Malware Analysis Report

2025-03-15 07:26

Sample ID 241105-m91yhasnck
Target Desktop.rar
SHA256 a6bd6ddfd9f1f5a6afc1a681707d97a29d2c89bdebf34a58117292f46df9f5c7
Tags
upx gozi 1020 banker discovery isfb trojan persistence ransomware spyware stealer credential_access defense_evasion execution impact
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a6bd6ddfd9f1f5a6afc1a681707d97a29d2c89bdebf34a58117292f46df9f5c7

Threat Level: Known bad

The file Desktop.rar was found to be: Known bad.

Malicious Activity Summary

upx gozi 1020 banker discovery isfb trojan persistence ransomware spyware stealer credential_access defense_evasion execution impact

Gozi family

Gozi

Deletes shadow copies

Drops file in Drivers directory

Deletes itself

Reads user/profile data of web browsers

Drops startup file

Executes dropped EXE

Loads dropped DLL

Credentials from Password Stores: Windows Credential Manager

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in System32 directory

Suspicious use of SetThreadContext

UPX packed file

Drops file in Windows directory

Drops file in Program Files directory

Program crash

Browser Information Discovery

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Interacts with shadow copies

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious behavior: MapViewOfSection

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Modifies Control Panel

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-05 11:10

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240708-en

Max time kernel

355s

Max time network

356s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cry3.exe"

Signatures

Gozi

banker trojan gozi

Gozi family

gozi

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2644 set thread context of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry3.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2212 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe
PID 2644 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\cry3.exe C:\Users\Admin\AppData\Local\Temp\cry3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cry3.exe

"C:\Users\Admin\AppData\Local\Temp\cry3.exe"

C:\Users\Admin\AppData\Local\Temp\cry3.exe

"C:\Users\Admin\AppData\Local\Temp\cry3.exe"

C:\Users\Admin\AppData\Local\Temp\cry3.exe

"C:\Users\Admin\AppData\Local\Temp\cry3.exe"

C:\Users\Admin\AppData\Local\Temp\cry3.exe

"C:\Users\Admin\AppData\Local\Temp\cry3.exe"

Network

N/A

Files

memory/2704-4-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-0-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-2-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-10-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-17-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-14-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2704-8-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-6-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-16-0x0000000000400000-0x0000000000439000-memory.dmp

memory/2704-18-0x0000000000400000-0x0000000000439000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

600s

Max time network

597s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Gozi family

gozi

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\DHCPupnp = "C:\\Users\\Admin\\AppData\\Roaming\\drprssec\\chtbider.exe" C:\Users\Admin\AppData\Local\Temp\cry6.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2228 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Users\Admin\AppData\Local\Temp\cry6.exe
PID 2676 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Windows\SysWOW64\cmd.exe
PID 2676 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\cry6.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2592 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2592 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2592 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2592 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 2624 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 3016 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe C:\Windows\system32\svchost.exe
PID 1196 wrote to memory of 1180 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 1196 wrote to memory of 1180 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 1196 wrote to memory of 1180 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cry6.exe

"C:\Users\Admin\AppData\Local\Temp\cry6.exe"

C:\Users\Admin\AppData\Local\Temp\cry6.exe

"C:\Users\Admin\AppData\Local\Temp\cry6.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\B194\58CA.bat" "C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\cry6.exe""

C:\Windows\SysWOW64\cmd.exe

cmd /C ""C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\cry6.exe""

C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe

"C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe" "C:\Users\Admin\AppData\Local\Temp\cry6.exe"

C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe

"C:\Users\Admin\AppData\Roaming\drprssec\chtbider.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 148.163.112.203:31780 udp
US 8.8.8.8:53 margeruty.ru udp
N/A 224.0.0.1:39249 udp
N/A 224.0.0.1:39249 udp
US 8.8.8.8:53 tetchershteer.xyz udp
US 8.8.8.8:53 trasterrtron.club udp

Files

memory/2676-0-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2676-10-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-8-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-6-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-4-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-2-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-16-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-17-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2676-15-0x0000000000400000-0x0000000000466000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\B194\58CA.bat

MD5 39292e8b5766d04006a7a5fe4fba559c
SHA1 83ebd8f4e97e8704a4bc496fcf32a399a78cd6b9
SHA256 202b2077426e8f0ee5b44da806b25ed4711161fe3de456222277d9ef31855ae1
SHA512 9905c8a6f661df65b90e56c43d4c03688768b942c2ee9d36f5055ca083bd6a2fe7a10375f82aba7682f26c7ccd29111b8dee659f3f36a17e69f70891b451c1b7

memory/2676-27-0x0000000000400000-0x0000000000466000-memory.dmp

\Users\Admin\AppData\Roaming\drprssec\chtbider.exe

MD5 afb4846bd287f31e6297cb4095aece65
SHA1 b92d682a800d82ff6e980deae88f6cb7e048c11d
SHA256 639a86559b0a086fe388e4309ea22e49f79362c0983df1a5b09fa477db3c463d
SHA512 8f5b3062a7f4faada34001bbe8510235d20b3d507ee0858ef23db92853f31a3075c60e37738a93e1385995199c9d99dccb7e547247fc9af5b8a8f3557d03d070

memory/3016-52-0x0000000000400000-0x0000000000466000-memory.dmp

memory/1196-53-0x000007FFFFFD4000-0x000007FFFFFD5000-memory.dmp

memory/3016-60-0x0000000000400000-0x0000000000466000-memory.dmp

memory/1196-56-0x0000000000540000-0x0000000000644000-memory.dmp

memory/1196-62-0x0000000000540000-0x0000000000644000-memory.dmp

memory/1180-61-0x0000000004D10000-0x0000000004E14000-memory.dmp

memory/1180-72-0x0000000004D10000-0x0000000004E14000-memory.dmp

memory/1180-73-0x0000000004D10000-0x0000000004E14000-memory.dmp

memory/1180-71-0x0000000004D10000-0x0000000004E14000-memory.dmp

memory/1180-70-0x0000000004D10000-0x0000000004E14000-memory.dmp

memory/1180-74-0x0000000004D10000-0x0000000004E14000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240729-en

Max time kernel

357s

Max time network

358s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe" C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_arrays.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_WMI_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Parsing.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC5201F.XML C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc8100t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO5600T.XML C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpb8300t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\Amd64\RICFG7.XML C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Assignment_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_types.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4500t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\ProfessionalE\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\ProfessionalN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJ3340.TBL C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_job_details.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\it-IT\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBJ2920.TBL C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpd7500t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.Wsman.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_FAQ.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\Amd64\KYW7QUR5.XML C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\StarterE\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\Microsoft.PowerShell.ConsoleHost.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\lipeula.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\StarterN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scopes.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Automatic_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_For.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_escape_characters.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\Microsoft.PowerShell.Commands.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBJ3250.TBL C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4100t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2400t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\EnterpriseN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_do.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\de-DE\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hptf735t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\lpeula.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Quoting_Rules.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_split.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseN\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-io.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-execution.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\af.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File created C:\Program Files (x86)\HWIDKHUQDK.CTV C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\it.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ru.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tr.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2d42a6783ff36048\gadget.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\hpmcpap6.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp003.inf_31bf3856ad364e35_6.1.7600.16385_none_2fd781a76c9dcc13\Amd64\hpk5400t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b20ebe05969f5227\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ae782db97dad8098\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_588ed2f5c59731da\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Wired.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_32b04bf58a01b6f3\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_PSSnapins.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPO2600T.XML C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_types.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Common.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_es-es_190509f817d75392\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_wpf-winfxlist_31bf3856ad364e35_6.1.7600.16385_none_40b32988515caa44\WinFXList.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_658ca9e7eb14c76c\gadget.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_en-us_604bc8140b32a29d\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp003.inf_31bf3856ad364e35_6.1.7600.16385_none_2fd781a76c9dcc13\Amd64\hpd1500t.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..putername.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ec2a8bc0ed056604\OOBE_HELP_Change_Computer_Name.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_es-es_c8e6af2b99edddf7\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPW1B83L.XML C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_escape_characters.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_functions_cmdletbindingattribute.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\eula.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_68bfa622c568dbc2\Rules.System.Configuration.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Break.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img10.jpg C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..svc-extra.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5b995155abeb058c\Rules.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Break.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnsa002.inf_31bf3856ad364e35_6.1.7600.16385_none_02a32ac8d56280f6\Amd64\smf6x5u.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_objects.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_117bd8ffb46dd92c\Rules.System.Network.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_es-es_29826b65facd5de8\epgtos.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e3b259cc3b13b0cb\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_try_catch_finally.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_try_catch_finally.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_de-de_42cb9de18a532231\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Summary.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a77516706ab8de8c\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_35033bace8cae48e\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_117bd8ffb46dd92c\Rules.System.Finale.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Path_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windowsdx..xperience.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9efe081149283749\resource.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_data_sections.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\potscfg.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_e119eb1646de0342\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d34b7c772c3fe85c\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..igurationdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_425e0b40ea226db2\WindowsMediaPlayerConfiguration.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_aa305720fed2017b\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_es-es_2447dc63f323a66a\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..l-starter.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8027a962d89e807a\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_format.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_cc7ce9d4d87afd2c\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_04cea537b8ddcc31\license.rtf C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1028\LocalizedData.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
File opened for modification C:\Windows\PLA\Rules\ja-JP\Rules.System.Summary.xml C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe

"C:\Users\Admin\AppData\Local\Temp\e49778d20a2f9b1f8b00ddd24b6bcee81af381ed02cfe0a3c9ab3111cda5f573.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\NDULJ.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 shopping-na-divane.ru udp
US 8.8.8.8:53 shoptorgvlg.ru udp

Files

memory/2660-399-0x0000000000400000-0x000000000045A000-memory.dmp

memory/2660-1441-0x0000000000400000-0x000000000045A000-memory.dmp

memory/2660-1746-0x0000000000400000-0x000000000045A000-memory.dmp

memory/2660-1822-0x0000000000400000-0x000000000045A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NDULJ.bat

MD5 fc3fcfea27d6878a8f145c5d2368809e
SHA1 69cc5ce1e0d991c40c8f284e76435db4095d65ab
SHA256 e6417601ff8b4fa4529f5a11347b9d6cb853f2c7d18c4280762fecdb6434f209
SHA512 7c4c559f53fb8f7ebdfb2b6d2973caaeedc213a42b6ebf193a10dc26593227f4ed4dd917504431490a097eec948790c48295586ddcddeca302f7424244968236

memory/2660-1837-0x0000000000400000-0x000000000045A000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:13

Platform

win7-20241010-en

Max time kernel

117s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr" /S

Signatures

Deletes shadow copies

ransomware defense_evasion impact execution

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2598550 = "2598550" C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\1033291474 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\inquiry.scr" C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2724 set thread context of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099189.JPG C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKDEC.CFG C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00524_.WMF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Madeira C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\POSTCD11.POC C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\7-Zip\7z.sfx C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14983_.GIF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15302_.GIF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14710_.GIF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL016.XML C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02398_.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UDT C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD06200_.WMF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099161.JPG C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241041.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielResume.Dotx C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19582_.GIF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183290.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-PT.pak C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_fr.properties C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\ja-JP\Chess.exe.mui C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\ja-JP\PurblePlace.exe.mui C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBHED98.POC C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\HICCUP.WAV C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Yakutat C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\EST5EDT C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Sts.css C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01154_.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR49F.GIF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\meta-index C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File created C:\Program Files\VideoLAN\VLC\locale\mr\README.txt C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Basic\DEFAULT.XSL C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14583_.GIF.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7F.GIF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00438_.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18245_.WMF C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Blanc-Sablon.doubleoffset C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEMS.ICO C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.EXE N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2724 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Users\Admin\AppData\Local\Temp\inquiry.scr
PID 2840 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 2840 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\inquiry.scr C:\Windows\SysWOW64\schtasks.exe
PID 3004 wrote to memory of 3384 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\vssadmin.EXE
PID 3004 wrote to memory of 3384 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\vssadmin.EXE
PID 3004 wrote to memory of 3384 N/A C:\Windows\system32\taskeng.exe C:\Windows\system32\vssadmin.EXE

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\inquiry.scr

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr" /S

C:\Users\Admin\AppData\Local\Temp\inquiry.scr

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"

C:\Users\Admin\AppData\Local\Temp\inquiry.scr

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"

C:\Users\Admin\AppData\Local\Temp\inquiry.scr

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"

C:\Users\Admin\AppData\Local\Temp\inquiry.scr

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"

C:\Users\Admin\AppData\Local\Temp\inquiry.scr

"C:\Users\Admin\AppData\Local\Temp\inquiry.scr"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /RU SYSTEM /SC ONCE /TN VssDataRestore /F /RL HIGHEST /TR "vssadmin delete shadows /all /quiet" /st 00:00

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Run /tn VssDataRestore

C:\Windows\system32\taskeng.exe

taskeng.exe {4F64AD17-5466-471E-9E66-C3991BAC8F40} S-1-5-18:NT AUTHORITY\System:Service:

C:\Windows\system32\vssadmin.EXE

C:\Windows\system32\vssadmin.EXE delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pohacage.beget.tech udp
US 8.8.8.8:53 www.vabel.fr udp
FR 213.186.33.5:80 www.vabel.fr tcp
US 8.8.8.8:53 www.groupe-vabel.com udp
FR 185.153.11.80:443 www.groupe-vabel.com tcp
FR 185.153.11.80:443 www.groupe-vabel.com tcp
FR 185.153.11.80:443 www.groupe-vabel.com tcp
FR 185.153.11.80:443 www.groupe-vabel.com tcp
US 8.8.8.8:53 www.institutodeidiomas.ulp.edu.ar udp
AR 201.222.58.8:80 www.institutodeidiomas.ulp.edu.ar tcp
US 8.8.8.8:53 institutodeidiomas.ulp.edu.ar udp
AR 201.222.58.8:443 institutodeidiomas.ulp.edu.ar tcp

Files

memory/2724-1-0x0000000000020000-0x0000000000022000-memory.dmp

memory/2724-0-0x0000000000200000-0x000000000026A600-memory.dmp

memory/2724-2-0x0000000000270000-0x00000000002DB000-memory.dmp

memory/2724-3-0x0000000000270000-0x00000000002DB000-memory.dmp

memory/2840-17-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-16-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2724-15-0x0000000000200000-0x000000000026A600-memory.dmp

memory/2840-13-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2840-10-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-9-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-8-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-7-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-6-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-5-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-4-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-18-0x0000000000400000-0x000000000042D000-memory.dmp

memory/2840-21-0x0000000000400000-0x000000000042D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab29E0.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar2A02.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\$Recycle.Bin\README.txt

MD5 033aabf4ec722b472bb92c88ae4179b8
SHA1 9d6ef6e787ff179acef2bbd1ea52d134c959413a
SHA256 c802bb19984dba58265ce6e90df341dd847f9e29f22cf023e953e533e6310415
SHA512 787a2b97a09a1ea11e75627b8652ffbe11dfdff2d5087934675718aa73ebbf35d2332c847be09cb9152c4c9c7392427ff7e105a8540eb558c5fa9f359f5b8a0f

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Adak.doubleoffset

MD5 2bea3a3bf9ae60da9a341b8b4c93815d
SHA1 9be823728823246412338eefa509e46c6d620af4
SHA256 e0708cbd90bfc639258603cfd32107bf3a831bb3c0b0a0530ab437edda6c98a2
SHA512 e4f3d4343a08084e50d15d6dcb07bc6110bd135ca291980e1251f99f3d2ce3f80997166f3ed5e0f6898580c39f930b88b0287ca528092010b21d04e6327a02c4

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Anchorage.doubleoffset

MD5 a4dc979ba38930115d3331d867003650
SHA1 42ea3d323d9cbdc9f619b7069f8fbe740e332218
SHA256 4be5aa6a8a49b7340a720bae964735618478a4e24aa7374c844c492501e0982b
SHA512 3982f005e1349d0881ce5fbd1a436f427a5c574710f1e7dbab3db6e8b846091aaa71b16259e089d7ecdcb4f15ebaf40d68946a71d886c4e54cc080923073e289

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Antigua.doubleoffset

MD5 51d565d9d3db9b875d69dc24f48b017a
SHA1 c0798476b3b10648a7d06ca90c597598a17e4f0e
SHA256 39ff8cdf00af921b0a12098fceebd5b7898f0cadf6d05217acaa010665ee852b
SHA512 16f378c3010de432968aa0bd6809aa0eb46bc239f3b88db7a3dca972d039131321714055b475d5dd59f92ec70582c30c72ac6319a53056df22dc97a65a22ced9

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Araguaina.doubleoffset

MD5 024fc350063364fc9e92faba9870f488
SHA1 fcc34488e9d13f33f6b4a7870dfcf485b95b1a9a
SHA256 b6cf1f66cff3c9749ad8c28f1564a5e4ae9dce65397498b0544df35b57310a7d
SHA512 34f51def508a7fd1e9379f8ee132bc1d92bc14ba0d08cf5d127cf9fb881a8d40692f6ff4d2d74ebb27eec47d403ce625ed1ee851f15a1f2d09175a04c0bc37aa

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Asuncion.doubleoffset

MD5 f3afde85880368af25c997d464562f45
SHA1 c77493240c6a6523c92a0ad4aca7e6014c39324f
SHA256 5ed30ffc08f2a42cf18d4e2ae1dc4f9fca948beffcf5f4107b651c9a0ed30d0d
SHA512 bdea2e53a8fbd9d6e932a1cf795406c4c7a4f8765cbee60d762689e52389b21a2f68327e1e42555c5bd5bf1204b413d9167a587fb8c6e93d081dfa2719d64820

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Atikokan.doubleoffset

MD5 16cb05cecd5de85492740da3e9d36b34
SHA1 540f6ef85eb5c0a35302393768412cfc947d0f40
SHA256 66918af1588ab33c15b0935e87ba4d4c5495acab478554134b9225aa9088b7b4
SHA512 85587b6eba381bd4ccabf451fe02a5d09b430323a18e4020eb9c14b92c512069879346390bbb2c7f17f605c21478f81152d313a4d7494ec6c0ce98afcdcf1f0d

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Bahia.doubleoffset

MD5 375369a388f0ce441064f5da9667db47
SHA1 835b2d9259024578bc14a57b12adb670d3346ce1
SHA256 fa2285d82389d64d2c5af1b8d5c34be8b03e84fa87a62be98e51f67ad397b0ef
SHA512 4d2d25c1ffbcd2e2d596187863eb31ab721636e2da5b192191949b7c1f4e837e9b534916c939a5139a6ec922334f993cd0750d68fdb4fa13a12be332aeeb4744

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Bahia_Banderas.doubleoffset

MD5 75aba46250f3906c07140e44b7453e8b
SHA1 2805c527930812386ffe085e69c7b28b5894de99
SHA256 f3fd8c447327b29a83c173329c75c299595c3a6adead64a2cb6a69016e22af96
SHA512 655e717a9174baa55fefb08778eb821d3c27e12021a79817e0732d781fedebf22b68fdef0033c46321e42e2bbd0603b9609c067d0eceb73cb21f165ea708b63d

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Barbados.doubleoffset

MD5 29d87f52524e5c6fcc0726308ea1b8e8
SHA1 558a1ae0cac721e3ef2d1854720a039fcf9d27a0
SHA256 d545c7ee3d2b14840c6fa0f3242376c8d954b796bcf2d3058dd88959ae0685d5
SHA512 bad26ec0f36881162f8755cd738f58befb4d76d0426416c09199076871da723fef0e468c6b754af84f8e8223e45757283948b051c9bdd5e5be63c53c2dee3ef0

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Belem.doubleoffset

MD5 2a865bb2059e5ee6abb712d494a16a5e
SHA1 3fd4bb2221b81637318ed8a0791b2cea07c82697
SHA256 da5b56945eae3d846baeb1ddc0d8e3a2cad79af624e5e2f026295cb319bc1592
SHA512 08a98e9d7ac1725ca4a09c5b55d8c7be4016c1a4e98512239fed5230e475135643a9dabcc6197fe3f351be2d4720cb3ebd2233a494258ed32aed39bf4f1de564

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Belize.doubleoffset

MD5 732ae2e8833ac06a4f1d10a5b4428674
SHA1 230d864f39c00ba10d3d34e40161a6a8f8e9619b
SHA256 b2b408256caaf11101bab62111413e052b058099ba4a95b84acb26ac43b42f5c
SHA512 ad2f20603d4c2a943a482874edfb74979c03c6fba02d841591a445e7127aa6da81d6a5beb8e47dc883f836e7d7abdf402e5076fb1cd3454a5d6d0617b1754f18

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Blanc-Sablon.doubleoffset

MD5 af99a43c9792abf82c3959a3e3320e61
SHA1 335d471c0f9eda5eba8b984b04269e9e6eab244f
SHA256 1b2dbddf3d03766af4bfdf023fb3225f8c064587561882f020f2cff9950cac73
SHA512 13adba84129c5b31e5b187f1b982840aab4fec7554beb84e1655dd6ab509b11fb3402bbf0b8a492207f4bd09dc74029d712f53d2c5cd07658c177ade2078782c

