5c5b46
SHA1 bf61136c9dff232866b17b1abf6a36b66a3b228e
SHA256 056342eecb0895a031be3ccf23b489b4c9a53466013743762a3cebf7a772d6cf
SHA512 1e30a283657e9731ee2237c7ec2e1d8a58982b09ec02050639ca1fef1de58b7b916e627e3d83f0927a34c555f1f224f028ad3cc7f41a13dee66cbe5d435b4488

C:\Windows\SysWOW64\msres\skin\icon\soft1.png

MD5 fafade16d6c08c7c322e8e92a358e0ca
SHA1 6c8f4d421f718768b796b7ba6ec7a6780b524ea1
SHA256 bfff144e58423053320e91b34f7477c1f51ec13c0468e2f77fc53862e9107cfd
SHA512 c00e8f3060de46662d51fedf0fd97d276a0274e4e2d9419e2cfc236a887b959049ffe689f53f17e1bb7ff665807493097411d529e3a84f8625406e93b21e6fda

C:\Windows\SysWOW64\msres\skin\icon\pNetDisk_1.png

MD5 328b209a4b30f6e3840f5edc22296acf
SHA1 fdab9e95a41e4dab67d7e61d4140f3bcecd89dd0
SHA256 dcdc502d8c11b209d86fef4638715fb712df45c54298cb869dce578c82e5d4ef
SHA512 4808aed2c5d330b97167b541f514a30c24e0b45d6b4543ad245ff636454f90b348900062926aee0c50c254ac5cb1e161858bc36e2ca51e975e717b5ef114fce6

C:\Windows\SysWOW64\msres\skin\icon\pNetDisk.png

MD5 28db2590ecea8478c6b1bfc37941f351
SHA1 884f1db9622c5466d3a76d9c49e967bfbc0c161c
SHA256 16d5b7cc4c81f2add22ad65616f01ba5488ec9ca3aed171bb946e64e454da866
SHA512 31b0c49ea827c1ffa82041e573836d50bdf0d213346d3547f43bdd5f597818b4218f707d820eaf418de2decb31210e04078b94fefc0aa7db6f1bc8004aee411f

C:\Windows\SysWOW64\msres\skin\icon\p7_1.png

MD5 74c97aa0c28d7acc8b3ac809a378ab43
SHA1 949e3a1dd67b47c96a90d0efc6120cfc6cdd908b
SHA256 50a73b7de9dce38010fbcaaac8f4b50038b34d5eab7d6764e1f8cc2c5388cfa6
SHA512 a4e208ef55c2fbab70a9240de0d546d0a48e7979136b3981e2a7cab8f405aa9ac64f93da2b9f9030729759b6ba1190b82877c2cce4d2a09baed3ab77a8709bf8

C:\Windows\SysWOW64\msres\skin\icon\p7.png

MD5 607197c8f8f1047876e6c9172ffab140
SHA1 0bdf36e3e1de642aeeda7c45377aeebab6681277
SHA256 51fd391eeadd4ee7ba07a24991b7446042362b035dff4638994eacf87de16e9d
SHA512 fa0c19db1562e75a736f6f155e4e5bf692657fa4c5575e103cc575c7afaff88701512ee186a6a4cb86ef8c3e9417e34ea7fefe37518fe2f250b528e087ec52c1

C:\Windows\SysWOW64\msres\skin\icon\p6_1.png

MD5 b80580567c2ea520173889a378474c92
SHA1 723a314e90ca992b1b95ef65eab0982bed1ac2f0
SHA256 ca012a9bb5fa4f001657ae9d55cf5c84b0e6dea65ecc4eb782e2561f2c5847d2
SHA512 0ec58325c1a09f2892287040527ae3a3c2fc442e0777cb673a48a5ed32c27ae8b9b8b09c10ec455e3cd6de4c6d92d5fa77163a78d08a612f57f264d4b703b1b2

C:\Windows\SysWOW64\msres\skin\icon\p6.png

MD5 76e42446b24afc1e0afaca266ca3f13d
SHA1 168fc362a0e12cb93833ac1ad390eac342d055b8
SHA256 fd0e97811fd7d73812a1dd1a3e4f66f7e9953708faf906fb8f0c6d784067027f
SHA512 3d4ee0dd3b1ad5658c1871aea7ef8eb81357c4d38b80962136b38ab53e0a524025bcf5d678acdcf43847b48b8743bccbb73e53d689582dab2bc78fe8828080a6

C:\Windows\SysWOW64\msres\skin\icon\p5_1.png

MD5 432c09cc3195c20ee9ae292cbd703212
SHA1 53f6e1d78842bf6375ae10098f8abc4d54b7e70d
SHA256 736eaa15a7e7c76f53dd972f74a688a52a3a5f93a6eed3eac5eea45b29dd16bf
SHA512 131390422473182f2c698cc72cb93d45de0142213be59ed004e2c145dc6b5df0db99ff6d32d7d78aca95dc34938809d4b25ceb2da8d91e755c74eb7a386ddf23

C:\Windows\SysWOW64\msres\skin\icon\p5.png

MD5 ff7900b33cf8d309e3a61f45d64e7c91
SHA1 6334dc926661446b50429312474ed3a1051a9b8b
SHA256 03b4dff8b7b77fd8085ceb1dea006e1b10108ac69a49833dfc46893120b3a2cc
SHA512 81775d35a0a0ab58baad3970b75ee584f9a495af9019b53bdf6e3aa6f141b869881a07de60423b5b55afcc0c664c3454876a048b35376aac65ad691bec6bf74c

C:\Windows\SysWOW64\msres\skin\icon\p4_1.png

MD5 9a3f72316be8831a7268072ed0746895
SHA1 d0085afe59c72ef8dfa869807748691b40b46a0d
SHA256 1b735bd2d8187e7a9c4e1ab4162c2fcbb3cf70a2e2f5b304cd1ffde68984a2f8
SHA512 845c6181e428de514e2666a4f6e47b8c870d095932fdf84ac0a6a5a16fd68a13a21b1200a62e9e509fb9cc1b2e20049a70fb4ba7f2bb236aa5b6bc6c41a1dccf

C:\Windows\SysWOW64\msres\skin\icon\p4.png

MD5 b0e29af12e01523e3aebf2a244c20289
SHA1 887602a3c89b0d90a49be8b46ccca635526a11d0
SHA256 e45a156f8cff6f4532e4dc1a6e57a6295522d464a6d2a52c71ce4b634d40eac6
SHA512 9056fe48414351b55230e4899f349fd19cc2196252e963f4e9618f96688b72ef624aa16ec65df38f939601fbd41f13fdbf9d36392144bb4380a71b803a4f2226

C:\Windows\SysWOW64\msres\skin\icon\p3_1.png

MD5 d763d43de32a0de6de72b2a4104a3546
SHA1 329db196cfbedbfcf7a6c23eea4729a25aac38f9
SHA256 2d5aba1d3458b0af77e8affa448e043902fc251cf9cc1ad8599547dab4b2f24c
SHA512 082e6376c75a196c7e3cc938f6499cd82da1cbd7d99484a0dd87d8b745379ea5e88530b4a037fcabe2cd6a0e488e8a11d79968f68aaf4fc68accdd0e9100c05a

C:\Windows\SysWOW64\msres\skin\icon\p3.png

MD5 bb01e50abebced31e844287505aac23e
SHA1 804319b2afa1b8c2b7bfc5fe58397a72d00ead39
SHA256 f743324c2a0fcdb446a744ca90cf278e1bae2d6a1027aa75e6478eb469747bf1
SHA512 9b1097c0c8c64b3e20aac18f8e569cb50777e1f83ac5e16554d831555c586d5cda221a29bf4b2e7fc234682d3e2a352546b157d57bf9cd9f9d6ed1a57d0421d0

C:\Windows\SysWOW64\msres\skin\icon\p2_1.png

MD5 0afafab3923b8d82aa8f26c248d43c83
SHA1 af171cd36d438838f2b70f980cd27a8ab890db63
SHA256 8bc5907b8dce52d8e6b04db3e778f0e79e60c65034bd96f3ea9e5bd134961fe9
SHA512 001f232839b50fdbf7a18ac03fd763c1aaee782fcfea83147c027c72e6bcb75ddbc6aaf3487cd70d51688a2ab05f9c97d044d67c1e8b9b5a2813d25a8b7dfd31

C:\Windows\SysWOW64\msres\skin\icon\p2.png

MD5 9cf7266663ab86a3b22282e8857bb36b
SHA1 7cfb5615b254ee0890949674aae6d85e8337886a
SHA256 395713c6bda03d6b204fee18b118095ea2171c8ae528a4235d624a963abe4324
SHA512 84c0ab318d46b5836f22fa02eaf2cd4322c9fd035456b1076e819129366a935420d1685443fcc64124be9300c35dff9720430e43d28f3ebd0df58ba18b1d433f

C:\Windows\SysWOW64\msres\skin\icon\p1_1.png

MD5 29ef6447fd64b87ebb581945c13928bd
SHA1 ada100938a97b4451d475f5351552d16f60558f1
SHA256 8fb6f400a846c390f23b609fedeb7b91aab182d580d3019f3c27e3062d512bde
SHA512 42a67344d7ba22757205a3e03fada64f91a89cdb76fa51a545bbb14e06410434a883326fafbcae6ebd910b5c459292ee5b71e0f3fed49c98762a129e65f8dfa0

C:\Windows\SysWOW64\msres\skin\icon\p1.png

MD5 edb974624d24c9bcb4dcfd8d28d264ed
SHA1 f58a0c9dd42e1bed19b473cb5558dc8997d1627b
SHA256 68e1b29cc57ab61e90ced54d3152e85e28806e5723a650638def8c67050704f4
SHA512 1dbd513eed04a6e3f1a65ba4a4b3d9bc03c23d47401e812321d6050c5972094283129153270dc524e549ee7b3f088833a1779b0687ff2eb0ffd9c80154e6927f

C:\Windows\SysWOW64\msres\skin\icon\p0_1.png

MD5 94a7615f624c6e1743e9a7b1418a71d8
SHA1 da70a2a1118744c0de9fafb935f5a5be57156623
SHA256 bec6ab41af13b1ba41af43875681b1a1ce11fdbfb35b7e4c66c00c4f170a26cc
SHA512 9a4741e4630ecd33a647985fcff2d15a40218c78cc2e608fbb833163c5b19c5fa731310d55dc715049ec5def6442e5c478d152de1db3341314a1cc8a5cb3120f

C:\Windows\SysWOW64\msres\skin\icon\p0.png

MD5 4081330a91d4fa354924bbc56d1813e6
SHA1 d0c317d13947d24e13b6a51b1936a2191f1998bd
SHA256 08c2c80db2822a1192d1ddce0c4d2ef09d333eaa2a538f2624b8fb3dd9a41142
SHA512 8f30cfa19c6866787f9e37d5fb53717700f32277e3ab18871d08dacb68ed7853bb2ba960e2665dd42bb66bcdec97c28f99b834be55d18e33d633567a50bb496d

C:\Windows\SysWOW64\msres\skin\icon\jzai.gif

MD5 9e0adf17bc72f0e29fd6181ec56d491c
SHA1 b85e3c53200da84a68bbe32e55045ec8a927f2ed
SHA256 8e27d6d64df364cc62efc607fb08aa834891da819d70abedb30806001dae5da1
SHA512 27dbcfabf4397db8a789bc8ca99e446b42b59340c120eb369ae1193f2a7a39d2ce3c0af17eda273d0a66f586cbac933dca45c51c5a0d8c8e645ce717e3ec43f8

C:\Windows\SysWOW64\msres\skin\icon\ico_ture.png

MD5 b6664c8e59218355f6acbe0d37dd0c6d
SHA1 fe4b96e9997eab78e9b235691befe58b873abca1
SHA256 33ec109b04a70634863ca60f64181c1ba8c35ef84beeda3e164f48ba07736e23
SHA512 8a065cdf7e8921e3e873f82e531c024ffe1bec2cb3d91aa01155d565444643588078c0bdba6263a60b624d15b3f8d77791cb199bdf5b26fd778dbd0d9e86973c

C:\Windows\SysWOW64\msres\skin\icon\ico_force.png

MD5 6859cbd1c0f462b10021e96f7ab35761
SHA1 ff9ba6b9ce69745681f38bd3c4b760942c55d5d6
SHA256 5add4c8441be1b839955697fde7e79470a72d70547459312ae02d65a466a1994
SHA512 b8e07c176581dfae041f4e7509d053ec2fca5a5eb16b9258285befa004b417f4ae8795f4088477f6922ebc0d271dee7914ab17fc7550518c46b3bb789426e8a1

C:\Windows\SysWOW64\msres\skin\icon\ico7.png

MD5 0a881ae90de60ef3f4f187cc2019287e
SHA1 683c1b8cd656e7e97583147ed919d3deafd12be5
SHA256 6592a94b2743b388055ce3e18e5c432010bce49002d5c64f9950fb5d081b9d1e
SHA512 3db6cd2a497e6f0ef8f7efb9a6abb892ebd6fbf16d4d08ca65e4c595241260f33333f4a27727e0101e4480b26dea7f79821aa058e518aa8de92a68fd5f24c106

C:\Windows\SysWOW64\msres\skin\icon\ico6.png

MD5 ebc678da4190c9a0bdc5127928c0d0e5
SHA1 34ff8e4c3e1c69b92321c24b6b3c7205fa4e69f5
SHA256 20d7846ab7157785f4f5fb58e0c0a130f90475e6bb33c9c35317dc44bba67207
SHA512 4e75b2325b7cc4f10102e6508697fff9fc02405c1040a5c3f7e9da57b43b416d50d2003ecd59ac44d207be6b2e6c715922c1fae0616065d94aa05dab82281a86

C:\Windows\SysWOW64\msres\skin\icon\ico5.png

MD5 a72bc621ec69f6d076f24af43701225d
SHA1 931aedcefafb95e9ed07bfdcc33d9ae2dc9d41a2
SHA256 6efff1198fb3488889bebe792dca2794d7aa6d0e04a8c693a561065e6658de66
SHA512 c091b63162ac5cf3773db9c16689c39b51c1b718d3c2d3358d8bb3276a8f17178067d031d966b518663ea37d59d6a9a8da9e0674575dea0b08bf60908e546199

C:\Windows\SysWOW64\msres\skin\icon\ico4.png

MD5 4ff9f021ac4a7a57c5c1a0711ef2e914
SHA1 1d72805d315f36028996b6d1259271393a6dd383
SHA256 75e82832eab67f1e64fb571b98dacd9cad0440f32ebed46814bea85f43e8a586
SHA512 a44affa3b06c56d0fdfe0ae095581b9dc9437ba50e6701869eb420c21e3762141f71f129a46c7096518b375998a7fcac01aca2c58c6cb2dd76dfc9d39119628c

C:\Windows\SysWOW64\msres\skin\icon\ico3.png

MD5 6609c78a2756d90796f31e348247e325
SHA1 f70ca9c6b285366ecbaa2f6ff5cf646b570aee15
SHA256 ce86c3ee77807325bf0ea60ff6ad7168fb8d9ab98ac17f907fadddec4efed928
SHA512 dc429d295eee38364cbc9fdb331d521a6ad458e03af573d207cce73db980345a9ee63410feed0e763e77d2d149a22494de81ac1d4462bf0c6497cbcf9adbc1eb

C:\Windows\SysWOW64\msres\skin\icon\ico2.png

MD5 3b2adfa4279b9421546095989a42c29b
SHA1 efa0b2c66bafadec1277faa5b8636adc2eca05c1
SHA256 84eb72c4a70d4cb82e8d399db395363b037f7c69954ff3abf39918b586a77716
SHA512 0d328233010fed4d463955a1113d11b38960c20457199e65975a43eb3d0a7e9aee3047c67aa2c2a550ed04fb3fbeb1cec2aea1c447cfb2b5ce4a54c6267bed33

C:\Windows\SysWOW64\msres\skin\icon\ico1.png

MD5 8e3518321e329f5eecd82abe6a9a02e4
SHA1 03ab4c69d511daefc00854578d82f467f34df76c
SHA256 c88742bd594eeeb34ca9e761bd48712a291b887d6f98ca63a40c251816618237
SHA512 6f51aa0da8d6a6afe62a6ca06e49483bc3862ddcf37ff38e908d429a321cf361c4174cd0dbcfd8ff667185fbc40b64278ef25415e290ffce06daf0b94ec7fc0f

C:\Windows\SysWOW64\msres\skin\icon\gx01.png

MD5 2a260448e96a03cd4c8afe2f72809232
SHA1 9699249cf87a79e070191925f735b2a6b9e1f462
SHA256 48451401a347384b2404118b8b02cbfcd5b11923a3c099014c8a285a1c108684
SHA512 db5f7ec7039c9aa1b226dc6093c13ead84004079b946f3b6b212ad8bd4842cb1e662a03b59daadffc4103d0c5283c15b01552ce9b1d04eed5c6ca1d9e07bd743

C:\Windows\SysWOW64\msres\skin\icon\chat_1.png

MD5 b2a732609d7de098efd2be853ce45982
SHA1 0c352bb24f80929dd7fcd528b9c9b3ac823ef7cf
SHA256 bb2b5e55ae57c268ac1938afcb8b94c7495edd7f2b84b61eb5398a3c4482eb8d
SHA512 3f328d74774a319b4307fb8ad09154bbb92d621f6a082dfdbb556c1edd9b21604d0249bba84165677202139fa5645a8c04249b7eb43a419f2a5a3172d24af580

C:\Windows\SysWOW64\msres\skin\icon\chat.png

MD5 9b3f28bc022c51bf16aa758315eeda27
SHA1 c9162efba40795a7774b7eff804a9ce4a842b0f5
SHA256 3554a235a6583693018afda7dfee7781cdf9639068cd531bc44d4bd3d9ebf706
SHA512 87a7c4db1ca0499e13d453a2033631676f8d6b3e68dc2c615d02759227f6729e596aec79fec79c37173ca0f88ad652d106ef97a090313cfb75f3103a56533cff

C:\Windows\SysWOW64\msres\skin\dlp\yundisk.bmp

MD5 c44cb9768c85d7d5116f2fc530ddb95f
SHA1 faf79d9132fe0039976686978e7b05a224d99dc2
SHA256 cde5d1ad909187eaea434ac6180d75bc8a42b73d2e749d600e8207df480ad2d4
SHA512 b5eaf79ba6291971049d3dabc7a50fa4bc926560313bb51898ea1bf3e36d3ebc11b9969eff55a2f725dd4d2d1287e8aa07f18c14ce9eb4ec8ae91b62aedc5468

C:\Windows\SysWOW64\msres\skin\dlp\wjj.bmp

MD5 fed2e552254a627da3ac3ba69bcd947f
SHA1 8b6914276a557c0627949371a866c75ee5de9b02
SHA256 41ddc657fc9c98a59fe66ee439e2b553c2da8cb796c5531365b6338f19d7558b
SHA512 5efdcada9cd9321f29366cc6d07785e958809b0d754c29833f45bcedee37cd18b917bc76098f856579046c82f48fdaaade87145f3f731ec60a2e8d91a9fc738f

C:\Windows\SysWOW64\msres\skin\dlp\search.bmp

MD5 aa3eb3caf37c2490cd54415e502159d9
SHA1 ca3ae832445e10f95e097664e091edb1b03cf53c
SHA256 7ee7e4f2729fe6444deedf75dca40c3a8ec707b10925173433f9bb51d6c60497
SHA512 1da7b970856b43d66eb9741aa01349148fb626cbe89643c5d781b5b382ede415e2c81b7ad02a9261b06e85872e74c7611d4a0651d4325cace05c43975259b1a5

C:\Windows\SysWOW64\msres\skin\dlp\safedisk.bmp

MD5 890327d9157ba4e419750df4475f8e8b
SHA1 194fdd81da5587624b32d2bbe195aa6878633b6c
SHA256 3302a9d005bef5ce049b8e35cce912d15725226097a5393d5b8c16ce1f76f2b9
SHA512 f05f7bbc33d4259233a18c06ed104524392bf685838b7a7732ebdc54e25ed555d75db8b6b0553bbe146dd1ced38a2475c30e2e999b9848de866adcf0ef86e478

C:\Windows\SysWOW64\msres\skin\dlp\ppt.bmp

MD5 818943abfb3e2f6a66bdf9aa1b60d598
SHA1 12f2ba06b4322a3beedfa6edb8ae0abe886f102e
SHA256 be2292ba642b8c2aeb04483366bfb85771bf4fdcbe498887b1385b3b4a00621f
SHA512 64b7a9e6af470a617472e5e818a691991003e9b1e436deb7285e65fe3f343e0b124027f8dfc63dcfd3e3087f161b2b279dfd29195b6402f8ec1ed2d83b3d4c9a

C:\Windows\SysWOW64\msres\skin\dlp\pdf.bmp

MD5 283b536288a9e2064c143d1e0d59799f
SHA1 97317faf27adc622dcfd23374017eb558cb2215d
SHA256 f9941e6e9846314895e88f5c8e7ef2bb6fdbbff737500456edbba2563d05d72e
SHA512 bfcb8b024fb2fa5188603a0e1c14487f9a8d5798f6d9df493b8235b431fc9d8189ed4a7b353c5c38bec6d318e796627ef26f7275fe4d19f2573dbb82aff215c0

C:\Windows\SysWOW64\msres\skin\dlp\jpg.bmp

MD5 c605eac0c8b14425df71f1a6a336ba74
SHA1 76ee8848e788bd3fd3867868530738eb0d803ec4
SHA256 ffcaa3814d233248aceddff26537388eeaf8121179796808e39fcc6578aabf8f
SHA512 d5e5bfed39a129f9dc996d2cf8a069b900965b927221fa3d02886b390293aabe871b42e2e074318834779287e79a342c1ca960e0b81710e487e012a997790d31

C:\Windows\SysWOW64\msres\skin\dlp\down.bmp

MD5 2be1b162b7206edcf6905d14fb3bb112
SHA1 4b0f6c9c03b0f800c619a653dace5fc77ad0e2dc
SHA256 dc2583c8db29ba15dbba7d94a529a6b7d5e4292bf771cc5343a7f2bf831528c0
SHA512 fc3fd805d268e3e05239c8825780a01f81452a17f240726f32252bb9ab18246689dd37bc1474b1070fad8e23338b5520f9880365de6cec7d7ac10e2eafdfa0c0

C:\Windows\SysWOW64\msres\skin\dlp\doc.bmp

MD5 4c880ed17e3bcc32376ffd6e26b95a6c
SHA1 595bb97686084b85985bc80deb3b1de438497b52
SHA256 06a9b983f1e6a5cb1f9fd06bea8871b12538639fb46bebc43711e7d168e00de7
SHA512 eeb6437bc365c0831e4a3c6b1129685ca6c2e3920792fe327053dadbbf6e714109e476ea15230c02d3d50c0807c5065e0f5a4b34e70ec807c7d09f3649a1afb2

C:\Windows\SysWOW64\msres\skin\dlp\dir_splite.bmp

MD5 bf3d7f9032429416a77b3f49fb9b20b8
SHA1 556d9d37a14897c26058f514caa1b7f6b5efc618
SHA256 6f22f362c80aad368be42d7f3427ae753222ba89255bee1f4144912e7114deed
SHA512 5efa66d4d09b447a0a22633276788daf9a12142ac657994448cfd4f3692186d14ffbff873101cea69d29e26994849d29687a3c63a40e638094fe7bb70d51a5fe

C:\Windows\SysWOW64\msres\skin\dlp\dir_bk.bmp

MD5 534a55ffbd781cf6ca85da7fc3dafb33
SHA1 c80bdb1290f6414d69f52dae8f88c041a80316ec
SHA256 5a61bdef0dda5f82b5c3a69c8ba7f455a44d3dee05bd9ec3f569090ef9392318
SHA512 033178492c86eb6c1ceeb2781b5d249443085abf7e9b639b185adb3108b4cd274fe3126ba45f398d8f64d8ed4b18eabff2de11a91533f36fa385d46045871c10

C:\Windows\SysWOW64\msres\skin\dlp\dir.bmp

MD5 724cda648a9fcd16f5e8ccc3f3a1151a
SHA1 bb364e9a4a90c1b0cc81b9539dc0083607d52db5
SHA256 2d2328e9496fb86306febcc763fc01dbde94dab837ccfb3c2203419c446b3c3d
SHA512 c57c851b698ef83f6aea33af7d502c3aae76bbe5a62b6a7f4bf28fa8543dd51468ffb210859cc691c329a8e7a2888ac8247dd6d632e6af9d51e00eaf63249d99

C:\Windows\SysWOW64\msres\skin\dlp\box_3.bmp

MD5 b77c1f2d7952d92cc476fb5e96683cfa
SHA1 7ac29300051fa68c93f9d0888c199e2f3e3244a9
SHA256 a45aafbb2bae30fcc6f4ad6c8f5a533205e5e045b87fcdfd8307ff6121e55c46
SHA512 db37629e2fafce25168bd035204de0e5bef8a8a8ac553c3044c0ea61b0d02dc4c0b553b814ce0e047d18b6d14b9ffc0913e7bc022bb79bfba733c0333dfa6a86

C:\Windows\SysWOW64\msres\skin\dlp\box_2.bmp

MD5 2d2e72fd1226b25fd6abd74409bb36ef
SHA1 912917dd801ddf3951c4bf0acdcfe4d63746dd35
SHA256 9df050c7bd026b540bc4b9c9bfe337611af85ec34dcc0a061f296c951b895e9b
SHA512 a5569789c81ade58b2417b2d83c3dbc09e7ca1f52063d44fa138def823a1beaedd008204591949e2e0d390c6488776c0b911a9cedf4bb1d9e4f625f417c01073

C:\Windows\SysWOW64\msres\skin\dlp\box_1.bmp

MD5 a29a325a7789d33df2cf7122578c1162
SHA1 6b6dcce3f93574766c493ae48399565fcb9d4faa
SHA256 7ba7b4720e213f1e8bab771f5885845c9d01daad737e90b947e7335816b32c5d
SHA512 0bd351e2fa0b7c14c0d01b1b9498865897135cb5d5c9e61785870117201a258f8ae79f6f77c49e2bc67781807d24a7456a182cbb6aef0aa92819063a5b287af5

C:\Windows\SysWOW64\msres\skin\btn\zhuce.png

MD5 14b19124b5ca404afee8b085fe0c3d65
SHA1 f9a88586e639c8cfa5acd9b109b7ad06084e67f6
SHA256 3b85f63ddeb0000544977b00eadf1f059732496518e8f870685e90d5b8de0ec6
SHA512 c672c03d5cbd645db447071b9f3a48faafbcae0bf8f57ac9655e76fe6d700a42127c932f0a0116cbc1b9aab62bdb3be498633c0cf2f7c01ca68b884c30142e9a

C:\Windows\SysWOW64\msres\skin\btn\yj_02.bmp

MD5 25a84b54ff340670998291321893fa1a
SHA1 85af36955dea5c6f17b9ba9a7fd977ab94f4685a
SHA256 f6f1d3214cb9af58bb45fd5ff866fb0e2b695c8758cac8ad86ac2ae77aac6a0c
SHA512 dc36fbb0b71b5261ae0fbf0de1d72e31f1bf7e001526c7a0818286c4f3584ad773fb242d90664b1abaf8588ebf8ca612895da3614382d9a6449fe7888c1db575

C:\Windows\SysWOW64\msres\skin\btn\yj_01.bmp

MD5 c48069874e1d34e5bba67e7f4e843bdc
SHA1 cbc84e5076f208e6951c14d618b47dfb94f393f5
SHA256 5dbdc330251b3f8e0178e61b61238e8294fe3eb32179abb2db5794cf4527b1f0
SHA512 a94cd9df3de5f66e1f078d85307c0d68d542819f8fb29d5961c0f3d5c6402d0a2aeac9e00a14ac29466a669ccb9529dfb741c83a2aa26fa82aa29ea97634af58

C:\Windows\SysWOW64\msres\skin\btn\xx_03.bmp

MD5 7e9d6969104fa9f0ad69fbca8aef68a7
SHA1 2632f13ef44f9f39d1eda1ec801c12e51a57ad27
SHA256 f1ac25e1552e08cebda9693c51388b9d47e1609ab8db964c60fe69dbb12efacc
SHA512 9aefe528f4cbdc85f5fb774ea8698b258a09cbc4474690b4e1be85d5f28739f730ce052adcc45438aa6b2cf69e871419fc3f1ac3e103a7802e14888c224dd06c

C:\Windows\SysWOW64\msres\skin\btn\xx_02.bmp

MD5 9f50254a0e250326e2fd8378a3e24937
SHA1 76412f98c86f1553624b29f5402e67e0fa51d94f
SHA256 91f513bbac064c5a4911f2ced5a31619c1681e895138715a4a361ba1cf649b90
SHA512 3b298e4d4857918fb7dd9a1f1d3090f95d73a72f4ed0b02db5e3b0ddbea5d212621e98cf5b7a044ee784aa77f0228bdbaa959afdbcd02b6dc2c1014d928e7a29

C:\Windows\SysWOW64\msres\skin\btn\xx_01.bmp

MD5 59c55b6efd99eac43e28e824e606f9e7
SHA1 e1507bc1d0a96762f108d47c9dd6bf806672ec28
SHA256 cf3658c067043599630d4298843a4031280fd729541d8dfa3b8f31bd1af07d80
SHA512 10a21820e4f60feaf3a6efb21f6408369d34c9a3aa0cf1973ce0b5c857af15dc29ec607da9ff1d586e03ad81ccbf5a36f159be8e62075ebeec719afb509bcea5