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Boa_Vista.doubleoffset

MD5 2500a6893cc0d0cfabe921d1d6d9c6f8
SHA1 d4fd492ea75966721991271bc5ffe7f9ace9a007
SHA256 ee6714a67f0af8406c32c22cafa7d73c3e2b03b8e1e41d455cab80a7943307fc
SHA512 144057fd7abc269d05de19214b91e20ec4a7febf350c06ac148dfddce2dc0ff611135b2721b35040e6cd2a3d8673c722622b56736b3d78a44f6c8fc63dabc6cd

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Bogota.doubleoffset

MD5 ab34c05adf83d6bd613a288a3655e529
SHA1 e8ab987e1a7dcb769a00ae1dbaf8090f031a3c65
SHA256 e67dfbecf8f5729c36d6ff3828d24bb88c856cd5879131745348fca99b6ede6e
SHA512 bad655941dadaa52e6e151b81371d2d40a964c2b5172c045d65901fb3c16ccb27c15ff998f94687e1bd5fcaed3c94b263b5eda772d901dd2fb48169a102de754

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Boise.doubleoffset

MD5 61c86bb30f7384495759c0e49fecbe5d
SHA1 55de92669b2d37f6dc46e361d7886096aa134107
SHA256 e5514b23e3f55cd7e2ac4e5244ccf9b110df88601ea1a853092fa6a2acd86def
SHA512 a1928f7b7aa37a29dda9513f1fe6cf28cad593526adb724951a9de1d7ff0d0285f85a1d567c2ef5753af1ee6c1a991effbd1e1d1bff2e52784bfec689023f298

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cambridge_Bay.doubleoffset

MD5 10836dc7c6b2701a63f10f458e1cfc02
SHA1 048e44195d8ee01da126a78680d483f1d53fd56b
SHA256 7f4887cc734c417fe2893ecb0d7b51472e750c4f38c1412042aae737e7aac818
SHA512 3ef4452195614e8a3458bb69653129e72ead9ae256e2d381ac0a227f6659cd8d62ac6dab130842f8c3bdd1f172a95c741feee8526abfdf0098c5df5784c6ec97

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Campo_Grande.doubleoffset

MD5 4eda28e1ac65866ad6ade3b9bc2bdf5c
SHA1 bacb146b9e92cea43c3c6bd488342d084863a4b9
SHA256 8feb29643b5ec0554eb5df81c1513e728f63ea137175ab92face74f859ff8946
SHA512 437f0fa8461eb65fbbdca268f620a31bb664e891217058b28419e3613366ad2a24ef8ae5cfc9ad5abeb72cb0d7e362c8db26d920acb65d7f3ca46c36ea9a5578

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cancun.doubleoffset

MD5 233514494c8548d4ed102d5030f352bd
SHA1 878ac462161fdbe1b84dde054a2c724d62032d90
SHA256 52de4c5aa140fcb8901cb6cd1de746f03924a585a9ed8396827a8866ed589441
SHA512 48e96ee2a678dac3d345b8a1885f83a8f62607a411f3e307439baaac870302c5d37d0027ecf5c4839784116cefbb6a0855d753e1326221155ecfe3125fd23e3e

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Caracas.doubleoffset

MD5 0ee0bd4f303e2d4028519d7c4e037739
SHA1 f40f8b782443a9d6afe0b5f24adba8795885ced2
SHA256 19fb6bac4896981122308fb492f66a4c69a4ad71830cba955959bcc244837fd7
SHA512 02761e5d481baaa64a8aa017920b69bd0608c98ef42bbc84f2d25752751dd8c12e39ac94a1f58179641a09ce4886465705a6d1524754daa0624acd71dca02974

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cayenne.doubleoffset

MD5 21c59b58bd8836b9da8ff7063199bd4b
SHA1 0ead1d2c48303b9e30fa79758c2b4b2bb725caf4
SHA256 660c8f0cc848f710c7d1aebb676d54aa138cd5ef133e77f17680379af3621ffa
SHA512 e712df09c1c692163bbd0db31950084d0c08b975555b23590d26307561390400cf2c1e4624e18f81f157f00c5f49897b6aa87cf4483cf25732a0439a7635ba24

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cayman.doubleoffset

MD5 a910e0226f9c2bf79e72433098568d5a
SHA1 f8b313076fc1f19120cb1d6fb6276f05c7ba40f5
SHA256 0d88831273cb9fe7809443381ff2d156dcd171cf107110d1bfb342d92410450d
SHA512 6583a7849659c3bbfca2a0e21776b8f5b1453902ef01df1b659b4b0c6a23ff3c10695bd48c0558bbdbfac53bc1f8795a57efc8e3c3d277c71e126f8f46f61e31

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Chicago.doubleoffset

MD5 e3044247c684c5f4a7f3dceca19437df
SHA1 397114bfadbe36806f7eb5b6b1694c00e0e7733a
SHA256 3e6a64188df946aedb6e46ccc39cc8f773a97e375ea3e80de23141b49d0a87bc
SHA512 2bded8bab85737b5aad30af34a72b400136d98dff1e3aef25d9d4f403001e7b67582e8a48327372972e68fea73552bb18f1e3e1c436c80661b2140e1103e8824

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Chihuahua.doubleoffset

MD5 bcfd6cdbc36458aae8899a91a6c66050
SHA1 6f413f8d7a94e8a40e42f322408cf1ba619f199c
SHA256 0bc504f814d281215c2e0e39f283a9f4f61dd22c050196e43e84310fd12c922c
SHA512 d0fd5328949ae146abca299843450573dd08f59aef41b9fb04aba1f6ef51a68cc5d750978ce60552c2ae3c0c5d0efbe326fc97928fe0bb4b169f7d65d1f76362

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Costa_Rica.doubleoffset

MD5 bccfe81871d3d5cdb71ef67bad3f7c39
SHA1 8ad1534682c8ebefda23f4f25868cefa5b7e52ca
SHA256 63db4b42a7f7e4c05bccd52027364759c0949389b8ea69732ee6981dc33769d6
SHA512 2ed1b29d0425f17079c4fd21e9fcb31c26e14c200c2ef9390a37ce00b87f4b587eddbd75652c4f1357905e19e9aeb9eda157015d989aa2b0d3d8dc84c4021b16

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Creston.doubleoffset

MD5 4022be0bdd97f285c2e1660ece57e427
SHA1 74f574d55f755cbb1f3958065a17d766435516d6
SHA256 53014a4d403d9060c6ce8abb9e9e98a3388578538bf70323ef1aab0ebb7b3abc
SHA512 05f9f7a915e9a95a1b9081eca72db4094350aa30c86ae13ff1a9f5c057ba90be265133b6878c0c1c55d6c7b51f79ea19e76bf3a3c6e718f09db1c616180404bc

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cuiaba.doubleoffset

MD5 3deb3b63df3a496a6f98af32e176753e
SHA1 a1f179f9f41ac701b5ebd16a8fab935a9fe40955
SHA256 4b19527d46e3eec326c01c9053b7d24a98581ebf5af4dfe8cd40d80cc6c8a94c
SHA512 1835dfb9367248a38964755e3ae959f2974244c9a6d17041058b74334ab6fd26c36dd15c6e4ed1627516ae32c29812b8a5d6191f3a211e4750eec09d0915ccaa

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Curacao.doubleoffset

MD5 95065256d792680e26213f5e22daec11
SHA1 658e0ff25953343ec606d45abcf8b016016dc451
SHA256 1fd51822ccd33bd3f7393964dcb035e75ba2a94233497cbf33a4f6b51f27e066
SHA512 83683a86f87c5abe3d7af314d1aae82fb8d4ab1e8eee8a536be19882565fd82a1d8918defdefd9badb4d2f9e886184418cab5ebad9e549ac1e3126b1bbf06b64

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Danmarkshavn.doubleoffset

MD5 b07fc7917a27cead08cd35fee497a745
SHA1 5f5c28c43b6781ed4ee12482686acebfc576a8ee
SHA256 42c4ae676f21eaa369657799b672a1bf42dcab8b5d12dcab3eb771bb999c7424
SHA512 0004de30d67bcaad9803acdab2d81bd0775456c9ecd77fc2c4fa9522d0ed239a6b02180a6a8ec963d8a82eed1d1d1796916ce05fe104bbe967207788028241cb

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Dawson.doubleoffset

MD5 2acb2f19b8facd5c64837e162f44d1bf
SHA1 343360e626b3b1a1b3ab943877918a59ddc5c30a
SHA256 f586839ea5490b83bd3554bd3c02359c19e857ef582bf1eb314242658a66cd5f
SHA512 12913c9af12d99e9f875c640902ea5e21b875ff7e5c6433774fed44d800e78b0803384847a9ee3bc12a109aa480b4017c532fa151437e7d37d3ce1b5e06f586c

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Dawson_Creek.doubleoffset

MD5 78dfa15619c9032cfd3adefc2b33ab26
SHA1 8ce529ee4eb069f36c5e9a10ac1c6c1d01be23d1
SHA256 573c7d83f34dfd45480d0e374a1c13205d4488d26cc07d3afb93d47041201d2e
SHA512 4920251149611d2333f874a8566532468cf9ccd6b2f5f1cb4b2b7df7a1c925a0ffdb6589e9b20727f8f37f51d51347a3a1ece5a4dbae46d7d55f7d31ac7110d1

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Denver.doubleoffset

MD5 b59f39930eacd8e22a8807ba30687741
SHA1 437a14fa2f605cccbae63246da4f92a48cb3bb1a
SHA256 139a3c11b115403700b1e920590f5dd0f8f29a21f61dfd34fa9617ed9b813b57
SHA512 e7c0aa7f4bd9e823b1061e458d056c3a17d780a77f09091f14c8285f81bbd25905c9bc262fb91a4e2e124e9f339a0b24417087972b3710e7d0bebef1629cac1f

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Detroit.doubleoffset

MD5 b54ef6d9bca06a05a6f23b0eab58e444
SHA1 4b37786d7de4514466cbcdfbd52ac972b7fe7c9a
SHA256 4acb24f8818588ad2a8ebe742cb785ca5fb33d60a8c0402ee70623b6f6fb180e
SHA512 3fd3f36729294a5d17447fe90f78911e8277d9ec43d7b420b8be723521f7d8d3402749c1f34f78d579b855a19a4b5a168f11620b8b52f55a22f1afdb97c2d066

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Edmonton.doubleoffset

MD5 88cf1d50ce9d30c47c574250e5d72774
SHA1 cbb1d8f846da52a2900a117e4b420a2d745ea414
SHA256 1e6696c367be92d8128dfcade4878b198072caeb513a5b9be98ffc728ab42747
SHA512 756fa20bf86353856ad3f968703589024256ee4d2cafbdc116778fb8a52ef65ffd600e4a108cfdd19213f95e091c9f7f81088ec9d1ad0d4892bb226af763c170

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Eirunepe.doubleoffset

MD5 52cc5cbe02e59c060c0307d866744656
SHA1 a97cbf6ce0eee3f66173ff0c05adff62354d2dbb
SHA256 09498e0652e1ae10dbbd5faa47a88793d90ecf9c953a758e07d077440c9a8c2a
SHA512 26e74f82519d2fb5b8c4659d45a812546a4f87492f21f8b069c045589670d30f03d29bafe81986a87b5d22c54cec103b6975a2339edf1bf4ada056fccb975393

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-El_Salvador.doubleoffset

MD5 e43d5d5ca6b03077316184d9ccfb409e
SHA1 cd537d33fd23624ef80ebe86822ad9784d73f8d7
SHA256 e867b2ab70ee5348e58e366d1cacb050e9f59d4d1f330c93ab1a51e968a5aa21
SHA512 02741d0603800bd1d96e4ec8ee93de53a8b055c2fd6c1c43964f748b96c0d3f67ce459f3e21e04a76fb3c39582d42e457d52fe0a4148ebe6fab60151b1d9c7a2

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\license.html

MD5 c3c4445ba56e1afd8c0b4c297c1274c3
SHA1 d5a2d300f8dbba287157e4f2fe219873ea5bb709
SHA256 d872aac82ca86c86676e56f5b97855b8fd21cdc1cbaf25ba632dc53f1bfb9dca
SHA512 099b51167be556bdc2cb402fb563284132de4c4f9f06b41228aaf0bb54581fe5b9ae4ccbecdd084eee536176f3dd8207a92278c922daa313ac54402e1d89e80a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.ibm.icu_52.1.0.v201404241930.jar.doubleoffset

MD5 77e1d55b53d7f0740adf5ac5a579dcb4
SHA1 f51abd40b24eaf18892d89c69c30004374a4948b
SHA256 c8bab78d1b825915304d10bd9e83d9f0d798ee0202766e031e4d6b5c1f5bdfd1
SHA512 9200eeacbd15e8358c3450366dd3a9f2b24dba50f854348ad7afa33c65fb674a064243e7256fa98547c2a558a1194ef04f003ca9dbc609d5bf0a098c9e1dfcd4

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.alert.ja_5.5.0.165303.jar.doubleoffset

MD5 14322fd47fa38d8701d62a6dbe2a0ff7
SHA1 3843ce711eec8d124408f9e16ae2c7fbfc7fc767
SHA256 89fd32cb2b3943617d19800d6eb835465d239540942a3163b75164bf6276bd93
SHA512 5543512db4bd62addf27b2c267f999727040a67d4d33fa0ac639384e6171bda6f0621f99dea228324299a9478d6a776cb95969e1c8271004d4e6e24c1cbcab16

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 c132f2a68d1999e32fb2b3b898b4b8be
SHA1 2fcfa4fc2f60a319291a0788745bf16fc247e7bc
SHA256 8953d12ab96b6e4ced708c05cb3c112b92a58a1fa646ea874c41ebdb0df691f7
SHA512 7f10c651e4617773c3c18a6f2a52cb5c491acdaf4adfd097283b37545e8f4a00eabd37bfbf3839e33ac68cd855ffbc8c3a0db5e2d3b484c3f19697186097153f

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.alert_5.5.0.165303.jar.doubleoffset

MD5 6404c756fb98f64aa3127bd76874196b
SHA1 ab7142fd5366844900a2c77c98aa05bb085cdc3e
SHA256 d47af173d7bba8ba357369037118e3fa6a3f1e878e587ab9fe2a0e7d755e80f5
SHA512 7081b6d7cb0d7e9529eae262c764c15b819cf5f65814264d7edcbefa021fc2c2c8a369ec8babf483f50a3a4f2c088a53733b624b147c66e06db4edf734b9a158

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.attach_5.5.0.165303.jar.doubleoffset

MD5 438e41708c1158620aeff18f6e6881b6
SHA1 843dfed957a41b280bb70439098ea02bdd56224a
SHA256 d977928164b4e6cb6eb635f3e339458a4a12c3e3a7f8e747e43a62259e5c7d0e
SHA512 a2639a01bb10a26740880fecfd381db1a39ff10dac3a24438401f10afe9e2f39ed1c6b8a99f471e1cabcc45e2fc7671e2b37a1972116740b37ae112f495fdbc1

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.attach.ja_5.5.0.165303.jar.doubleoffset

MD5 f84a4776f290e4b8e16fbf098b161928
SHA1 538921165570836ac482e81d4029e7ac74bc5e4d
SHA256 34273b0fe767de9c76378695c4f27f47af814e37f5c90d32f2fefd26f9722480
SHA512 76213d2e9cae7c166dfaa252f9f29078fc9fe2c613e32c16d12d6ea326c7e235b7fea176f2d06d5d1e81f971cfa1c53ee694fc878d2d4fd4f25783c031c204fd

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.attach.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 823e759cdd02a2424c27a63f970c4873
SHA1 c10013e85a8f5e431e7bce337eafa4a233eb47f1
SHA256 3d33912aff75787920b3f5aa1aeb802cf57a13ad16b185cb88324da466567bc8
SHA512 d7c0d07b912d769cfe87ea1ad8a6cecdb0df35f33b41a1f9f24e5705aea43122da74fd6c363df918f8b6f0ef835a1f9c15152218633f540628ff19c2c6fdb5be

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.attach_5.5.0.165303.jar.doubleoffset

MD5 ae82edf25267e6dc2c12c3989b6e32c8
SHA1 4d697aaa30c4d2769b946219e4026a984df08af0
SHA256 816480bc79d85c58ae0bfcdd60a1c239be467d5d0a16a8e3cf0389e24e4873f9
SHA512 083a2acfb7cf5b8b18dfb49139d92eda8b06855773bc37df7d33e405eabe4193a33f1c686defb1b59ac49519d1c29b6cb22513fc81542c96c723c35792a786bd

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.ja_5.5.0.165303.jar.doubleoffset

MD5 3014c2a4e0e7f608ba284da96bc07449
SHA1 3d454ea4767faa68101e4d9e334cf58cd5209fff
SHA256 a97c9757410aa865a5a768ec352c6221dfa71980f8b6842d4e5cc679a9081d98
SHA512 7331c941ca0337dbcc4944410920e0761421d57b8b707b9eb6d2dede0deafb3d9f5dea4b745022a59e367eb04210c003493746280f8e2308aebd99c039feb5e1

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar.doubleoffset

MD5 5b7014343036c41460eb737759e59e23
SHA1 0f9815c5cade3aea3d6c664e03a99ef427604aae
SHA256 5dedbef2ae075200f96d061fd706766a5e29330faaac5cd0fd9e5933e48a1612
SHA512 51a1ff66c0eeb95c0fb7f4aa05ef1233d6c232ee588122fa992217fa310b5aaca40c8168ecb096f17266bdf2f58d3f3010cf1280b01728efc9ccbfe3e74238a7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.sun.el_2.2.0.v201303151357.jar.doubleoffset

MD5 74553b7d35be2f5788309e77eb971ca7
SHA1 a7203272f7e35ccf515713aad028226a6139200a
SHA256 935ae90f8e082b0423dbc3fe1002e05cd1dd4fc7a0f23b0c275daabc8e57d548
SHA512 32f013c8b014935dc033f8ddf03d1bba2fa404fbac3a1cd08b0b070951e96661662e43a202256bb55574fd22018f1ee7aaad6c79277a2a95a3361d636a12bf4f

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.ui_5.5.0.165303.jar.doubleoffset

MD5 0e88ea121865061e980cf85ffe390737
SHA1 c985f1240ad44778b14eab44e063fbaa802427e6
SHA256 243df5d10c9667e6896acd5ae553b37f771f549c518c66700b44a37db9f189e4
SHA512 206386ba25e907f20e6798af5d0eea1dd487e6943d1ece4f1809f47b97b08a00a936921009aa4002087ab67e55b128c5aa54562722f3be4d14926ca24be5c4b4

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 0caef1b15a1010c6e2cb130b6d5d503f
SHA1 afd630e904a501d91027625cbe80fd4525b6baad
SHA256 0f93786f3272fb97276971e76ffaea00d95ede23221ff806a69fa54c561f992f
SHA512 8d7f7fd99b257c9ef39b4dbeb6272686bb05d24769ed870367687e74b6f242eb95942cf560e50c24b23e2df172986ff3982a48f68d8184163891fc40ca132d69

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 0f9f91afbf9b270242443939c7ee01b2
SHA1 b103b896b7d556a5cbacfe813be6c11b2488d8b3
SHA256 77dd197e435805ae8898f2b0399e2744c2e3a58431c52b963d5a841a5d835595
SHA512 25d8a2db192fe80e074675bc516ac801ce26c8b831d9f2d7c07e7a48b8157285f40cf6152e8f83eb8695dabc267f6c87d0410ebef77fd94633f078bd6992035c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rjmx.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 008ce8dc7f3ddfc3651ef610dd217ebb
SHA1 a136d608a6c346e086faa00859f3e9010f70bd4b
SHA256 42402a82d86c42bec5ab34e94dba833d5352a65ae04bea9f6c375f78da23955c
SHA512 0825254084ab0e70f6c7ebb1a1d289e36f4dbe9081ad0346a55cdf9160d2a52f7764a992966bf362a033106686aded2b1b5bfaf556fae8a28d6ffdf86630c6bf

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rjmx.ui_5.5.0.165303.jar.doubleoffset

MD5 98d8b7e635f12c714e599813addc03fb
SHA1 70af6f543a83e8b09d263a70520b9bd47c4f27ce
SHA256 2c4655adcfec724bdf0ea113d55144713451df76d7d3439b19ffab381f10790b
SHA512 d662f6950e0b65cdfff14a5cd4e6a5ddab559eb36e5b598cd5c17e5db1488eb29af0936c800507e6b7e5076392bc8bd03716b1de8064baa82e6f7f5ce7635f99

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 c292d72d3e5b081a6f17036c16949c26
SHA1 920074920475ccffe66c90ed6ec1338564b5e0a2
SHA256 fa804ae8351e83229e519a8846e8ad07b11eab0d970f400f50ec3f6258e1b989
SHA512 14cbf2712c24d75ca08e811aae9fc4a2f92bb13c718f8a79ca288d64d7b48833b9a65c9230ad1b2a2a1a5f9c73d7ecb2e4918450a561a1970aecf7287f4566b0

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 20fe8b790ccb2402369ecca4b9075887
SHA1 59a15c6bddedb4bf67b85037941a33604a2ec5e9
SHA256 98a5b5f9f741ec7a438dfa97d7e131b21f2f983661350f931f431894367d5ca2
SHA512 f62f13af7ce1d631c4df90f1ed03ad45501f8eb94bb2cc032d3c82fbf24b32c3ae83d5f14fe50a765dfd2988269e302417b90b712d6aa0bba187eb2461dae105

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rjmx.ja_5.5.0.165303.jar.doubleoffset

MD5 80eb66e64ca3fb8b73fa90cfad4acce9
SHA1 de0a81e3cc6d64237799cc06b18aff82a412fa48
SHA256 139deaddbfb7ff7c8b2a32d9b585ea791ab645defdabea7fb0b935dfcb3ed65b
SHA512 4f13bfdba58f76b5618b323129cdd0e00df022246363465b3059592204b6dc9cfc7f318bd0dec6ee7d5e5e419672129feca510f36bba2d17ab028df3441e7913

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rjmx.ext_5.5.0.165303.jar.doubleoffset

MD5 7d155528d7d12eed99ab0b5a74919a21
SHA1 565b12f2e809bf00cfe63382943c85459cf4f67b
SHA256 c19b645becfe18560eebfa52c53aded4f1c97811924468661062de20b70affca
SHA512 34e67d731a5bdb507b80bc242f9957dae16479adac7182aac2f0e0e93c51650a236e56989878aa6b325fc10a20c52a09dcd8bddc8e842b9723b82ff80e9ec94d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rcp.intro_5.5.0.165303.jar.doubleoffset

MD5 1e02be53efc9ef80eb5c672ed337c7c1
SHA1 0903deb61d492c83bbebe788928026128851bba9
SHA256 24952e95dfc434f1a95ada3e309741f193e6f950c5b53b7c95cc4220face3d95
SHA512 f10769feb699c6c3b7f2f58e36c49fc795996f1c96f87d7e662a3d9d660ae33ecd8a3a868059ed10f43c9c7251e7bec6e76ec002c76b717fb8df234ab2839f87

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 1ae31067b5bb37ee09bd105bce09bb6c
SHA1 987743472a84afe8dd82d760584a995c2a6246e4
SHA256 c46f39a34308b2f4b1247ef46ad620c852101c8598841a12f47664a9d7186156
SHA512 60873ddaa80b3143c2f84173030f87c53359a387eaed553c53230c690341bf0e2c44c4ebaa7cb6b1ef57a5bfc70dbb14191c8d13de309a30eed6540fcbc40e26

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar.doubleoffset

MD5 fc5a508af99dd28b5dd2f03995bdd532
SHA1 bc9b6d0ff9456e684ff8bdbeef9ed5766406e66b
SHA256 1b68150072030f6cf8f58f1791f8d8df3e408c4f684be3062e55d34cc614c535
SHA512 dfd5b02670e691e38af46a93d4a7e9075d4fa4c51fd756a3930812d68204b33697292051f2f34b8ecb56e07c689f43b1ac322e332b84670f3eb538c25dd9d684

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rcp.application_5.5.0.165303.jar.doubleoffset

MD5 df6bb43cfda3e6c17b294c86deec625a
SHA1 789d845ee2a4af832d7819cdd9ece4adfc3f8453
SHA256 904bc35c1415c355533a1c7e9c3825c5d691f1384aafe189156453181dbba235
SHA512 c87382a115ef9d01ba2fb7721f55d5581aa123aa8bd921743acd7fe7f1985f04efa83ee55cb6ab5a7ee08ba7c95d8a921ed3b90beecdbfbf16d17d7ba71c8996

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rcp.application.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 f70208935c3fe27fca0fff4a941cd500
SHA1 e3ce37784464c01588f2c6254920d34f1607704c
SHA256 37a1e1948566ff3a7aa3490339ed5d1b2cecd30506208a9176be73ef9931e68e
SHA512 eb9f124c35d968e745751d46c17309b34840d1315158f7f6df67b60611e037fd75ff584de3ba6f7d7cca66cec43362837c06b043507e8d23286b2fc86363e57e

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.rcp.application.ja_5.5.0.165303.jar.doubleoffset

MD5 42ab1d7a5bd33d59da7c4b0b76447dec
SHA1 1d9c37eec4b0890ec359818ebb249f7b11f5ce2b
SHA256 eda9a355b35fe834e3eb61280f3126b465465d7e7f0fd5f200ff90e015d63662
SHA512 08c78ae04d84fb922d8f2a07ddc04f5a3dbb75cf550fc7037bb23e590019fae14342169fce244e20908d5d5b5662102ece9496fdd1eb22f86835294a2fb49ae6

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.p2.ui.overridden_5.5.0.165303.jar.doubleoffset

MD5 82f53a08876fdc5630b0d9e6e8fc1454
SHA1 b449204c0e9c80594dcc6c5679ca6855db7fb0e5
SHA256 4558dad10cde88bccba1202b48fd7d9f215a349105e56b6fd2242593885a7ad2
SHA512 9191b3c31d63a6ddde9b2fc983380bc47f1517b89999636a82c9da2f811baa1249e0f8b202f417f94c21693557832e723d21c2d147fdf47a2894b3b0a6d7991a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.jdp_5.5.0.165303.jar.doubleoffset

MD5 ffdf3b6e7f80feef8df9f1069f558a0b
SHA1 b65ca39f195a4cac9510755915595eaee887d9e1
SHA256 737147c1b23aae5f965081682ae89c222a8b5824d1f6d594193c114ec9d00cda
SHA512 6deb8489c9d576cc27e865022bd17a2b5a542077b85a4fe4829eb5268e18dc5f51332fc8666131d0abc3e57973b3eb76b318640696c2ce11ff2c1a348cff1927

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.greychartplugin_5.5.0.165303.jar.doubleoffset

MD5 e3d5c6084ac3aa40b780ef1f209570bf
SHA1 f2c53c75bac9401df8301475dd67027c59a6aa29
SHA256 9e91e371700a9280743aab265f976c3f8a5de214bf61db19e0f5374fc9f3ef46
SHA512 b99ff9738c9ba7743674fb0aa631af3785b8a94f780aa2a7a1ce59db53ffca330f3fb5bc8fd28d0fb19b4dd8bcfd3a75455b7fdbade8401b0ff53651803d545b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.greychart.ui_5.5.0.165303.jar.doubleoffset

MD5 0f6dce31725e646ce78e6007ba491304
SHA1 f820716d67fbd951aceab4aab4fbdc2d34353f5e
SHA256 f963462f20ae99626473c31a570a0f23823ea558c59b765ce422fec78a4013f6
SHA512 a0b55d7c142bb66b3cc4cc2f44b38286c411df313ee1b33699ecc59a88acaa1e9953ad923734065ab32852fc7b43566694e09d1de6fecd546303e9cc42b69c08

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 de38ba904af3c5ab516a0dfcec146511
SHA1 1c4e483ba01ede1524aed802963e9be54c2121be
SHA256 dc6f1a99d421673ae732c8c5ade83ad96f5b73ee80547d356a914d7cebbf8655
SHA512 2e630e9d2016776d6a6a587ef8febc8f35e44e9c07528746771ab55d18b5faedb5ea596239678b62e19ff08a37b7b3521ceca138628eabf6a4ccd65ca2e9a083

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.greychart.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 29b5f3869a1a1b601fb8a0d2045c191e
SHA1 c505fdb2f7f9a9b2b063841f50fe072f0398b087
SHA256 cc1d1a116351a80ac49ab40c56d05ec26db01df783782e2346be4af6625d28bb
SHA512 0e3cd2ade6767e0b35520c41a19f7265c0831c81b5fd130a9510921986ae216e78650124eafe0fc21bbbfff1ee05a679df08ace7fe5d5711aca00f97abf20e80

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder_5.5.0.165303.jar.doubleoffset

MD5 241d277fa9b37f3bdff27640029c0676
SHA1 01a89996063ff18c118fd0817fd09f6197587c6a
SHA256 52924a5d50d05a34b348528a5ae6a87618a2fab48225db8470c9a56de37148d2
SHA512 ffa4bc84fc98e9561ff6f0c2edd256d1a7e77275c82506fb25a3966d244fb5048ec88a69f44a1089e7dca0f582ebb3db87811b2f649142b8864e79583dd83e98

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.doubleoffset

MD5 211403b0b5550ea7a02ea052244d45b7
SHA1 6093a79453c45926fe5e903b203fb352c96b04ce
SHA256 07e95a350df04dd2825a14b513e25b5b59690e33f1dea8f4bac0cbcc93f46abc
SHA512 bdb28a0091cb817fcb8649ae195e37cacbaf626eaf4fe9388fba4f2c1fb0e31831426f32809f70e9c1e0dc8d3c539a53c52b02dae71ba00c6c8fc068d1023c72

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 b4d8d47d4d73def98964e74f19331b91
SHA1 075efbb096d86671e38f0d8babe16ff5603820dc
SHA256 a08907289819b613fa9a688cd78a78c8c40768bdf6f1693d53cef5eeb4aa1035
SHA512 9a6feea44b457609fed219d7d50432fdadef5a6741ab8e2131facac980042581ab8de6b311d273fac09daa776bc31d0cefc4a4d15591e9b113c5ad0f7b3b337b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 68ce89afcc6b7c38cb61cdd48d8f3f05
SHA1 65178f1b43ef4843a00998661c6c7f04d1b3587e
SHA256 254a7515e6818276ab32d47817b874131b7bb46efd7b493c481540ef76611fa0
SHA512 56d45ca986e538b3dcf2805afa34dee97ce848ab796ef30bcac77e7516fc7cac831bbbc0e89d400e58db9a4ebdddca0411cfdcde8bc8a24cae4a2d554c375164

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.controlpanel.ui_5.5.0.165303.jar.doubleoffset

MD5 351f0e2de5ea800ba39d1aa3f097ed33
SHA1 14f82c337e16e784dcd54218595dc56f8efe1301
SHA256 42205e519b2cc608c894394ab51185e347f5a0af6bc84341deb2657b7ad8bbd5
SHA512 fd7b7853275aee522f0d76b059bee3306f23ed5edd89540f3389f0104754e59f8bb03a3f9e03196ad2ff50a6d7cd15ad49285de43dbd36f2f0a0896cce9a4b7c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.controlpanel.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 f41a11c1133190e9c76ac64f1c5cb790
SHA1 8f5ded9e3c77eab515abe0eccb9db2b859849fff
SHA256 231e3776e17755856879e8964b32febe0d3cd2328911812c99c25e4d2fa7ff4f
SHA512 202003fe77622ff664f676d17d6e9a9b2a2969f099983dcd32499967f58ca3d651f9d4f8894aaa820a3adfbf2b037c0228ba3992a5b77d5006122078effcbf1c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 0312677142b57eeb33b2fab5681cf8e9
SHA1 e184e39c8dfd772ccf5238c8839811f33a1f1c74
SHA256 e5aa017e53866dc3a5c433084cc886768ee97ba9554ff59c28c82e4ac4369a3e
SHA512 a955f5a71c4cffc2416d047cc8b29b1ff83c4823247f917243e32700064a78314e76476625878c91871e350f7c17ea942b7937ddcc6f176a765e90877248ce3c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar.doubleoffset

MD5 853c2ef6725df4626782223efb969945
SHA1 dc27c101fe1552f01314b70b99767f91d2991270
SHA256 433d9e5f31b1788942682642fb4ec20973d3f353b09e6f7d9c270470ab9b8573
SHA512 118965486439846e7f4fe4bd05173f6eb2f953606cc475a786c475ee7d22ef610827d3bb4e4d98d52a74f21540f52d6f06ed80f5f141312e4b7a8a6390461812

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.flightrecorder.configuration_5.5.0.165303.jar.doubleoffset

MD5 fa42d13c496c7cbfb416f0e30bbe34df
SHA1 6b6e61d74b18b4323368ab08ddbdb7d280ab62c1
SHA256 ff9ee395b976d0a3eda14e51442e0aec2f90cf5ebf3026f32025d4e3e61219ed
SHA512 066465507d7df99a11fb46eb21417bd180259727fa79899bf99e098e28dc8090817ce6159a9e4e882581e6e89057fb617adf5f16b7683fc2e54129ac80cddc47

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.docs_5.5.0.165303.jar.doubleoffset

MD5 1966f14b19ab76044112a409463bb7c4
SHA1 1b26dc359e774ab48499a483e8fb105389910641
SHA256 b7e0b191f1b148895106bbd4a51e45b5641945e3f40a54e6e4ec6bf90203850e
SHA512 642811c8ee022c68fc5bd5773e02554ad62b7bc62fbc171a494efbe15bbe4c36073b16155a93b2effc3ddc6fcbc97557072b86b5004ca64cf0d96471ec41ae4d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.docs.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 d87b7b9344b53930adfa9af77fd746fb
SHA1 a09117b6da600929cb809964f16643c72000726d
SHA256 8b02cd71f8b734fab1ae155c12c6f380ed50ce98e0d98332929ca42c78cc8817
SHA512 166c2c3ff000379ff0145df84245f6737505af4424eafd39e36eeaac4402bceb8aa220813802f5f7f97639aee3acb66008a18e5dbbd39cc4e515b5e71d7f55ca

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.docs.ja_5.5.0.165303.jar.doubleoffset

MD5 5e713468c985e008c12ce60d808c26a6
SHA1 dd27a7f2f7bfd61e19393232f0dd7b6d79dfaeeb
SHA256 68c74f1167e8c704a9aec85d55fdde9f38746d6861422c606c9645c634cad592
SHA512 419ce44be208056072266cc037d1021914554850ef0badfd221881b7b06dca33f06e3b83c0b0dd0b2a8d5a7fd5d87353200f982d64b3cd03804983a42c0b8796

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.core_5.5.0.165303.jar.doubleoffset

MD5 e45f596e7527c3f23bcef36417a9d6cf
SHA1 674530f3254a6a0bfe6ff95152edaf00006fffc2
SHA256 30b75d64542e660b823eff10c22899ee9aec76992a6bc5a056d87efb065118f8
SHA512 bd1831168637c89bd2e136c6e997db2191f95118861a28b5d190c2fd576f3a19066c6d0ca72f996039a59ea3686ac588f1ccbad4f8d9570bb75db2db07a9d03b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui_5.5.0.165303.jar.doubleoffset

MD5 1686ad10f1f212b266d484f16bc8eb21
SHA1 16ad2cf6407cdfc4723ec406e0c6fa364c295e66
SHA256 a15c40a1c37c7d8d38b9d8035c3917d25041853a60b51af06c805f14830d3cfb
SHA512 06565333a4e8e8cab1be83ab7a3e35a13c072df36e5f4f2eac8ecd5367dc46ad39392ce73a3f0d5cec4fbd59fa1692ffb3d447d58125733d37db5bd3c881ab52

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 aac2ad8c3dc197bbc709d31b42ec79bd
SHA1 4c645a246513a4e5bd7867887134cd6d2fad7d3b
SHA256 98bf720d645e0fc4694d42d0f49a0c2bbd176c5ae7a4653c078fb8303a437a63
SHA512 0ddbfffb84f4d9c004ef54199a0e9bd65eada221d6ce038e77d9d2c44f955248718e1d7771c1d0b853afbed609233a998b4c134ba50fa8fe8f6926f21864a827

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 e8a468d380be5496ba0b3a40e604c2d9
SHA1 8109bcca18ac69d5c0c166df8aa59b5d567916c5
SHA256 9a66ea216537e5538b351e22f1c77a5589f5dc716184bf17f17bae842b6f74d3
SHA512 63e6dbc99f9a7b8b40938f895e516c200c6fcd698f1501661804b4427a6ff2b5f424565a4b0af967c9cbd76e572057af492f8497c82fcdb4b387deb0bd56e1b2

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar.doubleoffset

MD5 73aa12c4d1bbade78ee43edfb6389fd6
SHA1 a7d5c17eb969374f3562df5966d1babdaaee5c09
SHA256 6a6e3b517571e9b33793c12d9673336c856d5a8f3f593eb00976c0ad61f6bf8a
SHA512 c30f8d320126d563fc589225e9f82e361ef1c8c8274a59d24f6b9a6be60753fb91d717a7189508cc35715faa3d57fb748d04e4ceafaf2dd53f86df6563f5e6c0

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.doubleoffset

MD5 981a0d56178275745beea773b5ea002d
SHA1 7adb2a0e76e4e25dce3de7ea269a94bdc3632275
SHA256 32fcb091b151da3e95a3ccecd2d432529544a8110bfc0dcfeb67732acc146705
SHA512 c04152823985c9a6e7ee4008b552b4b3ff290937188533c66c93be0aadfca61f4b86fd166b8d71fa29fb9e6063a892aab0f4526dccc9d2c8e963045a1ddaeba6

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 2f22a32b0d73deb48e8314e89fc05f2a
SHA1 2431dccc3a420aaac2fb643593831c81e82290c2
SHA256 c6b31cf2fa46278cb66ed24574a3d84031489afd44f5933c5d80a4fc66fd201d
SHA512 532da2ac3baf48d7112d4df62c08c094d98db15b0d8482062f081a6769e2a4576fd703a8a959609dd0310196cb6655fe96849ee9bba959bcac6091db0a9505ef

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.doubleoffset

MD5 668133730e966d1058e7ca4fe19f871e
SHA1 853e786eea7dceb1fab29dda327a4f9e3880e78c
SHA256 9fb342e9673caab02d448e595879d8fd17de23bfd91ce93b36130a7e50c3c88d
SHA512 59d12abef2c48b8e113af70773ca41080778bd55a6af35c672e88497c93b32e2237fa75358887befd27f91a1091b77cc9fab14282b2d5c6c143c919af4228f89

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 939191a7800d2af6500862a0a15fc78f
SHA1 63062ce2a638e2ea4f2c912f950dee3cbb59f31e
SHA256 c4b672ac2432780c85a3216844f6db0385c037fc6f6e2e356be1b27fb4ce9371
SHA512 918e2e61c0a1c2ec6b909ad704560eda740653dc67c3700b80a581741313924a4d4dd824aeec220cce65bc57045f03d0360e8c5dafdf586110132424c8a76a22

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar.doubleoffset

MD5 0043a7e2c82bf7664606d9565f421f81
SHA1 b449f13d566cf6b707f793f9d80a3dbfe3dbfbe1
SHA256 a8fc80d2dad750f51a721071fd3d771749940abff6ab023c105b2f6c4ddef1b1
SHA512 428237e60e711ded175e8ac6700249e018fc6893c2b1781df5a1db4ec5434023909190a747c5e4509fcf7d239b21f2996f8d6b4b673d929abcfcd7c3d8b5dd78

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.diagnostic.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 99eb29d9645428d64bb56fa25ec8039c
SHA1 15df8c84d8bb192dfd4d9e91d43eee1e912ca1c6
SHA256 a16931c082c19e2edfd9269e76046a394b7efeb87e73177d3778d29500ad95b8
SHA512 abc5147f4116a25c26b60a058b047dc2e3233370dd4d482a090005b43c5b23170762411389b54d4151fca6e7fb376d002af22898929ddb986d81441386f28a44

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.ui.diagnostic.ja_5.5.0.165303.jar.doubleoffset

MD5 69aea62a7c9ddff7f934f0f189509726
SHA1 ad025d2a4be9f016eadc5a56692658c15d4c1363
SHA256 a0b967dd61eadafcd711b2a34a6243d2354d7236e7350ffd319618eade4167eb
SHA512 8c6a50182b35f52e0cc27240f8cf58fba932e5719e764bd49030448e79e45d72ea63f4e5e55eb8b0b342505525195b6e169e007933f4f247c215be961d45adab

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.historicaldata_5.5.0.165303.jar.doubleoffset

MD5 472338f885939da7259544b7ef9dcdbb
SHA1 696ecc0d4173cd69796126249a057cf5123d8c03
SHA256 8e2e66ab61f02c4441151c90758aed5f4366ce0b7a0e07a8460eacc7b1c44d16
SHA512 024eadba35c9ce1318789979a52708709f54aedc5bb74467b8ab997c360673e404c8d10e68984c9aaad5f9adcab4df29035be99bce482d35afa7b433dea08042

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 282829154a4057fde41a460cff0aa595
SHA1 c65072e83a4168136cc67786fa800a4c5142bbac
SHA256 425a5e02756912a867e924ed8168af96db373156af75cecd24c92b15870152ea
SHA512 e6031d2af7d7adc1b84f16f485f44fad611328ac65e0a00c98dccbadc37d1420c6d642f5cdbed073088b368c56fad1eb03e2de0e33f4002d1267acb14bf4aee2