C:\Windows\SysWOW64\msres\skin\btn\xuan0.png

MD5 bb3a4405f2a9d5f4f6bd8ec8a22c0619
SHA1 28f7c5aaf5ebe2d7699b4d6692cca065dec0be57
SHA256 e04e7dce2d8fbebc36cf42dea4a431e89ad428e6c0899258f1fd2300964de6ef
SHA512 d74748af8bc5ad1a97294ecfda19b10bc448d83a9897ac340543b005000b9b35eeb60ddf158a70d5119a731c5a3168eb059325b591d50eddd525a81318e5b51e

C:\Windows\SysWOW64\msres\skin\btn\userregclose.png

MD5 eb6316b9c081a1a13ad16d4abe56e4b3
SHA1 3616267f1d154aceefff0fb553029975d6071df3
SHA256 b3feafd844a7c1d1ee41d3f1d916a3850a0f29b090fd4cb3be35eafe73158811
SHA512 9734681116214597465e948b426d5c75ae05e369a3bf5059f88740dbfac4b6c69d3a25138d095339e549c50fedea0b696b970f3bd14323eda59812004e6571b5

C:\Windows\SysWOW64\msres\skin\btn\userchange_03.bmp

MD5 6bc5000890a0df120151f350c82a89c5
SHA1 4108a9d46cdaaa4f1faa4fcacc7960679112de08
SHA256 ab6a2e10f0c8262d784c1b2f408279577a3c79ce4c29a1b762a831c9d220e362
SHA512 82c91af78fbb3f0fd2d5022dcfcd5c324e039878ae870c46e73e00176e551e40018ef6fe9305be12d3a315c65a0ad54b22b5be4d2bb0a97624a078ec59ca2f31

C:\Windows\SysWOW64\msres\skin\btn\userchange_02.bmp

MD5 872dae41681b751cd2ae89dd6c9a9bf6
SHA1 d2b5f63d61b342f68979789ec6bacee1871b20dc
SHA256 08e7e887a9f38de99f5d8ae1dfd580cddde27fa59f00e9b435604134847ba22b
SHA512 e623a923740be0264f3832dfeba8397d18936e6ecee99cb4c49d37bb6a6178b3091263113f391355399e0ed51b1ea69e30e02940690241be2ce1c874bebf8ba5

C:\Windows\SysWOW64\msres\skin\btn\userchange_01.bmp

MD5 639531d855e0e46a7c056f91afb66e18
SHA1 07640f05adedcb22f7ad967c441dd331888d37c4
SHA256 f2b974bf0c3fa8af1ea42243866379c7135ff3e8960f8228dbbbf8c44385b2c3
SHA512 5b55523672b42ce8505464e4004e39d4a8ab528978a2bec7aee71313ad024cb80ea17c0570a2e476695b0c831b00a666e1359fc1011ac2a1cf9f7616969933ed

C:\Windows\SysWOW64\msres\skin\btn\uploadbt_3.bmp

MD5 3c1b2646185ecf6223f35e417e68a4ce
SHA1 d3bc3a5d85c34a097a74f9f9b53632951756e983
SHA256 2c2b6b62dd705686946d17260ad5be4b773828f99e8582e7f553ae6caeee9d3d
SHA512 91b0d1b500eb15f71dd172639607f4ca60b4ccac40e8fd1e4e243182c1f41b466a914c369c2d33027482e5930aeb09f52d473018d283b12010fdadb7dfdf93e7

C:\Windows\SysWOW64\msres\skin\btn\uploadbt_2.bmp

MD5 a4de09d017b33570a7977edf5249a224
SHA1 ff6c242533e5c5883e13ed6b035c43913f3a49e3
SHA256 4c1615c0db1982e5379c4bd553d78a50a33725cd8cce21f52c98f320b68b22da
SHA512 4b7242dcf09b0b676db90e74306cdcf92509d08de96da79b67597730d58c8245e2734852e435f64db5087f8c5e6797f27e5cc67fa6f7edbf70de02742e62573c

C:\Windows\SysWOW64\msres\skin\btn\uploadbt_1.bmp

MD5 50bd861bd5f4aa22e2ee0f621da2b11f
SHA1 6884657dc9fdca3413d623ab3077c1ef10d39926
SHA256 4f7c9974dfe93fd95b395329e9db483d89ca53373da40ce369f4417f234ed397
SHA512 fabcc044977fac36d9102f24e22811d67f5d5152e5bc27c6a33b4b0f2fdb0c27ab319748dabe84669706b5816f19c8559232cc11c7ab15ad5a6c0a20f80f338b

C:\Windows\SysWOW64\msres\skin\btn\up.bmp

MD5 1be29229f704b365505d0d2d1d7fcfd6
SHA1 77625860c976683a556638c14821c4d5ff9ae69a
SHA256 432b9d7539db9f482916c5bf6b103e669963f4dbeedbe11d90af026cf6c41c3d
SHA512 7dbf910ce73756825ecffb561e090aca08d6eeee6f6bba94f266a73272e4a8c494b00dede8bd16e40d1f0633b8dcfa5733bf810b681e108e6a27322a59ecc188

C:\Windows\SysWOW64\msres\skin\btn\sz_03.png

MD5 6b1ede9faaf0db4ea08fdebf319e8e59
SHA1 6a6d14f3acedecf4794c9ffa04447a6374ff66a1
SHA256 1643fca462910c4b544c0d5dfb22543f93ca28ddbebfd9821b3a4d574449161a
SHA512 5825d59d401c7522d366a2cc3862e5d30f9cad0a7fd9a8537b114943c0f3a7b90cdab42cc3dd429b1fe9ee3d86eaefd0144cf82b09a81d205f970beedcd907f8

C:\Windows\SysWOW64\msres\skin\btn\sz_02.png

MD5 3861581579a3bd4b1c07640aa1da34b2
SHA1 2b5276fb821c024ff7ce516256f2a67311c9aebd
SHA256 ee013f1f23a8126286902d00d73cbde34a59b674d561815e8497bc032e323f6e
SHA512 cf94e5c564a29208655a4d3fd863fda4b0f72c1a7f4f675144b225763c2530696a282c53723446836b75d3c2f0354f265f335f0a21d09444f4b58efb62103e62

C:\Windows\SysWOW64\msres\skin\btn\sz_01.png

MD5 092c79a65691d95228f6928a5440d524
SHA1 8bbf1f9227ae694b6f72e63a1a1b9b537c69381d
SHA256 7f0f783c6e6467be3fdd6a001e0b09781b95722d56b7712c8ad27da01776a4e7
SHA512 30713f6f4e0de8f7331d70980f004a1336efa1d7096aa1662ffab8f8cb435088fc43081e05ae6ca3e154083d175d4d2a06fa3253fe3f18e237d4177b45af6e62

C:\Windows\SysWOW64\msres\skin\btn\sx_03.png

MD5 a31cbc0eb699e6bb087cc88940343210
SHA1 d0016a404420d011d73be1408795feadf042fbe2
SHA256 176a31a76492bd1d51acf5ede3051ccc0b828f3201b775dd8924aadebb5501c0
SHA512 e7db6fe5b3259b1b69cdbf38229c21a03cabbc283732f09411b4dc54f9ca392f464a2883622721a90f3fb0a340bc33dbcfc9c8ea04cf5dda8e7fdd21123e5f39

C:\Windows\SysWOW64\msres\skin\btn\sx_02.png

MD5 269eb2b79faa19f7b0367572cbf78ead
SHA1 bda43e7d138c67f14160ac3c56beac19a4ef6271
SHA256 7ef10953a6d5a9109508ea7966d8141bd8f010aace93c483e831dc317fd782c6
SHA512 3f6f437cf5b825cc4a6961ee3f8f597d849883d1cf9bf95291ac3ec6a1861455586705e68b85ec887540923128a5379b93a554372cfe46278a9d983b698a3416

C:\Windows\SysWOW64\msres\skin\btn\sx_01.png

MD5 f49a753b0b26805f7773b6315f7a9aa1
SHA1 4202ffb7360c842e4cad9914f94fe6ee704229f3
SHA256 ed06649a604de7ac22b1540a1f519a64b81c98b50995b1db97a159991718ddfa
SHA512 7489c87a906560a03d0b9770a699ba493f6684a7f0b89915f571834ccf945b7b772e0a953b1de3638be3d1912e03d9a4081407684eef5c3ed4a1a73fb99e9151

C:\Windows\SysWOW64\msres\skin\btn\sendbt_3.bmp

MD5 4965fdf59ae52ba9f3140e963de6fd52
SHA1 75a3d4c49bb7aa04c491723a1aaf0bd9550be859
SHA256 3096c5316080628eb34d6ed92d0e02cb60307f4e74300cb2314ea1b0b6a7b34f
SHA512 c0691e89cb4bbfeb9f7118ff36a187e5110a1bfd686b14c1c2b45730d23ca4bce49927995b1b1bd03a2353cadb7f0cde552e95beb65b9f717911061d89b1e68a

C:\Windows\SysWOW64\msres\skin\btn\sendbt_2.bmp

MD5 bf922d12e4d0fbbb4a41fc4727745340
SHA1 2a8482c9fc21b75f28976e8a05e52dfa6d9c29eb
SHA256 5137a053f646ed5108ddb02b55d4196eb1620857759c4ad044e1d3128240c6bb
SHA512 c731110e0f75f85a041bb0dcbc93d7ce8ed6afc3feceb9c5ece751ddca20a5c0613f82b167d835a8a87c16e5941c4f60f02c53372743ceaee35b700a07c62429

C:\Windows\SysWOW64\msres\skin\btn\sendbt_1.bmp

MD5 2c7cb691f96da3c0b9e0ac0ceb209000
SHA1 b820ff7f8db411b3e777e767643a52e71852bfd0
SHA256 7b9290419c263af60147b5ce019abb9ee642507caecaf13ff9868d9ef5bce9ab
SHA512 b2e3cc61f9333c2d31e76184c70c9f5191add7d9e219b145ee05f8d74de448672f9c39205509acedd86819e79572288d2b9fc834cde7c96291d4e9962de89b8b

C:\Windows\SysWOW64\msres\skin\btn\select_fan2.bmp

MD5 68c29a6a96f79d1752d4ed1b7e5fb468
SHA1 86a9e1dbe02844f100c6fd22552800f967bf35c4
SHA256 6e255e441067904d1638f2dba90213d770dd62511305cafec6a2883febfb7aa7
SHA512 42749893a2810b5054bcc1b1c6d38a2f7bce6c2d411b91b19b5fc3d3ec30cb55dd3071ec5ed08b57ed75991ebd05b264eb583ace339be1d467b50770771ff5de

C:\Windows\SysWOW64\msres\skin\btn\select_fan.bmp

MD5 3894c30bb204feb48e745b57c6cba45a
SHA1 9d09f877741198b952b7297b80d29f3ab906433d
SHA256 e63ca2fa2b0daee61de7561edc6b4a62e19f2c24eec834cc9e582f157f8ea5d2
SHA512 455705067b7de4989d45e8edec707a3fd20d495fb11c8dd09f72288624c53c7809e76e1af7192d55e58392571dc6134f8b116578ebe170ec7833228d117fb0ca

C:\Windows\SysWOW64\msres\skin\btn\select_all2.bmp

MD5 f4a8585f6ed37542345702b15dc2aa45
SHA1 b131b59bc155dbf64949849d353c717772b0aca2
SHA256 56c485657d3a2a4cf713d6623fa4827937646c5ba0d42c0c73ca9fd584dbd24e
SHA512 91ab53003dab39e9f06d5166588e303af410f7ebc3d1d6771c1aff0987c51581f5a9dd4322062b0cdc32da39ba5fbd13e78e5477ff6906a356337f1b887b28e6

C:\Windows\SysWOW64\msres\skin\btn\select_all.bmp

MD5 68dee43fa6dc2e191828d9e209ee93a7
SHA1 f3a6f36969f58ef154ee9336da815547e798e399
SHA256 ef8a06d01c11ccee7a39c86fcc06d4941a257c052190db57f2691d0e427b307d
SHA512 91921719eafe83afeefa847c416a355fa02302a5ca594107315e66fcbee78bcbe95eeb53c2395030997d85383bbbeac82d0c80e210749b0f96e982b217e62193

C:\Windows\SysWOW64\msres\skin\btn\repairall2.png

MD5 e364790acf16c00376d29976dfa7a90e
SHA1 e4c61ec21501262712605d9f0fb6737306bf0d19
SHA256 5de39de19ce92239192cc10ed6b3474c55abd28b42819542cdfc4ec0e75daaba
SHA512 096803a47f6b2a25802be52459e0a48b7026f1d0c4d8c92b9866d832d703c4d727a4a5e1155ea63432cc40748acf13854f4edca32e078d88687deb8e351ac391

C:\Windows\SysWOW64\msres\skin\btn\repairall.png

MD5 d1f09ef50929920922427e4117381c0d
SHA1 fd7c0ebaf54aaa355052eccc3a5eea9a7ad346c6
SHA256 0a9fe4977bae45e368d9ebf915ba7b3a847ffe2f292a4f43692e7bb4cd9a0391
SHA512 8f06d8f4e476fcbc92e34b4c0bc81ca1f481cd0f80e9d43832e30a3baa2ca1e615f828786d6eea702ad18890f14523e7d1e24081b5634021254168598390a415

C:\Windows\SysWOW64\msres\skin\btn\repair2.bmp

MD5 d258762d55c0dc9419b431f583e2972e
SHA1 3f25bd515f659f5fbaf8ae1c1d2acf1f7cc98258
SHA256 e3baad98b151b3c19d3e23776b394dede3cd7902752cdb232ac9a43314585e72
SHA512 6d05ab2493b955e3833999d9b1d6d2245522a8028a6f8bb0ec0743aa252d3e23e4ba7b1b7d6e26ed653f5cfa54b304fb1b4e367dcb5da6c7efbb20ad2bf10b5e

C:\Windows\SysWOW64\msres\skin\btn\repair.bmp

MD5 b0bc8ac7971e2807870545d58ef8d782
SHA1 1b941ae0affca0eef8b34823c475c408112437a5
SHA256 d5bcf05529b42da0889d46a67ba8c5ada093e9730751a7060e5cfb4f1f1cef91
SHA512 9dd83220bd222f68d77fda2fb9b094e7fae82d590a959985293104d6125cf38440623fe73cf804af8744227e085e7e48e646cac6898bf82d0f8821c1a14183e6

C:\Windows\SysWOW64\msres\skin\btn\refreshbt_1.bmp

MD5 1565d3abe9770a7e2d0cfc71f88e73a1
SHA1 14db4a099fe31064cf25f32bed305a781a83052f
SHA256 f6507ffe860cf7a459507bb0874019ce54500a79425780dbbfa0f2ecc0862ae5
SHA512 5ba612da1a06de53fa0d19f3cebbf634bbfb1bb96fb2971c906da7856b996274b3156285068ec0e5124419b24a51f284aedcad9bc2e5c773834693442e05c15d

C:\Windows\SysWOW64\msres\skin\btn\qhdl_02.bmp

MD5 f01d748114d6300eeb9752b1a83b7b00
SHA1 9c37ef2259a07d15cadd1c722a05e9967b71a4fa
SHA256 54e44f9ea378ae94fe757d3b3512297b0a44799fbb6be899f600cd13538592b6
SHA512 dc1cca0dbe187a6a819507a889ff04990bf958ef8b48cff509bdfa21cf46a981049833fab568b3e2f6425aecd5e009f0a16b40f19209fa96dd2453f0d8c78667

C:\Windows\SysWOW64\msres\skin\btn\qhdl_01.bmp

MD5 ecf3856d9a7e72578e560f213834915d
SHA1 f6487978337c33a812253c4d97b2e5a3f9eddfca
SHA256 d0529702147e350dfc80ce3034e53b7a6ed6eab949f9ca804b85f1b39dd5e3a8
SHA512 b8a21941be839a08ef1ad512bb40d7c0672695e193981dc5dd5f5a4cc8fc09fe0e869a5037b3665cc26923342574d66a35b675cc1ad83d7cd86c6500c968ce55

C:\Windows\SysWOW64\msres\skin\btn\preview2.bmp

MD5 9c51d16cae97d8737791d8ee831dff00
SHA1 31cd403e1179adc53082a44de0b65e701ae92533
SHA256 1896570ae2b553204f298015d43c24e7e620368e55b3a2d254e90e6227690441
SHA512 eee5382c799973e13a6845a891d91daad78893ce7979c088e9c08ae3b1a1c2091cf387232874b8e01539278fdf31586f63895622dcfbc652a5c409e31e5f4876

C:\Windows\SysWOW64\msres\skin\btn\preview1.bmp

MD5 4dd794a2155253e372def01e7bea3019
SHA1 8f786e94515613065fc886b72c7cdf8a0679f221
SHA256 4983695a174a147ab6eb5a7e61ff2203054e69e993661d51f6f33c52a3c23e62
SHA512 1b8489dfa19b298c2af6ccaa8c8d4aa6083810daf5e4826d1fd010b4b944b84c60ef7be03a07ede0142fc4d2279df30848c2450f13f72f7ce52253e063b703de

C:\Windows\SysWOW64\msres\skin\btn\patchquery2.png

MD5 c1e991cee8ae756fd63cad582e17e25f
SHA1 e5d88027568850af2a573316355e2d26de3c4d48
SHA256 37f83716db6ede10e4b97aad78ab99a15ac73ac635e54d9d9e8773dd83a665cc
SHA512 e3199ee15fd132724f9e4504226e7f25c8038ac2462fa59aba737975f182714c8c062365803651ac0a6a76dc251f2e7d7b840e07d31e77475662178fb2de6e9f

C:\Windows\SysWOW64\msres\skin\btn\patchquery.png

MD5 0ce3819d97d15fe9087f6406a8f332ba
SHA1 04d28604e6c5531ba1dff3852dade03aec71e9fa
SHA256 8af41df17786316c9825f051190fd2db02692a80d4c5cc7b4d28e72d3f8de437
SHA512 7b5cce6e9c789108fe80347caedb8f799ae0c73f35bc2a9bf44af78678ff5dc288dd29a5ac2d235add4295badbaa056bf80ae86541dd8436462e3a1f2ec38342

C:\Windows\SysWOW64\msres\skin\btn\patchinfo.png

MD5 72b01e149a383a7db3aa316a25abca2f
SHA1 f5cbdcf36e2f6c2b7153b02c1b90919ecadb880d
SHA256 91311a2243a5b92ca27040bc4ce7518f1303a45aef67835183b0a520fa78c1d8
SHA512 d880da9edd42c51bb9166ce6b3da7c9efa65f0f1f12f4761a79f7768aa60b76c774c38bb23e10f1e0443b96d2c2133ed93a99e6773126a429d1ad721c92a6d2d

C:\Windows\SysWOW64\msres\skin\btn\patchbuttoncancel2.png

MD5 6775dae4bcf807872fb21d64aa31051c
SHA1 4633c6be9a3392fe86cd8138f92949bfe8e37976
SHA256 bbddf24e5ada1994f9b39b3adb2d507d972acec6c22d81b3772b10c8b887eae7
SHA512 f4744abecbc9d1270d8ad01fa8d774a9235045afb79ae3c645bbc29948fc1f5d16ba42b4c5a406a7da5512479c86db951b08319a52cf753e02521288e27ad24a

C:\Windows\SysWOW64\msres\skin\btn\patchbuttoncancel.png

MD5 d0ac51fbf4be1bffcb892c0df65d02d2
SHA1 00e6b93e0babab7e191d869a53eb16ff24ff7f79
SHA256 54f53a19672de5fb0de5b0963de24c83c7e66f9fe45a300b86b52d5974d180fc
SHA512 de2975af4442559820d0820085a6e9b57bcc193119f6aa173b121ea468121f8c65862d5e49797891ae2ed3d488dfb2d9512813dbf3ddf2d186ddb2e3170251a5

C:\Windows\SysWOW64\msres\skin\btn\patch_icon_left2.png

MD5 3d2d84320e1f7edac57db238716f75db
SHA1 a6a0c59ba69409585003f6342a248ab66cc4068b
SHA256 6686e617bd1a2987613e8f52030a8f838d7399e4045768dc33370ffc9ceeb3dd
SHA512 3b6f5a598a2a90aff7c0ec52cf384e862ebf6f7db2c1419eaf21d801556ea786ca43ff236bc57a9cbff002dca65b69071cbd365259bbc791d37da00ddacf4331

C:\Windows\SysWOW64\msres\skin\btn\patch_icon_left.png

MD5 41517aec8ab45827f2c85f2778ab9332
SHA1 79c90d38b2e35e17bb3349a4299b9d9110e72f63
SHA256 40e3184ea1eca7a7b9f6e503ffa5c42ac13035aea34499fc85758ffc09a4318a
SHA512 e5e6dec25f06e9a3654e775bfad30c3df27c369edd949700aee4553459c7ff19ed8ced78557b306313f5338a2d5583d6213235bd9d59a83ac943a589f254a7ed

C:\Windows\SysWOW64\msres\skin\btn\patch_icon_first.png

MD5 2b54d2fc9118644603d111c011866c1b
SHA1 a275f13188c078626aecd0ad7576c69e18d63416
SHA256 236876886f6828afeeb79ca10c1016e1aaccaad434bcd23a50af0b199ab6b55b
SHA512 8544bca59aa7b160a24503b9bee6404b9fcd6cc650e1e9cd284de6bd93791da4a58bfc8e235cd67c8d86b7ee9ac30771aca7378f6505b07e6f4a3abb69194b17

C:\Windows\SysWOW64\msres\skin\btn\patch_cancel2.png

MD5 355542a31f08db3c10f391d806fb2af0
SHA1 f9816c66e54711c683c4525972a4103816c1df7d
SHA256 c9fc7c1468f79d0c65e655396cfa0ab70929c1c69a3e4db97ffdc5cb372dec42
SHA512 2126dcf1b7e0b41f011177ad6e1ce54309be9d2d132c752828bf4bab7336f8f64ca7c9fadc40d5a93da8dd41ab30e3c5d410b6cf521be553f3f34905e8dc00ff

C:\Windows\SysWOW64\msres\skin\btn\patch_cancel1.png

MD5 721c6b4c704fc62714d95630118e9e29
SHA1 11eccbbc6981ba8ad4bfe55e07a5ddb82be7c1c6
SHA256 1cfa36df0bb7bf8c91cfd922f94dc17a14806405c4ff42590ce85da76c9235c0
SHA512 1634e97e21feb0d5481b54071f22b8902ad3b2f448bd90eeeee9f2426d8a256f47e2a9f88c481f03e54bc1e78c75884fe27cbf883a9ea536178b8c3dbba8c56e

C:\Windows\SysWOW64\msres\skin\btn\patch-win-icon.png

MD5 038976faa108743b17e5b6e9bf820b96
SHA1 e6f5ba75b6e39fd67550f2de1ed13b6dfd2212b0
SHA256 597fc32d7f778c6c1fc2b7a8930a86414ee2a7db544d8ae1acdc59bd9cf64fc2
SHA512 8c936130ff1aed46a4ff7a432b42a7822643341bfab098e8d5e20cfee6095d7b2980176e1670e47fd3c99c1fad6e1ad03ce2c7e308ec9af334c8e36e051f7248

C:\Windows\SysWOW64\msres\skin\btn\open_03_03.png

MD5 92c11f89a5a2a56f2724e6b7f691468f
SHA1 36bb669bf68770ddb20b376308e9b5203d84b46f
SHA256 e3b13eb2230b5d61f769fdf3c992413a34804847e2bf9fad3a029c3cee58bdce
SHA512 bb1d2414820ce76023c5e52497789aa65e8fdfb396ea41d1ab55977f067a90a3121e085c7979749cf96775f81662b7aca3988574e2df795660f2c21f96a554c8

C:\Windows\SysWOW64\msres\skin\btn\open_03_02.png

MD5 d1fe88d0c61375eabf447f188a69ffb8
SHA1 9b11df264d424d1b3d14a794fc41c23a2428f161
SHA256 9e2ab4ea5fb3655003403bb8e1f750c16eacc51cafe1c01c7134e0d2473e767f
SHA512 4e4c55f704965cc63716b26bcafd0a72d4f0698eb6e580060c2c5adf938621e1a0eca67b1c7e6b795de62ba7c956e72acdad46121824f30985940fb299a86620

C:\Windows\SysWOW64\msres\skin\btn\open_03_01.png

MD5 9d0f7c20a1260274c6c9e4a1d016f12f
SHA1 e0cd53fa0b93c86549518315080bdc2496440970
SHA256 bb05ef2dea2f58a60577641a1367314360fee9a64bbcab38ef21249624f610b7
SHA512 f2bb62cdf33e7bd1d0d215906519d11c9f4e2b6c5d909378955d8990f3578b47afefd9e5a26f29fa9dc1970cdeec853106a9ea48e713f00299b95597d46ead59

C:\Windows\SysWOW64\msres\skin\btn\ok.png

MD5 2a93cd427fc35a0069930c479496fc5e
SHA1 c8d3a543d8a331dc349c9221f26222c9deff54b5
SHA256 5c6e85e589bbdfec06ee683da0c128616faf6e0e87d43b90cb199f54fce5a207
SHA512 b1b0cb5c1f7085a99a89be3a57a1654d7bc064931fdb96f7f38e777bb713cf047634ad3a3a123bce5b79c5cb430dc93bcb77e2cf98257fc6e79ceda5ff2014c1

C:\Windows\SysWOW64\msres\skin\btn\myfix_2.bmp

MD5 3812d0346e31fd235b647583eee4a449
SHA1 02bb8dc42afc0dd84773bb6b98f08c6e3634c621
SHA256 052f0a7c743bb6a708f327b708a6ceeca0521565d5ef40e5c90742dde8011f64
SHA512 9e5dc92d17841696c4302675fc5121517fc9dfa5521ef011d56e7b7ea51c736b2add2aca59ff92a32355d2af01dd12e0535ef3b7ad9e8497267ed78c6c6d62d6

C:\Windows\SysWOW64\msres\skin\btn\myfix.bmp

MD5 94f2785aa8c438c57351d8c5808c936b
SHA1 96032935afb7444ac44d48b63764351e75ae59b5
SHA256 bd6616c28f16d5e22524bd47ad0e6c5901a71545423525d452f2475092eb8914
SHA512 48236c6a796e69c9de9f8a2038978dcdc204466cbb15bc10ec6cc7f048add55602c7cabe9e24fb6ded6b2e5bfccf141c22e870f0e2e4fc3cef27dadec408b0b7

C:\Windows\SysWOW64\msres\skin\btn\min.bmp

MD5 3a84c43ffc7a64495fe7cea2c5db2944
SHA1 bd309fb479a7a7737b9a947766771ace11f0beb3
SHA256 40074c619b4bf8669f5b22608876d5cc96d8d738a7f2216b9f2ea74e89e21642
SHA512 cd6be896b25d92c6d8d87cbdc0097189b69eb0ce98d0b8a4209f6066ed8b1279a97855c7626e8135ea28e5cf59c475d9ff82f9747feb2570f87af229ee174f0a

C:\Windows\SysWOW64\msres\skin\btn\head_03.jpg

MD5 fc701d36ea65d0d1f193eb88b0b3dbce
SHA1 57c5de69f2d5999945c71ed650997519151d26df
SHA256 83e2d386b620a1960fe6751a1c2bfc6f044171d6e92be2a73dcba2b4891a4ce9
SHA512 1313fd7f5443b55ac94c495a3b147648ffd0f307c364aa8462ae93efd49f5d687a4b5c674fb1dcf61f1c0439d1c80dfa2f33b7a351eae3a0aa2fcdf40682170a

C:\Windows\SysWOW64\msres\skin\btn\gx_02.bmp

MD5 4e1e1cd70441abe7afc6521a69e45795
SHA1 b22f541397fdd910d7741dc615039dd2fcf41bc3
SHA256 34ce0a3541edbd97929c3db8fab35682876db6b2105f040a148b393db5bc4c22
SHA512 4b3fd367cdfdb4b45f4be179b7e6fcb264ac9645456fc0a0ba3a604d40316cefeb50c2ab16357edb46c6e9ece3a20ad44c1a255f0cf2c80be812d76ab197737e

C:\Windows\SysWOW64\msres\skin\btn\gx_01.bmp

MD5 4ff50af4c00ee5598881b61eb54bf895
SHA1 89487db80e10542bd35c73eb6f7a8ad03ad33865
SHA256 bc4ad2390e571fdc6f2d90a1eaaee70679e0071990da2cccfcd115c702b0a3f5
SHA512 05bef1fe903959f62e6b1c58caa8e200044c4e1b31eaa47b77652e53378e5aa32ad1abe54bffe468f017fb36b0b67025b3742cbfc1a9c048dc2654ed9a653b44

C:\Windows\SysWOW64\msres\skin\btn\gb_03.png

MD5 3937f39931d8216e91a6be74878ea5c1
SHA1 3bdaac4911cc8ad44ed0d2394c1fc25f0bbd7b04
SHA256 0244a1e349be736502b53c4b7a7376f298d224d510e6560f137c766c859f1d02
SHA512 43b6467ecf4527ee86c68fe5c5089a15cb6b31cac18be5689507441d9e3cf4bef5664bf6c2c2fc64dfa365862e16c318e274479bc232010e9ee293f5cf58538b

C:\Windows\SysWOW64\msres\skin\btn\gb_02.png

MD5 d757a68871c7d6f4f68d5af5c75ee24f
SHA1 a261eda4462ee1e7fec6521cf221d28ba4df7e19
SHA256 088aa4629b0542290985f49f5c7bae6fa173cff3dfe7571b689ddd690ee6b9d0
SHA512 5390ce8710ec42a94e96078c955d6b429635e478d4ccac1189caee21af95aff49d084191045981fd1afae33f65191aed284c41188fcfed9fb8c83c65703ce361

C:\Windows\SysWOW64\msres\skin\btn\gb_01.png

MD5 c25a0e7bedb2ead4f37d48c3763a6053
SHA1 583e5aaff8ba822d49d16b99eba936efec321609
SHA256 17a83252a7be40b246656e24378ba9a70e5a8372ace2c9090d3052bb553707fc
SHA512 b90afa6ec8a2802a2f80cf512ed494f19c89832d9d788ade40f668ba5b39bb2e02978fbf72571b177dae13c85d6a0f18e42a4abff794ce49252c437d17952523