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.console.historicaldata.ja_5.5.0.165303.jar.doubleoffset

MD5 e9b10dfcb3eedb13293eac126b95e804
SHA1 d38aa473859ab0fef1315adcc6bc265457a9ae45
SHA256 ecc57ed3804b27150ac734ec4812ded6cbe5626e8863575c8a7254a6666534a7
SHA512 d1c1ca839d95bd39e424157279656068317d73b70c215b01d57001bead9730525a9f7eff69432b556728aed3a0d53d6833b9e957d83c93ad6fdb99b55d265e5f

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.components.ui_5.5.0.165303.jar.doubleoffset

MD5 14c21a2c09b4ea4197da24620b724aa2
SHA1 79d75f8d9cc795276ab09fbcabb16b1f2a31673a
SHA256 820a90598e0f2c6aff0d9d59ad8cc754b4bc298909939c75e064b1e955430cea
SHA512 4dafa80063ac256f1688346aeb8b8ac7657ea37fde761899b6b28a22e9d005ace9938bb469d4b5f780e4840f7864920d0495a579633d255fd4c33eea44b0f781

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.components.ui.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 75301bbcf19db89cce6c5a9fa91dd511
SHA1 4595075e1e6f9f79877e552349ea13458166191b
SHA256 53d6f974f1ef8dea762ae0dcfd8dd8b563146a9899d4e971d285e6ec8472a89d
SHA512 9b69901e1cf86984f3d352389ec5f5277df9ac57673bbcd1a69442097aebc36d691dd69cb5b0cf5f391fb3a608e9fc01ad31dc9f6df16c540728ca5f7a03c43b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.doubleoffset

MD5 99127c3fb4e67eff71806c8672d59ebe
SHA1 1ec4140c1c9bacee9666568c9aeb040a587cd305
SHA256 cdb2d646bc03074a54b65411779fa825613d4b6332c711abd1d856b12154366c
SHA512 94787a6990978749213b82f5d14abfa5df6eab26cc7c1a1717b445012fa8834002524eb0507c0a15452181ae531715e587f0bd594598e8b09993aadc160f40cf

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.common_5.5.0.165303.jar.doubleoffset

MD5 4a9169b5df0f0db990e3eaadd15dfd03
SHA1 bd27564383b53ad18d1c140dc074e4cd9f7fd5cd
SHA256 8fb9249c33b5bda081ca957b4edcc6b2b7e43c05ecffeb7dee83fa82ccb5ee88
SHA512 7fbd378eca759fddb87c7112a0f05ee823155df0a1fd591d354f77a889547eea2707e3e6b152c4f7490885cca097a5922c93af02ad6f43e3ed6c39635a63e445

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.commands_5.5.0.165303.jar.doubleoffset

MD5 bdc7bd905c93fb463f495676b45920a5
SHA1 6a1177547481e7ef5b1930f33e0b0152afff1572
SHA256 2075b1c65c3f64ed3764ff979897714a80f0df9a447a1a159596437f3b7b2dde
SHA512 93e4a0c28d6090759d8cffa6eb6623fff2661520cfeeca8fa5162b67d6a770634cef17b75013bc3e7b8ce844737b3bfbfe207755554795286ac4a244d163f6de

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser_5.5.0.165303.jar.doubleoffset

MD5 a5d4f8a9ae5c56c2da948a0581061a77
SHA1 9273a1e42a084af049ab881e85df2d3b601e3c0a
SHA256 61521eb8985ab5822f81d4154034999ccb6a30fbddd9dbc8a18fdb37816968bf
SHA512 9d4fcff5fbb89fadcbeab721305ba94d4e5a7fd62e7dcec37d4ccc19ed5c0473c9253b64bf413e1388a6509db78eb592967008da1092959146cad21d1be88972

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 5f626254f9d32c1988986fdf11350273
SHA1 765add34712286b38877243ca063934db0990777
SHA256 8d764a1ce3b5c67e42a79726b1de596666e47a435bda0488c49a4972b8f58d2b
SHA512 d932c8d4f9508e926ad19c87c8d7c4cda3bfdfbf0b24c9adb8514b7f14628a1beee91b36a1c7274663bb166cbb4b698dc7db642a977ceed2619c86e9c4db883d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.jdp_5.5.0.165303.jar.doubleoffset

MD5 69bd483106e8443baf4b860f2f552592
SHA1 33862f1cc8f6ae471b68040d3da9d72275c92fdb
SHA256 7b810887bf45a698e3ad7ff2811c79229f2c5b8274bd7a7373584ce3a023a720
SHA512 f277fd97c6c07f84e50af76b55ac4e896853cd9bc04468d6a37191c2b7026919adfa58b29e3ca3846b3f663ace249c073d985c46caac3cc9d59f8110d2dc48d7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com.jrockit.mc.browser.jdp.zh_CN_5.5.0.165303.jar.doubleoffset

MD5 b758324ab6cda02d33ad912ec8a780d4
SHA1 71d61098d1d622b2140554d3f8ebf552c1cd6e69
SHA256 1fed1aa65c7c06fffb88c677a5d622bec8482f0b0cd88ee740b8761e0198460e
SHA512 2360e3ad4aff1da77797035f9c9c613ca1a6fa111b0fbe9cbc4a66d3e38ca60830e407e98a577c4d6ef0bad183023d43c2ce5e12facfb851c864bc20fd2033b1

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-uisupport_zh_CN.jar.doubleoffset

MD5 c9c3ca4e1384534bf9b7097d6d6682c2
SHA1 afe2ab6c7b2b445c2fd68847116247703ff827ab
SHA256 0d300fd89ac3cd847446069696b2e1c7d93bebdf51b8194d63a75b2400edafd2
SHA512 9cbbadb9b6865af2094794b1f6cd610196fe910ac9ad4713b15a45e97a52e94877f5aa6075035742c33cd22944062fe2358120debf96dfdd1d258f4d8cd6affb

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-uisupport_ja.jar.doubleoffset

MD5 25759dcab077d80a6034a9b9103d6d81
SHA1 522523193c20df91bc75fd52fb3d9c269d794f52
SHA256 71c7057f4f091898e9c668a5805419a5e4e373d17739c6f8c04ff2a1af006f2b
SHA512 1e94c1d8a5fb4a151d8fa350e1908d9134725d65c91fd85a582a912461120ef575a9eb781dabcb5b2d65dfd70cafab3d94a831daa6859d5435cd3018661c8354

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-tools_zh_CN.jar.doubleoffset

MD5 a74da3e705948e08e06db2a7fb3bf576
SHA1 76de8bfdc612289c5a5266c44655ae6710b43e69
SHA256 38e6063dff237ed99c7a0bbf196798670a8ce01e321a9a9d33621bcda05a5fca
SHA512 364e440879393342d186227c4797002ae8158fcdfa42d451ac9106c66bc34186497fefeba3758dd04d380b4ad205d73b37acd37de44bf623e4e485f2b08fb090

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-tools_ja.jar.doubleoffset

MD5 a626cd7cdb6a8b0a83debefd11834e6f
SHA1 cb7b9cc6db1d03172450d5c446b37d356b557969
SHA256 3b6186726db987fe4c65e9d56d8b9099a205b2519befe42e46774a23c3b1324f
SHA512 4050a86f3ce5277da2467386a8a554d6dcfd0640cb64b4d00469a3d81ab80d83eedacb32da6af5253f1361a58390f14cf3e9b2d2e6d497609d6eb3c4000f70a0

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-threaddump_zh_CN.jar.doubleoffset

MD5 d66e75ddbd34ce9d0d08e6631c7b88ad
SHA1 ba14d858808e25f706b6aaea65857eed3a35a4a4
SHA256 fb488f5effc5729dfd0021662e5f443abf492a4bf0f511f5fe1acff392a5d240
SHA512 0bfea50b06cce1fa6c2b5b2aabf3f3fb02dae307c9a3e9fba4e8ba1aee22244d08ec4dd3be2300398f9e58ecb9a9a74841ec3dccdc60a7a5b3680756e1035f6e

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-threaddump_ja.jar.doubleoffset

MD5 67d01d21ef6e243ad6548251ff7eb2d3
SHA1 93538e98931fe173fd8610ed4c73973889438692
SHA256 ed923f47d284df76fde2024337ff71ed4fcfda556bd341af3e300de6b12340af
SHA512 0847340b17dac6ff58e0a4fcb8c1fa91e11709425a4c8c0519e8c71846a72f41257131da7ad0e18c5a44444c4aa9e75251aaf9edd2dc60eaea723f9b621223b8

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-sa_zh_CN.jar.doubleoffset

MD5 4f69f7f020cd5fe40e2339dd2634c8a0
SHA1 7da61c8debae16d1dfb2558439e3855ea2d60c8f
SHA256 9551aedc3d659389aaeb4f282607c08eae331a50d813a4a72ee90de14dedbf6f
SHA512 bdeb9772d947f0385f9d63c01b38f3e13075af91ba4404a574b58f38606ee074242a9ba8c6264f9afca764fce24cb4849f38c3d81530a755f47066e648712881

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-sa_ja.jar.doubleoffset

MD5 c67b5a8e890d3fde0663916b10bbcd71
SHA1 4aed787e8dc61e7df8a4ff0d3dcf636e5c623dc7
SHA256 a10a82a05daef04d98ab6212f42e912b3299882ef18030eeca6be917c49d4b25
SHA512 fd24663cc6fea99ca0fabc0fe85816317ee78349c12c5e2a2d83bba96f5e6e7b0f508b92a658852befc5aa658191259bbc7819a5c5cb2b82b02aa1350922a88a

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-sampler_zh_CN.jar.doubleoffset

MD5 cae6e2c19189811a495f54f71b71206f
SHA1 70eb98f42570144da7c4967ab1e1aec0ca7d3779
SHA256 09ba0707cd46e5c2c01444852a88ce4cf1971fc79c9ef386785eaf4822364eef
SHA512 802ce160f9e1c4cb8819ebec09585d53b3ff4e193053895b009287d200510c379d9c68b35c28c1571fbce77d55db1bbdbedc0d497b314bc7927ec96528f4b2fe

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-sampler_ja.jar.doubleoffset

MD5 90b03aa792090970d5253fbf16e21b73
SHA1 0cd7eb0c07b6f41d17fa5ae7a7aeee73c0ab24cd
SHA256 e52a96c513b8f19798341955473cd69fe07251369f65446c0ee69fb8a1c05cd3
SHA512 1102b90c26a523ee05fa7925e643b88360f443e81a43b14030c04aa4975a8adafe86cad92e36c02961d0c8d4c703a87e2224e575fcea5c8d54870630538f7c7b

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-profiling_zh_CN.jar.doubleoffset

MD5 c0b6f46eee24ea2068a1bfd7f0e406ee
SHA1 5f5b9a594017de938d843e91dc338bf80d45b585
SHA256 d1776fb33ef06f7ec119d2b080530e777f3b2adff67e8025aae13d0977842566
SHA512 cebd9665afd919950329fb24cd537f31e69ac17cb2350db30747c295dbaa1b8d2c9293794b457db0fe124ff1f30e6074b93c5cb411a5b1b83ae002e5bfba85dd

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-profiling_ja.jar.doubleoffset

MD5 7d7dc8519148c8e0de4846b1cd1c96d3
SHA1 3856a1a52dc86ae8f193fa045457d4726029f4b7
SHA256 df0087d9a690a15872dcc5529a9573d8fe5f7bd1545f196706044a2b06cbc0ae
SHA512 5d73854b2514fb8c8a5d6aea188784fdba4b808f420e86398ae6664cab027332a4bb4658b0b63fe71857fe38d43dfd07df01550cda01b1f1d6bbd8a7d411643b

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-profiler_zh_CN.jar.doubleoffset

MD5 93f1b118cac5f106d311207cdb1b84e6
SHA1 d5c407671cbdf00234d64cf194c6e6ffbff58ee6
SHA256 7d113cfdfa7553f6fcf006cd5626444e67705e2c49330d0871c2597a3390ea4b
SHA512 97d7a1b7f908088401a51f31676a5b03db8d665d25034606e1fcb01f53b96766eee7cdda81919c94d37607231fac2985011a5f2ce6197a7fe40efc7bc7260721

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-profiler_ja.jar.doubleoffset

MD5 ea18d43cabdf54f6757764b48dac9ba3
SHA1 83ba2885f1aea383e4a804a91c0ce670aeea31db
SHA256 37f8778f9320bc8ca62c374c036b95d1b7ce1489fcc58998e80f094fb4642391
SHA512 31f29cbe41aac48f2a184e1f429c7b579f6c46b5c4fa86050fccd06245c3a49acc15691ea06afd46f75d85aa1a4c9ed34bd5df1feac506c91c0cb63831bfbd00

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-modules-appui_zh_CN.jar.doubleoffset

MD5 e4b4875bf9076c70133864e5ced2a45c
SHA1 c6efaa504601720bae049ab4b279b3ea5c210b98
SHA256 e4b03aaf38bea7318d5ac0e7e9913aa9f08871cffcb14afd9f0b3a9706625142
SHA512 c10aa15f937d1165dab30180c3fb17486e7fed5c68c60872f629ee0386c1d72bee439b676e2996797f4e906ec3948f38d820967977b6c7695e57589565c17a28

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-modules-appui_ja.jar.doubleoffset

MD5 a4a4148dbcf8595626096fe385c8af04
SHA1 8d93aa1e03791801f1767a419801ba8d2e9963e5
SHA256 653b54e31a254414627bbc6af27fc6e87230e3459b9deca442617f07a9746780
SHA512 628dd7c38d355b6578ce66edab543059dec0eac14b938fade2c17e56fd34c1f22de44b75ba5ea45921361f7fcf3a8df8a031185050c68c7be490a5ffd274edd8

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-jvm_zh_CN.jar.doubleoffset

MD5 840b44565dccc4827b01ed2d84695a72
SHA1 fc580bff9975f2b4828cc203ee4d7ba5ffb3ac16
SHA256 4809506d6e26c0ff72c7774149d7ff1bfd1720806372f7e5d1b7a281a5a4bc6e
SHA512 0d3a3e6a0ff830891a87c4127b269c67ac8c3149aaf7461d4197733a106090e39e29c24b94173895c8ce7bbd86dc2b7fd21d396b1481b39b1c220f962131d886

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-jvm_ja.jar.doubleoffset

MD5 cc4725a8915be03b34fd5d47464a8989
SHA1 aa5f04887ab45830f7b075b569894a5ebaa795e7
SHA256 a255f827b28653da2dcfd85855ad8684ed453a9e728d1fd58a4beaca2f11c0ba
SHA512 685e5d3d21a5b85f2ffced4fc4536c6a4cf9d4c6753722aca37874b75934d00d5ca95a3eac4aff502fdd951fa04881a6d03df397c51de6ce4157395cb9a89877

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-jvmstat_zh_CN.jar.doubleoffset

MD5 316d0e421622f7dadaf3df9c43c484d1
SHA1 08ba7548c4ff8f09c02bba4eb65fc6b5928b0ac5
SHA256 e79e2c0a1749dc001ccbc8853e358235c6580f3e3eba4105916d85005343d991
SHA512 1af18818cfec768daf76c2dc45057ce21069bea14fad53bc8a243576c934375ab81e4482928fe8281f1a8fa22c83c94cd78da1dde6992e00c40f9f618bd944c4

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-jvmstat_ja.jar.doubleoffset

MD5 b2b038fbb737f379a6e490fcf03be5d5
SHA1 b508bb3ee954699b0d10599002931054c2eb2e4a
SHA256 f524833f2b6c14d7d7d23b85a5d9ab13a2ea0c1c7132b594d6617f51839a3a55
SHA512 93a8d10302190ca88fb6448e546575b3017ba47e62951dd18cb12998b3bb91128ae7f804a6f61632205b85b07ff86c3f7f404bb70d7b0037f4d558609ce408d9

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-jmx_zh_CN.jar.doubleoffset

MD5 8a486b34c8e4d96cb3dff1611ce8ecec
SHA1 eca9041c8cb7f343456703a13e379095243132b0
SHA256 83f0f6c4b4cdee7bb95af653d0bb47a5575999e4e1868961a320f4df4442d993
SHA512 b2c6d3acc9860a2d1431cf59b39bc4f8c19e10c029ae200eca1560afc20079f5b82e0687fc18f6db7984a1394de473906bdab358b888083db74bd20e0cd1bff6

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-jmx_ja.jar.doubleoffset

MD5 6dcb6555178a8ade2d72fdfae4eb3af8
SHA1 4241f646300c1acd4be989e3418fd8afc3ff4588
SHA256 3ba00d1be883ab065a46afd64feed244013805f0f094b485e686ebb4d69aa212
SHA512 f71da7981401b4ce9b2bf5da9d29ee5e9e64f82b57c349fbd6d8df9aa3a8138939e1c650eb836faa5fa66b538154857434cb5dbf00ec1214891834ea3dca9586

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-host_zh_CN.jar.doubleoffset

MD5 6edf3a5b455c9764ac0dd89b71923c07
SHA1 7739fcdf8d3e4a79d7541fa9718a05a88726d5dd
SHA256 771c5abda80246622dc3f1ed31183a5f259e96dce8aef9db71944df67becdfb5
SHA512 b3f7d91a9ea78b1f62c669855c9d8785f0e86fe69c39120cfc0f0a67222c1a978b985334c075f076066e4299a7be0f9457c78396e5279e61d314cce106b136ec

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-host_ja.jar.doubleoffset

MD5 4c70d2775d037c94521518041ddf3ea1
SHA1 f4d735ce8edca1b44ab59b0a9f7f8a4e2c1103b8
SHA256 4217bcbb57f16afc7de157e51da1669b077200fa62fe84b727b000d1d4548ed7
SHA512 493c59ea026ae915b8d1af7ccf3d44845348123053aed3090b7611ac704dce74f0134c2e12d7dd54c6816ccfbe568f8f376de68aee335a66be87c2301a8c319d

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-host-views_zh_CN.jar.doubleoffset

MD5 e5eb37e947880716b1e65870f28e3c73
SHA1 c62bf9d2c8f386fc0009cbb3fb1b978fd6e3a080
SHA256 5d0f6a95b0733cfea7d057387129df5b24c914fcf0c1076383a7198a99034569
SHA512 9b586461a5653c4a5976ae833e7c5c9b7172288cbf3a6ae41309df9daff06a202e8d9b7ff82cf1d4c9ee881afbacb33a346688339e7fce36468697c153f94340

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-host-views_ja.jar.doubleoffset

MD5 0eb2d5927e07422a69daef68b5a3a6f1
SHA1 bff719a7a7f9f3eefa0dc209937ad84d5ef3cfb4
SHA256 a4c7532911dcdc2b280dadf70931b51b54657430a2c69ae8a3d5464d4c435240
SHA512 efa4a7fe3138b57620ef378c0de92091fad30e17f6c5b4c2cf4f062c3a364ef244c304de8f5a68f15e75445db969bd30b1e77ad5ba75b79664ce70ca14906f6d

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-host-remote_zh_CN.jar.doubleoffset

MD5 d5f3cd6e20ea8f2ea3ee641f4a819924
SHA1 6506a189112d282df52d84083e61a7761a52cc58
SHA256 ad0706ec162a2921fbb740460db1c8ef4d38ebee6cdc0a26b226aca232f49bde
SHA512 040b6f54b6d66cc4613e8f7d6d3854556541145b79ddf0ac1eae0186e5a0dd6d91d6502d1030b218d23ac4eb571f23a18b88d288e193cbb61f8bbac10fee6aa2

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-host-remote_ja.jar.doubleoffset

MD5 2b02c62caabdb606fc457258edce11fc
SHA1 5fb3f1f02b2e14701b7ec58b4c258275b0ca1282
SHA256 1b44b2c1bf794f85e221d65727f927922e6d9769fe1ee991d24ed388b52b4914
SHA512 8720a0440a9354e0ef0b8bbc50f4573d251a3a516d849cfd129d5fb34e519e5bf388d6feddfad1fed4a40aa7a5badacebf733e775d2e6a0645c0ddb5e00d3ee6

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-heapdump_zh_CN.jar.doubleoffset

MD5 c639954f07aeefaac7799e5afe538abf
SHA1 989c22ff3871d6b0acf945738a618851882dc317
SHA256 fe84c3232c2d201574ebcab29424e3c39de2deb123409dcd464b5efcd22167ae
SHA512 d605b62f4f4739fbeacda71475ccf8fd3d810a65ae14dc8194fc35be4c5614eee4a34b5f17812d9016adc45cf984d5fb8ba673c14f4a59d91f2a5a7ced373774

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-heapdump_ja.jar.doubleoffset

MD5 78a7a5124f96ad040a614ccb8fad291e
SHA1 4ea1c661032fb1657534c30dc3368ec5d96bd4c7
SHA256 e609bbc9a2bb7c0f808b108df6bda27b62dce6fc214a046aeb367e1322caef72
SHA512 85121cf73486aa95139edf2c71a3fc299d39a2c892132b8972539842feaa0e9207737ee5fa66d18bb792310e79e42fa9a8036a61031cf23070a3f5de11c7709c

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-core_zh_CN.jar.doubleoffset

MD5 6d9182b473cddafc42cc8e98b40601f0
SHA1 23d5db9d962df1e7dd5fc7f12044725504fca75d
SHA256 c815817aff92a35bb23fe0dbbfc1c7b3a0ec3e7d5c258f105eeacd8c6f8c3c58
SHA512 5ee36406b0321aa24ef07cda515df2bf9c081a55c4343a09c3ea866d1f8a93c52174ed174d545d210f0064c6aad6512f650d056ba500bbaf50036ab3e71d050e

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-core_ja.jar.doubleoffset

MD5 8eb610ad1aec6678172dde670b9e65ce
SHA1 4217ab5c3e0420ce296e2a02471d435fa747e37f
SHA256 0f5b7d2d673def3adcd5a7daee5236458fda59e0f376591aad55dff0ddcc52c4
SHA512 4e20c9a26f916ddc9d5a8bedae8e87f0d7928001751bc6ad2647146154095c4d15209dd9e3fb3261f6a2e0be5b45b58b6fd848f50119bcd1e29f032cd3aa87e8

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-coredump_zh_CN.jar.doubleoffset

MD5 830a4c763ccce0e8f2cd3b0ec86edb25
SHA1 46acef5610397b7a5bb0979bacebe8ded10b8265
SHA256 51ad1a5fb0aa163772633d1138e72bf7b438dbf29b71b02989f25f692238cd1a
SHA512 7ff976d3a0969746c44a50ae74a5bab103bbb6061601959aba2d18b47b967ed4921c7e622222f48fa93d42b7e056ed242aa43d7ad1d2f6178cf5057b22c6a187

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-coredump_ja.jar.doubleoffset

MD5 5f3d3063d039c117fbbbb79514d0d72f
SHA1 2ea8c854d54fa4da2e6639dc1bd59ce7c8fec062
SHA256 717d5814addf16b3b67752d606d0a7c8d0d85c32f9bc1d8d42516bed8f095bf1
SHA512 b808dd6c84ab1e2ee84685d9b4d2f64c61bd7f4239477d28de8d3352303a6ffcac40891047ca2ec46f22d0c462f5d8b9c14de438d7dd63363eecef3d04d4bf88

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-charts_zh_CN.jar.doubleoffset

MD5 ce023f71949087c9b06cf8268485d8e5
SHA1 4bcd9518b3fc73165814b44b68740e38ea1e6977
SHA256 565c5c0b073cd53246a9a7f4806c786be1fa091442a6a77201c53079e182008b
SHA512 23d733030ceb54855bde5b8f02c466ab71362efa1de3fc07b7860b0e6b0d9c981745c156d6ff3602998af00070c840bb8eacb01c71a1a683a2e3b27cee27c7d7

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-charts_ja.jar.doubleoffset

MD5 c88e7dc6f148fc09f9cab2b05cc153b8
SHA1 3b8ea81f3fca5695e35a7ab6fc1944ee7ff3f741
SHA256 b40976a32efef3601dffd5487e4feac78a58e3c35b433c0849a38ec5dc825455
SHA512 2f54e6dd1542f9780035548780aac7b77e8e047cd49e72e8f795eff638b107534149ed6f00e01ab5a3a79dbc6bbfd03887dd3fefaac5222cd7bfcf31306561a7

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-attach_zh_CN.jar.doubleoffset

MD5 f1bd92f44f13c56d20473f3315649884
SHA1 b03dc5e04576d8abac063f7204ae8bc2f640dd35
SHA256 6366b804cc16fc6c3f15fb1bd83aa4f727c137d0b68343d6d65e63ed2fe1dad6
SHA512 236f3465d555ee024578e27349a29a2c83aec7fee13fd3fdfba4b36c493f92d242ee0e5baa159f789d0d30bca82d0e7ca1e023bb28ee6374061175077603a9a3

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-attach_ja.jar.doubleoffset

MD5 d84a980bd1727180b8b6889a65b2b959
SHA1 2378c664ac35900f4a4cf9c2082855c7fb27f9af
SHA256 e1d1d89ba7e6728ac8bc3dbfa1e35b4b7d6ebb866dbdcab538e28b54b642e7aa
SHA512 7883af0948f7870541cd4b7034c7ebddbaae79fafa972e9038cdd615ea1b0c9adc535776196078cf14d27a4883c605a7673e25cad5aa4f70a62eac069f3f56de

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-application_zh_CN.jar.doubleoffset

MD5 e15ba7906e5a51734c74d8c11c5d819f
SHA1 19351e9ecab74ecbd5eb06f51160672655f8b7e6
SHA256 f8771fa048c6dbcd45a66c4621f881f0d563cf68bd2be39ca361f1572e1d4c52
SHA512 c27d70075787f115dffdf7cb041adfbf8195eced18a17511f80c71db973a7c5b5f2bae5fbe510f477339b3299989c9e189f156b5a6a8847502b3fe2fb5cc66c3

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-application_ja.jar.doubleoffset

MD5 fce42306fe3fba6ba64e1555944f6272
SHA1 e8893f11d3886224addbc1a93fc4969b48b1acae
SHA256 5ab0344231dcd268a2167d77d3e17b09bb7fbb8ea644dde2a564168384cf243a
SHA512 5111aa4d65ccb4a4481590937b80e6fad02a788bb772731169bae23241c6c619546482f1ece99eba6f95b55a4c5a232bdfe9b52ce45e0090d8a05c80ebb57082

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-application-views_zh_CN.jar.doubleoffset

MD5 4394697d0dd39210034b6cbc6212ed20
SHA1 498e4adef9abfaa57c06bf67dd1fb75a31e93650
SHA256 c65f413c9e49736142e72e28c9520ca696a1c8c590b5743d39e8afe00535d5a2
SHA512 b47d4b35fdb22ed4c26a8cd7fd96e3839d3854f74d30c9bc9598727e9fc209947bfc3d97ce296ec86421a63263b68a6b22e1247a4f745b592a2210a4bb65d121

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-application-views_ja.jar.doubleoffset

MD5 5c020b06bd3c2b911c4f03613cb901eb
SHA1 03274053374f48ac3df8875744b0aaf40178d4be
SHA256 9649bac6251965e487154a8124f1ca450de53d931f8f59c9a0df9f053fca9ff5
SHA512 98bbc543f7c0c318e5d1ec9282b0bffeccf1c4a8873ea77e63d8e515c2e5db0d46e2a4b920306f0c8c1df4d53898e05639167d47ea1a0b927d73909cd230e424

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-api-caching_zh_CN.jar.doubleoffset

MD5 cd12565c15acab4dc9625898dc846070
SHA1 9f1c40d3dd039d43f1cd1de432e50a4961b141fa
SHA256 acbe6ccb83d812888ee452334f46e570c08184d4bb7ebb2b84177da9f326deb9
SHA512 d83dda36ac873c1e176d264d84b6e64904ac8a8008ef6a981bf3bf78397d724271b060318c5d3ce720b6a836c183a86333f7bdfdfece6c099857b46a13988f5d

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-com-sun-tools-visualvm-api-caching_ja.jar.doubleoffset

MD5 787594accbd1e9798e9d5bf9025892af
SHA1 6ec9d1cbe721fd7653f0ccdc030240495844dc5a
SHA256 4a650946ef92ffd403d67b73509166fb6209d91419dd39d5e297f31fd5e5e2a1
SHA512 8fbb01014bd1cb7c94229e7df86d93891e38126ab15357c672d61e4ae1be620324510890b4bcca6807cd71e3051a99ea185cfedb18d8fa5183f40468cebb21a0

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Adak.doubleoffset

MD5 fc199199ef3fd85c7251d2aab24085ac
SHA1 b65af2cca590402f180569831b67f6985e532015
SHA256 2e3086a5ceae46a62589e833eadb2deca9941a3ce68558184bb938b2d3472458
SHA512 9f26b64ae378c19985a2f46ac57d9c00fc47642395a17b3175088d6b10f167d7389950f1380432c3ea692f974afb7b85a79300439b93aa9e0f0f9f465366a856

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Anchorage.doubleoffset

MD5 5f7b7cdaf0b7bb197dc8c70375fb08c9
SHA1 9502566881eb38a31a2d19d7aaa77d21ce0a4b48
SHA256 f9c36280cbda13370161699851e9cbab99524e6b8eb85e32f83085b030429882
SHA512 85e5c2a0dc7bdea78ab03d34f1f547bf0097bde7e792bb30af12396228f67b7c4fa8c6f873603b0a73f0ac5bfa04464f420c1d053a9bda10f10e5e8fb2ad8cd8

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Antigua.doubleoffset

MD5 713b2654208d4bb9f716085bf221d74f
SHA1 be0f02c605e6fecfea940a0254bfc6fb471423c1
SHA256 10c175ff068eb986e8a8305dce8a373af58ed917429ea501cf279f416d704a2c
SHA512 85b3a8400f4e59505db745e94127335950768e99be1f195a97dafa0b939764e39d7d4b467ae656fea4a9bf188a181f7b738407b88f89bb1a644932cb21aecf09

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Araguaina.doubleoffset

MD5 c8efc96b882d818185da39be951d684c
SHA1 6105ea61c06b0361251200ab249fb1c41d5e4fbc
SHA256 7386dd84530c16c998c4406878a4f36e36df7317bdc519206c1a1223a971f15b
SHA512 872a15ad38d33d1023c06afa3d0c6e8f4edbf41c90c0b54ff2a03d60fc905b4d054fe7a82edd8731e2befccc603d47d7350317e71e1ea7b5a762554bd6124522

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Asuncion.doubleoffset

MD5 d97e38a46172026a4f6fb81babeac6ef
SHA1 9af0532042a1d335d32c6d47cf0250f5bf27e899
SHA256 22be29d0f0950bfd19f04ddcba6881623cf66ccf85c84089d94441c6ba336285
SHA512 7f0bd37b4aba6dff39fb4f8b3f57ede78151af99985e42d325df4af4916a0b128754b0942b5ac4cdcccb766900a3d63efa914014c3a793700586e8e1ea4a0fb4

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Atikokan.doubleoffset

MD5 4f377b6aabbd1aeae92fdfe2a0bbafa7
SHA1 cbbdb5eaa44cde45073885fdde9ea3d2c5ce4f11
SHA256 e3e72a6ddf02fbc58309c6dd43feead792d7202f768d8804ce9e79d792569999
SHA512 8f6ae360c14b80ebffbd4cb6b7f69d3c95adf060b296bfd3da3a93c547ad3a52960d8dcf2f5a0b243515bf78a94985f9c2b357c94d1f6afcb51fde4fdcb2e0db

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Bahia.doubleoffset

MD5 20bbfd1763f99bb8450e48eaaf76df70
SHA1 a67dce0ffb40f1224003eb051b2e34fc5368e7d8
SHA256 00966df279f024dae74946b4fc267b0a5b8b5d42cc26d02e224f2f0614aba4b5
SHA512 359580c60c394b796fd4f8de3588c363da5a9a0aecfb70810e964b930ef04650a0fdfc5270a1c7e2c2d018d64e31f7907e8bf2b5b9b9cca27276e9150bc8f93f

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Bahia_Banderas.doubleoffset

MD5 6ba6eed090d0ad0c69c9739432ad8b8a
SHA1 b4cf2d124ec2ccb7eef6d31602c6b130ee8ef0ea
SHA256 f4f8d13c2defcd32d0267f24c35a355dafb9c6a9329c20c8e6fee307fe90c4e3
SHA512 8b0ee2115cba598f3dddea9650419240a08ee675c39fc0a43f295ec9e748d0d9221b0074c05bb522a2459b272dab333bfdbe62442ff525a280843d4231aeb49d

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Barbados.doubleoffset

MD5 db847e101edc6340c2acf0a495d5ea0d
SHA1 29f45be256ec384eb4b7e31dd47d118b6dbdda96
SHA256 92c3bca70b3d7f97c7b2b5a865973f851ab5cc12f9a180b613684f80fbb29c59
SHA512 c24d38108597b24de2319b8b6ea4c415deda3502bf4ef44202709bbf2769665058fa2a75f4321643f39c3e189c2588c6845b2e37ef4e29a83d6ed89514bb739b

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Belem.doubleoffset

MD5 3c7372ae1cfdbabf2744980cf7bfdf9e
SHA1 21b81b05e964e3fadad86e1cf0e896532b781258
SHA256 7689895e79180eb96be1349e9f5da894c670a6ad5c5d683aee6849af67316702
SHA512 e15cf3646cb6946f03125e2236a0329a70869ffef25f76d330b2beace90cec18fd46cab36999f0e475c1ab790b919ad88a4aca5b42631ca61a47911316035152

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Belize.doubleoffset

MD5 d568251b4c9d672e043d0ff78742f087
SHA1 d2250c5aa8ef99a3465dfcd6cdb910c4b2b320d2
SHA256 413eca273255a53b148eeab69432893642a4eeab1890027713547ee82d9c37ba
SHA512 16b0a45875bd431ab07a4b2ea6c5c3c773a0f24cbfdc5a18f009d564b4698c3c4c974efaafc53b0c240ded2f87170333cfc93c33b927ee9da0e4597fc88daaa7

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Blanc-Sablon.doubleoffset

MD5 8c546514147c2cf2e2e794dfcf7d4897
SHA1 c34d95591b03b592dbdba7ee6f61dca625a08eb2
SHA256 cd918e0566d185c538830e447379db374864821e74097a506b1c05e759bbe5df
SHA512 fe0b6bdeccf83cc34c010913b36dc6ea9f5e54e13c76b98ee979a6d0fd537897df8f9103d50abb3166bc9ad6fb3b2bbdad57c61edb6f95c3d00a5d97caf92164

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Boa_Vista.doubleoffset

MD5 689f3c98e9820788b140801926f64ac4
SHA1 567c17009ec1b87152f97cfef33d7a076a524be9
SHA256 b527309e011bc5ea61dbb68ab10c802ebf3a80da77d017f3d5714b606b42e57a
SHA512 b7aaaeb570245f78961d8877586f059b9daa0323bcc843f84845e9cfd62b03972c9be4af13cd70cf37b6bc54cc07d079915c64d4a74d5da7cb792eb9b6f1aff0

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Bogota.doubleoffset

MD5 993f31d9e9bf2d9dbb766f496481486a
SHA1 f738682f7cbc65335607e5528e6bf40e33bdde20
SHA256 9052fe402215a0fce83e464b04357b5889306b5cee0ebaf20349a0c186448dca
SHA512 b3daa29705e6c4ce06273559548e48ed97371c7c57f1164ad403a01faa4568535c01d070ce44eaa39c92358d90bbb8561b536c3ce80597d2121998c285d8cf02

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Campo_Grande.doubleoffset

MD5 752eb72d64d0181a0cea91afaab5e007
SHA1 23ff3e512d0ebe084a22eb5caec0bf01a238445d
SHA256 83130dfd295e1e8b6d4981b077724f8f300b34692b15dba38dae3abf7f78930e
SHA512 e495320a5caeb3f3938f689f01bde4d8316e4817e9bda0f8e5c70c3b3a4ccf6a2c464c81b4ed4cec6c05d17851727dce34febae4eb4762e8185936265d553f30

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cayenne.doubleoffset

MD5 546d1d198c2dfffb9096000af1628df8
SHA1 f41a0142b76241afba0ac1f3e46d90c507a274ab
SHA256 de83b61c2f5540e6baef70af0181cdf31125058ed75fe86302562a58adf0f826
SHA512 f093a40bfd0addcf0cb0c48d4756d5b206f389fb80df368d067d9043dab3cf1920ca5e8943f956dcb64a4067f5386e64dbfa6c36d548a1ed0dd176dcd2018cc6

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Caracas.doubleoffset

MD5 46840b318096b357e167778bcfe51171
SHA1 aa450fa0738d4221f86fa444507a66d685976ade
SHA256 c6c60e9f4d4297e9bf815950e82f9c9d51b9e397f40c8483df9081774b8ed8e5
SHA512 93712c4039829a14a9f5216e6071c083b7023a69142c77191870555a693a7c638add3273379a35a8341898ac34c676373c5d9d974c181e82f28c91bee272cf59

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-El_Salvador.doubleoffset

MD5 54d37c7a429aa960c5273a1213077154
SHA1 042fcda22bfdaf0bc1822d6ddc51fd59cd1a3398
SHA256 b9fcfc261806c91c67b9c26993d4edc87712250c505f01af627550876ec9571c
SHA512 a300f8bb4b62f2d36eb601cce2f3fd8abcc97b6cd61fb79ce27ea657723a82794d6b5e641ec1b37b90fcb9f5e0f39a2a2997bb91ac40434e42f52ea3bd322ad4

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Eirunepe.doubleoffset

MD5 1c245de2d94a35c6646216a25392d2f4
SHA1 278507b6d69852cad292e26bd018a9a5058e81bc
SHA256 ec493414e59179c2516e02a72ac252063499b8f77bfddb4e7c07dcc7cd5f29b1
SHA512 dc17787f25122ef1960e547207128feedfc5663cef44623dbf6a04e27d0188b9f72c51c790cdf2e8b5f6f3226edb1397d57c7a54e541726e4810a67bd70cda99

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Edmonton.doubleoffset

MD5 76fbbbaccaddb54966c5fa07486fd991
SHA1 6d36eaf560224fb032f85f90f74bd678b7ae04cf
SHA256 08f6cb3de3c616aa1160de6ddf7fe91d0c826afa93d9998f501c91e0f1653001
SHA512 1973855e51341de412e032fbbba8f442d29b14cd3a025633d553044084809aa2648e9cf1dc3761e8bf3e050faed321aaf7ab4543505f8856e14bcf5d69dc74ff

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Detroit.doubleoffset

MD5 3bb56bbd861f21aec089876392797742
SHA1 727589b912a0907949c479050186c52897c9c425
SHA256 592909c198be2499c7fa41b36857191f9c9d01e4add601232f7fc192f3cce4f6
SHA512 5e08293902b8dafab23a58582cfa0b7226ac290f977e8d00d7145114d7fda4696b4b044b7db6e1669b7b1e34a624ce97f4e8f12490f4dae58691ec52bfd1bf41

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Denver.doubleoffset

MD5 b8d7f6cb26a4a2a3bfade092ea2c3d5e
SHA1 670c73402604848844e4ae607e3cebf902e79417
SHA256 dcac3648d34ad5cee930c03c2dc1705195a61ce2eebde7d6792936954a46403f
SHA512 156d479b84f4002cbfe02be78714aa890b8f870d4221cf9366f4e7242313cba6e3207e700a2fc85e77c807e213abd3f25bbaccc4c93d064fc0340bfea74acf2c

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Dawson_Creek.doubleoffset

MD5 303cfa5ca080e91c32a4b136d3de4a70
SHA1 099c4804834f1d01d8711d30426251b9a409c4a2
SHA256 9ac14f7ff8f679ac24de5260bd1d3dec75ae9b8130133662d231fc78f51855c9
SHA512 aaff660706e77d0dc291a7750a7adfe3ac3092a367b8b75738df5e221225b17f52e5d9bfc9432f2ef462d9cf12bb919c67f767c5737faf24460192680a8965d9

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Dawson.doubleoffset

MD5 4379a903beb6f44aa53a3374b18476ba
SHA1 cf95808c2a39eebbae218225f06f3731cefb2cab
SHA256 3225f9b8becbdeac7e84b98b8a6c64b8c35486918b4bfb58bec270a35cbcf039
SHA512 eab59665a9989c14a6c19459c5e879294b539e8b9859492830c36742725f33e02e901a12e45bdf4b678c0721e822374e7099fffd1be7969640cc095fcf4cd34b

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Danmarkshavn.doubleoffset

MD5 359a1bba9abf51fb67480f13e5515f10
SHA1 c72e21d48226bc3b60252e4ddbe257a64ffd70bd
SHA256 b3b8e6e83ef47971e88ff7c8b07dce1a7571b1992761d11d0db9ff00766d89b5
SHA512 efd912d530a9db06bdc9a71f8a78f81905fe31c019d2b35bec8c4ea89364b7543ffc24290a0d3c7f8878e27bfc70a24e8cf4a335332172ccf5e3f5675b5bc794

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Curacao.doubleoffset

MD5 841160de557a7b936116d8eeda0e12dc
SHA1 b47e9d1a901df5e81afebaaf8f01807bee2b5159
SHA256 14d6c00f4d4a396650bedd28feb9b91b7fbcb0b48cdc0f638c3fe43268b5bd2f
SHA512 314f748e00c88866f7d81d0ec3a1875476901a4dc8ff63d72e7bb7e36d785e9e05f16522d5851ee270981767925655814f24c77fa50f9a24444c3db93acc623c