C:\Windows\SysWOW64\msres\skin\btn\down2.bmp

MD5 e6f27e081f1c49257d0664917ffe35c2
SHA1 b8af018752731416b0743621275e027532010a81
SHA256 0505104e0f0e8999fd30645899a90a3260173d59fa9cbb6e4ea633af8be755f2
SHA512 50c25f8ba5aab3a7a66fb9d2f775870342fe73517d4f4212c9213e85f4262d42052b3b34b81d19d57899aefc1a051275c071d07c125b853eabef8690cb7a741a

C:\Windows\SysWOW64\msres\skin\btn\down1.bmp

MD5 a98d5599bbbead144cb23e9eda443474
SHA1 15defc8f3a0cea5776dd2e9ccfc36082ef9419f6
SHA256 36e8be716effe2e3fbfa0b334792c32100b3eae1fd8e477bd777473bfc5f0749
SHA512 ac1d567287078d2cdd2c956f19feeb548f9719268f67a04cd01b7ca90691b16116e8e18fa82d7b970357774049e73a41d9e39998c27b40579b5b3a46a09085d1

C:\Windows\SysWOW64\msres\skin\btn\down.bmp

MD5 9a00188eebee39a72e2e1d8206f89ddc
SHA1 1e94fbe330a2c13a4ea0d61ba253046ec3aea84d
SHA256 ba1c02fd1c6ecbd3435293d1b40c696b0407b225a3d8c60adb09378c9c908c8d
SHA512 d80e6bc8281dea03da39ddeb24199de20aef30f5b38a42573de91403725a994af9d7c6fb30df173ded4cea715cada942be3b2ecb5e463a9b2c8129f71c4fc128

C:\Windows\SysWOW64\msres\skin\btn\dengji.png

MD5 fa3424e212a6ab9c8b53994e092851d0
SHA1 fe59c67e518377575c480f8986439bbb1a28dd0a
SHA256 ab1c044e201fafd390537f399868a8fe67bad1e870b9c1a014844bcc066bbf26
SHA512 a59ebdb72eeff191fbf6d7237f6571d41efd90b563568524769a93da6ebf981cd1a8f824d5b070b67ca20b69606c9f402661e83c46fccdba882e62fa414468c6

C:\Windows\SysWOW64\msres\skin\btn\commit0.png

MD5 0cd6e5a4ed115f0f63263de3eee58451
SHA1 52bad0001866c055586b4c1b75f031305b825bd3
SHA256 ef4daa62d893ed006699499da3b9f64189995347d15e40e9df68cb853b036c7b
SHA512 f0bea18ee6fab0e0543c5e87428220e9688bdfef8119d983e2fa2507c82f50cfd67f48bcd0cc355ba49ac73cfb83bfc7980f977833c7a6a14f1cd4a9e3bd18a9

C:\Windows\SysWOW64\msres\skin\btn\close_user1.png

MD5 ca3418dc94cc9f697b6204229a8825ec
SHA1 d3eb922fdd2f20f4673485a898bda1893126c1d3
SHA256 fc895284d11cfcadba78b6484fc0d315f04952a4a7b60f0d9dd3deeebe24b6e0
SHA512 c352cd71e6c2a26e12cfe57c55adf29e60dc1b2f5da57c22292769b7f6e81d01a2a92455f4b0d26651992e039c876c78151808cea012f3b7c4b19cdfc66f917e

C:\Windows\SysWOW64\msres\skin\btn\close_user.png

MD5 2edd0cb4576d81ca994a6bbf878a55ee
SHA1 ef748cd07d659e40a6134ccf965e7341be72b13d
SHA256 2ccb149994b60afdfcf0f59ab212fa8f8e0641a9bb25ee148d5b0ead2af00a5a
SHA512 c70f267cd6df9f154c892236c631e2dd20586461522226d4d940f92034f3a2919d95067adf20768692cd72020b6c08ce41873ca8ffd39362b494f23b98260247

C:\Windows\SysWOW64\msres\skin\btn\close_1.bmp

MD5 9bf47cda3da8837eb527b8ee2921c6b1
SHA1 1bd0abfac7d0631a96bb80c0de6d4cbc9d0be60f
SHA256 387e04a0790ec61033be87e03628ed16c59668f7a0fdb04df508459131fa2799
SHA512 bae06d70b374cd72c95c0b0cedf8c1067c6567d3434dcdf3abe9a9217bac6c0030023b00eee4d70c6ebd0d884c0b79f3f457cd1dc63dc4db06e9119d36628578

C:\Windows\SysWOW64\msres\skin\btn\close_05.png

MD5 20d2dd746d4b0914a31f7d49e6d3e656
SHA1 42e801163575c5c4e5fdce0e1ba778d635684bb6
SHA256 81f45dc6783f758ccf11365733ab9b981e1a8e68447a1971ac366b424f7d2c8e
SHA512 25ded2284c790f089b1768085cc0e447fb5eb9ff9e20289ed135e3f00636846d53fc8c46fd9c56caaee7ced29c85d13b541e2d22fe54d565d68820cdd07c2987

C:\Windows\SysWOW64\msres\skin\btn\close_03.png

MD5 0b7171fe342b678a58d23aa12cc7e588
SHA1 cb351059d9856b9f99d791962407c8d8ba24f5b7
SHA256 add826bfa64351aa756b8de5ed252ebf148a5412c32640d1fac1937fcd5b3b00
SHA512 ba6bb714b090de008c342e7663df2457199cbe9100b77989071d66e6ee286b9b8c1595d6fcc8728f5dc2f0af35357c9c1c54908f6c2cc5a3e04c4201e4924706

C:\Windows\SysWOW64\msres\skin\btn\close2.bmp

MD5 a54cefc12437e2428656c0b203f5da7b
SHA1 17be083df58cc3d8fab7b5e97e3ba4311ca0598f
SHA256 4ea142b3ae9accc85f37513a071d1c6965a4dd711f3bcc3025f8ccca5cf2225a
SHA512 dfc60582691ea79a31f27b735bf814e52750f3d4e563d9d173e7e8aad725832fefb4d63b3999080fc8538f4139f2339299357d0a7c19d64edce7e300dcaa33a6

C:\Windows\SysWOW64\msres\skin\btn\close1.bmp

MD5 8259c23ba6c9c96d100d95edbaa8a766
SHA1 f84403a0a1af64a43200d6af56f606966482d791
SHA256 9373098ea17dcc56f46e5be5125787d6b2c9709aa45e0703acd6a9ad45c617e6
SHA512 02ef7c29a66c20c12943179c5388f340a907aaf92736d6954e1115fbb5f5a5570bb8f93809bc7f2801834c4b035f4b368a50445fc37422feb54e6462459a1c27

C:\Windows\SysWOW64\msres\skin\btn\clientlogo.png

MD5 50a9d8788f2f6c6149307230274369db
SHA1 082b8377ac0a0bbe592390f4e0d8ae66eff0c523
SHA256 e0dd0660bbf3f953daa1baf7894a615f9c29ac00abbaf3673fe6fdc5765da6bc
SHA512 f9d57d4a00645c68762e16c3ae315066b678f76801d5e054058b69b18554225bb7993d88a4ac41d27abeccf9823ed315db1a9264090a0938eab899f325f49158

C:\Windows\SysWOW64\msres\skin\btn\circul2.bmp

MD5 0019758ebf2c89cd162e0724263c0c49
SHA1 409c03ebfbd0efba5641de7c3939e004bf805a4f
SHA256 e1fbf8789dc5113dc33131ddd6c959b210809ef0fadd819b0b185ae1815b9053
SHA512 70993c1902357587b55d5b56c87ee5c2a7c2906b33c252dd5e10c916bec2ab32a30865d641db3954a3e9678b6c406afe2b783de54aada8c7495c93488a803297

C:\Windows\SysWOW64\msres\skin\btn\circul1.bmp

MD5 4afeeec0ac14ffc3043c1038b90a1fec
SHA1 ff5549834bc962d8e020dae3f840bc78617087ef
SHA256 659cbd55df5971710caad0ad30feaedcd826cc1cd4ea43fa382357580de7b43d
SHA512 9dddc7eea4a1b9cfd42ac2dffd5f0427ccfdbe590343f19d0f6cd1dc7ef6fff33138399decb3db6d79df8a2c32fcda96b9790964e339bb086771a72ec21bdb2b

C:\Windows\SysWOW64\msres\skin\btn\btnuser.bmp

MD5 9c6fac86da2ca4e29307c5412522811b
SHA1 5896dac46950707d4988aaa2e142874918a4956d
SHA256 ef3bcbce2a5061e5d673fc37683c167555bc107e05b66603fbf271dada9a770b
SHA512 d03cb267bc4f6bb25ecd290962eddac14ea4c18f2d28070d3cc607f87c5f2233e488558f4f2b1538fdee0e5b1486ca9ed6779263a43d2ea3218e5603771f0ab9

C:\Windows\SysWOW64\msres\skin\btn\btnmin3.bmp

MD5 ae138f6f4fcb20587ce6afca33f8bd3d
SHA1 722c3408282e944071bbf4f0109965d46e5045c4
SHA256 bfda49bbd053b32d3191799eda972df3f1a6615a7f799d6c295e09696c95345c
SHA512 8dc5b4cfbd815de63d355e7ded3af0bd72cb207b6eee9da83b5d88f19f4ad4061323f02db0255f540835b5068ffa22f614e8554cf439e8821c44af97fd39ddf9

C:\Windows\SysWOW64\msres\skin\btn\btnmin2.bmp

MD5 43d5d898cf2c51a4eeff5eeb19b6a943
SHA1 8d9d1b4405cca152c84b51116760dbabea4e5447
SHA256 887fca8af95986d26f5fae6cc8251185ed49b51184eb2f52b2798cff1fcd05d4
SHA512 e06cdae352ae7490051fe46d625a262a99e93ae4b3e2ad9da3511619f1d2a08f5aa97ed674d4db75311b5caf7f7aa802ddbcfca5f1a68c3935e58b32759bd55e

C:\Windows\SysWOW64\msres\skin\btn\btnmin1.bmp

MD5 7629821d39e9ac4afe60285d007d29c4
SHA1 75818cb5cdacca6c04b91b152383692a01bc2647
SHA256 a3125174235aca3fa2fa41bca8363070f7f0dc4aa4a5f60f6e1ca1c0780a8f48
SHA512 23508503e3f7e31b3d0eec5cbd31bdaec700c31a66d052038dde6095c1a100a5391b23c431da58c91933d0c10fba3afdeb002ddcb0fdff0e411ca7f7070a68d6

C:\Windows\SysWOW64\msres\skin\btn\btnmin.bmp

MD5 1e1ee84b49078e7bd4b769b0731ee1ea
SHA1 0ebfb572db3416f17266c71e377a2b5920bd7d5f
SHA256 d514863ae5e7ad13c023e75931526192f83917cd54a6e8200e398ba4a7401f4a
SHA512 9761cb38e5acbc75d58cf5d4c503e6d60cd2ece7d59901dc7b1e0d13becd4c753aab48be0d83fa6477fa4c7ffee76dc492bab79ae2a2fb4a96fcefc22245920e

C:\Windows\SysWOW64\msres\skin\btn\btnclose3.bmp

MD5 74cb833ac4dd0cc8a58457b400fe0fd3
SHA1 4bea035be376ad6e1f459562fbd7fe2f1831d23e
SHA256 a3defb3d69e2723df06914d054e45dbcf22a3c36964eeca84f09115cbdbbe6f2
SHA512 d186a13e25f5cd7c034ab384e61d3a1e5cc0d3f3d9b440a96542fe2d03a12bd3ae0bbe2f00f818a17acbc10ccd58cb7a47b8323772118ae81d26761d5ef5e052

C:\Windows\SysWOW64\msres\skin\btn\btnclose2.bmp

MD5 287f76d882833c7a610bf5b49c4aeecd
SHA1 4baf4006fd1ecf06333bddb85502ef2e3f18b828
SHA256 9ebf24c095e13036c81891aba99a8f1318919260adc3847271feb5cff432b106
SHA512 ab404afb4625d365564df057563206f44f54fb886b96d3822156754962a5f97b8a9a1848d3960b681cd0ecaca97d2e8ba5ab60e894244ec507af4e4049fef3e2

C:\Windows\SysWOW64\msres\skin\btn\btnclose1.bmp

MD5 3c4c6b113b45c24bad62cf31bf4a6ab4
SHA1 d1bc7b2421761a22b301881f57663cd8bed47a01
SHA256 d5cdf3e89365709228b18ddad76ce9e6f82f251db174b02f78bc24558c9c8c36
SHA512 bd3e4830312ae5ab64b3a325ba4e77002863e96a8353f5a890821e6030ee225ff064668c782f61bc8e982f822777b46bccfa44e4ad4fa69c035134263166f460

C:\Windows\SysWOW64\msres\skin\btn\btnclose.bmp

MD5 5c8b7c06c88cb68bac6284aa4220101c
SHA1 79be14d2398a5e39e4c449d9311442ee97e31806
SHA256 24f0ee456a937ccaf612bcf5f8a4d0f77a64b5a0b875dc9f0c19b509166069f4
SHA512 06ec65c5567c9b1235f956068b33f2db171c13a8182054a47dc92011daf4d6128ba06d44e29e31043e6d05b52e55b041ec96bada29cd88c428dde23811fa22f3

C:\Windows\SysWOW64\msres\skin\bk\topbg.jpg

MD5 958ed7a29981ccfee518270d95293c73
SHA1 e6a25f572d8136a886a18815a5b040744d2d7822
SHA256 4c9459fe26aa315cbe40d6bcf673dc78d5918c370310177d0e9d9caa64d6c1b4
SHA512 f5bef43dab1451eb6fa8a4731052abe6b795745de591c39ce385cbeb96cce5ba44ae0495f00e777f5e8d768b7bc2f7ddd16d4e0bafa78bf5fa5da87ab75de23c

C:\Windows\SysWOW64\msres\skin\bk\patch_repairall_bk_clicked.png

MD5 0ece7f60b8472bc9ae817fc9d8818705
SHA1 0bc9d89e8c0b45b4c2271bf1e1ecf555f802d06d
SHA256 8875894af167d094a9ec8b885d5ad70167a7e410608f76aa25b1f7d42467c610
SHA512 2b32efb4560232815a978f3e8115647b8a1a97549a6ca0c73d300eed2397e6853f7671e645785db10cadf47349d71cd7ea8b231598af01116c2068c39173f477

C:\Windows\SysWOW64\msres\skin\bk\mapbg.png

MD5 eca869729ecbb0821b3d469985621bf7
SHA1 45254b86854b02c37d55a0dfc6bccd8a3d0972c9
SHA256 9c4e6c63fce43542809ece8ebdd7f8e8c5843833d6b13beb8a3905da3a74c656
SHA512 d38135b14c2cb963c8fe90f76bdcbe412893f8f03d9687946b00017704800018250fbe863b99c550c7b9f0c6b990de10cb159c3f8b2a17edf13dc79e477c74c3

C:\Windows\SysWOW64\msres\skin\bk\BK_Assist.png

MD5 425cb23a66e983803a003c85ccca9ff3
SHA1 5e7af765c12ad5fc49380d5136ec2f7daa2b8ac3
SHA256 3fad38e867aac6db38b93380a78da1f606182d54bc170d1ce950af761ffead38
SHA512 c1cd119e8f7b2da9767577319affc5b7294f57aeb23b3bb9d56320efb7b509711c84bf92eb7fba7f69d56ae2342b262287cb5e86166df7f172f762fc02e1531e

C:\Windows\SysWOW64\msres\skin\bk\bk123.jpg

MD5 ca09dc76c6ad2ebd2e681a1e84c447a6
SHA1 06ba74c9b3e7967c4b6cbbcef07b275dd08ed7c2
SHA256 aa9144c36be91bdabd0f32e550f9101fd183e8faac3285e23ea69822ed4d896b
SHA512 c8f39bbed9cd1fdf23477f8b6081290b8ca61e646cc392676993d05fa249f07ae784aecdd88cb64b825cb7677894ed72b3496f69e3b4e0a699cb60e8eae0752d

C:\Windows\SysWOW64\msres\skin\background\images\zip.png

MD5 a4c2911a39fcf7e062b50e822724528f
SHA1 9ad144737818c6d019a05b17e43856a85886a2f1
SHA256 4d2d4c168a03c71202053522877552b4625797c47ed5904d843bd34becd10015
SHA512 81c250ccc59500ef9c22002edd03950aa97be5dce40de6bc93b3a0d97388be9c5df07844bff5196fa198386f967b808fe53d324c1cb11c4568f7c625f258602c

C:\Windows\SysWOW64\msres\skin\background\images\yp.png

MD5 b57e3b8ab4036026821e42b665a3ce03
SHA1 522ae403767e7a03d446067e2e272cf49223c97a
SHA256 35824df6ab7da9551dacf15e1bab8967a6aa0a027c8ab85858ba041b926ae75e
SHA512 51437068ea46863742006e2b3433e69cb1a57eb8a2908129d5f3edeb26b35f77a006865853db8f78c6ffc136bad270dde01476f9f0ad2c117d1525e6de3667b2

C:\Windows\SysWOW64\msres\skin\background\images\xz.png

MD5 5004a79b83d8acd02ac18c91f5275379
SHA1 c77eee4a34541274a0d965f166e63a9c0b8fc240
SHA256 11ee187348ac2a48dc3f7054130d1274c7793e993d8765d5109738945bb5fb88
SHA512 665d0e60aa616cffa7e3ab7fd48bd8dce025131f549ba187597e6bb188b65c35e4e2114823c75898321fa80f114cbc4db7b9f158d654cd06294587419b380892

C:\Windows\SysWOW64\msres\skin\background\images\xx.png

MD5 7a26af41cf4a70426ae32f62b0e448c8
SHA1 695b31f0985e5a1e259e4ec5c51fb2aa090c10b3
SHA256 ef080f439bda13cb2fb74d48a476df99119ba338ccb57a7a3332dbb14c773eef
SHA512 bb501ff9f46fd7b84d45014f7ce06574554b2e6a4829dbb10e92a4c7744c53007eba110390cb909b3970dc652056a0d0611658aa49d798eeb77d1e1e190de7ec

C:\Windows\SysWOW64\msres\skin\background\images\xx.bmp

MD5 489a1958a73d961032c41c8ee7109baf
SHA1 b3fffde41392bba5b319b586f310e1e91b182300
SHA256 d963206f12242d307e0f3c38b3c9193592888d85fc9ea20c96131dccd6e9500a
SHA512 a167aa0a1815f94e39de8f5864f4725036bcc241984d5b70ea57071a66afc08945f0241edf5fce25d82a97f127d1b17907f29ad65ea1d4567f2798e235a5187a

C:\Windows\SysWOW64\msres\skin\background\images\xk_03.png

MD5 079896123dc719fa0c207a34c44d70ad
SHA1 28b8a012bc9e39f6a171bde7768118c561b37a42
SHA256 6c4bfa08e128c2b2eb32b4126649a9bf292c9641e78815c6a202b350c11f95c6
SHA512 1c536a149fda296af7b57b6149eb661e6016ae166157626011dc9cfb07cba5bb04d6100c28e5395415b423e8449ab78234b9485d47ed988501740bec838df684

C:\Windows\SysWOW64\msres\skin\background\images\xk_02.png

MD5 1f57c6d8dfd1ed766d910aee6465a9b7
SHA1 79051383a3b6555ef7b8dc0ce219cb30aefd1611
SHA256 e3d6828e4e45542df045126664fa3b6879b62e5838b25b9233c2f8bc6c5b63c3
SHA512 766c0eae0165eff18bdf3bd261314f9105b9274e6d44a17f74c89fb2960a5e2a88dc30c3644897be30053238029de1531844ea106c4cb2a79e2447f19bbdd0c5

C:\Windows\SysWOW64\msres\skin\background\images\xk_01.png

MD5 044624821577ff2bd8bc1613f25db61f
SHA1 a49fbcb16f8ca923fbf5319e6d6582807e8d3b60
SHA256 3bcfdf9bbe038982e098a28b3ed5d8e3cf803534b25b81ab69114ca1303b9533
SHA512 69eaced038caeab3e20c2ba67bddfb722666f3d57e8a2ace184451e39fae19afd7600813ce0122b4b18f44b5e1246a94ea1bb5b0e1a4d91e73db25be6ae97726

C:\Windows\SysWOW64\msres\skin\background\images\wp.png

MD5 f14425cf2749b41c4099f58b2ee70f21
SHA1 7df65d3d40ba5e093549bfb049cbc56102e833cf
SHA256 0558dd51431ab128caa6af3ff41216d4c0bcba0f59839baa305a737889b8558d
SHA512 be9ac80752a2bb39b1772095d215c18c64c39687847bd5ad3bdd3f93a37c774a9052777914ef018b1ef5631b42fefdf06104fcd0fc08e83c17ecff575333cdf0

C:\Windows\SysWOW64\msres\skin\background\images\wjj.png

MD5 f5f56e28d6e4f78f46785d2efa107e12
SHA1 afaaae10f315b09f6b50e1f9821159db07d1c7e2
SHA256 0a68b4595fd5da92746a69258ecb5c9b4d86c66413b433b4d79b100057cb02f9
SHA512 d86a186d5246361b236a343eeb69c0d9ad860d4f07aef58bda800b571dfb081d294b8aa2dc463cf13a915379d611dbd2042e9c28cabd5ef615f891bbb168ec6b

C:\Windows\SysWOW64\msres\skin\background\images\wj_01.png

MD5 e7e0142e6df524605deec972890dda13
SHA1 50229594532e99160958dd45870fad17fd92ad6f
SHA256 0bcde301af3901fab73b452a26f635fad725d20cecc366d52aa0e9762c0b914d
SHA512 8f00d9933dbc86f3a877117f330b894b15e985319baf3de18ce129931be17531cffe3961b2c6c118fc4bb3a83b71b700fe39b0ba0ea4b1d49f459ec13bb47c38

C:\Windows\SysWOW64\msres\skin\background\images\sx_01.png

MD5 7df1ab6c1b90967bd0e61f3826d19d77
SHA1 4231008899b9824d5f8b309f24d6375d5da6f6b4
SHA256 8469747bb28deff28a382026a10311bff9c22cbff4556dff428e6b9748cdc26b
SHA512 529de144218a46b011a4fdd00566b7f70e92658a0d633c220ef67c426b42dfe7a34654c68b4223d23ee1f388a99260193b90a54fd13356cea555ef1668ca685f

C:\Windows\SysWOW64\msres\skin\background\images\ss.png

MD5 3e062490071758d8188e99dc45a36f37
SHA1 4b485b69d986137878ce2ea2dbac42198e54b8cc
SHA256 6acd80b49f48b3819064f0f68fe7a3cb83a4dacc28cf2632d2f41e7c87744bc9
SHA512 a0fbe199ee93e7d0fa9b3accc01f64f6c95119f5ab3bccebe72f053ed43e7ccfc91f11135679b64c44b15c4d34fbeaab7609ca92b80cea62bebd5382e7f2e15e

C:\Windows\SysWOW64\msres\skin\background\images\scyp_03.png

MD5 26ac237bd4e7b327d8050cefaf78425a
SHA1 047eb1c3bda32eb7aad2ac5cd6e0a02a4a3ca3c7
SHA256 380bb765bd333b8d9fec14dd7c1a1c6081ac748c1e79e3c7fb1ca62db2bae99e
SHA512 e0419f5b6fb38a8886f6431376de2a46a192ea5f0a39f0d4865453cbe503e04a9950edf5a988834bd47e081a93e7e9067ce8d69df47b2ea3d69acf13d20b50ba

C:\Windows\SysWOW64\msres\skin\background\images\scyp_02.png

MD5 9192bf1c4803f057e3bad878d4c4b98c
SHA1 618c195592a87511fc2f1c4f87921ae68e776708
SHA256 17e338eed5abf795fc14c38b14a287a1c80a5d8ca1af7f40e38d449b539db8a0
SHA512 1d5451384e72c4103995d50770df7a078e44d93c39b7f64cbdcfcb63c0051e05f3e96738f17855c5524ab41e04d62bfa81a0383e1abea0b528c0962b8a13667c

C:\Windows\SysWOW64\msres\skin\background\images\scyp_01.png

MD5 db579a5d47b079e353e91789b551400c
SHA1 8a230314258d19e8dab2c154a29ab4c536aef647
SHA256 737a5d9ca8f7be693d98500c838b64979a1d145b971bbb89b7ee24e4f31dc48b
SHA512 1d3155a91a8ea8c65c292d2ec6bf53c906a10d648ffebe83f00ce1baef346eb472cd99a6595c30188c1f324d1f0688aedeb85bc671e2acc17b6e2067cd03122e

C:\Windows\SysWOW64\msres\skin\background\images\sc.png

MD5 98bdcad618b4cb920bf54bd33ea4d155
SHA1 14d6536d1195b8e88b617be3143f7cd1f814d4a8
SHA256 dd968bcaac8cc61d035d6991da9a6e790506eb1f608ac4904677a0d32ab0cb34
SHA512 1b7483c32c4ed7ebb0dd32b620232ebceb76d839321929c27a07cf0088641466ab14f3260803ddf049505e247237311966824bbae1f8a43b4cee7b900e8ef257

C:\Windows\SysWOW64\msres\skin\background\images\qxan3_09.png

MD5 e3d1814087385dc89fb5e2c255c9e859
SHA1 87a19b8a43eacb603c5285c80eb9d41cc9fb6301
SHA256 974609a4238edae2007588b6e9509a34ffdc2abfa07d32cab5871e9c5cc80051
SHA512 dd68665d6fbd09a7c0e4ce8b32325b1afb0afeb14043790bcbafc1f9166a63e8cff1751e3864957b5d3779a3b1959e8973469030d2be9227d1e7231611c581d5

C:\Windows\SysWOW64\msres\skin\background\images\qxan2_09.png

MD5 893d369df5fd9caeacf2821d94329f57
SHA1 4f6952745d578f3d5b9cd686f142f9445c4111cc
SHA256 f65f338310f60e12f7d5a2af54e6ec21134044d4445f17588892bbbb3e0ea6df
SHA512 68b1450561382179869092e042b641b420d5c1df59e1383828ee07ba974d5e58a24b0af1b9a49cb528a08a070dd5614a1a659fe26e7146f20229466feb317747

C:\Windows\SysWOW64\msres\skin\background\images\qdan_03.png

MD5 63cdca90e49946058e529cecd981e160
SHA1 80ec3d4a4730d94a6d3908cfa4454224e65b8b66
SHA256 8c56f8c68c010d110b44c48e786bbd68d5650c44a0ed49b9b57f42e7ac1a345f
SHA512 d52ef043a0faf4b70af4902f41c3a0e4d4284880e4cc66b33da394c86024e7b6d9d484ef9d8227e37327a412af21ed0e1298429d894e42acb05e2aacf85057d4

C:\Windows\SysWOW64\msres\skin\background\images\qdan_02.png

MD5 8ca0e25e03dc574a7765beaf09320c39
SHA1 d5cb7ac0b99148a33a942f0ab058c38f61d31a9d
SHA256 71f0bff9922ac59edc4a676404b025535b6231457784327ba4f899303f5cc016
SHA512 f349b0ea0454bba8010fa85cfd0d81da4b41d8298e7f9d00a099b222957f6e5fad540acb6540f24dcada92f2716f9b665dffcbe285edd317011ac881fe6cd92b

C:\Windows\SysWOW64\msres\skin\background\images\qdan_01.png

MD5 79672eb2594fc01a89a8e8a06dcc50a0
SHA1 0bc02bbfd2412afa1bee759012c88f13c63f892f
SHA256 0424f26beae781d0af18c205063fc813c18ac44ce6b655dddee1eedf3bcd7f3d
SHA512 1aacbedb167a71bc4b750ea3ab94c9e0430daa33ac6da7ed0cb90e9e14ba38b16d1281ad768f65e3b98f485908c7e274c2b331a7fddaa86b7db7aacf992b31f9

C:\Windows\SysWOW64\msres\skin\background\images\ppt.png

MD5 cb58d93a152c97ce3286b9fb72bbb714
SHA1 4f0c4ef4bda9caab80c754978c3857a10dce7db1
SHA256 a19b81196546469e88fe13b992e211b1e9dbea52bd216a0be66a09c8b81da1e2
SHA512 c0a0488b56ec5ce22942b1ffdf54909138cb4a38839b5c48ece4a3393edc92a1bdcd2be83f68a1945df480eb681efa1460659499007cf1f405841693c7a0d7d8

C:\Windows\SysWOW64\msres\skin\background\images\pdf.png

MD5 db83ce73c96a4bd930644858bf6e1275
SHA1 186607aa3dc547c0f60941bde0da9ae02865d17c
SHA256 e36b67c17eb0e720f8190252a3592e62e5d9c56939142271ef574e539f587df9
SHA512 8d10288e184f1063484831d5af86a6d390b6fa3d3b445d519a163b8f9f696c518859b35531b27c4344e64ad96a14698be2bc46245d0f5d2ba11c99aac8322885

C:\Windows\SysWOW64\msres\skin\background\images\more.png

MD5 6311dc9133ffba689862a514a55ad1ab
SHA1 cf9de205d25c225b50b2acec3d0a24c39f838bc6
SHA256 de68842941638b770e3320c11eca4bebfbeafad200a15b6b32fb6a1c4cd01ec0
SHA512 99ca2294c82e5c0cfd0603067be1f7a6a5013d21806ad352dbe1a620d3f1990c02670ee6269c743f91e1de33c92edd2c37a3df89705673f060e9746824337615