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cuiaba.doubleoffset

MD5 7ad5ba48c0b1d0f83d0e6e6d088af612
SHA1 bdd23c3d096483a74512df33e24c0fd872d7d0ec
SHA256 e03fc72d01bbc358a94ba15281c6d7b1de97fe1abe194c9276ef308575231ec7
SHA512 081d99f832ebe5696cfc69ded1f3dd04556e3a74313e63bd6a3b6ac5be24d4af0022a45a1f7c361bb8e47163aa5cf033b1744fb492d3bd2a69b08d43141252cf

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Creston.doubleoffset

MD5 b898eb2b73b1a7f19a18cf7eae5d1e5d
SHA1 0a2e0a47459e408a75f8a72bf8e79b056a4e9dbd
SHA256 b68909edc585ec3ad3487cdd83c0cef96fd99aeedb0a4a79de0a47e488dc64cc
SHA512 5200b9dd092cf94d6f8946e35c675723df41a66ad2485c45e965d4264c13513d6502e24d10903fc06e19b5a0e4376032802b4c0ede574ff953b93f199b6fea77

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Costa_Rica.doubleoffset

MD5 1c188d6b8b6be9e2d90b6080618e928f
SHA1 840314c4c723f4f7f5e491ac5af07b5e4c2ec396
SHA256 c902993af5dbf6a72dfa7e569e9c92d46c40c322b3710fd2bdfd417c14918641
SHA512 03ad44ca84c887ef451fbffea9ac8a6fdf535b6e08d8c3f852ed6dc71b251b480308baca3c99bbb61ba4db12530782951b7af45f7283d97203b1f9ea5056f542

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Chihuahua.doubleoffset

MD5 98385d50439091cd75646067e974f562
SHA1 cc45e94685681d6e2abc4d66e46bb168cfbb0c1c
SHA256 07a51a0354f4f1928304576580eaff786575ab440a6b8d01c8557557915e848b
SHA512 c4520f0d6b32fcf6c106ff5a52788aea5d4a5e07f3d8191c7be5d5fc416261de433f67a67d7132137fdd31f93b990ff5b9ee830ca7a452c3d05d7c2a144c1764

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Chicago.doubleoffset

MD5 8ea846b3debc19f0e65ee10847904469
SHA1 71a7c83c68a292a21dbf598da2f67f1279fc2f36
SHA256 245c31058b528341330b09e5ae1fa71402e3a897add35ec4ace28b11cc85a705
SHA512 8d49a8705198c5a12e3ac11b21c2b67c3d59a972b4110586ea8e0d20db9223f4f6b5ba5d39e1514cb46c7a1f0ce2afe1780a20efff73a9255424aeca7acfae33

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cayman.doubleoffset

MD5 cf7a3ef61967994a40d34150c38082bf
SHA1 202dc19353ec0dbd3cccea8ddc127234d8680d5d
SHA256 1369b8e57988f855ef5486d3399e55adff123e4fa16f1ab8ead7f4c68eaa33c6
SHA512 2034b591608391756b99b47ee45c69297db2ef46cc9ac46f75e0677272e13a4dcb3c45293cece33d72a4fa1f83201a72c8857ae16c2abf81cedc16fa17c9126f

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cancun.doubleoffset

MD5 5745075679d1acd29eef993fe6f45d1d
SHA1 b18264713f11db5541d9f78a32b97e13ac1eb95b
SHA256 71deec4537443162514e74f3a499fec1a982119450a8088b67d23955ae93feed
SHA512 bf5a6a5894df53785dbefe9517bddc03aa803e78c59635faf30e9ffbb5300863c5877a36a8bb76669534a83efb0bb117729d58f225e08c62a784a439cbdc1c88

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Cambridge_Bay.doubleoffset

MD5 1135895879ce322a4eb93e2fb5d26d5f
SHA1 7d0fcfd43fd7309916d82ffe875016e5e2d6d192
SHA256 ebc4199e31b0d544e6ec5ecb6d933f4460d82f5dd55c6da4710dff5832a93c3f
SHA512 8503a4f2adcf5296d90a230f31be22a37cd87c848677c1b3abacf717d87093d9ef203f1c955b18ac2bf482d7c619faa5cd72710633ce9412100b12e47d18fc88

C:\Program Files\Java\jre7\lib\zi\America\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Boise.doubleoffset

MD5 c2888a54f5c3897ccf32b6e267950818
SHA1 08cff58c412c669a5704e68c81384db518597924
SHA256 861a6d5d446c30f1ed234c747c61e9342fd37ff9ec953082e9f29087a85ade41
SHA512 57b022b5ec6004de2e6e45db45872c6014bab1720ea744206ebd2f9faee466bc99587d19505d00d7e9174c89bd01c711d1eb7c35bada84f00b811139766e9235

C:\Program Files\Mozilla Firefox\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Accessible.tlb.doubleoffset

MD5 08c93d54a394c66cd240477fa80d0df3
SHA1 c8747edc1cadc321fe7e6cbff7969a8823ef0390
SHA256 b6972c7540d223b0580d184e5115b39a9060b2c00834934778010e1e81d441c3
SHA512 d6ea50b342d173ceea147728352f9ae922008411d08e6b3258358f0b1e814b65eb736c51672656c8c5ccde5714c03d9443187d1da80fa025dd49ce2f9d7e48ee

C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo

MD5 e85b15430409ca24db511ec40372ebb9
SHA1 4a0ee5a0fec3a12d12a9c8cebfa5791a94698a0a
SHA256 282988e590c96ff4cfa0f3f14c10e0e6644521bcbb914d4776c467556b93f82c
SHA512 e3782e645cee3e07b5843e794b2092a1c24cbb025e6e011b4c5ef3287609e13647bde4de7b736f7f199015edf67b7e707517e691e17899b029aa365b4b464f3c

C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo

MD5 7dd884937431883b9bd0ae3ad5045eb3
SHA1 552b558f85459b56253668222ce5787e826b4b7a
SHA256 ac50cdfaeeed873eda44a7c95ee8d23278035b2bcad2e88fa0002a6c198de2e5
SHA512 5046c8ac6fddf97ab046b4e67532ab7a6144a4e2b7501f4e9dcec1f736f9fb7a68c39cc4dfb4e9f80c8890635f5c7b2df59ae8a419f8f3255ff3cc5c7331ac30

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt

MD5 ba4af26ebfb9cb631d2d43fd0b965403
SHA1 a74097c26e521c04b95d70afd8a0bcf97ecd7d51
SHA256 69c66020d096bc8d31906fadfffe31bbf99f179d389b82f1f9853834be2fea34
SHA512 c22a8539206715799374522389846bcb9d1834f5ee9072cf16740bce828daee8c9c465057169db1d236b8c2f92038a081466dd47191ff99414d511c01d8b5ac1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ED00184_.WMF.doubleoffset

MD5 83cb592aec7e166eb09dc81940d685c9
SHA1 25348f23dc6db32070641ae198494ce94eba050a
SHA256 d356ee330cecc632969431723e6830b7c7446ee09dce5b32478eb683bb326a2c
SHA512 1aead65153f6cf7955596ec2eb29e76f31b867f7373f26a771ad5947e4e37e72b7e0e9dedb03fbcbc665b9403d39b169477066729b345f568ace9349c464a4d5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ED00172_.WMF.doubleoffset

MD5 b695f6f8ddaee7bf53b082d151c03879
SHA1 d8e326997bd6442c4b17a0640c4d573f2827671c
SHA256 d5e8101c758e03c44a32f12217f08f1d40f883d0323eaf8fa6dffdb56f089dbb
SHA512 72c9e8ada1ae715eb6ec810f35641228f06b0bfde3c362e1c3ab8ffb27288046ada48589f2b20b20c2bced41a8cc402491e7ed76c8e46ccae5bfb96f00ccf6e4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ED00019_.WMF.doubleoffset

MD5 897f54f06fb6bd6740e73067087b3613
SHA1 81f87f90788aaefb4b25eb7f1ec3cd5ec3e8eb58
SHA256 d87a459669f9caa17cb9536bb4cb1432e722ddda97e7959282a07214c3438922
SHA512 e25e81eec9b9d8628e0b61a3456a282d69c4a24fb86d1f5b3dc9b1d71469ccdec8faddceeb47fd1e07f07dfc8ee794dedc421d64511c1b49790edc19c1fa55d4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ED00010_.WMF.doubleoffset

MD5 60bb0919b07cdada03ff5cdb78759bd7
SHA1 372e142cc8b62520ba8169b3fc9eca18089a72d5
SHA256 fa7b8b79438032c26bee6656b34f220a01e4e0699a1477eee3ba7fd8afb8c8e6
SHA512 6bc6ea023646cf75ecdc02a5e69c46c1329970eb7e162e7b9e2a61b40cc59a46994757ef27803746d99f68138c89eb5ccaa7a13c88d444feba9028d20479a4f8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-EAST_01.MID.doubleoffset

MD5 1386d2a7c62a7aceb884d470266047c9
SHA1 f5d908f4ad414845f499c6163cc5c27a1426879d
SHA256 82347f3e68e99b420932eb5330c3e61b306a75df39421d882a311f81a26c5f41
SHA512 6347ad7d6cda292e68ff2c61daf2134f3098e62daa82373a0fbd0965a063fa7a13cffb7da07fa46c2184d95deaf5ab3f7f26ad9e5fb6fc09e2bc96a3a0447c03

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01793_.WMF.doubleoffset

MD5 4d818d0809b8cd83c83874da643d57a4
SHA1 852b2b77d723885063dd992b274d799c4078ebaf
SHA256 3a5084764128f83a7f714870993bfbd2c4ec108cb17d867c7a99bc22fb26244d
SHA512 6c9c152039bb77bfba6c41c56b694663ddf13b6eeb9f9fb0745c581acef7a44ecaf14ea87bcd3cee41f15b14456dfefa764440bdc35f673822f4e8c9c56bbc55

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00135_.GIF.doubleoffset

MD5 df9f23194504cbf8bf8f101e29f555cd
SHA1 485d3ebbd85db14aaf527df12507a1d39e3a935e
SHA256 5623cf274a9809f5347f6b0a947344b16ee59645d3c2fb1e4d8bb6c18f5da60c
SHA512 98a8584c75480fa868a3b091d44cb798f6c74d53bee7d295dd8332b48a5d699e412c3cfc153504f92a5ef6655dabc4743582e631176e096ac6d489d473373710

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01772_.WMF.doubleoffset

MD5 1c9a14edd932cf2e52ceebfe4f8df73c
SHA1 e9da2dc8a53ae8ca01f2e99861adedea56467edb
SHA256 881bfae14b4a0acbceef91d7dce3a7c7ac5237145e823fe04ce9f0aeeba907ce
SHA512 fbbdd0e50e8667d959ec81c75761ecb08a13d8ad2c7c4e2d077982a72b66f4114b37d6a27e9c52825a98ce0f74c703460d8f46e9ea9e8a76b1928139c47b2fd7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01761_.WMF.doubleoffset

MD5 ca5541c3e95db69e83fd113926217ef9
SHA1 806226c4e92f0a9e5827c595da7d89631f56361b
SHA256 2ff0429c783622e4dcd3faa799238f99a824d65f9d0f89c17132786de94839a1
SHA512 1e4058db8e3501e76cde367764624adeb005c97a38461504fcd60dec67bde475f22ea19b7c8317566f8b03cd755a8254926225df4f075dddda5a3f1ca87020e3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01631_.WMF.doubleoffset

MD5 f7e8b16b8618c3df7b147b1e43e9beea
SHA1 69d500467b0de8e819ca6c12ce06dd9c81c5b1c8
SHA256 986e0c8118752b60532e968d620ea42dd47e0132390e7f716efdd3a2760e8e4c
SHA512 1d04745ee6d33a3ac7a8d63452882fb5bf88cd1d7bbd6dd58b5ce62a74139dd336cbc0eccee5df8edb115954cab4705c2328858b27cdd99738afaae812182640

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01630_.WMF.doubleoffset

MD5 ec8179f9dfd740dc9cfaca008607b11a
SHA1 86cc18a63fcaea5d8e4f21e2cadd4e969fe86f95
SHA256 dda3ee7f74ff9f0e3b7878424b4b719ae44e1c01fb3c2425241554e8fbd5ae3f
SHA512 4a3123c5cdc7180e7077d6f3443a8dff2d3e1eceabd8e74499c53a61f5fef2cb6af4f357d0ee460ac53dc4343105bf4bc10abe48115b1bc14a4a8c855c1016b5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01629_.WMF.doubleoffset

MD5 c19e63b0387d8531ec9c6704e1009742
SHA1 3ca44d7703a739f4021e4cda7064d58d11a9d207
SHA256 25dcd3217cf26e5e766e7533eef7a7c51b8ff4edb3e09eaa59a97ad9c859ff83
SHA512 5973a4cb0a23c17d72228186f5e139761a8ff779820a6fbd168e15fc3a12359327b3f590ceec736f4340f1648fdd0cfc3d95685e317ecb084ce33f3e9fe70a22

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01628_.WMF.doubleoffset

MD5 1be114a5499bf5c4cc54c9c5c12d18bc
SHA1 3d075344f340442eb4d05c26601411e6207e5b48
SHA256 7773bf111dc0cd24e31f13d7c69074681abcdf89763efda0b3b68ca6b07c45a0
SHA512 043029dc968d7a2c35ca0fc926f110d3d647c7df6a1dc65c215693955d052c2a7bebd831f11130ef30b4abbbfa5c8740cf4f444a779408ceddbafc9a683e651b

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01586_.WMF.doubleoffset

MD5 60c98bf0c8ca6499459df6e4db5d2bfe
SHA1 84f33cd3a1f9fcfc7a8a5dd80a58fea388e344b5
SHA256 78b2fbb1d52e22ef1d0e00fb36e49e0d1c1bbdda6d02bbb6e15e521f10948570
SHA512 4d03b3fd5f681d22057e2dfd4033890e520ab8ecf454ad1e68a21c60ce482f02b63244293ff5179bdbfeaecb0b59356969dc5b1f0c6ebb2a907c048d155a9e90

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01585_.WMF.doubleoffset

MD5 16e665100075bf5bdc59c1c92ceaf6bb
SHA1 fa3ac3feb2eb44a72f27dcae26059902851e7e29
SHA256 ef4076b131af8911aca1c87f0d521f76b80da5f664e72e46e6d8de80460dbbce
SHA512 f50a6535b0fd9d5aa4c77aad00cfaa530b67a9f9f77b8df08f14fad65e8f1e3793f45e958890f0fd98dd201a254db7c1cee7c38f495a7daa012514206e13fbbd

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01434_.WMF.doubleoffset

MD5 e527a0fcbe5a8a7df1655332ac6807e4
SHA1 b0b02d3b89a94d59375442c94631b0b29d3e6d59
SHA256 3572cfd02b60265c0a5924db309486fe950aed5e69a686b2f0835c31eff156f0
SHA512 7568dd2e132561ce3dd6821f617878ad6393c653544fbf16f145036a9d4c8e743bc007aaafd8c13e098818c8bdf6b286db43add50d007eee9cc9db50790edb22

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01366_.WMF.doubleoffset

MD5 883be4d4b1f2456f21449b21315b3f57
SHA1 19a88fef1a5a0df3450d43a676758aef41bc4206
SHA256 c02f04e0846622adeac544035fc44ea142810e3dadebc950d3e3ad64effd1415
SHA512 0c5e93a52651e5893f75071eca0951c3e899ff74f76209e418efab39fbf917bba8718728892bfc334aff49611af7c7b396010629b7cc854df8a84d07ab3dea66

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01186_.WMF.doubleoffset

MD5 c55af72b9c79ad0f150268f81028f749
SHA1 8366c4c37c6b2c1ea76f644125330b1e2d98b304
SHA256 645bd75c3b60d03c4f915ca7a508579120528530ac8a8ba34b4bacc923644c0d
SHA512 4652d230a80d36207b4b3718c4d864fc006f4238fc3df1fc21bc98270aec322728f46f8df2936fa9803f0bc778d85619683c5a933aaaa17842bb0100958199ca

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01183_.WMF.doubleoffset

MD5 bfdfbf48c2a673da184a09b1d3e50dc4
SHA1 4df359696da4bc32b343bbb7c2d67ceb809f2a7e
SHA256 2df7848ecee1c449971c033b48cd606d78bcd3e7d0303334aa6892b394571d8b
SHA512 fe6c1fcd9a0d141efe6fd91bb91c9f8af5718204adf706ebd2aae53b9243f0533bcdeaa9a67d60f393ab9369258c2f372e54795e871b0a6c325d05e04f870781

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01182_.WMF.doubleoffset

MD5 7b4f61b9025342312b9259113583966f
SHA1 735fee77308eb50a0161b18113268033dcd0ea39
SHA256 c36a01c6615a7ba0c432633db5ebf74a1c2b42159a035d88946403992b0b3796
SHA512 a43f68500b0808782a33453a201c8a8559a63c3bc74e34d9cfb71ddf9090ff7fb2275358dc178c93d4740cac225a2f534deef169c3d21a6ff4aec75b2a36adac

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01181_.WMF.doubleoffset

MD5 44877c85b6aaf9b5a59a9db878a96eab
SHA1 9fe275e9178a9fb973e4b00cdd4aeede156f5ae3
SHA256 2796294a9e82ea482920cce604e16e2c95549dd7a9f8429886daf98fe0575096
SHA512 56603ab3704170a9764472c896680f95333b95eda02a0b2fd304ea794c9bfb326844480a917786e4935cc940ca59dd003193a50bee6edb3fa8e18bb8d85185f7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01180_.WMF.doubleoffset

MD5 c47446c40a68cb84989e161b6b5187f9
SHA1 b792521b973812ad813e95882702868f2774c853
SHA256 cb4ff5711bc1e08f4ffa55899aee96814f5e577d578b47736b58e9a966644971
SHA512 f1006fb426ade63bd5a3b4bbb7c65f1bc7d6c92df4253aca82bc4275835c9fa0b6fb41080f472d1741c6d9514f89c804d2c483f885ffe275264b7b0199ee32f1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01179_.WMF.doubleoffset

MD5 173f88889768495c9df787dc9d11712f
SHA1 47f0bc9150b0ff7859770b084dd0db733759b20a
SHA256 26e6fab5887e01bdf52ec9b34b8ab06288bd64625b83129b42b442467f710164
SHA512 8681d48cc54468ba2dfad152d47bdf9a9d154c8df049b2380a474206cbe17095c78687208fc78dcd51b2e897b71863442a50adf78d84b2e116c843172d34339a

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01178_.WMF.doubleoffset

MD5 a1c8d5727fb8ea92a575ccf1439169a6
SHA1 7e7f43b86cfd438f2a933fd4bbfe9cd5361279d2
SHA256 6f7a881df073f5f1ba4519504aa1a2fea1058a6a0a2e95c3add0f253c7ee6a5b
SHA512 74812a860dcd84a904adf6b22d1839f28f3a83ad0d9cd42c31229c5e794b1068d8429a5560ea747a7797218392624b0fa5a853c564d1ecb4c0cb11d5684dfb5d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01176_.WMF.doubleoffset

MD5 c98f1b1b2c98bd0ad641268bb0789f69
SHA1 cf042157a9a746c63bc44951fd5df2b9ca1bab1a
SHA256 9eb5365a98cd3b51f476ab76be31b92eb48974f1e9c0c4ec09bdfa7f5ae90da4
SHA512 028ae04c30b23dcd216c3676573913c9ac8c5f0f64e19e6621f3316eb77be88fef59e6cef7760a59e587003c6b7c2067012cff923de16c6037e035923ca2998e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01173_.WMF.doubleoffset

MD5 7d81f932e32ecb20983b04409aad5439
SHA1 f805473d7bb15ebc6678a843b0dfbe8a4b09ac13
SHA256 af34b6ac2d36fe7da9816ffbbf60182b15a7d5734ceafdd32ab272476f6f9090
SHA512 cafa6f3b0756c82d5931d064c74be3c67dff3d323f95270f7a265e3107e6c640ec4279a3529a2400dcdb02c52c5340ce9218d63669912bba4c43022dc67cc16e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01172_.WMF.doubleoffset

MD5 9e723ca003c8a4873dad905ec8eefe91
SHA1 b79568ae145808013577e9fc687b706050b54464
SHA256 aa0ad690a279638902d34d97b42b67bb898943a486022ff9c8909cd5b7e0510c
SHA512 151c154233cc32286497e7caeb9e2f80b1491c43494afabeab4cf2fee8ac5dd7a73fa3915348043e5c17b4d8393cd347f09ba7e8dd6a5bccdeefbca6303cbab9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01171_.WMF.doubleoffset

MD5 14a682f744a6fe523549dea4f6f9c884
SHA1 fa948ec3671ff131187c3802eb4946010add0002
SHA256 5add0ee8e25b1be15338681606fe65c31ff0f997b9ed454b4957c9434403c9b1
SHA512 3eebdd96f56e20cf7c4347b22b49aa4aa173857ab6c3bd98601dd472afe420c6233b5914a85c219ff93d8241fd56c85b71af85ca01bb2643355914b102073e65

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01170_.WMF.doubleoffset

MD5 e95fa5cc972275dda45317f8d49d3f59
SHA1 5bcd64881d7a64532985199823568227675e27a5
SHA256 1d5ed9ce0d204a48a70feb5f47c6b7d98a71923194b59b23adc5042372b28aac
SHA512 4a1aaa8da34b68c563ebac6a918d41e9c50302ce2bf1b6ada8442a34bea801431a8b43d4e433d680a1f7c57658a9e468433c73b4201238d26527350d2db311e6

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01169_.WMF.doubleoffset

MD5 8a9a0f9407f1083d5815157b6693ad73
SHA1 4285159c5e7766d724a2b0ea3d3cf64b1b670e73
SHA256 16eacd3c25b12eba9924ec2492c19b0b3b8eb57fafdff327f7713fd5a3ed8fda
SHA512 ca837ac7b5fdabb347421b5e3e242d6bc8e996feb9da6b6546242a49751374b32874e92871290dff633233e8709cfe6baf4af9a86327188982e8729ea4c6f7d4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01168_.WMF.doubleoffset

MD5 4ae61d22d5a5c2508f01eded892dd6f8
SHA1 314c1d7433c270d3b429f34358b334d2924640db
SHA256 298c8b4ad006303c6c33774f3e335c6dc80f7792aa63a58bda86268bc0d6af62
SHA512 1bbdbef0e68a4e069e6452ee1aeae288fc8148db0b9c16506388e3dafe2082fa5d4b05c118e3591ce347ee8cb286e5c149001c1b3111fb40ded1cf537f0ef438

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01167_.WMF.doubleoffset

MD5 df4a6d2cb719a198ec51002132e31ed1
SHA1 a5208619b6889834d56b00bf89164991ea29d97c
SHA256 c195ead1aaca4cb11f34fada53d58180e84b72dc791cdbad17c97bdfbf8de40b
SHA512 05677d5df28369d26d6220528ca0beabb44bfc2020ab318765f3b8fd226780f4be86f9025e5bc848f974c811dd1d7ae118d99d3c9e15068dc2069453871ccafe

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01166_.WMF.doubleoffset

MD5 7e592365da9577de4c35e8ad0222355e
SHA1 461380c593105911d264705a4fd53e689d557d70
SHA256 ef33851bf5f3c334fb4af329b59e630512e9db74a133f2d77edaabf9f6fe01f6
SHA512 a6d2c460a176a3e58867c8f31e267fac5b36623a8ab3af43a6041afb6999b2097fa1d3dc1542bea351ab8bffc05960aa08b36211ade4ec8e7e8778d53d561eab

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01163_.WMF.doubleoffset

MD5 063747419549357a9756b1bc9d3aeb8b
SHA1 ec7ba9e0efd4753e0d99b03cc5ff23ee0d1652da
SHA256 5f222119e4425c2a94562763cc3e6f6ebc3c9ef22884e4ca9594eb38f268d341
SHA512 0660989839a8a89cc3498761823c1229c576ecdca96f1ae1647bb2e603342a5ef04c6ce502279622435957c9c3c983875f0626e81080bb87efd2f367fcdef7ff

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01162_.WMF.doubleoffset

MD5 95b22a459f27fd616b314b86dab5ec95
SHA1 eeff54cff1262be3179d2b132eb50362bf22f8f2
SHA256 5f0b5e303e93947ad54736507e78197cb2e1b3182593517331b1dfcb629d1347
SHA512 4084098bf09b9aeb030b334731563d701e7be2cd87967c6751d57a9e2bfa310a02e64ff37e654c9807cd5c506dfdf33d5ba98519466758026ff9b704fbe30da3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01160_.WMF.doubleoffset

MD5 ede4a07a4420e90b03cf8e8c607eff64
SHA1 2af0545fedd3673865a4f4397a35aac71107f717
SHA256 08bc07c8d4c8753131247919139f885e46039e61f4b26b1cada098e35eb90ec7
SHA512 2eb33894b4e6f34a9b541b77a26cd33430828c6e52b50d80e333b1d092cb1b09312fa989e0bd05bcdbb09ea562e5b33fe7f15f604492768919fd142a4809daca

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01157_.WMF.doubleoffset

MD5 f7f99d2e7e601754c3e5df0c89226c64
SHA1 1e4649e2ce27e75ca870f05833b48c312da31774
SHA256 4199e1981e0e452dc1521e6919ad955ecafeeb2796a92c8ac76635e9f0dbe1b0
SHA512 f00d81377cdd9f7286df4f76115dc473dadbf95919610834a4748c69f083a895e1e60b86a55406745ee8eab719b158db702f762a4dacd35050a6084697ef3ada

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01152_.WMF.doubleoffset

MD5 580d55d0be1b84942e65ee7130f87dbe
SHA1 c0ed11f8f36ed8d862308b78426ea92f76d6a2a0
SHA256 2ecc82190774c7cad14356cae229caee61f1009aa94e7ccdcf6830613be1a2d5
SHA512 d112758dc6f6512809bf38e61511205139d27965ce224f600900a8a55e409ed98927a3d88f84ab25508e82734bb16ec4362bad8dfe65c2d17a477a4760a3ca18

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01151_.WMF.doubleoffset

MD5 9c2ca55e7b3007d58ad040fd9a86aa05
SHA1 5025a997ddccaddf73a9295e0035561a12a4f919
SHA256 07f9e6580d66bd71c98dc24ea17641cc29d54a9922510ea375d40659a24416e6
SHA512 82a2b87677950105c575336f15ee0eac80f6be28796497cc160aed8ebf430a8923976332eb533fd5fee261eea19304ec8bb47a34595c1d02a1e3040009744646

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01146_.WMF.doubleoffset

MD5 c6866a1be904cc7b8de0f4d879fb8cf8
SHA1 7bf9e857f1c004abf29fecc3e0515b0df3c7a4f3
SHA256 b539a5b82c7e98f3730e645ba5060d77fcf468e8c4b9caddc9bb02d5cf9c16e1
SHA512 2e405a22645f1a38435510ddb7a894c4084769bf5c5b31a50fef27d9821653b1dda923f80e7902eaf0f185412965bac90a0eb6cfbbfcc64c065dee8ff1f9cb99

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01145_.WMF.doubleoffset

MD5 43f44735a46c76670fbc97d792f5ca1b
SHA1 b06baffc454c679ad91bb7f112ce8a783db3b1e7
SHA256 40fbcc3ea6c8ddb1087cdc8446e72fd29d74e83aa73cf9965412f8baf0a7a32d
SHA512 0a9c0b5f91059c171187b1c2faa5dab3cf40e9b573b0b4d865f4d67e400571cae4516cfc3709423105a0ece8d5f43cac6f42d0561e7c057f112c6bae4e6be43a

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01143_.WMF.doubleoffset

MD5 ff285b6dc3949e6ce8bfc1c897daf8f0
SHA1 ac69ff57e786a7167e978292c865ac0813aa7af0
SHA256 9d0f194cb321d5554cb87b937a657e7d698a8a2c0652d49dd23825a98aaa34b7
SHA512 dee4f4c752e355dab4d74edfb79694f27305e5a5e68e517b2c425ea8b943a8b02a4fcf3f8748e612892690a2fc63d9eb8bded5d3b9d5d3fe0468c618d730fcf1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01140_.WMF.doubleoffset

MD5 90a1e4dbd7f7eaae9b66c79445be5bec
SHA1 24403b24e744e3480ef785ca00d0d49a512dcbac
SHA256 5a29392ad4cf974b79221dab7342b4d05a282baaf1bcbcd320778d83715913aa
SHA512 8d407e631fab7b274208886de88955b0507a2206c599d132932e3b22916bf6935669c0dffe73e71ae113e41b3e6317785d097952c7171d13c5ef7de027c9b426

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01139_.WMF.doubleoffset

MD5 155d197f73819a6f0a61305331353c27
SHA1 e9586a940da748ab55810fe8e1a71b9ccb1edc31
SHA256 8a7f19add882f7c423345f4c300f835f8673186cf5f6c120d318b508d08ba7c3
SHA512 9ef1d924a69348bfafe1ce54933dc658eebc7cf11702f7d1c241de64e29c88440c7a5b97203f9145a52f5aa0a16d029887d7c6c97b7e10f91bd159eebf673fc3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01138_.WMF.doubleoffset

MD5 7bdb2d8271e8f8f18e6701b7eb25d481
SHA1 de4711faaf13487f64de360bfc485a008a5a42e9
SHA256 193a2db22db575e8afa5a651a54b7f468676ee480ea8805350c249d315fa34fe
SHA512 973ce63ae650cf18d11193781c84660989a4a791c80e3d21f5a3e553c5bf1bf0d6b3cfe8d59fe7e7b5bf7fb57c3556fd4792d8fca61ff09fd1dbafb2ab036442

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01039_.WMF.doubleoffset

MD5 f909d3852228025c857987ede8139bb7
SHA1 2650e8a7428f4939ce8e3c14a95a044c45a9a00f
SHA256 4fade2aa772cde724efa15760e428a4d45e715f4172a4f696949ece450057494
SHA512 668b08978a83399fa74af4b8e32162e27d97eef5c984bbf48bdc68f7245e9035cfbc5e7d24b0b1b99885f96b36bfb7287afdf0781d80c863ce46b2d9ee732500

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD01015_.WMF.doubleoffset

MD5 96de8211f932548c9af3019361f64016
SHA1 a64eca4991cc05d775cf6c763f4f0872009a9347
SHA256 e659fb9b7c4c5be68c77eef45373d89afd2445024bf1d0a86b174948ca81dba7
SHA512 413d7bc592973f3118e3fc12d306c5859a8932dc02112d8e00a1218793a31cd6d5958eebe187df678d1df5c83c670774fce209c16786d25cbea78026af558c96

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00705_.WMF.doubleoffset

MD5 8a88029abd005bd138185b0acdf944a5
SHA1 877bba47025f8478e926c3353370a06d0b237f4d
SHA256 2633966c26194984d322b13f0300f98bf08ff3837bfa41a01e5346f99fde5f53
SHA512 26d36b5bc9aa8222126c765d0e6e1f9ca93427cbb650b0d3697f2de30ec96511a3c2191028f0bfa26b4f0fe623c2813e43c0adbea07951e73dd3dbd4ca6b33a3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00687_.WMF.doubleoffset

MD5 a1d766c5b95ed273000a75ce3dc5f416
SHA1 8f93b4d5369f62e9024bd286cb80a3ec7552a8ae
SHA256 b0d7a14d1e0c479c584d9a32c38d258ace95f02a9e1a92bbc2ad6a78f08d2a76
SHA512 ed93a6f24372ea540babef7b97b327f851606223b8d7aa5ad42a4350be2c6febc540efa38354f30adb42edac8de38f3359f0caa14a02409e143021006e9dea94

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00449_.WMF.doubleoffset

MD5 920eb77a776f56e70f90920bb3c0fffc
SHA1 906edd48c25d69b27fef73d17970ad0dfa5ca312
SHA256 749f5ca98174183322deefe24cd7d4ee4f2320b5136c4b994be05fed0168b367
SHA512 d7ab409c19d8f1f404d94a2d5c49fbf170666bb5c54e4ef029c56597c33af3a0790cde3129e381892a183798d575ca28e97d5790c1676f107688eb0cbf50596e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00448_.WMF.doubleoffset

MD5 4d8d8ea653b1279e6b2045a33cd1f6bd
SHA1 e1b7dfffcf4a7a206d958d5d56a14137b1264401
SHA256 feae7747d1ccab71ffdb3f3ade98f32a2a8ce635bf7486c45d70e212cdd8b610
SHA512 a2128e9e859deb82ba33b380996f60bffa818a645b4f5aca07f4024e1b2cf21d8ef6bf3cebc67ea4036d6e89401c4127e526a1bb674f1e3cb263f942ee1620bb

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00437_.WMF.doubleoffset

MD5 1a347295e2314ca030dcb2e57645d4a1
SHA1 c55898930aada29eab8e9c2bd5e889fb12b28c61
SHA256 5d0dfc3441fd0c5c9a67ef3e920b3d846941336757b595ea154f81f2078a8118
SHA512 c3ad832d98331b71c1f5ef6cee0bce94e7fcb471d2cbc8f5e2bf9699b70cc10a3edcbe26359737a81022970bb82cafea03916ac680a425f2e3056d05180466fc

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00419_.WMF.doubleoffset

MD5 eec059c4f0db116fcf3f1cba8e201a8e
SHA1 145eefc9ab1a9f0cb4a623909594ca332af55d72
SHA256 6e720327734f3112f3ea01c943489315c0c51253fceba892cf08be232874563e
SHA512 bafd7745c0878240584127bc565d3f10a712b7156a3584959c2318bd20d95651a255e6763d7a09ca536771b64f1fa41a1235d40536ae07e08df91abb755016d1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00414_.WMF.doubleoffset

MD5 aec3524614502bd53a422318c76d00ce
SHA1 929325cf8cb50fe871242e599916e92230b48460
SHA256 76f55e732ba425eb743f87a56b9f37e9974c42563bfc38ed6fd9e7057665cdfb
SHA512 61b39a3d9ee072a38f86761e716a54a82836d32270faf8dd361574c0bf1f9c8d1c3341f69b61f7db70d034409370c30869799386828644e9d44d2c48288325ad

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00413_.WMF.doubleoffset

MD5 652fe32beb72854fa24cf6c5de52ef3c
SHA1 2f820d81b2da08e242464db966007549146b573a
SHA256 3cfbf92aede2c489e2cd7bc27c4d0083ce1875fdc2697aea786aac622d4c95a1
SHA512 2d9b36338e6a9dbde4c196a64d2b30764ae526ee45ca101fcd472703a18a2e3f6b8c0edf29ac607e29b4e7b5dd90b23b32e307cab14de64877540c58d5c6f77f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00407_.WMF.doubleoffset

MD5 26694469c8a7cd2fd3afba5e11dfa866
SHA1 fc2fc08ad42dc54b001c8a79cf0156c61664c2c0
SHA256 e56d275b628db020b9ad1628713600e55b15e89f81501963e7820663dee83eb2
SHA512 8481d23e4aa9014a54455d79d13253b60e5b01409d435caf44b488c177bb2c540e4ac0d79bb25c5e4116e5115127de0fbe66eadee77656df3c073248ba001dbf

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00405_.WMF.doubleoffset

MD5 e8913326118d5abf84c0bd2305b8ed4a
SHA1 bb1bc85457d685f1bf4531ff6732840373251270
SHA256 0fd39121afd86b7205a59df928ed77d827e662b5f092272e94da894cc4139af5
SHA512 78fc5d49a5879b15de103e8d621e38d609cf313e0a346e164f008b1748d2180fe907f2c10f5c7d9a5a9a60c9f8d37dc7bd09d9c1f6c1b929e00b80e86ad233e6

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00372_.WMF.doubleoffset

MD5 5e5ebf9444d0cae10105a8939feb4433
SHA1 a39ec5020c77bfbd8443de07fb209e19cb6e3c90
SHA256 924ae1b25e9e47f7ea96fbfcae152e2386959e45d438487a26d3b6b85c2285d1
SHA512 befc26fa22d677f8e79d628100611e3c771c5f8e603739dc3337cba4addb019bac61380ab1a735d095222f95c8acad75ac656bdd66a09de480cc48c27a3e610e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00297_.WMF.doubleoffset

MD5 22d478ce36e0b7466ac7629b1f1caaad
SHA1 118fea7e3ad2e296bb5eb410ad630d6df7798b6f
SHA256 bc45399f7e4e11db994324bd6567627e12642823ef8ff5c0578f2be54aa7d035
SHA512 db1186332c98f3775bb3ef5d0311441b747eea56212711dc909a50b8d75e9d39e68775ee1e3d8a350503d6c6b3f4d8259f484efecc05bd80cc1d34c54350a023

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00261_.WMF.doubleoffset

MD5 34d439efc01232497eb7be99c2da909d
SHA1 249cdd4333fd123dc1e9bded18bbeb20c01c18b5
SHA256 1db4b5b02cf6f80e714deccc1b8b5cfeff6494a6fc83d6930fbc305d5745b903
SHA512 7d859b3cb159be8b8ee9b75b7ffda7d9d042c5c6c2cd939e0b2c12517c66bf631cf00320fc6d06c2c7f97e146434f27361f23b45df61b3752290e733ca177b5c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00256_.WMF.doubleoffset

MD5 b671b6c18f87e9c6671e30332bb4ad6a
SHA1 7bee9fcc9102deae4c0d900adf2a5f87f8f1b78b
SHA256 6fe329b4fd855be46f4a04640bf2f443adc47b519c4e085d419a54c188dddf65
SHA512 01b419ed6ab4b4da8274c6abff99803ea3675e1dc8b3a864aff4c765a5acb778eae558258853b9c8d8d568473e18d7652c48250c2242e9c2b216f5a659fdb487

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00255_.WMF.doubleoffset

MD5 4521daba726cbd810711d1dd9e4ede0b
SHA1 666d31c115a307e01025ebf7c555b2c9d2814723
SHA256 a0327e1141eb02d659088c6928f4c4457beaadbd30cb8a652e549f49e78d19f7
SHA512 6f92050b3d4cb195a8aec43256b7d9aade558dfa37475589d9ebfe7be880767dfafa265c2100f6201d0cc109d5e42cf62bb751088623e92ef4366a320d53dbfd

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00234_.WMF.doubleoffset

MD5 fcda74a4e75b6aae6a8cea7df35a9e3d
SHA1 364b1f12960df1428af6e20ea9ba858e809ca0a7
SHA256 467e216bf0974ec791bd744e6b976c0f98ba0012a872b563ec769592c6bb55a7
SHA512 51c51d87a63a6df1402deb05881b028153c177f82ad60b6017b7f22fb86a4efbb61a8672ec994c4179dad939327690e88912964dc681bae103091a15b95c42fd

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00121_.WMF.doubleoffset

MD5 9e6bab687e588479fc1db52881f04c92
SHA1 d84090f9c5520aa87c166b4b9fc2967bdad92458
SHA256 620c55d490eace7372b72c46db365b32e755f1daa2b7884815dd08fc0369bef7
SHA512 09378bbc26ae548d0319f5c1138875b47bc597d06474dffdd9407908cd84dae34216f59ff06a63ff7979b292f621d3133531ab88f4c99a66b90160df1d26fb4e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DD00117_.WMF.doubleoffset

MD5 b21d6b2254bd3876ce83c8772c8ee4e6
SHA1 2fda0e0236ee7059b4877c1e7264fdbbb5e1738a
SHA256 50e467837925dbfb2dda9df8c1f60f217c5736c1cd771f5466b8b6fa0f198a1e
SHA512 7c116fbc1a5a488f7138748175c81f244e2a5b76b6a8af09af5e515fc82000b2f90df866561c9b05b43dc10edf3f3bce835c33944cd3e5a6e0ce27ee5c9fa706

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CUPINST.WMF.doubleoffset

MD5 6fbd31696d8f40aff117b6d91c950cde
SHA1 6e9e6eda4085d9713e5c809eee49f4555f277753
SHA256 9996f99c51c2c08f21755089f791b7d71779aed610f9def89e036450e3c3bbb8
SHA512 09d2d3673bebd9a9d27742fc456b1bc83180d8852575e1150ed9cb868883fb73f9aad154a319d4c3f58a83db902728eb2c5eb58b5a7bc5d3790bef3be61619b0

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CUP.WMF.doubleoffset

MD5 2b99a232335ca410452331571f4304dc
SHA1 ea39fe3d5942b8565c83673c278650dbda341ddb
SHA256 c6dd1093c1523c080920cf1b3f29ddd87ce12dfc082f1671a8d20a7cec13dbd1
SHA512 1f45e5b656e4976df4140b9421930904a28bb29b5b2713c655363c6205303c9fa6eb4d57e0ab39b4286334402b858b585ae2866ba8a791c00f3bb20439fd5974

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CRANINST.WMF.doubleoffset

MD5 e6ddae67bc3e7b2d3629bbf6a39d271c
SHA1 a8fbe904ec1045abcde654df4b53a27986e6eed3
SHA256 70b4e8373d3bcb46d42c65051eb2ad27e6faad8e655d0a40c67f315febe2f43d
SHA512 6d6d97d332dca9843922357d12ee5bf68a2aa09541ce9b765f896f163ecc69b2d4c91db6a8dad9e889793e82bddc2ba8c2dd6c736af954a6875d2d1fd27ba2ab