C:\Windows\SysWOW64\msres\skin\background\images\jpg.png

MD5 f8c6977c80615e1104c7f3b5f307189e
SHA1 01ceda9894abb7f5b03ec484e7d05803db4b838b
SHA256 a208bc14aebc489a30565da20729a6c2b604da175f4dad41030969551f9e9503
SHA512 f270a7b2490413a31d4fed090efa41be365b2a44a1ef44e50be7020948e2bf185f7fd43c9c744db0ab26a374e59e2877de1bdc572db22cf5d3eba09757ffbf17

C:\Windows\SysWOW64\msres\skin\background\images\gxz.png

MD5 56116feed8b9d0c4017a44f4a57c27a2
SHA1 535ba6b212bb256e0a24567453fb811b0005af24
SHA256 26087c7fd28f49b6258b8613562901f485c979f296c5a49a61be8ba9285e991d
SHA512 73fcea35a97682c27be2851c96acd42b3de748262a6441b0ee0402bf91876d8815a87eae28ffb6b76c0e090985c94a616c9873dced403ac0824d1a914708a21b

C:\Windows\SysWOW64\msres\skin\background\images\gwxz.png

MD5 9fb8ffd16038106577928eecbf1f62a9
SHA1 2ea1b28f306a3a531a1d03ba83f3fb57b3672c97
SHA256 b5ee86c475e7a56d81441aa4d3bad4da0f0886732aab249547e1a021916f37be
SHA512 128a999e3e814b11643aa8af090ab85f94d54a7139f15d19cc2fc41a75d5d7d2b6dfba90109f7fcefac861ab0e81377815e40c27d831f54c2ad1c78b7b360a99

C:\Windows\SysWOW64\msres\skin\background\images\fswj_03.png

MD5 a00040fe94f92efbdfd1c289eccd09cb
SHA1 9c68bbf2049341f13a6efbacba13b7d790dae9d2
SHA256 56711399e9f10f65764b160838592f052840a79a75fb7c954cb24d6ae18b9aea
SHA512 1a6f21d3eb7b6ad2902574fd748ef17355e2ed0444eeb4b04e645d9bbfbe141990f183d9d0585f33ec06788a50f481088ba567fcecc81ab0fdd5bbbd3aba88af

C:\Windows\SysWOW64\msres\skin\background\images\fswj_02.png

MD5 8eb19e91df40bbfd57bc1021686da264
SHA1 81aac816fd5f664745f46d213ef6c8dbb9d22662
SHA256 ee4250645f2c98cc4f071af63cfb99856bd5f6f2c7281a09bb1329660a2cde80
SHA512 4153b339f3b2e832863cc0a80ebd7da5a0fe8dab12c86fb82988e68111c57ec5ec62b3ca43d30bf1810338de139a9a36ec6ec3d5a7c10f450f5819f8513f8b33

C:\Windows\SysWOW64\msres\skin\background\images\fswj_01.png

MD5 b506ae56b9e7ffd2e4a7771109830f05
SHA1 72b0c680b3bd4b28e7b432f41dbee1d5833bbd26
SHA256 8aa828517002dcebcc448873b1d957a3f02c881161d6331d4b4ba7d234427fac
SHA512 78722be6bcba62c9f8130bb140ddf94c9e47c113c45bbf6c158e19284df73cf907f08053b1608eef14692f88977d660c718fd62d1fac9a4c33231965eaf5e484

C:\Windows\SysWOW64\msres\skin\background\images\down.png

MD5 0c90ebb1caf0505de7a96ab29d893fe4
SHA1 43ade853940637d0c9cd2574bdf599bd90f65a86
SHA256 e0ff6e28a3ab6bbaf88f510b80c0305b1a97daee23205dc4764a91f6aa73c46e
SHA512 90e06983002b3efe4eece50625f44ede7d23fb54d79296588baed7fad4c8726febf4f33c4b2a18bc7ad25f4bb26603eca45501e0f50f5eecf1753ea30f491f3a

C:\Windows\SysWOW64\msres\skin\background\images\doc.png

MD5 850b3946aa9857f6afc3610af8769d14
SHA1 e35a26f7808a7ef7d7646f72d5ce25a6b664b25c
SHA256 f4c9a502571ff715d6cfa85a9b53520a113e003d3337bd57bb81f898dd3ff39a
SHA512 49ff4e322210606e3ffab65a9dec1bc350376bb54cab105ffe9b064e3434e35fde1680b8edaf4a5bc8e18e94043517bb5e781775094d1aff91ef5339f27387a6

C:\Windows\SysWOW64\msres\skin\background\images\dh_01.png

MD5 015bf2c485cebf8ade6fb8857409a5fc
SHA1 935580cce2ae9466eeef7475121d081d5814bbeb
SHA256 6fe0fe9153fd320329d33b77f56c3c37c4fbde465310ea0efd60c3206bd67dd0
SHA512 00f9c246a74709b45bf17963f29088c890d622379001e313099cd616b3c030230b1be124d8596fdab5d266abcf626dc4b81456638fd6bb5e669504aeece74642

C:\Windows\SysWOW64\msres\skin\background\images\dh2_01.png

MD5 8d16f1059d39f2fcb8c45211caab1e29
SHA1 9d183bd6ebfa40c180bcde2465dbf9d4336538c8
SHA256 bc73b83826b6f9ad44c063bd6363b37e5e11e51488df4277d4b55252b990ff6c
SHA512 0c66d7cb47f844b17a8fb21854736f9bc242d3fb77054bd18e581c980f40e7d64faa9c4f393a1ab02b1fdb58c22a48fb05213bb3ddcc686a4693ad2d9d1d6e12

C:\Windows\SysWOW64\msres\skin\background\userreg3.png

MD5 5bbdb5c183ebb74c4ada9d6b4e084043
SHA1 62c0fe7226a664e9c6f34f727cb11118185feff1
SHA256 f49f438971daf7b5549f38952017a6e1d6dd726faa5c835de90f1668824fcf28
SHA512 8a5d2d25ddf9d8ec57b5af3b8dadfb9f77586dbcab26f2f70374761fc5b81db12094e77e41c24dc99eda1fe421bc1112d695e2ab7c468733ae3bb20386a839f3

C:\Windows\SysWOW64\msres\skin\background\userreg2.png

MD5 be522a89dd38de5d1c9629f479b7966b
SHA1 00059dafebffb2ef15a6f095dc1eac5d195da170
SHA256 d015b82033d8d2d90ed4082195a28d6475831f44f7cc7d01a56489d0a25d990e
SHA512 f724ac7a4a43b5e83fd988dba854df7f16e1ef40c9c6bdda80d6f181e5d931be2171635b7a53cbdea35ca445a08ad41e8616cab4e91eb135bcf3fa2ebb99ba2a

C:\Windows\SysWOW64\msres\skin\background\userreg002.png

MD5 8da79d821305d93d472e76b3b14b548b
SHA1 e7e10d2cdc76525ad216c3a1639a66da61a8cda7
SHA256 08ece1fbf23281b5754e6408403334bc86353a097e7424b8d062a3f9d534905a
SHA512 02b4bd33f40d770e146310a11d81562a810c6dcb2c51f7623f4be9aecb045e8948ed3f31c2fb81e811a901674977b82c24460610d4fff30c298efcc00faf814a

C:\Windows\SysWOW64\msres\skin\background\userreg001.png

MD5 a750dfec49a809d10cd7260723e2b013
SHA1 3df8e911aef74395d2973dbe9a26cfb443e14194
SHA256 cf5fcafc317aa30279db660ce48faddd2ab9ac8714325f413d2248331cf38c4a
SHA512 b357635f8d9a77d749eb8e28c27008efd139ea190f9bdd3f78b0ef122cf31d58c59d868c8cc3d5f53c32416bbacae0ef3aef93d9d37de2e1fb23c149b9a8cd26

C:\Windows\SysWOW64\msres\skin\background\userreg.png

MD5 b4cfa488a79dbfbbef2cc6266f216687
SHA1 56f0342465dc6c4ce6edcdcd42e8d2cb60c56c49
SHA256 bbabf4500311ce059094eeb5f72f5ea87929f1e4a4bd874b741752234de6b49a
SHA512 4471c007cbd6186361d72e6ae19798c10cba1089dfdb2e13503109b89910565648a34595bfb39b21f426ca46515a636ff567609fa4c4857c3bcff0db4e5600d0

C:\Windows\SysWOW64\msres\skin\background\userchange_bk.bmp

MD5 92ff4c569e52582555fbdea97c00e62e
SHA1 a46f23b60d55e4d3a2eda2e45f1bad6db565cbd4
SHA256 8b5ddec3d62be67c74d9bd744081f549b6b46b53bf2527ee847da644fc907243
SHA512 356b9ae703a96d69b7065d0a3f74c2e9f999950fabee26c933a47b4185a51aeb6cacf4bfa49de888d02769e75fcb51d660ad95aed6de2af9d140f5d3ea2f287e

C:\Windows\SysWOW64\msres\skin\background\upload.png

MD5 8a1b59e21e7114518aeace49c0d57938
SHA1 a17ac9a6c4ca75d4a6d5e05a6d7ebed584689fe7
SHA256 fb5708872e987e315ceae31bef098be713484644fcf934ab76c7fa8d8da71a4a
SHA512 28dfc6fc3678d7312c32de906e1c78d0a9d48a87aa27801881ef632bcdf698d6dc4be53c344423e3a2077d060ca92454e1b4fe3700c5f0f1327d66b628afaecb

C:\Windows\SysWOW64\msres\skin\background\search.bmp

MD5 27926408a1adcc8ba2ca95ff459b63fa
SHA1 768654a0369170c629d2e3bfe11dea58fc25eec4
SHA256 4f1808f3977effa67dc0fc06dcd1d52fa47fde99bc69e5671da5bab0b68982bd
SHA512 2d94f507ce06948e21041922aa3b698f78bb433d65943f37ff21b7cdba609520d87a2b71b33a7cafb6bda060382eee5e6a27a13f5dcef030a13a5357a0ab502b

C:\Windows\SysWOW64\msres\skin\background\seachnone.bmp

MD5 463c35b53a10307fc361a94e5a4e42cb
SHA1 d1c4420c5168b3748ef39983fd97bb1006742f39
SHA256 5d6e028134e8c16fdc8eef127ee6f504b57853e4e37c7823e074585a5f9a52a0
SHA512 02c8c189d86ff9a27b1fd654fa469fffd8b5ccdd1d1c74e3e5b9db06e20081043e2db1a9704a1968c5cfc0e96e71715e74a496b1859f9dade7ad31f1d6c7ae5d

C:\Windows\SysWOW64\msres\skin\background\pack_head2.bmp

MD5 f9874a0049623b95ce0c072275bebcab
SHA1 b7e026ed49810dbf457b77218e5ca5d82f4c5d6f
SHA256 4cf5a152a2b4526c58a38c5adb7e70575dac27dfbd4945320b890c0e840ac83d
SHA512 1bc51c246d5036e0bf11d95ba6ffa8d7694be24c9ed7a7bfde7cb7ab7127dc13fb050e9d3081b9f3324148a3c12ba396fef85bdd07d0f74099f4525fc38170a7

C:\Windows\SysWOW64\msres\skin\background\pack_head1.bmp

MD5 597cd1f472b6b296119c6ea37fa8f787
SHA1 07fa18c6c75843a8ee9ee06a77645c53454ad594
SHA256 cd86f8ae97bd64469ff52e897485dcce63c42fc278d463f9f4ea2c037b8a2464
SHA512 f6a08a33bec92822562a72fb4409f6d1966aec0a221cf53ffedcde15ca9bb02430383e2c89cf92200c43ab062b9ef1af35f47fd240383a1aba2ea96bf8092a62

C:\Windows\SysWOW64\msres\skin\background\pack_bg.bmp

MD5 aa051e68c05589d2ef9d879a025209af
SHA1 453aca3fbe1bf952edbc00e178a3f2237e3abd3e
SHA256 b3db981306af0902f5b8e5b4ceef88741f010162df365544f73502b9091590b3
SHA512 55392f2cda65f360ea67eb7c6adcf9b906b7ada291b1740136f1461848deb0bcb7a93691e7c1aea37e98fae76e0732d6e113d7581c56a51ece20381fa3b5d41a

C:\Windows\SysWOW64\msres\skin\background\depsel1.png

MD5 5c52f4d50fafdba43ba764999c885a78
SHA1 755b04397c3d13f23c9716a43b60753f4c9f9254
SHA256 d91853fb55d637c84971bf430768f2477be3b03e14ad440c743d413be00818d8
SHA512 93cb1e0e5e52192a0b898f224b7f2d644b0d31a775e3adafbe04402c975d67c20a833b1923a3ac930b2fab54dc304510510e05910a02484c907ee2512487b734

C:\Windows\SysWOW64\msres\skin\background\depsel.png

MD5 d4f675353ac72c37ad4e56184b808499
SHA1 dfc3b452590ae92d0d7a5ced91f2a053e1dd3d0f
SHA256 06113b7f974aa2c7444c511f66f37ba16fbbe5c2d6af22f22deeab6550b0e924
SHA512 147c7f95479cd8f31267f0d2faaac6c06a43ea1767d3b318d54dfa7a383cdcad30838c5374792a41fd33304e5ab776ae5c054ffca64faf741eaf0bbe9b654e51

C:\Windows\SysWOW64\msres\skin\background\cwts_03.bmp

MD5 2abb6aca016706e73e1c7d718c9f5cfa
SHA1 d9866eb0f512469ac7d6ac3a6496ee9416c364b5
SHA256 c27922ff1ba09643947a5b1552e87276a78b4c3e9dc841d253e3d97e04b7e463
SHA512 198a401f54ba31ff2ba5a178253a1e1b9be03783d1dadcd2e34b2b49e2f273e59d59254bb570311691dc8a1e3876cde5484f56c0c891f88387cc88c5175e2cf0

C:\Windows\SysWOW64\msres\skin\background\cancel2.png

MD5 031d3c2fd360359edb815b4510c53e88
SHA1 ac04b5f7e92fa909eb3bbc9042ec1396a02f0884
SHA256 698765b2c55765cfe66f981ef34ba2874d3cc1f09ae505d07912563f994f4387
SHA512 ec4d96b16d95272682e249d82f995dd4ebfbd974c5d12b338588bafabd68f4de7fa428f099e53dece6a564b455f967410f6227140443c88ad6e70cc0ae05d368

C:\Windows\SysWOW64\msres\skin\background\cancel1.png

MD5 801cb2f718c4def9f916d18569258cee
SHA1 e64be4a03c50191e2ed2c3600c7d48b38e05b2ce
SHA256 07e7bba06ef7e21ec41875f7c44e62f30803d72ab1fe5bb308d79540df6e9fee
SHA512 4caa369f46bfd4211c5f134296b30f74ca02e8e098936381c02c1bc2260cd20ce1ddd272cae168881cad262063b707c85a87d568933dc25d96f64da18e42be90

C:\Windows\SysWOW64\msres\skin\background\cancel.png

MD5 3040cbfec66c55c185ba26a194ec0c11
SHA1 3d3ca98f9767b41e92488607b94f42704d82f420
SHA256 3335c18277485db66f1e83c2a9f818442e75fdc3872b163de065a79a121fb51a
SHA512 a9b8dd12168a5dcf7473c19aaf9904f1e1880999665f490a88847b8d03693f1a22e560e38912bdb6ace78642f00fcf6f5a81c6f902d27b01bc90349b1cf4624a

C:\Windows\SysWOW64\msres\skin\background\bk.png

MD5 76ab4cffe491101921901543f12172f4
SHA1 b4e5c4f4cc34824093d6b47e7abfc65589004c3c
SHA256 b63be74bc359e51b4fedb0fd13698d27e18e6b0d8057e4476d7e20437842cf52
SHA512 ada7cdbe99027333cdcad2064ad2800c7c8e90c011b6180e3fdb2e97ff6d0361710eace1eb4db58eebb00ad31a995835fa573c7ddf4d9013a737f8b98d08a3c2

C:\Windows\SysWOW64\msres\protect\STDMBR.BIN

MD5 526310d6b6734d0959c7ecfd0bf97e0d
SHA1 6a83060573c0c37c5aad54935338d6e9fa492d2c
SHA256 ace0fb7a119a776657a9b761e757cf2780e3ded807e4c3c7701fa5f0e5621ff3
SHA512 ec215e789d4cb8534faea7eb6b407784aca202ac93196ab24bc65812456b6595ac311a2d93af2c7885b3f60e6017d9b89bc79404e115da9c9293d31b3b5906e0

C:\Windows\SysWOW64\msres\protect\RSTDATA.BIN

MD5 30dc769658414e48f42a9ba278713fb4
SHA1 cd86581e75e0bdf1f9a0de08b43f2b4d197af013
SHA256 a2c797c5ee1575fbfb727eb4159340c7787357112d1dbc46be0c704556f085f1
SHA512 df1ceeae1fb6fd01051a293d57370cd4cc0cf8fdba1319d7871293f8fe552ada53000acc81ac14e3b1e308883d1e0e2e199539c4c17f26c2577884f20afbd28c

C:\Windows\SysWOW64\msres\protect\Restore.dll

MD5 4db693748baaee9505d14e1b43749e91
SHA1 f98b07bfd5b2e3b133cfe8e81c2b694c3e692d0c
SHA256 1d38ef1fe6363c73e98e6f6fe90897864d9c842333d87ad7bc052c2fc08dcc9a
SHA512 6f4fa41c9e5ec2d2d4e45af0e9cb8429885d444a1696794448087b80e9184b2042b9e19285fd3eadd2dc8a7cd4ca54be30a1021b1c124e276f7a8a9eae17f4d0

C:\Windows\SysWOW64\msres\protect\ReadMe.txt

MD5 691e62028337a522d4211102b91e4ced
SHA1 decf5396f555c35a762bf7d877171a7234ea0585
SHA256 1a7c5d13a03e897ff810b87ff4eb1b641b182c4703967c47b9df163510e2a934
SHA512 b8047d969ff2735570e5cecc45603daf68876d18e473f53b8b1cdf59625ebda4538a7bef4368e4394c6c6896c185c7b28c368672224306523484dc25e10aaa14

memory/8448-4263-0x0000000003A80000-0x0000000003C23000-memory.dmp

C:\Windows\SysWOW64\msres\protect\License.txt

MD5 539add8b63c12fcd42bfbda80465965e
SHA1 a4be331dc60f79c6b805a21edfa7bc1d695250a8
SHA256 21199badf0521ddf637e75cb2bd6dfc1c1b409f165f1a89982cf30ef0fe38edd
SHA512 c12a7ef1d4fdb0f7fb228d540135c41139b729a286c01754ceefe5cdf6402ec2a70f2f1449748f3321af1135afb2762ab2df1e5c1cc9b14cdfec875031fd6dcc

C:\Windows\SysWOW64\msres\protect\FRSDKTest.exe

MD5 58128d77088760f9c96f7597dbf4ad94
SHA1 05d94bd4140cbe424d8ede66aabd5e7f726c7a4f
SHA256 f2c4ad6d9a4c89200586743017a326bf01fa2cbea5760eec023a18645a167dd2
SHA512 2277fbd981e75e77f81a7ca524888a5d2b15c3e66853e1e495e3ad574e1799559aaf71eed09694d148ed41b71da1249f318b8c0d9cf88133f6c065001109afd5

memory/8448-4266-0x0000000003C80000-0x0000000003CA2000-memory.dmp

memory/8448-4270-0x0000000003D00000-0x0000000003D25000-memory.dmp

memory/8448-4268-0x0000000003CB0000-0x0000000003CDA000-memory.dmp

memory/8448-4267-0x0000000003CE0000-0x0000000003CF6000-memory.dmp

memory/8448-4265-0x0000000003C70000-0x0000000003C7E000-memory.dmp

memory/8448-4264-0x0000000003C40000-0x0000000003C5D000-memory.dmp

C:\Windows\SysWOW64\msres\protect\FRSDKTest-2020.10.14 bak.exe

MD5 9fa14df908bec6ec466c92d5b90f4923
SHA1 a8111ac7bacd780c44f987b603c8dd3f1e67bab4
SHA256 490f6bdcd7b80e5c3063b48333ce8e7d842e2899e8f228f14d6a10ff0267effd
SHA512 adfaf0d29e4c1a743e4f858b51abce468b19f77168e64343a99787508aa161758ea73d97ebeff74cd46dd616a210e8ad2b045227a419416e4f3e5df3efec97af

C:\Windows\SysWOW64\msres\protect\FRSDK.INI

MD5 15d054280e6d5dbfca5218f3c84a4a9a
SHA1 9b7463c228fa20d44297f5eebc9bacb5309f1cae
SHA256 456ce3a371b1946d1985f6a89f7c40585fc5010b345328b725fe90ab43f10817
SHA512 28a73729298fa43e42a48b509d19e49a8795af5e1c6061620170e0bf64ae0235064dc9b2f2970fb948d26d6f60cfd405aa8b996512bd1dea483976024cf00d5f

C:\Windows\SysWOW64\msres\protect\FRSDK.dll

MD5 75310adb4f364176d64b28c5ab128fc6
SHA1 6e4ee07f96359b4f7ab29f5a5112169e001a8033
SHA256 928db8309813a11b850c3769656673785cec21ce51a8f33e5069fd114be1c8c5
SHA512 aa11e0d8df508b01357defb2b9e91d661ecfa24ea65f8987fec069a0e254095125721a40e94ad8ac424f1c3686f47508855968e0aa0a7872a28aa601bab61afc

C:\Windows\SysWOW64\msres\protect\FASTMNT_x64.sys

MD5 7df8caf8a3585e504fecbb3217711234
SHA1 850f951f02ffad02cb2f757ef295fd230c9f5a78
SHA256 7e999ad2fd0c1ad9cef68daff129d3eed82dad265cf79b9b7eb15eae2d647e4a
SHA512 acd69cb5efddea25257cad64f38caba887f7b531084a8e97bef7e006b18861edd92d4ee8500ea0c67eaf507451eaf805727389d5a9da58a033498c0f35214a77

C:\Windows\SysWOW64\msres\protect\FASTMNT.sys

MD5 23ab93987a34deb15e9ce5d6728b39ca
SHA1 881073b68c7ddae34990ea4843d2ec8167eee51f
SHA256 d219c0d74d6e961b5e9b202a79e36bf60844954a9732d81eb99d8c07c2daad41
SHA512 6cd89b1ed8086454fba7ca0978315b8f1756f19e2b53fd42b1424c40182269403705b9d43832cc0212c553e31b3019f1298267f7a5716769926354a88c0b73a9

C:\Windows\SysWOW64\msres\protect\FastMnt.dll

MD5 1b03e5fc6232981cec8d04986efd63ef
SHA1 b39108470df11fa4b1f9b088764e1e8f281c118c
SHA256 fd11d2da6d878c378fcb51c6603639d405ab9c9594836cd495b7edfbfd8e8892
SHA512 cd814c0b70445f4c31113964e7399277eb498cdd8d0b91e795d509320f71fc76c9d9e2038ab7ae4502ac0d6817b688237d1f9a1f8483de254ef2e2c6e1036ba4

C:\Windows\SysWOW64\msres\protect\fadisk_x64.sys

MD5 a2ffe985c45b4833ba8f725f6268aa45
SHA1 dba050fc164c6b38192cb1955a13c6209a969e68
SHA256 afbc7d48a0cad54eefb88b5d93c2e392f7d6a21de6d46f2a7c36754a02b6c2f3
SHA512 9aebdde2f8df141020e49e246d5aaf74d697f66300a5d056cc69a04602e748e1aba1cd22463e16e7acfddef5a9d03f08f9440e1ae16ae7ec2af3ee4f002cd717

C:\Windows\SysWOW64\msres\protect\fadisk.sys

MD5 aee9e961266058ffa52e1510e5fd7fbd
SHA1 c2363f619706e3528e080b4df0fddba78ca2f09e
SHA256 3a8f998c86365cb4c3b318f48085a021d80421dd5c85abbf2cfa0ab3d0b86e23
SHA512 537936bf0f69b12891713d0f321212505280d98dac543f27abcbab650e84d86f65b6b6a9ad3ca02a38f5a4751559c7b9891487f88b4b56e6aec8ad7b0e310095

C:\Windows\SysWOW64\msres\protect\Detection.ini

MD5 1b5e768a8bf9012730779655ffd45335
SHA1 3266191db09c40124b52d93a4f958ab57f9404fe
SHA256 f2de8c5418cf7c6d13c64b50ce6a38ac4294bd57f4c44ab02e059a35e40bcfbc
SHA512 b0b163f1b4fa9352165f3cee848384d273c4a7658f1d73bed522eb3f1408cb4df454ba2be9d799b7c5c6c0e8228bcf30376670830feaa0f13e2b719881a6179b

C:\Windows\SysWOW64\msres\protect\Detection.dll

MD5 8c62ef18b5e4e084eba23551eb265fcd
SHA1 22b961cb466e77cb5a14e6e2d41bd5bb12950c6b
SHA256 dbf02ecb4c64d240fa15b42b84844ecc8a1c8509e090edea36764e05dd8312f8
SHA512 8e4548dcad78cb5124837f486aabfbb01d31e461647db398363dee15cecd1ad8038afb8c3c17d3004e071394b97145b49e30cefec791187c5b39daf975ffeb17

C:\Windows\SysWOW64\msres\language\English.ytf

MD5 db48f4be21f97aacbc247cab0439805c
SHA1 41a6d8e09bd829cc5e90dd0fddf662fb12f7cbbc
SHA256 ce10266745e259632f0e1824cc681c4d701513e14fe055b8034f1bc46b9ff066
SHA512 a2db1de6779bd10a8be8f21441aae693fdd89119ed840dec68a361c13f711b2c5fe4cf2399d2eba6e22c748ceb2f42da98d0693fcd904225684871587c069a39

C:\log\XFMainTh.log

MD5 a1fa1076339277bb7bf509b66c03f64c
SHA1 b82c6652fc0e0b827c96008ebb4a9a310e9a7245
SHA256 e14fff6b365ac37b0f9493311ce0af563bc6278f4b326c4cad1a26f0dad37ca3
SHA512 e26bddd75d20c09b67fa76ffd77bbe5cb57de1ce29f8614dbd032bb3898dc7b35fd33a8d25d3ea63defec0338dd50f5ff464c9599f1eeb6e788db56a84b5d987

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 67078265c62561a42ef3f4f480561fe7
SHA1 f33ea87e6eb2d253a3ca47ada13253bed05e124b
SHA256 2105eeb60b7dd319f5c10a0d5856184b0efd04fc0489ade4ec53c59902c3698c
SHA512 ea720c3658fd9a73f1bb7806f690419b4535695086152b49352dc1aa0609a4a78f2321cecf17edd88abdeec9fa2b8a8d029d34105d369feb68fbcc907ab53299

C:\Windows\SysWOW64\msres\config\USBConfig.DAT

MD5 39c33a46105131a5fdf5373cd83f7403
SHA1 5497b0911b3f5772723def3b360a2e654327c19b
SHA256 097328e8c957de2428283954f6a1ee8ff7ad7def12e100a600178407f5decf24
SHA512 720036675e1262edc23ace394aea5632e01a84be675acc64af60554d33a541afde61c56a6cddb98659bf2a77c48ab23ce38b178a95413d495827b857c75ecab3

C:\Windows\SysWOW64\msres\config\ScanFullDB.db

MD5 20d30b97765c709cd80d3a5788abf157
SHA1 a0d1f40a20b0907733652d9a34dbc99e78d02b67
SHA256 2dd8db96d8f31636f404d072b39925ef30b033230dd44b1b3c23ccbe2f0cd722
SHA512 ce9449eebcf5e8fe7a66ce26a8a53f278714ff92f8072c5b09e6f9f7ff45d072f3350f0428d17af17406e7d55a0a88b79df11e4de32c8be010663cbdc491c648

C:\Windows\SysWOW64\msres\config\ScanAuditDB.db

MD5 fb6d18199a3c28746bb6ce95a41c9585
SHA1 fb667293377bfe6c4343b1cd2f30d0252a1a4529
SHA256 471d30d234558a1b4d2c6a16e0b065c7a32a324c6f9c9b4def1d9a0f6599678d
SHA512 586ac97ddd9e7aad4acdd485cbe6a9abab5812adeb3a31e4acae7e608587d2dfda1b8f5bec6d9c384eb58ddb981bbe31669d9ab69b16009be1e81722ce72fcbf

C:\Windows\SysWOW64\msres\config\riben.ytf

MD5 c0a475f8feb3e9a92a117ba0df4705d8
SHA1 8088b2831dfece8f38221274ea791a300ed7de3e
SHA256 47d2994494b732ca89385d218c55fb762ec36e7bf5487f6ba42791088940f9aa
SHA512 efe2b394b1eb6e9cde049d3259bee165a29ef6c03e35fc661759022f4ddd2328439be26356a98656ca866009f0d92fa83225c26b656c6f3e2622f4bcb55895aa

C:\Windows\SysWOW64\msres\config\ChatRecord.db

MD5 a9f4cfb172d413cfdd81de0598ba82d0
SHA1 749339c778e896b393318fd0ee6ec34f05d3e2fe
SHA256 79bb8c3c91638997e5ba5eb5526b3b11e4aa2deb1569c5f6cfdbbe0d00167064
SHA512 2e4a0a709ccaa2bb2c2473269fb863b9497736c50aad995dfaf6e2a910f08700582abcec2975cb93dc3245a511e6683899370cdcfcdba23dbabd203bd91d9935

C:\Windows\SysWOW64\msres\zip.dll

MD5 0e5d5e39973479d84fea27b480d6ef74
SHA1 9f467a0c681e56c5793216a4cb01127b9c1848d6
SHA256 79b43e1a8bd6880c3dbb7bc5558c3c345918cfbac151ceb08a70f04cc3e38e97
SHA512 803a7d49fcf89ffaad3a5510e972805c53a5da44b3b56f670776049b1567445ff60c6a459f8225f096eb88180816a8bab6871e847a44e0f45bfa016b701e0065

C:\Windows\SysWOW64\msres\yunoper.dll

MD5 84cef7ea8a1ede402f5b01de45671c45
SHA1 6d77b571031f4012f0f241d8881478060eafde2e
SHA256 8e52804d68dfb0a4e5edeeb26bf5d3c3849e66dfb4500e3c271633376023e6d8
SHA512 6fe7e694d44bb4475e0726a89939f0d4815747b36e259c0c6197fcd8332d2723d07163110ac6fa623ed88e29321f7dde9ad87e73bcc8651c167ddf1efabc3a3f

C:\Windows\SysWOW64\msres\ytuiafun.dll

MD5 d12ab4385df88db5b8c306f0c31dd916
SHA1 caad6f70965f3e5407fc383150e70e7fbc5f0ef3
SHA256 57dd9353ac36678b9b34eea1171205157ba2964952e66e29bbfff914081f16af
SHA512 401ff731680b8464f0a560adf560aeb6b0fe8ba630ac367caa39de9dfda9cf5f21f94ae5a1363d0c134a6d390912f79b71806057f3d054c369769babdc360c51

C:\Windows\SysWOW64\msres\YTSysConfigBak.ytf

MD5 cada4898331568cef2b8fb760ee0670b
SHA1 c907bd823a56f19bc759df8f39fc7045b2fcc48a
SHA256 8bedbc8cd3dded1d12fe8229c8173583a2a0d4197ac284e7d85d727cf03f0005
SHA512 ce738a1133bc1db6b199929f3c339274f38d89374a74ce76eabe02a2f70fdafadeafc6fce2d4de9d1bc608ed192828268ab9a1877a50b36d237dcdd7f37c109e

C:\Windows\SysWOW64\msres\YTShellExt64.dll

MD5 0db3ebe71cf3a166329d8640d1da32d0
SHA1 a93f47c89409a5e99e5026af219e157cbf2281cc
SHA256 a9ba9d8cd5604f059575ce1010baa3e62958c39cea71feff0afc40c7942cd1d1
SHA512 e8cdd24c6c2460e7ef617ab80a24289af20afc8b931a4a79279ee777dc49dffd74603f3dca64168619978554c9afce53e65d4596eeb81e7945a600e9f58e3cf3

C:\Windows\SysWOW64\msres\YTShellExt32.dll

MD5 ee0d3d887efbb12e1155dc86ed8b10cb
SHA1 20a083a9a120d38d5c12f7297c3bf4e06308d901
SHA256 a2e70678709f90fede8a3474505362fe2bfec25f7eccbafb9296650ab2089635
SHA512 66c8fa4374724eb047e1416c0f2f131bcff9f8d24bfcf72db9f7391c08436b27886df888fe1ebd1d3ff4a699b5033f9bb9e18c6a59b60ec110a306aa59f3acca

C:\Windows\SysWOW64\msres\YtMiniFilter.sys

MD5 b05849dca3b08846c9b2e1e20e62f8d0
SHA1 1cbde7dfb7bc105eff0dac56d8fa439a7bef0e6c
SHA256 a7670d15ad1833e9f2bcee60c2318b40e747c97f2f96658c1c68a20e0f73da27
SHA512 e60aab79b7c0eb17b832e1b73e4873e2739e3968c5e0dfc3a35f361c0e89ac2d0cc5432b3fb1f9c6bf9bec1772a2afbe891acd38d211edfbad0d9c11175b31c1

C:\Windows\SysWOW64\msres\YtMiniFilter.inf

MD5 93076ededd41da9cd404edee12fa9795
SHA1 66c34e356ae6946bc2e19a0c14376d2d78b16d7e
SHA256 bdb919abfcb2a4d5a05717db73ed6034e28edf8a530ff55a76d167394eec6c89
SHA512 199361bdd22f0c64027f76e5b0f20e0e24f06728e6a4d34d4453bba7324791734a0674d374c6f7d8755243a5adabc79439504a12ecb098a51b062ef89deaaff2

C:\Windows\SysWOW64\msres\YTFunDll64.dll

MD5 102274f4908dab25069c235ec0b311ac
SHA1 7d5ec17cadca892ab2f6c235f14e1faf43e0c38b
SHA256 7d2f08557153c9b37022c3dc2c0b16d651967ac1524d76ad6c7250be8fc8106d
SHA512 68a03f6e14231aae464559f15d1790a846011616cc171e56c6b94dc021166e699792ac2a0f2b11b95af01227e57626ad294d082f4e67cc45df4e414985f57805

C:\Windows\SysWOW64\msres\YTFunDll32.dll

MD5 0640f6055ed42b426bc7764e0f038dcc
SHA1 d6cd21251c84f697662adc4a8298e7fca8711cf7
SHA256 32272eb9b639c138be652a5206630815634b98daee4290df708a5c2654bdb22a
SHA512 6d350dbde8e6cf9f523cd1a1ce084e7267efe7dccdc63710a9945b13882d5d2a111d09ccba8392470ee002cb2c3de36b7dcb1772f167e2e99b87285ec685039f

C:\Windows\SysWOW64\msres\ytDisk2_64.sys

MD5 257119af819314ace39e0a95cfbf70fa
SHA1 0dad13d8491b2c859f550958a58b0056f72d663e
SHA256 f6268d2f89c826f8f0ab4c165fb324672e0e00d198c3b43bc1ad6b2c9e0f65e0
SHA512 ce183a3cbcd60c2d6e260fc721b5ba079ea9f383ab3aae1a6907387b59a8652231b898858a5ea07522b6cd1938b59c736a50a138536ab17983f7f7eeaf18cb3b

C:\Windows\SysWOW64\msres\ytDisk2_32.sys

MD5 89c4e0fdc3853b511a2cfc43aaad4189
SHA1 ff8064e6e0b9bd571a84f7eeedd4efd770f9ca04
SHA256 577bc08f78e11bb23322f25166a7ca048f3f4c80b0fddefa673c430d80302fb3
SHA512 0e8fdb2d34dbfd8988da74f8bef73900c5357f04468883719a7e848dea41445e3e24d5ac708f7b3d1073ab1f3f15a725c893b10c228c26a197f78774b1aa644a

C:\Windows\SysWOW64\msres\ytdisk.sys

MD5 a8ade889c57069e5582b2cc8a7ce85cc
SHA1 6933b933de1dfdacaa262881ef06ec9f83ed7a58
SHA256 b2c4e83bc892f065496cb6321411fd0318622f5b89796e68e16b8d5d67736e1d
SHA512 dea05bec0ca7c8a7ea159fc8268d96648c82a40903ba44d52d28ed7b46445df5ea7e239ee208143111b0567c634c150133b49a107c268a865dc65e724d94bdf8

C:\Windows\SysWOW64\msres\Xz.bat

MD5 c8758711951079cdb5f2e9918b35b5d4
SHA1 2e6cd6760d19036a04496976ae824b8386497321
SHA256 3e4130104f14733a5fd9b1f2c75e8be976aa15bdd693382ce902cd33b0a3bb12
SHA512 192b4da18abd9117c2efaf59c86a007de32c6552e3af0712d1b777f4f55f54b9fcc1a229b5332a39361ad7a8a663276668299e3670ee720946de2fd526925e36

C:\Windows\SysWOW64\msres\XFMainTh.dll

MD5 7c0ba520eff1174ac7c8122c630a0793
SHA1 f7f1acf035f508350ffaefce630934c4d5a3320d
SHA256 24b22085bcfe011329eca31f78b6546f55097245e8bc3fcb4177bb714948b1a9
SHA512 62ab4d0ec13541b932379be9df7396fabcd1785758e6d8583aff4eb448c65811aed7b6fa29e5df5e47b8b9c6c07efe4a5442cdb6bf3645f20f20e825b50cb551

C:\Windows\SysWOW64\msres\wni.ytf

MD5 6bb4955d7e1050b3f19c7ea4246ffd9b
SHA1 6c502332a14f1791e7549d5469d3497ed5ce2d9f
SHA256 5cb06a70268d0062ada41957628ad9270ffc29836dcb2c0e24dfbb3169c4c673
SHA512 cf5b53e0070ce756cce8da4f06e194373d2c5f8d7ab870dcfee27acb5a5cf0fa45b84677fc8ce0ac62aa2bd37a6a5f95935193a73f712a911cc1df29f4312573

C:\Windows\SysWOW64\msres\VSetup.exe

MD5 5e242a871251963dd5d0929d07d3d5a2
SHA1 853a9b3b05712311a75ab126ecfb98441feae545
SHA256 eb0504ae1dea3fb6a4db2d705196d7f94b0111d365825e53194f64af3e71c8c0
SHA512 eb73289b78668d1049cb30336fb64ce25313d23a28babc5a543bcfe7b8f78225a921636f75e9be76c460203bdcbf14399addd98e83b046e6a83d1900237bb1d9

C:\Windows\SysWOW64\msres\VSComLib.dll

MD5 271190eff252587d0894a5cf6dea7831
SHA1 4096b2950ed10f4af5838ac718b5b07775dcacf5
SHA256 620a0fd67167ec855c62e48d13a8059c1c90b4d57e3d2cc77be655fc3c53b18e
SHA512 eeb2369f3865ba3c5edecede09e833b41e645eb00388240a5d8df412468efc77a372f29afe80e260d3214974e4a362f9d6aa78d8fcdb231c8c6805232ba2fe62

C:\Windows\SysWOW64\msres\viewRect64.dll

MD5 e42f2fdea9fe6eea71c598cd62bc475b
SHA1 47265769aaace1aff0a0c4cf41f37543e303a894
SHA256 fed1bf695cb11b0fe1f9f726dcfcbfafdb3ef9fc813bfa30cdfc2a90745fa369
SHA512 315b45b0d1a463cb1fdeefb53624880350c2de9fbb3f13ee13f0f195898fb9eb761dd9eb3b0d0502c562f5e56ad428b078089326dd95f9c6e5052ccea03521c7

C:\Windows\SysWOW64\msres\viewrect.dll

MD5 bf33b1a2559d66d56db8bedc94e5bceb
SHA1 fb05cd60f40660da76343b2b155c3adcd451ba4e
SHA256 6cc77760933cf843493d827ca1b558622c9d2354e267914c8a00f727e3ccbec6
SHA512 ed9fa24dc9fae221878dadf6ac164f029747fdb27b860edcd149617176b39bddbd56b03e9073d52d8d88500dff555da3a06fd4fa1c6916d40ace7fb6ebf0e576

C:\Windows\SysWOW64\msres\ViewRecording.dll

MD5 0e43acf4648ed58b371ff4a1db02d557
SHA1 ae2d9a616c25811d55b01e3ee8d15ed311012363
SHA256 b0060a1ee06899cfa23d5dcea0271f0f876edb6f970fb43a1138dfd3a30de7b8
SHA512 536fdf1769c328ef24e8b4c9f778186a78a9aa3a44a3794eb3a64b5bc2c5b346609ff769a8333cc6bddbaa92921276f97f3ab97e1d4fcbe5bdd5b5874c776aa9

C:\Windows\SysWOW64\msres\ViewC.dll

MD5 5c56678149e77a59eef758fba4da7aae
SHA1 46a0f27be63240aeb9cc7d1bb70b99148482da8d
SHA256 f306faea2b7979fa68f4df0996942f3bd727b794f99224d7c70031e20940411d
SHA512 a37cda656f35f443c0adcd7fc669be5593a529180d8bd7d12613cf5b29eb4f3aa3e6f82fbf33240944cbfa6488d18c96500c9e90b7a5b53adbf3aa99a0d4c14e

C:\Windows\SysWOW64\msres\vgwdrv.sys

MD5 5a12522a6ac480dc1668e4ecb470e3e4
SHA1 66461816cee4ff92b8d75aa9ec62e234a974a6bc
SHA256 fd18c523ab72276834b5988288edd194315653081c418d9c509be589d0aa392b
SHA512 12584840c5da99f33c0af3d5b4554cbbd4cdf1588ac880da08cf037f20808f82035b22bae6cefd0d22595832db9a4cc1f7c64ff87cd0e864590425fbff2cfe69

C:\Windows\SysWOW64\msres\vgwdrv.inf

MD5 60fd4032c9a1f4654df9a7e8be7d50c8
SHA1 4bfc55a4609bd452731e6cae54b6fa61db446706
SHA256 f1579ab34267a69494303ddde980fad73e309bbc15645d0a511d4cdad7aa5093
SHA512 4a7b191667064d3fec33658f678b8537e928f66a8f25ef8a43153fbf9b6dbdfa052aea78173f186099e5b3d21af2d84c3552d22a8df3399cc5436cae4d9c2f29

C:\Windows\SysWOW64\msres\vgwdrv.dll

MD5 faf5ae9075b85af3244a8c3ec9d83d9e
SHA1 7bc6c9c5f61165ceda6e670f7591e6366add77c0
SHA256 0be721df03ac9378d1a9901c268b2b41e21d4be551313ea86d3f578215c28e61
SHA512 80ae75924a34738e68594d6850afe8181795c3f09a1b1dc55a2d74c45e7c9bb0d8e25d4325b05b1de3feed592300dd8d35ca4bb48ead45e2f96c041664e193a7

C:\Windows\SysWOW64\msres\vfsd_fre_wxp_x86.sys

MD5 e976449ca5ebb3cbff8ca444e4625fa4
SHA1 2efaf45fcbda84597a306464141b66a9a9149104
SHA256 105a21cd7bcc57f9f586eb1068ea3cfa00052eca3d5ce6d5270111e1ade42767
SHA512 b6860292513a8ab8ce3d81976ca568055026980a5cd10f677829dc53fd71390520e15fe58d36b64b85096a95081d73318d7a500f8c37c7ede592925f1d3d271e

C:\Windows\SysWOW64\msres\vfsd_fre_wnet_x86.sys

MD5 2fe7f00b7cd4f92cc42ddb4f78bcba2b
SHA1 97099221be63bbfa7f4e4498197f652f4dfaa09b
SHA256 447d3d1517802755cc06fc6e34e80ddd29df49241ec68c0ccff18e32d342a4f5
SHA512 e64bbd3b2b654c5850dab3feff15f4de793a85573c090975f986865cb32c843fbbbd2ecb5959ce6f483434978b7541bedd17974223298c6ce609aee09b34cb34

C:\Windows\SysWOW64\msres\vfsd_fre_wnet_AMD64.sys

MD5 f2585a8f4ba8ddc008f348729bb0fb23
SHA1 b6cb5fe25698c51696fa19c840ee929bd23a2082
SHA256 893d941a24b63983681b59194097ded2219e8950188711e706636b6eb057bdae
SHA512 20a010fb204eb18b064978aec139fbcf43fa479f33de0de5369e4fd245c22af21b92a9f8f105736e989c4ed209979dc6167904e3222f20fbcf02955f90fa7c40

C:\Windows\SysWOW64\msres\vfsd_fre_wlh_x86.sys

MD5 ef9f5989a40128d40be798b17ce55cd5
SHA1 5f92f37dae7d3257b588e42155fc095dc4f97b5a
SHA256 47214f7aad8cd0058eb34229e8a29157ca14dbf2e905dc921f09653f27fb6b58
SHA512 08e6e0c52de912ec2fe98a1923ef87811f850afe2e2821812603029f88e27375de57c77f79e5d1fb7cc4b9fe7695a9df83b928a24bda1ca1fe9b87450dd87dfb

C:\Windows\SysWOW64\msres\vfsd_fre_wlh_AMD64.sys

MD5 bec5c469d4b712070040ffa99c92a565
SHA1 bdfb212534de60381fa616b8abd438772673de41
SHA256 a8ec90c0d4dc1afd4fd9d2c41319e677ef1fc407b19866ec2250a62b1ef689b2
SHA512 7a914e1eac6bd85c4705e561b7df98d43e9f4a929eb74b43e543bfdec2310ed9efa5f642aca6d9a2bd70fbca4704c341d4f235abb1cc8d2b8520d539e408d685

C:\Windows\SysWOW64\msres\vfsd_fre_win7_AMD64.sys

MD5 ec585437ef994f817d1c8fb333d578d3
SHA1 851ce494f13fac3b866c5e55f6e61309fc2bd039
SHA256 e8794ff0a18102845b3e09df143d0bdcb408c1ce51440ff436233488899a3f30
SHA512 2e42c5725e98ebbbc0ccb52e7b13376520b96fa0cb328d0246aaeed44b02c35aa0449ff80893f2657a6046b9504380ec8bf95febf0a78e1faca254a1fff1f5fa

C:\Windows\SysWOW64\msres\vfsd_fre_win7_AMD64-Replace.sys

MD5 1eb27ce27e9f86e70253ef065a77e94c
SHA1 9741ccd82f8035fe0c8e4c7066f1fe440f56a7cc
SHA256 71a2225e57602376dbe5b88db0d005291535052efa3bfb5c5b9a924766f19eb9
SHA512 406542ab2286498efcdde58ac03d4c0378b03f0243533df14a13815a87227f9bb69eb0dd7de0c11aed42aacb37c98e4468c427d9a1f336ce63877f563c6def1e

C:\Windows\SysWOW64\msres\vfsd_fre_win10_AMD64.Sys

MD5 166989f0c8b64e0e1be5597434ebd1a1
SHA1 80e68237472a28726f802c8f2b2731993ae77243
SHA256 bf32737eb2e7599a58e677966d73dc942bc15a962002418a1bb779cb255ad0f5
SHA512 4842566cab3801cab66aaa6404932a42048cce98ecc2415943520dfbb095d5235bf5c2895679dbc8c4032010b804fa0a83e8b2d971c7446152534092316e9f4e

C:\Windows\SysWOW64\msres\UserCtrl64.dll

MD5 6b6a4fb57f8437896a42af53b051fd27
SHA1 15327a2ac71a405539f6b999ffbc449eac3d8aca
SHA256 15f43e0fe5d9664171e092be805dd6450aaf08099536fee0a2432e4e139dde11
SHA512 97753fa59b35b45fd60f2875b69f872a9f9c528bad5e5dcf4e0ae5ff1228a8c674c35962e5778e9d7b57d8f8dae97f70d71a95b1a2fdee8e8d79882a249df298

C:\Windows\SysWOW64\msres\UserCtrl32.dll

MD5 41adc2a37fa216b9f2c3774ce1987a8f
SHA1 25d2b77df9e4a5413984e9a7426cfa0be7c3e87c
SHA256 97f9c7be68f97091660db56d1813b9a561d9f5e87d8b1f08e84f4fd8ba5f2acf
SHA512 72277edff74ab3e9b084d33f10673d0c7f34c37a5ce58c0cb19f9dfbefbbd8993a23f79953a289e0ee77569264bc02fad17185b7a16b659cfa7e05e8500cbe84

C:\Windows\SysWOW64\msres\USBManage.dll

MD5 f18cee1b2538e428d2fc78d276ff2bb8
SHA1 904365140a30b82b1387da95a19781dd6e87239e
SHA256 e0cc2d9775b267dbfb1566b4d8dfec43bf23c9e1e808d4da74c80c8e7da19aa3
SHA512 a5a3f2a53c973306ad2dd301436d48d0f97f1b9853db38be6eff86424caa49d9ed75003f49a7bc77b38eed560caa6ee4bc435eb9716adb0f6ab58ca3c36c52a0

C:\Windows\SysWOW64\msres\UnicodeDLL.dll

MD5 36933a5fe7f45746f42c9723774a776e
SHA1 7e1afd70f201f52e9b57c4062116c04f6cc11901
SHA256 cbe552e4f8bb64aff155f1298623f4e1fa18d7e719a519e0ebae1a7692c3b934
SHA512 fac024727d0b2fdac1bf9a66a6bc0fd0208d572ef9e16e67a1e20f3eca31cf228e7395e293e329e0a78211902cd40dfda38639f0e6b03a1d3d1eeb4a62cb9392

C:\Windows\SysWOW64\msres\ufsdicon64.dll

MD5 2001b48fe1a435fc5bd35923b83935e2
SHA1 4616c349762ff0b121722c0e20009ca2159b7838
SHA256 bc898384f963a1f3910c8d9d58b0a5c26ae4c47fe738e63b8f1c6c2c1e813ff2
SHA512 a6feee56df0025a2677729e83bab76ee78c031f445e20b64e7967ed4e6d12bac7ca837a67188012bddfbcd141a93218e65509574e72219c7672807ecb46bfe00

C:\Windows\SysWOW64\msres\ufsdicon32.dll

MD5 3a7adc5b176da8d2110b743e0de17f64
SHA1 b2631f9bf25d27d8efcbeda08226e8ef1584c0d0
SHA256 677719900cc390a67097b433deecdd4036c39a79d92b2ff1fa1717cbaddd1908
SHA512 44b8ce92a254856d5b25c274c8cc4f1e353c329ba94a480f8cfbf007523aa03862b20bf85ad2bc9ae764464b6178952c301ea457d1658be9b49afe908268cd3e

C:\Windows\SysWOW64\msres\UfsdCrypto64.dll

MD5 83f9b6dc3c1b23c884a63369ed7e349b
SHA1 ff199b0b7a6937bd9e46ea8c6e98980a3c4e5bf3
SHA256 b3e07f8dcd8e6af2196853dfaff1e7e570b0cb391d81efb2226248aacfe04ef5
SHA512 9a9fd44447d21a140f77ab75a26883adea46ef97e7034908fd096b8394f35ea0bc167a12601972c1d78ea02e805e1db975166afb8d57fd219d8083eb477ff20f

C:\Windows\SysWOW64\msres\UfsdCrypto32.dll

MD5 977902d06338ec52794ac3447e297c92
SHA1 2f03d08baa5b3ebecd9561a8bc1a36207bd83e5a
SHA256 8e25aa6dcef80e3a20c6a0ed8f55321f8e4b245cfd7762c95398b8de7f39f40f
SHA512 ae006fb659b1af678216d99af7d58093ac9639fb953d5d84c68ea0e5f3fb349082dec115e5b0115e25ae1e14997d0b09437365beb6602280abdc2299dff74ec5

C:\Windows\SysWOW64\msres\ufsd64.dll

MD5 6bfbcfef404dfc9075950a49b6fe8f2f
SHA1 c756e0a239c5b7c0f90c06a3f8c544c5a2a49990
SHA256 f209c335499c9f06a89b32015bcaddce138a58eddba1c03a567ce7054de8363e
SHA512 33dec79eb131a0ebc65229b25444715059411ab4e59124e49132877947977c6271996fc3b4dba50993136ccb70228add10daeb2a1ab0eb49d01dd4200102a96b

C:\Windows\SysWOW64\msres\ufsd32.dll

MD5 ea2c494e88a990f8dea47ad09a730ae6
SHA1 b8cbe90b54ca4c4a6ef6f7ed2e376c6a6fb49e4a
SHA256 066771464bb301a3164fbb0b4a65b55e01ec3bdbaee6975dc418741bbc5bb78c
SHA512 30caef4b2c5f86444b60393b47f09bdee248af11ab71576e9f574cba9820bc71953bdadac2563f24c7ca03650ea94ed5dd2bba7a82766b8331eec08b3bf6197b

C:\Windows\SysWOW64\msres\UCommon.exe

MD5 0f8ef2a22aab4d607979ecdc5c92de17
SHA1 dae1600a0fe0a0be56cbbf2a235899f7a0929427
SHA256 a892e0d0fa0dbf01f6e590b323aa17888d8ba2a6cb3473d7e59bea72eced50b8
SHA512 a0204be8261530cca64514a2ed0c6f774d69042b9d72433e515707e643c466dfc765ae10a98863d595367195598f2c13d623bf961d5a13cba53ad72acfb5d4ae

C:\Windows\SysWOW64\msres\TurboDLL.dll

MD5 9a9b87f524fa36dfa52c0b9957577f1d
SHA1 f46f8b07c911a8827d8e94bef6cfaa7558934ba9
SHA256 189b03db826c2318a91782c12b069c58a05a1535530f5d0f7161e1fecff88a0e
SHA512 e690f28b1477870e06cc6e584e5bc5783061a963b4dcb45251113e963da8bff7c6b32acb607acda43c6dca602da1a5c9c79f0884f6836fc3ef973e3027853398

C:\Windows\SysWOW64\msres\trayicon.exe

MD5 ac7b21072089f94ca90f3f0ba503ac7a
SHA1 f3f379edc2e1fc65f8f602694ab0951188d79f4b
SHA256 ec767ad75bf55658696041d3857a6fa385cbb2255d9ad0470daff9efe677cf76
SHA512 fa893ca9662406a0ee364477d20df5a81628d435579f279bfece5c98e0745a858e94c53eecefb7e2916ec77b75c0851a42c01dc702b463f94ce64fbd30cc0ca1

C:\Windows\SysWOW64\msres\TaskSend.dll

MD5 be52ecac5b3ea07918d76ee8e2e1967b
SHA1 e6a61085da84fb36d997f2e0245356c301b31c30
SHA256 6aefb65e263cea3a0cf64336ff72b38f04d317080113f2dc9e1d89ea6f8ba94d
SHA512 717350fedfcc13a4fdb44d093278034f285bddc4f47dff890de4b16672429f9f374de2e4992c1203c46cd7d77b81a4a64745c5caf304dd2d4a7eec6a1d830f4e

C:\Windows\SysWOW64\msres\TaskKeyHook.dll

MD5 55db3870c4346302deba0b3e90c92a15
SHA1 0160cb1afaa02743450c125055047d3b7928000d
SHA256 bec77506c9b95aacd2703d45d2767141c5ec6186123c2817537c77d8a9cc7bb3
SHA512 6fd08dfe5369954f102bbd1a3e1992d16a44332a3a96ff63ae7f5c424a8ec91fb60d0ccab3884664783a3af4e99e63302cb33ecdaa9d3144fcfdfff7d263f28f

C:\Windows\SysWOW64\msres\SystemInfo.dll

MD5 7083a1687e0c92f682e7283109a63519
SHA1 3f1bc7e9c86cc2dbdcda469eb89932ac6c54bf84
SHA256 a64afcf309de50a2912159210639e464f85548b3046c8ff485ce09d8d603e856
SHA512 808eb88d28abefbb992c428ea88d173cefbd2e87fa329579fcea5e0962943de0d750b972c618ae9ba640979d2fef40e5d8a7e5d896c4e6c95c0962f5b4565fbf

C:\Windows\SysWOW64\msres\SysData.DAT

MD5 467c77d42dfd1b24f3dfcf2cf394057e
SHA1 011b2c003ca97f521a8f3b89da66ba4be7500e4a
SHA256 83e02ca0fa14adc2d2c1f315b9db7b290d9d58501ff1bd8c50369f8a400ce4cd
SHA512 1f4f3a1ca992c081651481200bf62178709f4ee43bfdbd850561bcfb119d01dab416af8976ced7fd7239ed74c26b8a217684fb94706f3ef45d1184381144b950

C:\Windows\SysWOW64\msres\sysaid.exe

MD5 a111604e0fce302bc71ecbb314ac1a1d
SHA1 2a56217341868ec3dbf8d272646f03627e9bf0fc
SHA256 c35041d6dc9e2bfd9d924d7b205f49f2132388e834d832aad42ab63d245eae86
SHA512 3b45fe0d3ee9fbe10b3d840e156481cf4d242bc08437a49c714ac9056aba7448e6989e8d4d064a5ea824b1ee884e20daffa73ea25a552c4ad45976d2c8017a51

C:\Windows\SysWOW64\msres\sys_config.ytf

MD5 302ff4e1186d887cd3a45b5558ce8465
SHA1 41e13eba039387a7f39a6ed60521815464184456
SHA256 73821bd3d6c21580fe7f1c4943179ae06d7b50ea7bd7e356bbfe9e0f0c30cfd7
SHA512 42fdec91d89fd7c175da3ccc51046447749709644b7b0dba278acbed5cde3caf84a49c45af2abf6b8c3a03e1eddf1ad8985d95b296308a6ff3b84e38fe16b223

C:\Windows\SysWOW64\msres\swscale-4.dll

MD5 eb53cb93384ae5f87120066c10fca605
SHA1 49a93c6e580c57f2b9894acbfed2ecca4a2013f7
SHA256 a75532c4162ec1219713057b6d8a1d00cbc65c33ae59ea3977c4e795aa120d11
SHA512 1dd701260873cf136718668e80103ec56007631c49130130125788c2afab456ef9929517c72443b0a933b7c5f9757809be8d0c4f27aa9748be42c64ae1291ae2

C:\Windows\SysWOW64\msres\swresample-2.dll

MD5 31806fc2b8c0e0be86465c70021622a4
SHA1 a68e168e144c34a266ba8bd518c1177ce06eb26e
SHA256 55527e84f99edf4a9a42ed514612077d8e84af28427d8751944d384016526db6
SHA512 b851de2393294fac2d385ff4d104ba75053a1faae44485bea2122e467d830799cce85244d6f6682cccf2984795d30c9f7f6a2fbb1ef872dbb7f78ce6c6455441

C:\Windows\SysWOW64\msres\svcwtr.exe

MD5 b6f5f1518cf246b8bf4017077e97b502
SHA1 03cdbfdbc55e8f6036dab47af8dedd04790e8575
SHA256 22aa5e3e2c4e64c0f01d74cec5b92c9ca96eb60a3de0d8e8dc67474a72d952e5
SHA512 ff349e10fc8c0f64f4e4f6300d47813b0b2c16a5311313725628a03cd4a94c4d55cbdc6cf50c921c736dfbc05b60094c1140a91fda339fba5db7f11c434b6d3b

C:\Windows\SysWOW64\msres\svcvpd.exe

MD5 f2fd5cdc313a4abee681c1a18d75f566
SHA1 3af962d6700a0f731cbc8ea949f783590e8a6297
SHA256 6bcfde9998ba5aef0092233625a8ccf6347488898415c56329a77051863f794c
SHA512 4e1dedf4f00781c254847930b97d9c0ec96d98d3c4cfe9c47dac73b3c627a05895248084fd30092f4281704858ded1203e2ea4d1c85fa1b74006ea2688d4ce5a

C:\Windows\SysWOW64\msres\svcnet.exe

MD5 79650be2b3b6512ce4bfd0378c704062
SHA1 78e2e56845746cbb359ae9b57f75cbddbb5fc5d3
SHA256 f87946f5093c2a378b34b67355a17e79147d03aa0c31820d34fd037b3830143b
SHA512 6dbc4fc15ae2367fec7b3da0a81f7900899d3728cb1a113108bd35a9e2e8327e03cebe04544cc54adeabcaa2da3d44c5ac1db00f44d93bed6ded6269793af7a6

C:\Windows\SysWOW64\msres\svchost.exe

MD5 94c660a25dcb34afa31bc01886a337c8
SHA1 dbdf7ed39cd4d954eb03a46a4d9b715a7f5c9717
SHA256 04a765b047a765289c8e9f79878ec703c25c891f3f8ab1a2ec1af1d2ddfbc74e
SHA512 d05846d8e70ecfc018c23560eff1f86e01b11954ef22f9eb07c3a1b9c4c64490a411e4df3815ef80a352be44f84f674ddab0c330ffbd31293cfc228f93a7fdd2

C:\Windows\SysWOW64\msres\svcdsk.exe

MD5 338d4704a839d4d4aaa168d68f2e0cbd
SHA1 b284ea3a3c127aeeb68656b5e9c6371faa8074a8
SHA256 0f289124de7cff4558565da42fbdeb74aa3d525150ce859785a64a87afb41f84
SHA512 39f6608ee4d8a9c255273b1c3f2349b673c7def25f75cb49243c3c4745116e1c1d56bdd2067bd4bf596e096b748d2b728a8eb314f682915cea26cac995795ecb

C:\Windows\SysWOW64\msres\svcCom.exe

MD5 ba2aec28170c34dc20484f873a48e5b6
SHA1 45f6756c98be0c389ece882ac10596b2eb42d9ea
SHA256 86c7ea63f7c6d88bed22373158b11fc36afd7759475c8113a5df0e65c8e94309
SHA512 23a955a26fb95a99407289d0a2026d02597b5761516c49db7b147bf9d7901c69c5abe99bd4e33d44b30968150137e4df16fe14b8c23877a1f1fa964fbb7144b5

C:\Windows\SysWOW64\msres\StopLog.bat

MD5 d46cdca9c1c4ff36cf0a9787dd0ddbbc
SHA1 edfc8b4bb1491b8cc0376c59f2a3a1d6405b6166
SHA256 4b0522a703d92e5d6138898f91b9e5c959b7d27c07524612525f2114b9ec9e8a
SHA512 2eac2dd5eb2d769a7630fc00470602a18a2ea1348c58f94772b19b663c0d28f9064cbbb1cefbc49078eedfecd995331676b3eeb43bdb371f81be7d19adde029d

C:\Windows\SysWOW64\msres\ssleay32.dll

MD5 9be86831858566c0e89d071399ac0ed4
SHA1 01e09d2a2ba3ced6e883d7648495109110bc776f
SHA256 abce97440cb27e899e3b014da2256aa0dc2eda7a96d8be543fbb959bb7712c7e
SHA512 a0c0a15977c65928b06069447914d3a5df8868312586b55b35f66a0e42f823221ac3ca87b62598cf0a09666ee795aea308eb8e75f907c49ab3e8185903619b91

C:\Windows\SysWOW64\msres\sqlite64.dll

MD5 723cf406f2243221b2f8063d178cb2e0
SHA1 0a435868a172dd2ceb418f4610ba3506b8c60b8a
SHA256 75a8f39ad9787268090c3ce04c18cfb13314be394ec838c740a3a419ac74706c
SHA512 2fc93a600946f894087ec1921a2febd2f76d3b39e0f2cbb019b3173eabd6f0213d7f20e8cbe8315e3fadecff28d4711d50e365adebee4e27c762be9c9e6de897

C:\Windows\SysWOW64\msres\sqlite3.dll

MD5 3196863b7bbd6be5536c2ddb9293bde9
SHA1 56f3e5fef154aa89b5655f98fc1c3320de0ac1e7
SHA256 cb8687b931ee0f8f5f804d5c19db094f3645bae496d278e772072dea532a5421
SHA512 9a7cdb8d96c2f133ebc26531f10d75efb6c379a4e2c4b189d01d304df00712f5ca459ae1b30b90d905101be994c73dbe12cd9e639ceecbb0957a8d64431aa1e7

C:\Windows\SysWOW64\msres\Special.ini

MD5 eac8a9ee99f80fd68dcbf12ce6feb4d0
SHA1 8551f220fc310af90fb6baceacf25b46432bd401
SHA256 cfda7b43fd016281d1745c5c4bfa1a3064c7f2ff70da3d248afbabfcc1004580
SHA512 8c954ff0a64195a2b4b17ea8e73caa71396c70a5a101c50b96b79feb63e25d4e7d924e95b5e04d0bdf491c1cf99eb3fccd754b77597d0220465f153c6c035034

C:\Windows\SysWOW64\msres\SMSS.exe

MD5 aff410e185fd5dc4638c9714e5350dfa
SHA1 4971b43ad62679f95de07d6d475de3b004e8dbf1
SHA256 865c7f85b6e8f12d132cc6bb519426134fe07e9c6e388acdd1905923f97e2656
SHA512 24ac31aa75b5b66de929a7dd5206676d72e450abd20114141c0451b71d91b1e4bb912e8607b185817742de9f07019ea810bde67c5d930b67e836a082f0e9d60b

C:\Windows\SysWOW64\msres\sgfp.sys

MD5 9235c4c979623ee498ec49af36cb4d7b
SHA1 ab33a64adddd19fad18d8bb1478880ed1212e28f
SHA256 764ca705469ab9ea4fa11d25886a6c40d1c14ec1bf7ae0bb6e025d53769d2119
SHA512 7aba69d0b4b231c8b5ec4422a8cfe7a803b37dbfb1efda0b442cfd356ed57d301c787c84570b57ae0fea006357db68d840bc3aaf2c114b3e89fe7215af01db70

C:\Windows\SysWOW64\msres\SetPermissions.bat

MD5 8466536955f19c74f1981f4eca320d37
SHA1 4e0b5dd25e3a7447d10a32f993bbd7b1f96639d8
SHA256 e21e34bf3622617f2a573afd7e52c2683d2ebd0f38fa284cfb594fa15b5ced43
SHA512 5b0dd7c30a1120b72ae7b86a69e6d81322a89b8db4040ebfc6a5ed199826fb8eefd7d0742f5ba76cf6754fb9080624ce1ea1bc8a9fb74144e7bb7534e74de057

C:\Windows\SysWOW64\msres\sedisk.sys

MD5 e9efd01150e7a38815a9e41c8b03de01
SHA1 1c9f7eb1067309637e70944c92c83b5d80908bad
SHA256 462a576ca834d3061ea14b9bc8fa75107a9863597a48a7b3aaf6b208fa5dad81
SHA512 7fb965d636bbf542b8674016b567d799b8c62925f342d9b5b5b1e799616c0a584cecf41281f6aac6a63aa94058cf36292142ff4098d17006efc4cec34b236bab

C:\Windows\SysWOW64\msres\scwnew.dll

MD5 acd5d34a3b9004a4f5504619e1c52b72
SHA1 cd73de0c3962fa866e6ba8abb781f5c77f895d9d
SHA256 3c7c1706aa82cb0c5df0a9b19401a9e246db9bb0aa8d4de8afc9f98705dee9f7
SHA512 87dfc23ca00143160de1428da5dd22a638bf465a7991419171d6496805758d46e19deb262fb3d19a98260b29320b79fbfc5e7d856e615eeda5e614f6345f58b8

C:\Windows\SysWOW64\msres\SCW64.dll

MD5 f81c99a43fb1bf6b06b5b1e9ae1bcfec
SHA1 8a116541d499aa41d23cb4b70c6ec497e662cad4
SHA256 e35393e0094811f4bb7148ccbee06da9df854dd29123612f3e81b98984fac81e
SHA512 430ea53a5ed8d814c18706ef70917f1a3098f9aef850968063092dd1a61287aa49a43ace7a2b90d9e0e4369cc9fd3ffc9b6f9a8f8ee96c4f575a34e472ade0a0

C:\Windows\SysWOW64\msres\SCW32.dll

MD5 ef975ffcb54968bee3fff3bcf540a329
SHA1 935dfbe93aeae48fbb52b2affe55624a57236142
SHA256 6feedf3fae114b3e9cdd0ea9ef01312aaf579c03f387c748d646aa97ebcf9b3f
SHA512 9448bc739d60cb660993f0be7292b89d2dc11ffd1fe0feb406635cb16ddb333beffaeaeb1e61979d4beebb59b18cbde47ef128ee189de93248d3812143a71ecc

C:\Windows\SysWOW64\msres\ScreenLock.exe

MD5 2114ee736f7312dbf140c2da77bb0bc0
SHA1 d929d7e3b5649819d5525466527c854213044436
SHA256 8b30ffa66b2370175bdbfe902870f4fef18bd959eb6c12545b84b2ade817ca97
SHA512 552b77ee025d86212422690ba68804262429060ee753b494fbd669be111aaf7ad60d5d3586987e322131e52b5800b5018e2d2e76ef379b192a024a612e836b5a

C:\Windows\SysWOW64\msres\ScanOfficeDll.dll

MD5 bb6e51da32e9ca85fe7d5d9c5aeff5d0
SHA1 904ab1ce0348c936e97cc8eceae655ce0ca6db8e
SHA256 4d90dd390f2fc2c345011c690066898409243e39d3a72e2aac2baf385e82e508
SHA512 e89c66588b40158b2f79621365c4c071444f4b88cbe699b42145f9b11b0102e54e1ffb5b27fc2f7e9cc4861938a8fb03e2c5c8ae94212621d3877a96e84f851a

C:\Windows\SysWOW64\msres\safeport.ytf

MD5 1b49efe2be1a332ff69740fe79e5eb16
SHA1 8ea7c758106ed8df4cf1187fdefd717e1f01ff5b
SHA256 e4adce7ed5df86e7bf5c98ed95eefe6f94ce05eccfef3e6aeed47c2eb170d614
SHA512 c808729c816af5f20f967a8abb8008fdcaa5144efb8688b7b468b10ffe326683c77064098c86d833ec7bb3f2a75f3ab137e988f6389f7924fa2d60b897b63e54

C:\Windows\SysWOW64\msres\restoreKrl.dll

MD5 516529ff3b5d51c59b9ff8e8cc574756
SHA1 75a7446d03838d3c11fc501631cf960b54c7af72
SHA256 57ea7d17563262db0ad276b234db5a1db433d14c272ffebf3e62ab8a7aa860b1
SHA512 58886e44dc3bed79a766ff57611fa81d3ca5a86baa05518be649c5c480dfe51cf6dfd26bf49cad72478b86fcf8e891cd7a60f70fcd05e6c067d012630f2a98c2

C:\Windows\SysWOW64\msres\rdt.ytf

MD5 c4e5affb1dfea34bedf9fd518a96919f
SHA1 477ffdf60d812cf6c38163681c91bb7d36cad2a0
SHA256 fb76b1a0f281a6b917beebb85edb8ac844c3b2d4bd910988d0b844c1ed88b29d
SHA512 9b7d7a82a3cc4819b46366e7624b8efbd56a2c544c6ec8e0130762d8f11a8714b2bc1d0b33e999ab662d56204418ae1cd2722b3a3bf8d5a965c9a0bec459b64d

C:\Windows\SysWOW64\msres\rdf.ytf

MD5 ca6e95b72182054f0ced62699e8eeea4
SHA1 5397e33d7e424cff95ab0f7f561ed51f327ed44f
SHA256 9e6b1cd851e9de4edd4d8bdccf75fc0cff65a05818285cfb2ecf071b1d8c2617
SHA512 c7491f63a267d781bc96d0a459bc1724e3e4addedc597678a1e597b9051d6df33bfd537086e0fc61abc4119f1fea33650595ae19b5778e3840b241b41de39ab5

C:\Windows\SysWOW64\msres\Rar.exe

MD5 d2c0870392366d7512ff9e8eaa90b677
SHA1 19f648e6a0093ba50cc75259ff18ff1674f5fef4
SHA256 58bbe2d40ad2f9881d0883fc5aa72d2e25000f77b9559d7a75e4a7620502c6c2
SHA512 41ae3b6e4486299d8ad77d1e7737ebe4b3be015a69d8f2ac78ab3f4554edb160e91db7b030ca774e1f2251696cc0f6c20d5f1cd9e1f8a88ddb6bca5d624ad8ed

C:\Windows\SysWOW64\msres\ProtocolFilters.dll

MD5 da8106757cb1c4a089f236df09f8afb6
SHA1 bac82db0aadc7b76a02a978538cc11817d262f8f
SHA256 91794153ea78e4823b12bd60f8929eb251ee1b0cd39dc2b01e41c83bc0a8e6b4
SHA512 08cf1c35bc7d8aa3f704ae4a903efa75cb3dbe5e32ecffa242717fa6689d85a1dc2ad164fa0d2e767f5ce28d07387b07b6a2294cbc6d18380a1a90166db675fa

C:\Windows\SysWOW64\msres\procW.ytf

MD5 c0746fb68ae692d994665be34d830fd4
SHA1 da09627150cd3e2f4d745fb78459ece14788d2de
SHA256 48d314472108656f653c13c14030b68cd02e5cf7373261462ee98b1596c7761b
SHA512 efb0b52679cae4d531178def403aac7821dfdbb1097f2d91bb633a1836ce5aabc24a3c150178e0964d229f6ceed3fb2a7b4f034a475d02ceb5f2e4a5a59eebb3

C:\Windows\SysWOW64\msres\ParaSet.ytf

MD5 c407effa3d6121579dd4772db7f909d5
SHA1 530e7545f262b2f9d7196bfaf8ee655f088494ba
SHA256 01aefa0e161d12e2c3c60f347015bf3d19e70fde76597f012d20b432a6272368
SHA512 ab4112ee4942b307ab2ecb20e346c21a5435e2ca9bdf08d97e61f29465d1812b9a6d8935d630d9c6fc7d967374eb466f07ace015b767aac7bdffbc090c1c0613

C:\Windows\SysWOW64\msres\PacketUpdate.dll

MD5 65dccf77755cd1f8cdc970ad2ee286f7
SHA1 95b6597ffccd3aa07ed48c40cb1a87fcb8ab76b3
SHA256 cd705a15cd6175d428266ddf5b2f3b48a9edf5fb1b3d994ca5866f59a69e6c53
SHA512 cff8b0b765c0ff22a10caa4edacdb8cbf258902dd48570135529c517d237d6380e5d54168cb3f265ccad8c05bc423bd1411e2b6cc408d7009d1f49b49fbef360

C:\Windows\SysWOW64\msres\nfapi.dll

MD5 5807ddca5570d4e13e420c3ffbb41dd0
SHA1 c6515ba03150cebddb40ddf7beeefdc028234df8
SHA256 57eb61219499a328474a6a2bbf129baa9809c0a8a1bd376b8a614344509a9abd
SHA512 62eab36fd6980682ba16ba60de94657a5f6c1563ee1653fc9de057036a8cd1b0201c773385c0882915a0e1fd5a98cfcb07b607332cf774754cdee1571cd265d9

C:\Windows\SysWOW64\msres\NewLockDesk.dll

MD5 7bfb0b43672beea22de81d562e58b9af
SHA1 def751b67cb7b8e2cd1eb2f047975cf15c249c48
SHA256 99399ea32524b49d9468078a7579c476e9ce732a94e83ff25caa8ec7682eb940
SHA512 a102fa9ad56e60c92894a11e2b8d7a5dda03aab64d0af430b184aea3e07f72c7a8179212d06fd46ce646f9841eb553dbdbe791607dad27240c377ef9c901f48c

C:\Windows\SysWOW64\msres\newicon.ico

MD5 5b5155eb1ff718bae7b3530cc5480d80
SHA1 12561278ca6bf6bdc91a637abf5bb7626101e69b
SHA256 6b4e8674be3f4e804c02439f7d96cf510f1e77dc87d745f31dfb1a502d8115ba
SHA512 8db6834022a64936f8f7d4174dff7ace5d7a087449d34cdd4abb37d0cbbe79c66c1c16b3b2abaa328be829cc59f53d49611710cf7d086892565589ac323ec774

C:\Windows\SysWOW64\msres\NetW.ytf

MD5 31683315c930c53ba320e316e4744fd9
SHA1 4f418fb1f4353fd8c5bb5c68fef3caad32450d51
SHA256 d5864001f2eb922ac579f1cbfcb3dfadb1216ee43550f3955218c2792bddffae
SHA512 f433069a382e1b47436576167628bb8c84aeb2743ad006310f1a9b68242bd55371c43487de7afa8e131f5bd3b6deccc950b4b440356eb526ca1e9f52f593de98

C:\Windows\SysWOW64\msres\NetTran.dll

MD5 4122874d356a486648376497dd4e2167
SHA1 99ace6b8b97b9b868cb14efdc91a0ec1a4ebd56d
SHA256 0ad13019aa809b8a5bf46da8b05bba1b5a509c03c5dd70f1566dfbe870b25d9f
SHA512 52f61539385c9521376edcd41450f2813f72a1c27459a6634c614b04e81c84e081fcde7fc1cd545202b0bc77b099a06bc8c68e8fbf73f776e9275d3f921a1aef

C:\Windows\SysWOW64\msres\NetJMFile64.dll

MD5 9af32ae2d28add612082dfd1016a2f75
SHA1 022de6c73f24f81484531bae7b1196b3b06ecd66
SHA256 4bd949919778ef055a8003fc6ebc7c49b422921530bdd5935480fc4cc17682d4
SHA512 d313e537a39c403da14960b39666ec1e5bbd92acae79ac6d329715f2e1652a99b107af788898389140f1cddce95125367d4d87cf40a626abbc3d0da517a9cf9b

C:\Windows\SysWOW64\msres\NetJMFile32.dll

MD5 de623b00727bf0b7185fbefab75d3581
SHA1 c4f7f289e65ac5e61831696004308c76989322b5
SHA256 6f4c4188c07a35e87878648a3d8f96cb5c75fff593ac540b9db85e500f96059e
SHA512 654815a348cb625538a093587876485432d90a00056a5a0be5ff1d4aaa6bed2ebf80ef0ce345a2b347601f1ca86d631ce616ef0c0107f4874a902e4ec0d85f75

C:\Windows\SysWOW64\msres\netftxp.sys

MD5 ed591cabae41d55e2e5b3c2acbbe3f04
SHA1 a93386744c9a9fd481ef2993053c4b15cddeb57e
SHA256 e019f34606cf878e6b0a2f568673ca302936a8b949cefffabbf024b8d88136a5
SHA512 09b33d49e6ac030b1e2620cb22d3e0219dddd97767971c0014e5efb37bfeb04c0e30527fbad2da85d1a8fe5f8b1c862ca4d5b42236f88442b0f6179473a7657f

C:\Windows\SysWOW64\msres\NETConfig.ytf

MD5 51380bcc0cfdc5aa18c20476a21c9f31
SHA1 d380a35111f4855630e47ea715b095fef4b41ec6
SHA256 71233838af45f6c01715f3dfb4115a2a81c0dec1bf2943d4b127fefedd8c1f76
SHA512 28bc216e6e8150cf49ebf425f3c1fa43baa0e51caca2cda3f8a56aa1093d51a76030df28ce5d3e74342df04bc52bfbf3b0c6802561c213bc4ffcd1bd9a5156b7

C:\Windows\SysWOW64\msres\NetClass.dll

MD5 f34e3315efa93aa4ff03ca86c241027c
SHA1 e245918191582647477f7d957e518f487fa5b40f
SHA256 88c60a80d94c2a24637983fa1981937efc78f74270fa60a8aa08753581a67466
SHA512 fe05994a68f5cce7f34f5418661e27b53db89fc7b1c56b4fc96b83ecee83e2bb08049ca0f249ad90827416eb7492022fbb307bd44333d3c56be3a8ac8db075d0

C:\Windows\SysWOW64\msres\NetBase.dll

MD5 615978b04fdabf69eebe80caa526188b
SHA1 1624a3adec3b895101e2706ad6df5ff82181626d
SHA256 c02d4143e20bfdf2ed11da972414e3eeb6f4f155a34e336aa3d1b5f0075d6b8c
SHA512 2e1cf411de46d2b4a0137397a5820c9d0ec18ecd403f2b6e2cfccc9f6843ef57353646b171e529ba1d3e03c753a9a7e1b753a42834a71037a3e86cbb8a13926b

C:\Windows\SysWOW64\msres\msproc.dll

MD5 96a15a8b8eed530afcfd877664445935
SHA1 496de99e72a0e10ca1983b1edb9f5fdd421d271b
SHA256 a0181bbd93b6c8bb812034870ba10fd775ba4c966856cd9b105c93d611e71f1d
SHA512 9fe11194d219511a4d14eeaa4b5d818c7a4053b711e617f43af4f8b58913aaf5a05ab4f2d4f2ac65472b7f5d94aecefad0d5523becde1005b39aa30904bc4f81

C:\Windows\SysWOW64\msres\mspm64.dll

MD5 c067011817bb63aeb3fd36b7af2fa7dd
SHA1 9592ec56b165091bde06e5b848c9b39b6f5a5e2a
SHA256 314edbc1586de4b59983984ce850b7e8f22b7e3dc44f109f5192234ff5569260
SHA512 a2ff5340853e6a9933513c4f53556e69c921f9637150c84722b82bdce9ceebc7c4413b3cc0b786b96391f3b37e7cf06e866d3c3df0e1b002cd6ea5fd6018005d

C:\Windows\SysWOW64\msres\mspm32.dll

MD5 0d81756f820830ba5a1dfd4d9b4423ef
SHA1 d9b9807e6b2acd95923b18daf6c00afa3eed62b4
SHA256 ee0983a48b032db76f18535c23a4a12f1facbe57a07774473707bbe4d9b54bb2
SHA512 01ef964cb28f7927610894be01d83c5f20531455de0a6c8d85e61aaeabf828a09de76e798ffd6fc9e667e2357dc81360acc33dd39770eda60d6b358f14e00ab3

C:\Windows\SysWOW64\msres\MSPARAINFO.ytf

MD5 ee0b8e017b81da0ea4626316edfa7244
SHA1 a0bbb91a538869405cf8d49ebb4355013c5f2c53
SHA256 c474458905532d0e1fb92b99319e25ecacdfbda60783a1c21d9a292caac432cf
SHA512 a1048d50254cba4304ab40d166af3eae62469ec71fda4f524dce8dc405099a321eab78069170a89e1f542e1b592ca6739fd5c574c0f4b3bf355a4a59820d4afe

C:\Windows\SysWOW64\msres\msch64.dll

MD5 82659c40f5ae6ac6d0fa3f00bf0eb0ac
SHA1 c8d0d192d3ef7b305909e52aa5adfecdd078e3dd
SHA256 8bf06ce8f7503ea80b7363842194a3378d3fae602a9469ba7c21d98b9b36da10
SHA512 2a590b2d434f5114ba86e25b643ac9e861a7d4a39bc9b14659b4b126009545e195980427e3e293f5aecb3feea114d129db825ee66789ebeb0190393dbd33b48c

C:\Windows\SysWOW64\msres\msch.dll

MD5 73007115059442b549007d056a524eb1
SHA1 5903a93d824661d047148ac3a900b8d8a548574c
SHA256 f7f4953a9ab301e8be4a9a144c5fb2e110e58c6b37075a0f1b6793eddd7d21b1
SHA512 7f296379516e4c39a911cab1fd046b933ee8931b924540378a80b25b40f1ccb8f1c947d983be1af59244a344879a1395267799e66a35c7f8a221b2d89065755a

C:\Windows\SysWOW64\msres\MFrame.dll

MD5 1d1494bcdf9f582a99a1ede1ddf498b6
SHA1 82798d3fe5fe069fa83dc895e54de283bec3c661
SHA256 4a7cb2850c50857e3014238c9176a3c65d5b6f38cda3a52f1987378894f76b8d
SHA512 0bbffb9409fb8eb41cd09413e58bda45e420f9be7ffe346b9dc124de0f14168230422e1f03de0f467fd74b4ffc03ecc3c22b2f8f0f1a29677abc736e9c11716f

C:\Windows\SysWOW64\msres\mfc140u.dll

MD5 118f2bc2314ab6ea8a64d86162e38582
SHA1 ab5ebcd6b064dee8020979be2d6c836fe1167e31
SHA256 35cdb1e79f7d65c4a0bb7e01bc8baaaab58e6413e6876029b32865b8564d2f9f
SHA512 63a127908d783bdf64f77bf6fce26f69a7e82bbcdc0dd0c9098f146912979b7ea8351ed44c9195faf3e2320884535278e76eebcf4f28713b6766bfdc18d97e5e

C:\Windows\SysWOW64\msres\LocalSet.ytf

MD5 4dfbade0848835450716c514c1773917
SHA1 192f4ad8c335594d03707dc509bdf7d779b61509
SHA256 bc9760dd52c86d7d9b26fe92c27f334fb3b25532eaa186085fd171f2cdee116e
SHA512 4acf0fade5f85c7e22177206d353af29688ca304229c11156888ac85cd81d418e0bc868464d68f6be9e6d724afeead3d2de1e6c476a1e8e0c5dff0d4c76460d7

C:\Windows\SysWOW64\msres\libsedisk.dll

MD5 9f05c6288fa97551e4cefd87a7b5422d
SHA1 7baee78c953937f5f9c50dc81d8184105eb7c4aa
SHA256 78b8a14a8951684442cfbbc5a01576de595957bbbc8d2cdfc8240f34b93892bd
SHA512 afb8edb706eea464c57c32965fbbe078dbadb046d7b5ca2142c8ee2de0b54b3c9c2ff821e2af08261b67cf85267d96b6a4fd22545e69552770834fe6b467fa5b

C:\Windows\SysWOW64\msres\libeay32.dll

MD5 dfd4b6ee0c8194de8562630845e00137
SHA1 705a7af22af8de5df47adf9bd8aa6a9542f33cee
SHA256 1df7766e84d1293495f22087d19785aa7cd761e13d7895157807cc22ceccf6f5
SHA512 3098e803fd9455d3e43da0400c192d5e60120eb45f0fb8130a96c66579b6985de1c098c07a97fe09ef8b18ca3cf8b5bc3ee24fc62a8c78099290cb566b3f1877

C:\Windows\SysWOW64\msres\itp.ytf

MD5 0d1d8846205c2d3cf80b1da6d304ad9e
SHA1 0e8ad84cbf6241fcf561cacc71af5480e40a7b6b
SHA256 47d5daaffdc3dcce3ca48f192faca8c739eb07fe6fcd43695ef2c537e288bcff
SHA512 e682c1dcf521bc28d5295e615613d681d5dba22647aaeb6594c1b679b9aabe9f1b102da28a217f3a57263f11af45496606ac0b2f424119b43effb4b24ee0721a

C:\Windows\SysWOW64\msres\InstallEx.exe

MD5 127a1b81b81cdc9e7bd36de9c8682f77
SHA1 36f8095787cad214c5863b2a76e19acb0c69c68b
SHA256 ef1eb9dc0d1653ea2e0a6f22e5914504464539158a81a89c88e4d7c86ed2bb9e
SHA512 e247056aee0c45661d4b6dfa42f5c97bf4ebacd2549b125d8302378d39f9bc1401ed7f51610cf00341c5cd012b0ea6215c4a9ba59bebf067c9854d8eaff6f350

C:\Windows\SysWOW64\msres\InjectDll32.exe

MD5 ec6b0e127eb520a2bdc89e974bd73d71
SHA1 950051a12ca13a65d7f1be70939072ecf569d0d0
SHA256 1ce3915be07d472fc6fd66cba5a467e40c295b9cd8d56ed391fb2b37d41106ae
SHA512 12343255eebe58e8076759a1573e790ee8bbfe477943ef4c83736ce5861ab307cb97d580b28ea413a74b0e69f710a0f68d1153334c86dbbf563d94f452f06280

C:\Windows\SysWOW64\msres\imageocr.dll

MD5 f0a9bd46ada6b1b29875d29f2939a11a
SHA1 979957ae238b983e6002d6aba312aae91efa22d0
SHA256 eb818b4c6bf4fa277de19bd5a094d954b39b49695fe37a87dcbd697a4b7b239a
SHA512 8e3290b64ee22d7f87e2f62ea7b123bd995244086137a83b053ab95feadd5a99541de0108cfdb84e6f4b96beef2febf7e0e3773105cf37ea0bb50a24f4b45002

C:\Windows\SysWOW64\msres\IJL15.dll

MD5 edf2f50f221de6ecf3171efc598b2d57
SHA1 0fe9530ad895ea6ecc87a784d579ce0736a52661
SHA256 85969ae1d3c51dc21f5431a69eacac07e8f2f891acfc298e8dd41988fa38786e
SHA512 25d9546706100d7c7a516e5f81e77773a231717353f850b98f69b82660e9286ad0b62fb9e56ede5568e13c0982e4a19dc7aa63a6d19fb56030b3a6174ccfd27b

C:\Windows\SysWOW64\msres\iconTray.ico

MD5 56822a7200e5182c72728644430e27ec
SHA1 c8eee470d007f3530ea4c5137769245e02071e8f
SHA256 870209bce5d9994d3d03f5709476b2ec732073d3d36ca4d21f1047566f90fc26
SHA512 fdc2ea5de62d2724638f34fbfcd61dcf9915d39e203d506fc92612f7f72a025af303a9936aaeb51ce36d820a799461a9cac2511d69e9a2d620e3210062b488a1

C:\Windows\SysWOW64\msres\HKSock64.dll

MD5 109e0d67d79b4cc8887cbf6a3c689dad
SHA1 d27be35cf777811a15a55c2a29b4aed5f283499f
SHA256 4b007c5be27a67d89e4c8b397d7085accbff8573650a93af629765d3897fc813
SHA512 eb873c946dac83c8875418a7bcbb98e232c0a2b14f43460a092e5fdefd837801ba6c6aabc347ddb2ac6077fad759334dcdc80a84fa6ff84b232c43651f6b0f4b

C:\Windows\SysWOW64\msres\HKSock32.dll

MD5 df7e15963d3c675b06edb8b34d2f44cc
SHA1 8771c796203e9dc19821c0ffce697ee7228c359e
SHA256 4bd453a2af713299a7493c749a35a52d24b10238d0da1942a07d54214b1cd085
SHA512 8f62cd5450224c054df5fe6d60492b4eca21c1adcdcc5271545800505f3386dc67f97ffd067b047b6714959f93fc49c46af99f3c7c991f4f570c1dabdc279be4

C:\Windows\SysWOW64\msres\HKForbit.dll

MD5 907a1de63bd2c4d4393598df19b13ea4
SHA1 e837a21da0ae3b662e24593a3ceca1b7ce96781f
SHA256 ac4fe65c52a0c69cfb69a3553f16879e0fab862973013080ed885d720e62663b
SHA512 5cf0b92dc53b98edb32cc397361fcd881bd437ab79600772348224357377d94277eb72935e5bf328bc680df09dbae1e4d64ea88cb02c91a61a310b0e6213b9a3

C:\Windows\SysWOW64\msres\helpformat.bat

MD5 e166b2b921db985f0c02a5f5690c32f8
SHA1 0c048123f7a93b884f2b93e1c052c62f7dc3d22b
SHA256 956873d9b0fffcf73bb8a7e5c9586c337d9524862393fb286d489c4d1f009e83
SHA512 1373e9b53ca850e56a17ca5e077c28d6b80dca0a5ec1d530986115db461b3387019dd4f7ebf009a3a3d7602e7730731a78648405eed643818a8baea9dc58ddfe

C:\Windows\SysWOW64\msres\help.bat

MD5 ec6fed19c0f0215e9a9f82e475eee04c
SHA1 9bccad279f5f7017f5689f11c9e4adaed6d08132
SHA256 72eaf1d0ba948f467fd98e85883aad933957167640e6a1be74a79d3e11ec7f6d
SHA512 011bd2f0582606b19ca605920e6db1e5343837da50e8401cf4212eb383b116c9dc92d439b68424344bf68719dc1f09c98bbb21ec6aa1e03b7d0f7c1a582acc74

C:\Windows\SysWOW64\msres\GlobalUserCtrl64.dll

MD5 ceef5e1ae1acc1fb566b791687b291f0
SHA1 1b79620ba874e5e6f489c1d0c213f6551e00562f
SHA256 eda254235f25345c78e854dd1ce88360fbd71f711c6d714b55eae160b04abd6c
SHA512 7dd99ea5f1fd1cf023722fef4db4cc1f08a0861b6c494c0efe27f410e39ad8b151758d80ed63838dc6b83914416feb3cb6ce8d8e4c7f43e99510aeaf84aa93f7

C:\Windows\SysWOW64\msres\ExcelFunDll.dll

MD5 14a7f3c1ae5e7ab3f8eb95ffb4959617
SHA1 85847ece52253457ace1fecc327310fe9f9fcc1b
SHA256 c09fa3a3b7de322132a2b7f417568738c5549722ff5afbb51f710684154c1262
SHA512 38b6bb67deb2a7a4a29de0c634dcd2c3fdad1bd87524f68f4db040d8495703cfa3fc263c99521948e605f84592c60110c597c420d9aa1f340516cce73bf234af

C:\Windows\SysWOW64\msres\EncryptGUI.exe

MD5 8e13aaf3ef3870d90484d4d125c9144f
SHA1 7f8fe7a05da81413066ce4ef6000fa3040733791
SHA256 799d02851e8019d171f187760310f498ef6e212c3a84331f237c8b6f31842a55
SHA512 3605ee2b4a287cb62e99e6e9aaeb80b8c7fece8a0bb25ddc6e6e4bab4b4ed49db127f179592375fa3404c3cedf6abef91f4adccad5168510800cffda36d49bd1

C:\Windows\SysWOW64\msres\DeviceManage.dll

MD5 aaa8db2ca01bf916fb7708f00be0b8d8
SHA1 674c8ac41bbb140b0783e5c2a1b64bcb2382abbb
SHA256 92ef2741c29618daa2e188a016f4f7bfc500f601c0b6ca71be754260aafb0142
SHA512 f781b02459b2b0597eeb85e07efa0bd00238f3e1b6d23612859e259874edde5cea785df2dbfcb22ba790547f4022b333dffccaa8b4adf6582fd170c1d8e09e38

C:\Windows\SysWOW64\msres\desktopDuplication.dll

MD5 5b8b7efb1e496aaaa72057cf672dfe8e
SHA1 1ad4b600dab18ab10c7900c70031d629e70b025b
SHA256 a7b4afb3f0dbe6eae4129945d8bc4d22a4721b3014a7fb7b4b2cd403ecb38416
SHA512 0214f48123b532dfcc92b8f6fab028c28057081186f8c6f68cbef31ce55a28da85416150a853ab18df2b2192f210fe1a8d76575f5dfa327ac469d493f476f8af

C:\Windows\SysWOW64\msres\ComFun.dll

MD5 84023c82183a94eb051bb222d998ac55
SHA1 b0cfdc27e4509b1f4292649bb1f8be61d953005c
SHA256 9626af0d5dfb63ac4797130bc8f1cff54b8ff3bffb1e9ce4c5b52a9932f7eb36
SHA512 0e69c19073dfd237b9c060848dbb3c436df4a297f321057b5cc6922c678bc79de685c99c6040fdcf246bd65f6acdf4d42823aae0371f1c128d2109e4566373f2

C:\Windows\SysWOW64\msres\ClientTool.exe

MD5 f5e8931c754192b85d4b4c9f1b2520ea
SHA1 3a6d934ff332fe4255937c564584346fd52d574d
SHA256 ee482c148f573cc0f7dc4aa3e83eab262db7216e3acbde6fe1e2e7f291f9a1e8
SHA512 1872ab36cd840663f0fe46e08f42074f7d673c5d6bb7513d2b7a4a6401fcf316f81a081174be6d6e4ec337ebef5bafe5391e6ed24e050dc0ea8c93259d607b67

C:\log\XFMainTh.log

MD5 b4fba3c06786c720d3372dff46361c42
SHA1 118854670083a51cdfdf922c0d56e002f6a27e2b
SHA256 bd8fa483caafaa4d60b9a6ac46c3ef384b660c2e0652eb787975e28a336cf22d
SHA512 80eb15bd6173927b23c06ee429e9c9753a7dfad40ce0c8ec45135498c991f095bd10e26d6169ba87dffd1e77a050faf121cfd6d390fdd736895d6eeb890c11b9

C:\log\comFun.log

MD5 eb303f4c79d69ca6c31322e1ecd555fb
SHA1 c5daa977fc1d8814122d7e987412aa2431b9dda1
SHA256 620cc8470cec08fb678bbfaff746db822df54d1884e9b2c7082d710fbf72ec70
SHA512 c6bf1bc29d185c571b4a6be324ab7cff55f33a4c1ba86e11f57ff6ff675c0673584a704b39b1cfdb98a72650be6b265b5dde648fd17b2557e8ce2ab645eb1de6

C:\Windows\SysWOW64\msres\YTSysConfig.ytf

MD5 f11d158efa9b0ce8528fb4f925fee478
SHA1 4d0b93f1340599b40142ad19ff59735c55b965dc
SHA256 940778dc610e1c1c03ac660012d4a3aa7f51eebe155a38bbec5d155d71e13514
SHA512 e50bc8aa5442878d45766e3066ca077499ee92d41f7503949d9bd45c77d6f5fa0d37d4239fde6194c7ce907af0079a918e282d67c1e6c248d09657a26dcf25a2

memory/8448-4381-0x0000000004580000-0x00000000045CC000-memory.dmp

C:\log\comFun.log

MD5 68a5b4ec8c02a48906cbf792193e8c80
SHA1 3e5dd2577129eb607ceef6267e918ab8d0fea248
SHA256 eb79769addad10c9a100b6ddf279f01065f6e5a925b03585f4a4f1a4fb5b1de2
SHA512 3da5fee8ad5dc2d120145af0d52b603297ef8d8ca53a9b2c01a477a07e5819ef76195a461b4c32a12edd89b5da6633281225ec969cae9bde87a5bb49d58eaa9c

C:\log\XFMainTh.log

MD5 38f722eeb27c8e37e477d0f353e37dde
SHA1 7543481c72214c780c62c13430bb6cc74a79541f
SHA256 7eccf7bbef39c1de34610f6781064ed8e7beefb6f52ea829526d3aac0eaa563f
SHA512 00c66c3a5aec9eea34ae9dd20abaf07b0ff75961115c3d9057a747e4d1c515efac7f90dd319736595372253bc133cb9fabd2854ed62fbcd1e63bfb9ad286083a

memory/8448-4454-0x0000000004900000-0x0000000004917000-memory.dmp

memory/8448-4456-0x0000000004920000-0x0000000004986000-memory.dmp

C:\Windows\SysWOW64\msres\LOCAL.DAT

MD5 e5acaeb45d881d7fba1f856989e8fcd9
SHA1 b308fc5d492d250ab1d852b8a6026b8c17aafa39
SHA256 c62b48b63a1103df097b77548884bf30d3baf19d7d66bb7ea6f98c7681624827
SHA512 6ed0b36a21287cdb2a06dab27a430c67d8ccee92135b39518801cce855fc154d7c70f9e84fa3eae36ddbbe7505234870e781652a81cbdafd77a63a2e0edb53f3

memory/8448-4529-0x0000000060900000-0x0000000060982000-memory.dmp

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 1f13d6e00eacc4c7a9fa22b181893a3d
SHA1 c316d7f97a27b19cac61970c94076cf1b7005ebc
SHA256 d7711717db7069a437c3be73acf15c472221dadecc1a12b09867f1368194c195
SHA512 502c4d519d4906a9b2e562e911bc2f06490c3fde734fc23352d19fb2938fe42d8d17b886093e3f77d9e6b95ef09e6195aa9ca78c3263b28281c4a578986289f7

C:\Windows\SysWOW64\msres\sysinfo\OpenClose.ini

MD5 39561f9e7542f33f3f04271cd005dadb
SHA1 0b5ecd359317a9c1fadf4b570f7d9073be627ca6
SHA256 930c223c10b712ef3eb742868d2d029616701d2da4c774c94235f5f9a7eb804b
SHA512 a0954d1f90015a97255691780ad774af3d84085b3728006cc786ea677aafce245bad72cabc3587afcb8c356f29edee47a2167e3d255548a196b6bd06ce9e3fdf

memory/8448-4585-0x0000000004F70000-0x0000000004FC6000-memory.dmp

C:\log\AssistantThC.log

MD5 683216ccc7e534f8f1bd8797f9b92249
SHA1 d5f798137c31f5b95ffe24d5f94ebe4067f09faf
SHA256 372f8084ac2873ada4d6e49628ca72d30147a6d8d82a255921046f571138b031
SHA512 506b2cbdf07c8689d8a5b1c871f3778ab7aec26f2f19d27e72fc8186041bdca6e808997aadb56d3daab6e4a3f8d9c0c6181de5a469be5b57b8841aa81887e3c2

C:\Windows\SysWOW64\msres\MSPARAINFO.ytf

MD5 e4af6623b9c1d0c51b68c486de553fbf
SHA1 6e6ed7586fb69c1c6b64aad33efb0723e598c721
SHA256 c9e96db180a6607aa7fd29b4760b4f90be3db6f320a292fb732b337584ce6399
SHA512 0022ffce582dcb4ec47d7dc708b1d86e5d6ec7a4c6c6338336a8257e03ad9d8bede5f333ff9ab46ab0594b35fbdae1bfb77669d36f5427e058e9a46950d98ced

memory/8448-4643-0x0000000005480000-0x00000000054C4000-memory.dmp

memory/8448-4642-0x0000000004FD0000-0x0000000004FF0000-memory.dmp

memory/8612-4664-0x00000000041F0000-0x000000000429A000-memory.dmp

memory/8612-4670-0x00000000042D0000-0x0000000004314000-memory.dmp

memory/8612-4669-0x00000000041C0000-0x00000000041D6000-memory.dmp

memory/8612-4668-0x00000000042A0000-0x00000000042C5000-memory.dmp

memory/8612-4666-0x0000000004190000-0x00000000041B7000-memory.dmp

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 f771ee122d671a555b3433f4254a1a30
SHA1 f7e56f23d797ed786eaaeee94200529b350ce559
SHA256 c4e6b6eae19eb5305076fbcfc3995f2fbf8937c39e3b836ee3570f19689d7e37
SHA512 b5610672b7adbd3c7036cfcfd7607af124d6667003b23eebde42f6be03878d5ad715327fb9f933c20539096736b62e535896d997769ef2cd2a074e2325ed0946

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 61c92cb4b167ebecd324a2c67364fe30
SHA1 baa0d023729245b662e15bc44366643ee2e6649d
SHA256 b8e9db410c7b786b35e20afc4d3a56e712e299938bcfbd7661abd063efd0248a
SHA512 73dfe6e7b5957c7eca623db6ef68f220e60902f5ca579853d28dfaeae025fc9472f1a3981cc8dde6bfca41b4de87119057936e18ad8885bee7e730e25c5a4534

C:\Windows\SysWOW64\msres\config\policytmp_p_water_m.ini

MD5 8f2dc8d37f8dcf17804e9d1638126545
SHA1 1e7912ca1fc0d3d61737e4de328ed0541ffca823
SHA256 b235c2c5e0faddde86675994cbbbd389931eb2885ea318633f9e3b8a7d1b2a97
SHA512 ba366df869afe27754d4fbf0e85d717b07260434a0e840280fc775581cf097b1f18f1efff35e07d0acabe6de53c814051b12145508577111642430cb8dc71ccf

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\SysWOW64\msres\config\policytmp_p_log.ini

MD5 0887ae4f2e7d2a08f591ff5a62888c94
SHA1 25af9a9a5916e8a81556f47a6e0c3f4784a22bc3
SHA256 768fb38311d69d9a680d7ff27e7e07ff7b137e61b6773d329fd2e2f4a2a1411d
SHA512 21a735a45dc93a6f0e873cf8114e2cb7df1d12df392d844eda0221ab60dcb1092219e312716ecb5ebd6d4949c3e45f36a45db135d4991ec46cc79fa53705e828

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 21a78204817dca604c98ea44f1582bb2
SHA1 ec65a1a8441ae3994e2e2a2e7439ada56d513af4
SHA256 ffedf736fd7c243e07695d1042608231e11811be16a7773032e16c17d973fcc4
SHA512 9fcb801094f94641c5739bc3ec9991904fba4602b0e9eb555a9c16dc285544c51a45cb89b1614b7bd6f323775a9bd37535b57bd966f6bb70e29e096297b44608

C:\Windows\SysWOW64\msres\config\policytmp_p_system.ini

MD5 ba3c1719ea0bd1ae14ae059b3e86e0a3
SHA1 2bfac639ae5667f4bdc90bb7d6ceb6e1a8ded51f
SHA256 736ca0e71048ddcb7de1e9c189bdbacb3bcb43c85d87d5fa3a97d9eaf3d8fea0
SHA512 c993bb93a1cc745f7f8e8b86b1c48fdc56aeb57cbcfd3c816ce869ee1af3d348e0c5642312a8d5aa3113856c64530514cde4b586e2c71c30e01da6140e407208

C:\Windows\SysWOW64\msres\FilterCfg.ytf

MD5 8a1d31341cb50c24522ee68168237119
SHA1 bdb77f88c291d37af99dc93e6c774f0319b38293
SHA256 de4397881fa07961b2403ce80914c28ecd29f9650cf625d003e1938fa4497eeb
SHA512 22d93fca01eca76829bf2fa247abcbfe3e6dff01c7220d44f13ca389dc18079d4a553c433c629ac976ff4cf91184358155cd55ef395ca34859971d84b2d5d98f

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 5e34f9e900daf1883a292bdfa3babee2
SHA1 ccdddf1cccb7b0207cdc83f4bb733f8eb68c2907
SHA256 019dda4e2de70715bc79f94fcab702f9e3403884efde95ba90f1098bec3bb9a7
SHA512 694db48e552806d0e5fa96c405dcd861be39dfcc183f2846dd7dc613c740577ca2f586dfcba531caab08bd919c585b7d217a050a5fe4aea42da2a2e00af91003

C:\Windows\SysWOW64\msres\MSPARAINFO.ytf

MD5 a0afcfe57261025c0a30e1035331f618
SHA1 2f4f94f193d9a0e22a0a0a53f57fef122d612057
SHA256 94737fe4023abf40cae6991e70430ab95061cc742478134b1106364e76af88a2
SHA512 d29e79102bfc7eb3f6e7e5a06fc810265de020eb75ddf44649db22ae268a3b7878b94b79c9805a2bf19401e18275271161a1e4de4ba7e518ca9b2ce565714e45

C:\Windows\SysWOW64\msres\PolicyInfo.ytf

MD5 fb4addd713fcb0479fa2fb00e3030cdf
SHA1 ad4f4c423e3bfea17497fb22e3218e5a1ab5fca9
SHA256 7963eb1010bf1ac929eca11dcd8f173b9902faac9fc8ec54247d5bb5ec2bf740
SHA512 441aa1e7c510436a66b5a3519f6d984b36d23b5978ed69a21760ddd7ee7fd7405dabda57948f740b1658545ff007f9bc762e3ca60108deca5a6de3a025c21db9

C:\log\Filter.log

MD5 dfec1210a436936eed8924c2c8a729f7
SHA1 3e5ef7ec8051171576690261b048259e17f3d852
SHA256 040dd3be10de9cd201d179a6eb4d63f0fc8e7ab5ee9f4099a9dd5e210c8e8135
SHA512 e56cf5adabdf6635b603e48ba60b451d0df20d4effb27381b37717be595040c1a78f37153fa7248cb94522298996791671c8d688ae7e4b253207bcf5c6a14fe9

C:\Windows\SysWOW64\msres\config\policytmp_p_global.ini

MD5 1a4b0b831cdf2fe180289efdaf23b581
SHA1 21f29a2f229d93fe2b9287145cdccb9ada032bcd
SHA256 a5da8c67b98f1e247d9a152dea9989116fb53a9d8741c128e5c9dbcc40b79e33
SHA512 433eb7d8981326b83649dd0963ec91e01970b9b92a0b8a31abdf1cfac4590a58ab266d51c9122f7ee4128ead74b9b21e623434fc7d7c6d612b05903bfc94cd38

C:\Windows\SysWOW64\msres\RunTimeIni.ytf

MD5 6674d271520bd3326ad18063ddc2f90c
SHA1 cf1030e1b591344bd860f4552ad7a63d01fd91d8
SHA256 0da44728f75ad94ca1c1f92bb158cc3c1ae186919e1ef8b41f07527c009c95ec
SHA512 0a2f3bc182e2e4f3bba41806f3176b786c164016008b83f4cd910e3b03790f979ea8dd49b5faca5408267a060bfdf2f2a25cb2f1c7d7da959e99de6810aa490a

C:\log\Filter.log

MD5 7fa022e61278de798c3712a58b0fd520
SHA1 cb593a193ae4d36e7a061eb76d101d4fc30f3d93
SHA256 3b0972cc4b20e97a2a75b7a17131b0938071f6186b7d6285a385578a66b6c1fc
SHA512 b2a9ac261eadae614361d497e9f0917e4f5da65fac52a189c72d9a51d2d0dc9e9eae00f77212dbc28c959b404eee6cc063eef8ea2ac9d449b52b5ba60719ea48

C:\log\ucommon.log

MD5 3ebd6b7fa4e37d60369be41030433c5a
SHA1 1705b1cb145e0a8d83d252aef5750f600ff903ec
SHA256 a0ecce86d11407e191de325417685d5e5c82963ada3279de360a0ba644a045aa
SHA512 be826adcf80139daa3bbfb51520a8a71d839441717785c8929fe6824f7ead8c5068051efa1ef728a80564b2d9d097618459cdcd64dc5804ed458056561c577ee

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 bef55f4414990264e222695107b42540
SHA1 80484b2c0ecbf8d3ea47282ddc76fd8dca7d26f3
SHA256 381b6723bfe2a2b50100ccb5783fda1d06380b75d0297080b58c6de2f6aebf55
SHA512 7cd4d9f25e52e9408747e15ed67f02c34d1d1675c4b0cc6be6a3592121b64e250440a3e6d86ed7c36e4e59a520526616e0897feb16204c15a1bf46169cb9391e

C:\log\AssistantThC.log

MD5 d92af1431b51e4e5fd907c32a0acf6df
SHA1 6fe97bff36c3a84c4cdac8f2cb59c06727c54124
SHA256 09bcd808e6ec1a2b16aec5ace3b1ce0d4565945eff2cd4f696be4df908c93988
SHA512 e33e27db6cf8e6c21c2bc36ba85312f4cecf4fbc31ee1eb1300a3eb2eb5b1fcec541ebf1f83553bb2d3eb1ec03febf6d229975f5b098d2070aa0e6fa6787cbb1

C:\log\AdoBase.log

MD5 fa84428b34eeae59d3e90ffd593a1641
SHA1 6bc00ec30d77730faf71877064cb35b62658898b
SHA256 98c9abd1fbab0416b6644b449387b0944757abbbd911f3d197611b33f20efa4c
SHA512 fb547432039fc023808094643454cb1e0b06ac7d6ec23becf03d495477250761d584c249fd8a16fb50fdc46c29f8a78c9b8d3718002792ae4376e825a0559fc9

C:\log\YTFunDLL.log

MD5 ce4e42108e3c244caa37cc07c67d1001
SHA1 22cf96dc94d69230ab33b11d7447707974b1d571
SHA256 e80952ca5ea3987c0be54e973e44478c242800606eda9cb2447ef70685b167c7
SHA512 233dc0cca3e65f54f3395e795aaec656181588495a0a8245d8ed49e896fc39e49f399a132526f1076aae528061a97c26593ffaf0eb72f5c9a901d2fdf06a5694

C:\Windows\SysWOW64\msres\PacketC\PacketUpdate.ini

MD5 25dc5dd57d5410ded94002d4526e0041
SHA1 70c20e897a632018c3bdf1ced153e7f61af30df6
SHA256 d1359916637119b32837c4fe21a90bc53533c96f9fb07e89696d84ec23e0d0af
SHA512 2c4cf46b4d33480b49d8f4b2f125589a1c479a0cafd5a1a44c610725de8e1a98c010dc64a27df527ec60a14f2847a4e15801776723d1d600073da10d330722fb

C:\log\Packetupdate_C[2024-10-16]_0.log

MD5 39e7ac6644c2f67e5706950992be501c
SHA1 d7f7fa0011cef427672643efa3a63f934005eb4f
SHA256 492257e8b21b9535607cef245ffb37516cbd7cf6a894eef555783842360dcd01
SHA512 b2b7af198a5c81075a9300970e6411a0e43cad1d1f118af94848fee30593bb0485b6364dc19b5a69bbfbb918f9573bca6cf0a1173cf00871969dea85f375e9fa

C:\log\Packetupdate_C[2024-10-16]_0.log

MD5 d94b05fbfd762d2d50eea65dc5c2ca5d
SHA1 55b63dd398f1acc7b9136110d26be82d764f96ed
SHA256 2e93c17b6f98dd355c68eef0dd550b2bf9b5fc52394146878d5e6fb6e0703f86
SHA512 cea74cb10829690ff59eebc7d4bc614bac57680da318acce7c364c93ef789602e7e6929071d3f158eef520149b1258712fc39825aff730ac4b1c292ad3dc8755

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 c33b4ac848e506dade7baf7b5c18b0fd
SHA1 58a9592bb64d4ee557470b7393ff8391630027a0
SHA256 5d117e99db0c47ae58022b578b245aaddeea156768898ed37ddf46d25f6fb7bb
SHA512 a828b7d417b57b58a906f9ec5a3cf181292d27ebf6c538bccce297fb3ade900ca8f6d16a39d619a31a6918e69b6539eb628001722af14cb55dac742d45bb97e6

memory/8612-6375-0x0000000060900000-0x0000000060982000-memory.dmp

C:\log\AdoBase.log

MD5 5165577981577d0bc705c5acd9f89a47
SHA1 10f46d458ce9da8095ac92da601acd9a45305970
SHA256 21c2eca42912e4a86a5972895369172d9bb0f8d72f108a59ff45509b831f4fe1
SHA512 7142097b0e1e5991f13a2e83936167250d68f74377e8f2bedb0cdc668f93fceaf0ae1f3e530e6bfb9f6f5e0bdac407a68d0d0d85f43179ceb7bdc52ba04e02b5

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 d04bcbaef57d65446b96a86e9181597f
SHA1 871a802f6f3772d7b4de8dac7796bf7d7ee43b21
SHA256 6f3963de9f1e8e61c975446142e35737dfaf25cbc6e080a21c98279046be870f
SHA512 2811ea5ab6abc78cfa1c656667f2bb7d7c24dad143350d43509a86e26627856bee67d71de5102f7ec0ef311cb1e85b97830e8e477749b493a58354ea00b647c9

C:\Windows\SysWOW64\msres\sys_config.ytf

MD5 a771f112412010a4b92ce0e9168a89e0
SHA1 7e9fdea8aee94abb5d5dfca238a61dc3258991b0
SHA256 0bd3761791511875ec810230c13ad87c3039520cfbf0c2b97a2406b56392a39e
SHA512 b552a16c7458b9ed97fbea50ce73bff0e703e4ee7b52d1ae4458f9c8631dadce1bbe7abb48655e762bc89da2b4e63a686421daa01bf007ae88d9d97ba4e536ab

memory/4484-7239-0x0000000000910000-0x0000000000926000-memory.dmp

C:\log\EncodeH264.log

MD5 7808b99763b208bb45a3cd90c5c717b6
SHA1 69595f4fd3c259c643d10590d7c097bb093af33d
SHA256 7c731f51a6e9fccc106d5b9dfc33716b679757e534e2dd4952ffc6b25c8d8b07
SHA512 a14d43920f4884fe4585395bace607d4c5287658d7b1225c097bde8b6036f6c3e1c12cc5c90952034870ad8bd1db5418bbe66b0e4f3be46b79346d24674ac119

C:\Windows\SysWOW64\msres\sys_config.ytf

MD5 0787d7702e40df055c779957b85a356a
SHA1 dc068772dbb82d1137786635a3cc40dad2faeab4
SHA256 2539fd1ca0bf7d361f9f3dd57d32f82886f2c0b8941af1905fddb7c55f8c9f40
SHA512 ae6414430cac5a49a07941dd5b9430956f54168884e2e2d89445166a30f35b8b46cd9a6476bdeb2cb47aa7f4ef108190a376cc7ef462cbe4e418d06cd1e1c257

C:\Windows\SysWOW64\msres\sysinfo\LocalSet.ini

MD5 448f935870449b611ab54bed4681d9b4
SHA1 da4b1944d4327f80cca6355c40b9b9e33a90174a
SHA256 dac940f4a60314c3f3a9781cb4a93c1d22fab3da0834d16354caab126c75cf56
SHA512 e1c205a07ce86b1c74247e2d1cbb54b25926b09f2baf1cdd9a9a622387531329bc7e8241c4255f11cda8594fa9e7746061382622e4653f605473e6f811fd8e2c

C:\log\dotimer.log

MD5 cf9f2480e2656c409e19547870e9ec40
SHA1 9d25fca06305313965414691788b164bcaa21b2f
SHA256 b7030b8ca582236c8b00ad8c2089658dc66df89608128cbfa799ac51e199fb08
SHA512 ce44aa88ba2a64a0b75420d6bccaf4e1348fb3c723799aaef2ac54d2a265285815801040815e827c9656f6b77ccc677cdfe6c5bf0d72891e2a322ea1e87f05e2

C:\Windows\SysWOW64\msres\sysinfo\vir.DAT

MD5 1803bea9ede45cbefe986d0cf21acd48
SHA1 2dd14319ddea77a59adc8710b4a25772b4275e75
SHA256 0faf2b58cb5d5670b624453b3ba4eae2a9176e4017c2d63e22e544549388d0c4
SHA512 e8e3db5f25f82f8b3911d01a0722b992c0b62f388baac6023f2c347f47b9bb404e270f093d886cc589b0b185b2a2b132d57d7c51db7d921cf7fc9f77c9906ddb

C:\Windows\SysWOW64\msres\sysinfo\shareDir.dat

MD5 defc080e24f426a3fab40001053c16cb
SHA1 9af55f5a7e7429945b222b234120c97f23aba1d0
SHA256 9873bd75d21eb68c26ba0f616e3952f8ba885f2f4c6aac13ef0e82fb71e28226
SHA512 1e5ad46b74b8cf1326e94cb80193feae1e24f0152bf53bf980aabdc33a30f6e930c740f7eb179bc87c1f0b72c1c5287610c6d8d21f4d4274e5028b7712329a34

C:\Windows\INF\dc1-controller.PNF

MD5 771f97f4222a8e67db3ada0f5c96af7a
SHA1 9f1a32c31eea6fc7d69260501761674e8518d693
SHA256 8b56bb0275ac2e6d407cefd16302040531fcfce4523c6b681918daa83923dd12
SHA512 b22d2327f0c9e4715ad62cad5de72c489530bada6aca7f73a994557a6a1f97e3744d66837cb175b514276b2cc161c764a01c3cb044211922574a62383e2d5ec8

C:\Windows\INF\remoteposdrv.PNF

MD5 3a39f8804e44f31b004d94d307c12869
SHA1 0d3df9b2dce06890e61133220c136ac1dc85ae53
SHA256 2f7f366e71fed5a9e8d3b8d12502d92ff1fab343b7698fa9ea6653ed74ffb050
SHA512 0f95ba3c362b9e3fd57f25263e4eccd49021fd0c1e7bc106092935719bd48f38b684638cd50205b6125452446c8513d25f03686bee58c8efe41c52f832cada95

C:\Windows\INF\digitalmediadevice.PNF

MD5 809816b7e03df836bc59d1c76c0106c5
SHA1 b39d1c1db91f352733032d766f5450c6e92858ff
SHA256 91e85175633e3bbe910e1ccea2fae04cde4d75bd536b23cd4e4df449438265b0
SHA512 20a9a109c813ea4d4ef8246814dad50e47ab59cf508c89b502234f0af91f9145ad3c4cd0eb1611d0f0be51745dc0f3daee55d47ce50976f37a98f3cb694313fb

C:\Windows\INF\c_sslaccel.PNF

MD5 a5b60198ed9c83074babfa86f60c1e4b
SHA1 2f3e922d885fec14b965d9138ec90a1571125e8a
SHA256 024d245e7af8409c38f53bd91cf4ede6c11dad6a192a27351ce027db7fdcbb03
SHA512 47571c1995d026e90114bea355d67842e8e77ab003e906f7f5b247c1fe50743609165b944368f7b92759082c78f5b0ef020023c45bb712ede8e408979a7bbd00

C:\Windows\INF\c_magneticstripereader.PNF

MD5 b89b96cf3377bf72f1e2365504879931
SHA1 d43a64352c5c29e3745d977976afc3f6a498b7a6
SHA256 5c38ea9f6c2363930f5554af733e828cb8d1cac048222f7a9d75928086b387ae
SHA512 66abc045abadcc5b31b4411340a57e616be9c6bc93af562dd67cb0a2d06263920d949e61e7ed3a3581736083a3e90df91de8e1ec6af061e44611610a7dff60af

C:\Windows\INF\c_fssystemrecovery.PNF

MD5 2aaa89e67a8ea58df8749b572d74b40b
SHA1 28b370ba633d37034fd6f41b9b2df9a411d12ce7
SHA256 75541b1187c81b304a5802e9137e8c278e7fc74e39dea26611ae96a3fd07fc39
SHA512 1c7cb0cea8c28dcdc5c1dcdfb86fa8d2162a48ef3a8759fc5c5fa42c3fddabb41705ccb3d939444511c9440c558d0ee902579d0ad5f1120e45c1ccdc2b571f00

C:\Windows\INF\c_fscontentscreener.PNF

MD5 b1d11d3342457c9377120911ecea7a9e
SHA1 11e297583c63a37f0b4eeed7230561ba87f999a1
SHA256 b130fcaa180af94e67125910a448e63535af4748c7d4926d61ece47e29c0e0ba
SHA512 93420defdb4963ae8dca7dd7757c22f7bf2de141aaf6c93d92c005923c5a9dee3fac5d1ed7995ed0a0872ac0c642636c2501861f14703141aef2a7f84397ea41

C:\Windows\INF\c_mcx.PNF

MD5 1b909c8deb042ba17243934d48b3ee41
SHA1 928e854f9097ac311fc5ce458fd6909d812f7d96
SHA256 20781e9cd4f11ab6dcc3cfd6df92e0c70f55ff043165f1681bea6e48e45eda03
SHA512 088c1db3e9b55fbb46cdfa4ff18040deb5c1a1347b7f6366b8bbcbf6a1d42ec74aa9e167fb021210ddd613a55c8fc223d99ce2f39974dab1eb301d4f3d1ede9f

C:\Windows\INF\c_fsreplication.PNF

MD5 16c5d603195ad04737db7f09546592c3
SHA1 35c84a3194953525ff3e024b718b3f04deb666f6
SHA256 952a097e95d3b744cbf582462e71561d37e10224acb4e26681635d10e18f003a
SHA512 af22dc7e56c5b3b3b050d8d74665fd6729e15e7c7c154e7d50c3dda1afc1052569fa075dc2cf963bd1ddf06aaf4ff04cbe9bbb22efacde3d435cd06c5bcccee9

C:\Windows\SysWOW64\msres\sysinfo\OpenClose.ini

MD5 39b8643406200071fe47fc106438e9c2
SHA1 b208e0fcf643234f241e0b9e46d186ebaa6767ea
SHA256 d913ff6a89c2a3bad44b7060a1a53fa6a2a0037cd549ddb31ff6021412993962
SHA512 051e89b56f80612ebe69deb2b559278c99e0f9b09c1523ef154dfe06d1e74631889a6fa23335f16dd76509f610fcdd9418f3f7f553c1b03a56452203a9dcdb69

C:\Windows\INF\c_diskdrive.PNF

MD5 a03e2ee117636dd402bc940ceebe4910
SHA1 d54d914db1cf8679740c87b0b8398a4f3fb416ca
SHA256 e69d237a4d0f0ae8aa08a61ab669f13860cb25a99de6588c8ce45ac92c3acd76
SHA512 ef35a5a3c6fb311c9702133f8ace9b0c138660bd8e07a0fbe259d33c9805aa07f9e550e23591470f8ba0409b9e661405044f8f0f06b3e7f7de9c96b2d03e6b0e

C:\Windows\INF\c_display.PNF

MD5 716a1b21d16beae0405cc08d35d137cd
SHA1 a013a0d39efd59a831edfe5194dd182af25109aa
SHA256 e3170e44d159d924bd7884c4e0fd6b590ffd93b0ce2c1eebd0d68606039f7df5
SHA512 bf6664be664c1675b1038afe91d108a0d0f487f158cf6d0b183ab5ac5cf10836270c71687b69a220bd7ef8383bd2aa1cc9715edcedd4fde1735c7af50ac103f8

C:\Windows\INF\c_media.PNF

MD5 d6f787534eea52824abfef940379b071
SHA1 b200fb5e314de41c743ac84fc973584dee668946
SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca

C:\Windows\INF\c_monitor.PNF

MD5 29f6df5957016e418fbd0f2407e3575e
SHA1 0ffdc37e214ad11658b1732a8448eab853713b6b
SHA256 8175f3000d31f9afadbbba3149b647da59b30712668751cd04216bbbbc9897ee
SHA512 e5916dfd44a4456d0f8c7f42b993426c1196059c053a46ac324104edc674944f622b43c7ecb652e1904dd11932d98b87216e7860f5ce193bcd8899162dcbcc8a

C:\Windows\INF\c_linedisplay.PNF

MD5 2cdb8750cf4d771d4b645b1f7f7f86b3
SHA1 f55f5b770bbc742c345e540865cd705c7189305d
SHA256 da71d267e72aa379063aa4bbc0c4e8c12f02b0f51c86c68303483d8ea9414886
SHA512 c358e452236429f2ec91e64fc513a0210302e48396a90cddb0ff5241114f47b48e1aaa5cb4cc8b0589d1bd0ddce5dcb1e9d9c993aad44c2e615008ab3b3c5015

C:\Windows\INF\c_processor.PNF

MD5 19eeb3c2d574371adb0a5b3963b9e455
SHA1 9c85743ef05f9f6ffb11d46fbfd091dce9c46168
SHA256 c77892904b0e14591f60c00234c40c075b89cb6aa819326c98226e1dc3e64d98
SHA512 482aaa27dfbee518a3bf1d928cf8519bcc83f6fc0d5fd0b405482dda231295275119949b6f0a87885f0ed0eb8fff4446e7d2ac03262f25298e38205297e27991

C:\Windows\INF\c_smrdisk.PNF

MD5 9ccacca8c6fd3315afff7de2af76f6d8
SHA1 0d45a234ad1f5ec983afbe42e4b8d1fbdb9b5d8b
SHA256 c865a611cc61b623bca85d43a7a5f8100dd1daddfc11963604772b66ec8112fe
SHA512 8521ae798c555d19639baa86e942d4be65eade09dc1e17835577d91417d3e37c3e68b5158de19ec27a7bb8b90cf50389bfc6b68e29730213f440b88cae6d71db

C:\Windows\INF\c_scmdisk.PNF

MD5 e7b570f07874776e4cef2f9c08191001
SHA1 f85095870f4f1bb349a3daac6bece51b3a5c2031
SHA256 7c0a5430e7ddf37ac601603bff865ffec1db51d745bd4ad18c11ea3ea7711201
SHA512 33d1968d54d9dac5c88e91312a54556be1fec2e192a7d3813e3e0635083b9daf93c51c7acc47596fd8d381015995e04d68fcd4009bab14f77c5ff8eaf57d2935

C:\Windows\INF\c_smrvolume.PNF

MD5 b5111085825780c9db8bc417678f8149
SHA1 efeb256a99fd73ce0fccb48ac01647f5fff1b277
SHA256 715edaceb7ab7cdd1d7954679c3bd61a35b2fe072717704c58eb84c25d4f9895
SHA512 39167e3fc6e79163a680cc0941ea98c23dd76ec917dcc9bd5259e46d9215977b60454bbcd95f2bbeb53ee2fa203367e706089619e94bfdab8bdff8e66e35ad51

C:\Windows\INF\c_scmvolume.PNF

MD5 946e35ab7a9d8cf86d5c6cb83dd8636a
SHA1 3455614b00b7de00a3c3d5c2bdb87cbc8c5ebb04
SHA256 4f57bfc496d88106f21875c2304e3a8854cfd02fb93ae106828fc420c5303580
SHA512 c727e7014545520c8a8d4d08662d6cdde8e88fec7dbf5c3a282331f9654c96a5ff67c2cd37eb0a73f6702c077206d02355470a7b8fe157bf192083ec3a7b1a58

C:\Windows\INF\c_proximity.PNF

MD5 557e6c5ee5f30ee177fe90bd396327ce
SHA1 47da2b91f66ed53e2643c8fbed2de2c521849bb7
SHA256 b24cadbdeaa14c68277ca7443b171074c36e2b28f2e2b476d055c4ad317e9c28
SHA512 06f724657a29605805bd8913ed6801cffa42ba7b641212b32be226a530c855166310ae0987f8446c186f252a592b6aab6ebb80c23e16c9bc7532fcc7cf4dad99

C:\Windows\INF\c_apo.PNF

MD5 b310777bf7130d44cde9a6ae009d6412
SHA1 dbd895b85e21b200c574162ff42f24cbb8a2675a
SHA256 98686cf07dc6d4f55efa5919ed37ebd75c61ae928098c8274b31862ab3d4e3e6
SHA512 d537d0d95991ec0fcd84aae65a948afd5aed0149e23020ae31a4911c83ae8eb36dfe2cab9d607813745a51fcf2271e3c3ae3df01a23ca74829131250712e14cc

C:\Windows\INF\oposdrv.PNF

MD5 cb24332ea78cd872da9ae2367af0f03f
SHA1 f2457e775140eb8f49974e5535e4b8f1a0b8f1eb
SHA256 9210ac7c6fdf19e3939c92d278c73f2271a427ac21deb9c8031f703d88c33717
SHA512 52561e6cd14860b92b7f0dde664c18cf555c2d4be463b12bc8b678dc92836ca99889044a6675fcbb9f122f301c409ad5aed1d0dc45146d5a1f851df6578016a9

C:\Windows\INF\c_swcomponent.PNF

MD5 b097dc99f5d4e4924505d26aad418060
SHA1 56c03dcfd0de0e0248c9087d278736e1c047ee98
SHA256 f46763a9b7072706927e582e3cbae297627738a5031d03b60dfa860888aa6712
SHA512 436d54a5912128459972bcb5cefae0fa9e878f8c0b142df76a4fa7060f2f08f5bc4fcffdee437c355f52450c1354c7128be72d1e32a7bb012aec02b7394cdcfb

C:\Windows\INF\c_fssystem.PNF

MD5 2ac38f764eccaf526b9cd0afe32d1d6a
SHA1 68614e768e8cb992d106d8241af4f03028b821f9
SHA256 655fe8302f85fdbcb13ba8714a8d45aca56ecc9ca46ade3ca6eff8e63161513e
SHA512 7740bdaaa69fd525cf564704601e40c7c1b76c6c5696beec38a61f8c0e5304f7dc6ed4cc1eeba0bd2ab56b955d6fac5aced440fa518aa85f010d4ed8568b8f1d

C:\Windows\INF\PerceptionSimulationSixDof.PNF

MD5 b1098f9ca6412ace5d9b6bcca5e5e3ec
SHA1 f3383b68929d323f7fd1924e2f10f4993068facf
SHA256 0d39822906f00f876beec95a498ae548ed811cc93d1e05d6988de95ae37ac330
SHA512 5bccdf675edec553d3f31f402d033583914864b5611d41d6dbc319bdcff03e3cfa1f5e596b2c9a69f52e905b34e2e9a793467dc9069cbcec1970d8035ee40d3b

C:\Windows\INF\c_fsphysicalquotamgmt.PNF

MD5 f7715c0142ed35c732d6149b2bd4b6bb
SHA1 f7649975159c5892cbe3dfc16ab2678d71519ed8
SHA256 da5baa21906e92aaa5f6b0947343d4e88de3f1993f2e100adc9d41f4a4fd24be
SHA512 ae3d8beb79ddffab2506672e1feb783275a553e7fa264d6efbe3ffebf0d610288b5f7b8a7642cf5fedf9a7790c432e31e9fefc4b035d07c40d70e1fdf16ea3fb

C:\Windows\INF\c_volume.PNF

MD5 8b0c8f54383cef8ac91d3c21663b21fc
SHA1 0bc698df786a3396c58ecca34207a4c81985af10
SHA256 41cef722ddac2159237cc6c4adc318e75d5b1159373d616e9bdd35f807d2280e
SHA512 80a87ef617b5fb2e8ff1cc63b45d2f7f8a368da382bb9bf6d5863f83748f3ea1ade79c6ac7a0de8203d1d43eef01a603bfbc9d47a0d3b9fa56bd71b235c6c8b0

C:\Windows\INF\c_fscontinuousbackup.PNF

MD5 4f9c90f378bb1595f29bb93d7741156e
SHA1 e64be2c95c334fc0d0fd15c7909450a703214dbc
SHA256 2c79aa824378d91c273138cf97f1d7e816862e745a09435b8dfea931d39f5993
SHA512 c724043d7f401758e805ddcc30341570f2922ccc56bc483e15d91f0f1b4615164b8c6948057e026187415c5b7399247f085e1131036995372ddb6195a18a78b5

C:\Windows\INF\c_cashdrawer.PNF

MD5 8210253c127ede2cfca6d6af865840e2
SHA1 0191aa53ab958cb798d19d7263120c618e530842
SHA256 33f9b32cf7af8b738c17ac973fd14c531e16cef06fb432d2bd99f7dcc44b3e05
SHA512 520341c2e2e00f5437f570ea2ea390536372cb7a0a8b97d93d0686ab625fef04fb60a5fda90f1ce841622ae270eac0ea01011251cb94baa6970d51d2439b69ed

C:\Windows\INF\c_fsquotamgmt.PNF

MD5 3f89a0dd90abf143239cb4e87f197a25
SHA1 2f76223b8c2b82cf591b85ba2da86fd0136ee25f
SHA256 fb2ee1308ec24b3df1288469d1d348c5282c45fee47ac1c22a49b3bfab9df924
SHA512 db214e2b8a896e9dd67006e4bfba24ef005105beddf0939ff263fd78411940810fea264aa24ef2c5fd6f00c09eff98fb4fdcbbb8f9675faa0363094b87c53bce

C:\Windows\INF\c_netdriver.PNF

MD5 5c27ad0bcfdb97c82023615170e6fdbf
SHA1 bde09afbe5ec6218a0463789a88b54e35964dc62
SHA256 7ae12586e00113234cdb39741ada6312dc5abc5e8fdbdaab73464dab4f296d7c
SHA512 2689730c5c0e2bdb8b5fb4e5fcf50c53c7f0dbcfb681fd7e8969a2c9578bdafb7514cff2aa9a952e658a2a386a53870e0619ec03f39aa483c3c968a1104b6ec4

C:\Windows\INF\ts_generic.PNF

MD5 7ec7892ac4a62ad2548387f11f5a8917
SHA1 75b606edea0cb4964ddc2d28b7706d437ef8abb3
SHA256 8854966db0db843129614acff3ff81c06cecaca079833b83a7f4f5a0e7592db0
SHA512 cb2478853de7b2784b62043e37f8515ac1c0777ee2c336ed1c81e6f8d444c8b16a9e6b3ccdec80117c46b3971a0848a860bd7492970f2bac4799443b8fc211e4

C:\Windows\INF\c_fscopyprotection.PNF

MD5 efb626c14105d2095cef5efc9980491d
SHA1 d21c921f7f23cde3ed4fd5c3816b3d3980c5c779
SHA256 02ad18c41975f876d48f78569547bc69eabe7c85b2d3480a763b4bbae17f13c3
SHA512 09e999440a51713f87de149383023143d09a21a62d8c94bfac549f4566bf997551412fdb3181afa6c232f5305695783d7346af89ffbca52918e464914c11f2b7

C:\Windows\INF\rawsilo.PNF

MD5 9441fea041e3c2de594934093520b76d
SHA1 4389684a700ab51d36c8edce42f8ff33d1aa2eb4
SHA256 f1055d270c558caea39993ffcf1c476527e960b7761f207be5749b497d01278c
SHA512 965d9259ab98871da202ea666304bdbc51a7c9f3049b95f4bbd6c9e656825b0002f74de25c364950b5fb6164bfe76365435007806b2001355cb6143ffe4a9f45

C:\Windows\INF\c_fsencryption.PNF

MD5 5397ab29a78f8d6398fd7e5641fa3761
SHA1 a2c2c3e07e1cf1cce346b9e269b7d75e63c53e3e
SHA256 66330f207deed42d9389203523249926dafe125c8e9368bdf7233127d9e37286
SHA512 19ec50cc3cc673949c838eded1fc8141aac2f90d7a49e7a02d2ae3e4f787420fccbf9a0dad5e6779c6ca861ddf3ee574ddf1951ee3ca8cfc1a423d041d5bde56

C:\Windows\INF\c_fsantivirus.PNF

MD5 b93d641489836820549a799c8e0adeb4
SHA1 cb8c8a23ec4af9db35ee5a8b7ba05dc45a88c407
SHA256 d26f373639b2492bb19b1fe49cb4a15468fa82d33a5edee783085ea930ea548f
SHA512 50971c7eeb11d71c709d973d02095195d402a9ab841d209b7768915799b0efea44149c2295271d370e8ece6bb7e61f2a710743f235d3dac2c01b504bea8b22d3

C:\Windows\INF\rdcameradriver.PNF

MD5 1c5d8d8648b79b79d2ddda9d78fa637c
SHA1 5de477696fdaf88c626717f8a3a5c06c7135eb02
SHA256 ab0cb0aa7c4b85d6209fdfc916c5426cdf92fa8bc63c3fe15cda9485bc39f7a6
SHA512 e0a1d6d35578edc27783a22e40ae533477fdf0ff315d119d4fa460faba1653b23104976b1e0f685d0201f7cb9c06a304481337b567c3b2aa57ee72d31bf743e0

C:\Windows\INF\c_fsactivitymonitor.PNF

MD5 a3a9b712f940de4e926d0e4ccf405dfb
SHA1 414f8852997cd8b4e6aef89116575f2144aa2908
SHA256 14b47248b7ecfe5ab120d45dbf04b3c04db263b9cbcef687b61928f952db3442
SHA512 d1d1561b1080752f3088f0dcc7f87038eb7e1ed8c4f9a8dd4993706b696c7df10b0fe540a48ebe65bec6643687464adf683ecfea6ba14805a44712a131d7b506

C:\Windows\INF\c_barcodescanner.PNF

MD5 74e1c190c35cba6d85415d8e48b97af4
SHA1 b848b49c5ba335c6acf1ec5150d613e29501c87f
SHA256 9f11c371bd8b0c9b35ba3bb458992d56a656f7551774979264c323cab27393d9
SHA512 23d7831ab9497881f6dbde55b60dd40c3f7c3297e20fc34749b253fbee6a97fa04365c24c48c011cee0bb38b3d78457940766001f3ccd53e4283ab51cc7f60b0

C:\Windows\INF\wsdprint.PNF

MD5 1671a9ea5066b2b30ad0b59fbcd67992
SHA1 eb44dfe3216ded035bdc4b891a06763e2a0584ca
SHA256 2e4a7afab81f605c4b994bb71ddab299e7f1f7ce96140fb930110c3aa5d1167d
SHA512 610c718048e2243f6a46bb02f9921fdf0bff26306cd58114002ca7269b68db27ed37e5c7be45e62dd328dae24f634496d78a08263d708f27868536a98a4d4b38

C:\Windows\INF\c_receiptprinter.PNF

MD5 5880e166fb4a9243013ac5bcf6d3da9a
SHA1 79980d76e1b31958a6bc678ce5b20d79de30c289
SHA256 eb9e52d4195016ad315b2143a8cb469681b2d07c2ac13edc773093143f5f7e7e
SHA512 1bf8bb625411945770ec9972c986a485cade1fcc79ff06e041773f3c2c1371d8b26c090c6c4ac37c84b4bfc37791d2c82be68568e83618cba7f8dca52e49a67d

C:\Windows\INF\c_camera.PNF

MD5 55c37531cb8d70055e8fa5e74dabf42a
SHA1 fb46341f146c582e63db0e26d2a5da006d6f3424
SHA256 70df4413fa77f63e7783e51b9c90a9f7293ebeaa236be194f788800650f2206b
SHA512 814bca88ab2a8ce33feb288bd8110e7e0698373c7f3c171d9960167f4bed209005d36cf46e7f0c3860a22f86b1fbececb3c83492d34d4b38db418ce429fa14ae

C:\Windows\INF\c_fscfsmetadataserver.PNF

MD5 cc316a005167b7a7b9acd1e1d24d5153
SHA1 daa6b910ea852257d8098fd1611760a8b30a3634
SHA256 10dddb5334d5da9bf1088bdd461b9ed42810da1d7afada078c7a1ffa112a5a27
SHA512 459ba0ea0f1153ccf313408c162ead62b502468a9f4d29a6306c30e343bf0a8eba41e7441ee73401e4c06dba44cb18e4f007f7e07bce46692a8d53390241853e

C:\Windows\INF\c_fssecurityenhancer.PNF

MD5 d33fb400c473d002277078f03a6d66fc
SHA1 959920ca0c867a2ad0a2d0ecfbf675df3b6c913c
SHA256 2d1b6ccbd91b8a4d90a2043d58f6b2976b7a81580f2fa39968661ac29425e087
SHA512 fe3755a1545737c6d6d3ce8c4e4dc6ddee1d1795a1500b3a516de5811506a7e97cfc57fff5dda760b5207c44e317e929e1e6108a347204eda69fe5eaba38256b

C:\Windows\INF\miradisp.PNF

MD5 0f685882a5769dc64ed69b4041425a8d
SHA1 37d27a0c53e7d8ad27cad96f5818f6dda589fb47
SHA256 bbc8eb7dfac8ca856b9c63dc8dcd346c05d46ed84274caa25c389820a3c16b30
SHA512 dacc8a3878e51148cf0648423eb9639eaa35d5fcd19c02f2cbab7ca01cfa9141173dafbced2ce44220533fee191f14deb94363b42f76670c1f76d2392178388e

C:\Windows\INF\c_fshsm.PNF

MD5 c062e91e8f62f9f78912ca9344270637
SHA1 c94f67913ad48c126c15b8d77ce7667328bd238c
SHA256 55d99af205bd9dd85dad77d3159ab8c720b309adaaf5538428a8a2f53a7a8810
SHA512 79ccede585f009a8ff41b5ac54fbc0dbc7c40e4d438282f202854958f4c112814c74ec62b2aa3ef8deba6f928ad4f75f8eb23691c4cd4286a5d7a63f49eefcef

C:\Windows\INF\c_holographic.PNF

MD5 aa3e4c509d54843eae8eea2f62b014c5
SHA1 3741dd5b1e804e9210af0c13b36fceeb8102686f
SHA256 b6eb1ca1b567c4015a3688b390f893075d5ca61c178963921056d7a3c38f9d6d
SHA512 12ef529740672b855082056d0843b868c1f2946ec810cc041117e2941d4f153496b76797370f904fa892536bac993636949c0d2ea920783aea1ef26967689b1b

C:\Windows\INF\xusb22.PNF

MD5 dea52d76dc74b3b3ee288360db65f795
SHA1 be6c5ca7abbb34db17981f4c669f644af2892aff
SHA256 85ebb8b34836e15b5c1c74fbbdc0081e8f1ed9ca3f12d0af0419ad7a58bdd5ea
SHA512 9d40755bc81756a27295474c20e69acd453e8eb19e83164eea07ace5b7b16080a7be6f362387d9f44e403b2791b0b7984f40d9324fab520a56b32bbda404aca1

C:\Windows\INF\c_extension.PNF

MD5 27d34bd884f705ac09e31702bdc6d849
SHA1 b646aa41779f75da390fc57b6cc8e00923615274
SHA256 fb5b8135d9c19421bba195c08635a8666a63958b0a846a8afd064da1e4905d2a
SHA512 de27e181309d677554f6322e939cc81f96fed9be175c72628b9a70a8d3f8efe2246a920cdaf3e3052b6344d111243d11206c0aae53831a4d1707a6a5b60b0e6f

C:\Windows\INF\c_fsinfrastructure.PNF

MD5 4606581f16fa9bd296a9004775fa34c3
SHA1 7c2d8e4d7e3048c92ca919d9db10b50edf4539cb
SHA256 dd17315e90f52d0654d2e090764ca944f5c42c36aade16b0a5e2f66801283f2b
SHA512 c488a5ba805e8b1d0991058e7b1e65512fab592dce4eb054ad3d938643712de3a9a613403e02c89020c191e418702923029de0eedc03916b89fb26d5e8f52b91

C:\Windows\INF\c_ucm.PNF

MD5 ec52dd60a36f01ecf099f74778014f8a
SHA1 3f9e5aab56a2cd648fb0b5350d02102c4543962c
SHA256 7d485b556d5bee9cb39c8115cfa2a5f2c0157d12e530647c6ca7487b61074df7
SHA512 ba99a67d8aa9712ba24301fa769d7e19aadbf94d95277733771bceb77ab12087942721bd270f5d8f9686a04c2aca382bc53fa8cee1fd15ee730433be9709ec4d

C:\Windows\INF\c_computeaccelerator.PNF

MD5 b84db9ecc87e382cd4fd7ed496627a23
SHA1 028fe248e7aa9f8c93dc318b2db13c9a936aa722
SHA256 501ef72dffdf8d05caab5a034f5c22829793de765f175a77c39027d62e7ede98
SHA512 2478ca52b9e26075b6ead73399e420f62d60b1adcc49dc00fa33a15ddea53453743505abf807b2605f788dc65e5cb884ae3018cfd84c6347538d337ca879d4ed

C:\Windows\INF\c_firmware.PNF

MD5 8022f7d1c2cb1ee62aeb488b3246a6bb
SHA1 bf7bb2917cd027254eab8c5bff9926edf450c2c3
SHA256 c90b57d094a22090fbf4ee1b3b3f816c907bc6c643556a48c016a1914c731c22
SHA512 c20642aa47b0ffd9abd7445340affe2ba4f1f8eca48e7a0333ed19165bb17461f2778389c5a688e7a8999fe7be60c82c0a6a9c964e0020d51be4696e40c7f638

C:\Windows\INF\c_fscompression.PNF

MD5 fd4e88e4e52cbc1e2b8acacbf6674838
SHA1 4e4c289eda139c297836c1d4a37caccfce398233
SHA256 2dd7c1c850b6a736b6cf145d2081f2f8c36fe4b3e9d8c4011ba68cefb89c6b19
SHA512 0f1eb541fa25e30fb2e6bf76091ee709f7c01b3a85bfc592e67f42c9249a305ed002cd033f469d5f8a745953019c32751fc3e5c58b360d71e56287726fdba5f0

C:\Windows\INF\c_fsvirtualization.PNF

MD5 4d6d40c0abde250fede5569eb226c53c
SHA1 b07f372152a63a7f8d53cfaaab21cb00567b27e6
SHA256 354c90148564093443bc7bec3a168d2b331734e6388935ca5efd7c1914bef740
SHA512 a5f75244ffaead3673f3c15e3e3fbe2ca46f1e503b317f4537b941c016960503930c80a52bce62f57b938bb21ce9299eef6cb4c696ebe365ca08b96f1b98b40e

C:\Windows\INF\c_fsopenfilebackup.PNF

MD5 be200b9d8eb3a64e1c62ea7365c2bdba
SHA1 09e57fd6911b7996eedb64e7637befdd1a39c96b
SHA256 c8c64fcb9dbb8df0ca85ff87a6ce1d032c0cea7b0ef08bcfada984dc043239af
SHA512 759eb8c2f63ce1343ad217083813dccf1cb8ec2be18027d5ec487d0782fbee82ee4a3714896e96a86473b52cf1708f7c39d25f06527ea4baa771da92c7354cea

C:\Windows\INF\c_fsundelete.PNF

MD5 fe88069637bc9c7ac4399769aa74c07b
SHA1 bc6155ef1b4ef28bce96442d70a2f40a70cf2411
SHA256 d784196bfb6afc54d437162107756df374e8f6e118c37e025d50b6ddb2978431
SHA512 25342269a8c117e518a2d577a72be12f41743b62e85031bb62541286529da62102209795bd36f48b2aee411b6f6312209bac0d55fa9ba6a898b2dc07ba386e7f