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CRANE.WMF.doubleoffset

MD5 e633b05af6aa86a512bf48f1a6adc4cc
SHA1 d56ed11e3561e05f99b994ff3fbacd8691dc3e3d
SHA256 2ebc8e9df46d5ae6fe7c456472a7b1e7f2b5496f261c9a39c7a5b38f9d71183a
SHA512 00599447e0d444e12d09c83018e98fc82a7bf220ba5aef4352c1cc56d77a1031ffc979705c75e6d3eb9ecfb0172f9b17035febdd4ef26eeebd0d84eba806a673

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CMNTY_01.MID.doubleoffset

MD5 76d94a15151d917f6c400dc1f7dbea16
SHA1 bef51c23e98a181757527fa9973ee940d2697d92
SHA256 b3c169a29ed14c2122e3b6b449775837d93c60365e1dba061561b5eabe1411ab
SHA512 27296b4ddc6b7f162fe9fa40d02f50825125b0075952cce9d06c3fcb44080bca725245057902e7e17fea89e879003df45224d062e36d21b1e86329f9743fb8aa

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CLIP.WMF.doubleoffset

MD5 60b5086668e961083394bf5a08ddb0f7
SHA1 3a18332e44044737b7a2069098583f5443cc212c
SHA256 989bd394ff201a3ca4334e22e8bbbc7f06046515cd7a430f0c3acbfaa0ad3ef5
SHA512 52530d0187f3ff48b7a2addd6d1c6866651c15bff69034c51d8d81b5f9c0144a263d6bde1f005a1e6b25032a34eac01c45df61c287a3099fb567bc9767864dc7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CLASSIC2.WMF.doubleoffset

MD5 5a6d38e98a28e3cc49a4763235815395
SHA1 697e2d04922b81312339ca007accc5f14c170094
SHA256 9f4ae1af80f8af3cd239b55e322f3389592b6ef74dfae0a633ab2f5a90d4eb5b
SHA512 8754fcb3282897b3f9125b7468081380b2458425ba173f21702b3d82800fc3f0f2d232950ef69c57b3cef31b0daf7f2e321e6347f26c91452e0281dd119d1d6c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CLASSIC1.WMF.doubleoffset

MD5 9e0e27907d6444abecad220483f100f6
SHA1 1a0174f0e86ed0d0931790845d751bf4d6105942
SHA256 3d908c6b3c4b04388ca6b9618fd98c08ee5d5276d1401274a6bde7754958a3ff
SHA512 84e9f078943aec0960bcf139ed3d9346150f18bb71d8b7ffaa4e069421d695cfcdcd45d3856b622d9b19143190252b7a5ea1e24ebc260d3fff3fb70735045e40

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CG1606.WMF.doubleoffset

MD5 c04a8b760415f51bfd21a3f05af0cffe
SHA1 5455200042728ecbd8dcbf595695fae6d7ed6562
SHA256 39fc2cc70ad451fc91468e672f75af29e657caf941059c51f5714aa679091690
SHA512 1d34eb39d5e5f06255305fea5b90239359b45bbb6d6b2f1378273b9609e3bb4555f12f0c58361319cf3f56bfc16a80cf3d2491eabed198ed2bc3d79ba51fa3c8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CARBN_01.MID.doubleoffset

MD5 576a36e879103f502ee1239623e5e713
SHA1 15e45b04c4472199314cb0ef231c274bb6a68b4c
SHA256 a6a12b19c7915ddcb7ffb5ba56e91d3672e2e702522a19d1f641ae8d07a7003a
SHA512 9027632ed46d895a8e054f2499a7ae0b26c2638a3202cab259e571b95a88032d563474ee88ffce8ae8a4a3ba5c5a2d32b5941edd10c647d13c46d17ec26584a3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01639_.WMF.doubleoffset

MD5 3c916eb78942327bcbdb2d6d84026706
SHA1 95174aa83f7ab5ff2611b643d7843c9239ad0710
SHA256 7a67cc5067d6d746a6888a3118d93883ba8f8ef83a924a647ca13713ab2e736c
SHA512 65da984477d73717e4bfe6844af105df30dfe1246214491e51508f3654327c8eabad4f5ac9cd44b3a5ffda982e02213156abe9116f8b51a0b7cf3cc7fbbe293f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01638_.WMF.doubleoffset

MD5 be08bf93e5fbf13dfa3c1bfd7617073c
SHA1 51ccf5e3a769da424015886920e1b9f4349e039b
SHA256 0b6e07a8a633f72c6ff527bc52847ba32369bc82cd5b68951323daf2062234c1
SHA512 fa2f149b32ddefabc0abfb58953de692f0007a62a8a1ebc7232c85a98d5ce0156425ffca45458f0d413cf20a367e67e51a6fa08e1d4fa7e4e657f9a5f3584205

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01637_.WMF.doubleoffset

MD5 49326e8b53281517dfd7ac00a4836a31
SHA1 ecf62fc4c14783c371ae8aece7c82c2c36782332
SHA256 3f4c599f077a43f99d83d3f3d9de693e238eb495944cf960e856542b4c1da983
SHA512 5d60952ae3d789bd6b8ff30d04a44c19288b38512c6d522ca9cbcc0af233cb6ab406b89636a8665adde404d7758158a595e4e256872d06bac8a00e062c6f54c1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01636_.WMF.doubleoffset

MD5 1b962c1c5ac57dc5a85eff798029cd08
SHA1 8bbbb555c493c323b343ab2e14d8971cd1fccbcd
SHA256 5b0ba8f891320857d59a0f69d2fa306ffb58dfa1ccb986eabd14aeb6ab6048cc
SHA512 8dd1e07d570cd343852d21df6358977f99a888be9de0bfcc5ef9864a2374b62e2f5f35951514be99115f48d7566bc4fcec9e33eae2f72764f7be4ac9dac33c23

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01635_.WMF.doubleoffset

MD5 053ddcb2486b80b4e5adcbbba0df8b27
SHA1 4adf73c9b465786ab34c8fcc493079d8b3a43143
SHA256 1f545380fa27001f7f0a9bdb4090d11629d2aa7ff90e40c86be562f38df749b2
SHA512 d2eb5b4a2c3bc935875381db793f00cf9a748a9001fa7045324bf77655db5a13a0684148db4c3f9e64f342e6905120364b0f556f7d0f8c9c18ca5b2dd7411460

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01634_.WMF.doubleoffset

MD5 4a5b056737fb51b2321bebd2cf99e00d
SHA1 3a1bedfaf5456f98ec91ef07dae4010e18b12ee8
SHA256 2afcbb9c7a1466f3583b6191e2441508bc7b5278e0c4857a055357cf0622273b
SHA512 04160daa43afc94787f86d409eae56478f39e2a261d7d1a2ca69ca4090a6e2f41fcb6e03275eb44679f9cb5b367e506cde99ede66c70d8047c293a8894f76248

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01603_.WMF.doubleoffset

MD5 4de39956e469ea4f70d5cc1c22fd065a
SHA1 10f42fb139bad720dabe9b28aeceb0264c37f222
SHA256 319a52ba7c08621e38e08fb7eb6b1ad16821858d7e135db31bb59342ecaecfd1
SHA512 51f179ccd4bd1ba25980a389f2890f911833477f46271555b9ff536b87ac42d03674e42c18ae975a890dd615de50f3d859e364f396411a903766c7edcf09d7e0

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS01080_.WMF.doubleoffset

MD5 ce082128d27767f8b6516abb4f4c6e05
SHA1 0347c814dd10ba291bc4a145ba646919d4592083
SHA256 dd895d3c9363b2298ac1ee824102234742284c89151fba9bb9b42c8fe38d6fb6
SHA512 ad7e2016a4a1bf579ad012615f77b65ecadbc0bd1a4a2b2ba0f2343c280b97fbbcb61fa18347f5242c3ea428ef23204476dd92da2e103ea9fafe719244678cb3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00453_.WMF.doubleoffset

MD5 4eb08d47fcbf5749b4365e23f0c8ee3d
SHA1 9479d4beb4f46e1e77d215ff1f012437c50bd18f
SHA256 c121049583c7d6a0c92143bdd3cc7e2ebb4962d68688baaf5a0eab412c950b9b
SHA512 08838fc63bdfca349bda4ba3e3d80bf58b99a92480fb83599654fbc7e3424f80df89a7144e6094285243daf63c70c119406e836e28712e87f03fd5f93dc3dcaa

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00445_.WMF.doubleoffset

MD5 de063c7d359cc9b0022411a661b52157
SHA1 b7e741123f0fb72a248850bf11e8a225f05ed81e
SHA256 6f4261840940a937a84905b4e75da73f50246a1398211b86fb2c0931b719cd43
SHA512 0c377280c0a455ca0d50b2f3616050590fae2b746561e463bbb60e0d045b3c3def333a6c6cb76bde4e8e0556c7c5c04bd04c2e9ef17bc398b509f13749fa60d4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00444_.WMF.doubleoffset

MD5 7fa13d1030132b1fddfc2b0d5033ef08
SHA1 7b84f89735c05712624cbbfe757394f15f9705c0
SHA256 9e509a895191093baf10b1feb4b226922d2cbdee3232b3af46e19a54d4e3575e
SHA512 0d9c3e8212aa6e051fc576a04114058fc5ae2399968dad79dab28c0ba0267252cd50b552470cead3811c73a8077009b94a5cae3aec75258da6661721006eb3a9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00443_.WMF.doubleoffset

MD5 05e69b563fde5cfc75c22aa1d1946691
SHA1 2fce09b59fc32ed42d099fc0471675c3ae9f8d84
SHA256 0ddd1430b0e4f7fe23a86a14bb01b76f99e0a723dfadfa001f257fd191a4b168
SHA512 9467fd7eff10ab63ab81b936c65cf4a38ef2726da0836797795a4fbc8aecf5eeefc7ba8f9daa1365b4c1e0b05c3615dabe15b9abf36a7182d4cfe0261c11035f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00442_.WMF.doubleoffset

MD5 98a73047bf451f907a2ec78b097f1558
SHA1 18a96473ae82ca0ca594e05cf954dee5cfbb62cf
SHA256 825305bc0bf15eaadefe4e2d91aaf43fb4f6f062658d3e8f064ab65e14fa3f3d
SHA512 1f6846c4c7ddecf541eace00d0088921d86baddfc5b07718aada9ae42d29b901611c6a66088f78756eee2f6ab8f154a1e07c65f4da631a843a0d829611d7ca4c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00441_.WMF.doubleoffset

MD5 6f5005a966c6aa2c9027c6c5c2969941
SHA1 8c7fcd079b163ff91a3045ce691658b8fb4f2541
SHA256 fb066147f5314df1d8a9b08401e8425faa9ea3e5b730e586d5cb7122263e93e6
SHA512 35a249971248fa2098472921dfd56a433f956ff34d0de58fd89550d1066573a8561e10f07341b66fefffeeff647e6566a3c0d4a69cb8618b766ac088dca46dce

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00440_.WMF.doubleoffset

MD5 8fd62524a3d060be2ac016781a9384c1
SHA1 65fb57d35a2761f3bb45791bd2179b65b133aacc
SHA256 198e13c0a4199811ff1a575d13e1d6d2c63f275692de3f0f13a436d8f3f3ffb7
SHA512 1c539c577495d66c1e6bd8f69785df1fab119ab617272bcc5c3761084c3cf0da498c8a29d9be317b09f610af45abbf86881273f7001cf7f0d18ab607e3c8bb33

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00439_.WMF.doubleoffset

MD5 b80fdc3c1ce06effda19db40a1417aee
SHA1 30f985d291baf64adb23fbf6ecaa8bcdb9ec4a93
SHA256 7d7f44d724819b67f06d81234ad52b253447d202d6c396a87e74c9399e21c567
SHA512 b0d5de839c1fd1a32bc0d75f72a19be0c517533e4e59e358f6a0fe7ef01b84d52f22e6cdd83b0cb687b7d2982b06b1e95bb072bcb487dd9f1aa044f132539e4e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00438_.WMF.doubleoffset

MD5 baac34b648dc2cb7f06c7cc6dad6e55f
SHA1 b65675f11abc910263fbfdc1e0d3165745bee920
SHA256 2ffe23955bb8c1a969eadf43d54d23d80c2953f704a8373fdc84fd5e40988328
SHA512 db1c28240357b03a2cb5faac4b71cb85a315aa6178c05f996d3dd950e68b3232021d169b4b013e254b6ffa796bda5d8bb1cfe353b64adabb9711d0faa6677585

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00224_.WMF.doubleoffset

MD5 c43e54448e754436e53cdfd773f51bd5
SHA1 0081e1e3049ca8ab8b0d41e5a36c773cdb5e4fa3
SHA256 cd391c67e4bfc52bb0ee27731519763db0a31ab28f0249746d91a255a014830d
SHA512 99fca5481e8782b463bee85df16d3c7931897c4d220f369d8fde1c0d0676fd0f76b875cb0d7b116e736e76c6862f0e7200fe103c835d1c0f21c4009d7f34d8f4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00200_.WMF.doubleoffset

MD5 09b54c51cc905e384f185f07069d30dd
SHA1 53de4292c12e6df51d05722d3cf976089ade4e7d
SHA256 2540e8e4cbe6cec3afff745ab5f1f0ed2c0b8f99fd617715adc5e084d581d8eb
SHA512 d11ee5630bbc2154f1cadc9ee74337295b4897c185b5baf00cdfbac454a3396f574bb45a01463f3563af6c9a2943e1c56ad3a0f79cff388d563d04edffde73b7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00186_.WMF.doubleoffset

MD5 0e13aac7b7ffad3bb6bcd4ed593c6131
SHA1 239d971ccf63ff571f5288a1b45af4e315473680
SHA256 746df77f22e98244abdb789fb6d915404b1cc5cb8558610149499b939a25559e
SHA512 e036f954585b78ad701d5d1b082cad219695d7dd07f3cfe5f5cf89c8e165de3b5839205beb2b6d25cdb3eb91aae40cd08e1bbde9fb33aae9e59bd0b14056c295

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00184_.WMF.doubleoffset

MD5 e8e7c9097f1eebc6e386cc3cdc25d877
SHA1 9a47fb22e017252e8f74cb8ecbbe2006dc42463d
SHA256 4c7c2ae184131728483016588d7b309e12bd4f029d061216d8af396a26fcc356
SHA512 657e52aba5cfbfbef03ceaf09f810636f100d1115dd99ac7ad302bcb2fe822fd26b05bf5d497358d1d1f357c2d04e441b3cba9e699f24a957ffa098502d387d9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00174_.WMF.doubleoffset

MD5 495c0a83f06f59db5fe6d4edd7bd1ab0
SHA1 1d79ec24b203f93ee59be9c8a4d07195d703fb08
SHA256 12309210eece7e089c08a0fde869b13589dd57252f800df1fd24770522ea7fd3
SHA512 9ffa6c35f081a14611f819729a424b4cd636887d37aecdb689e3f087463bbe781adcb8356574170b1f75822e63d37c1af2689bee2b5800f447074d37f662677e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00145_.WMF.doubleoffset

MD5 3b9ae3d8c799ab0045e11114dafc51c3
SHA1 0a9bc612524127f3f963ed4774e42d7052fa105b
SHA256 6ad1f5befd781dbd34b6716a03e1ea8fedd44ffa1a08f8c8d80c58594c3c7a1b
SHA512 e9516fa3796fe2c5d0dc41eb1807efc5a92268c353afcd349f4f330b86460b10cada026064f9334698d324ac9fe3d025dc2a52d0e0f671c4de78401fd006a143

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00136_.WMF.doubleoffset

MD5 d18a7c074d467362acebf985f3f36452
SHA1 90b92ca56e9515789f57739ea7282f42d3fa4fb8
SHA256 f79ed92f8d648ee94b7960b1c2111166e120e635db1cc24f2a8a35c32f42fd84
SHA512 1857a5581bf1078d6e17ebdf37e59e38c43f6e61665658b6ef04023d228dc597b7aea775fe4e210cdfa1e5ea60c934c173dea4f654f0ca6555b9452c38adb248

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00135_.WMF.doubleoffset

MD5 823fda6e29574f49a5d97f6c973ab80e
SHA1 d7addef4705177b9d12874e7601e4763bf5918f2
SHA256 75d1942cf8409371a0c07be0dbe6b42bb3dbd06ffff6354537693881ff004816
SHA512 1bab79bbba79ec5ea46a678bec35122ff48002b127b4cfb09dcaf571aa9e1aced343f68c756d8682864c7413c0e6f06c7152861055396bcc7aaa604ed4467301

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00100_.WMF.doubleoffset

MD5 9f808b30945fee15d554b14bc40b0edb
SHA1 80f4344f060338d2657194bd00e0a92a833d37a0
SHA256 cf622e3b2cf1052476c7044d5fff6a91016e021df498bb785af06b8de3e1c8a7
SHA512 def6b4e4ed9602b8fc1763e3e0da31ffb870d0d1003b4d7d21fadb4cc4c24f43df961cad1964c16d776f7359ffa921f432d814a3007daf61c7486bf9b1a0a96d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00092_.WMF.doubleoffset

MD5 978baa8657b0f1f41198cf1d46886df8
SHA1 527a2f579e024bddef37b0046ad862fb71158940
SHA256 825bc65f6f936a2bd9ceba40034cb72b3546abefaae4a97ebc752b66e8ca8433
SHA512 314a3cfe584f0fed19036caa35b9943c3b0383437929f9da65ec749a078eefa2d125b418f11b694f68a8f0fc512ad13cd9f1678d6c760b23c4856004eddd138e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00078_.WMF.doubleoffset

MD5 9ce3f39753e67256ee5e432783e0dc88
SHA1 16babdcf831dfbb800364bb10d972953c368d189
SHA256 a6ef1330fa0e69cedf388837c0c16cc8d7df24419a9c37c39cd5c9de948a3701
SHA512 b0d94d2bf19f51fc5c87ad8eb80ad1b5ba334fc890de26cab5b3773b265745bfda1022867e8b81cbdf513f887aa18e312005f1900a04228528ce8cc4eb3e82d5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS00076_.WMF.doubleoffset

MD5 404810fcce802e37595939a0bfade21a
SHA1 f0be075a4b6bc91773bf5d0dc571c948c8ae6548
SHA256 16808e50ad377c9e3822141d4448e3a1d865e08643904dbbf3de9f8c489f4ba7
SHA512 bdbdad85c06b6c1dd869321347f5335678dbef0762de6f4e508aef834daff4ea79a6b46f744b4e4e21dc10bd00f6bf6addacdebed5c72b1f8aaf225c95bf6c13

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BOATINST.WMF.doubleoffset

MD5 eefd6c2bb28020cab6d6427b398b6ac0
SHA1 d9b701cda13ce5c884c99507483030ab7056dfc7
SHA256 8dc4cc70bcf181724d3ce51ad376da87662eedf0eacc6b4fb35dc6e93189aac9
SHA512 dd5f408f1827cdfdbff1895a85ad5dddfc90982744685eb822f3ac34f9df83276e5cb61d3b45bad69bfe896607c8f39a2c9b2510ad371473ab591b17278fc463

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BOAT.WMF.doubleoffset

MD5 2d7ed7191123a2b4b74805b874b285a7
SHA1 664366d6bfabedd02723c51c6013d792c33130be
SHA256 27594792d9856d08c482f0d17876cd1601e2314df518caad4ad9b7d9e3204625
SHA512 9b6f3ca43c936bca1afee6b2f9b34b14c94c1264b6c9a7b098bcaac8088730a5e27cd17f0fb4a21e20eab8c0c85c97737effb65ceb1e2a5d93b5e2b6a449996c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00985_.WMF.doubleoffset

MD5 0b6fce6e9cc20b6c4841478796be0fb1
SHA1 825ffcceb9bba2f72c7b1939711d01d57468c823
SHA256 d84096b04837f0e7939c84f68a1a444ede62e6b4f1f1fc02d38721f6f2af06da
SHA512 8e23a4e78ab6d04fb40ebe57a33c6fba4926e29d95114d57a3371c1a29d04bb950272222e050587f9a1f24aa7761d4aadce654e75516f2cfcf43939fa9bd903d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00932_.WMF.doubleoffset

MD5 21843213c28c77b05748833fef339d9e
SHA1 b684b36095d913012d23687b4562d81d3dce1d34
SHA256 4399c697aa54be303c16d4ecca1d11e6d8301fec2e1f2aa6d5f1a632f9a9eca0
SHA512 8ee22458e31ce8b8726bdd0c4bc14e17a2179f0bf56ca7f242ad8ea375b1e53b71ca3e476c712f1944d936f9ef957782b77f1a0911c931655c0691ce2d232299

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00923_.WMF.doubleoffset

MD5 c6c943c526e8501aeefd04c8391e671b
SHA1 59b1ea9fddbf2939b852e1be39f101f156048f9e
SHA256 cab54225bb6aa94cf7e5f83226d1c0ffba31c5d0390e45703a4476c9bf80827a
SHA512 79f85fa0f66ece764494ab3f2b15481886346d4f2f768cd785c2c0de75efcde49f90954dfdad3b14968d2be923aa125403a847bdf001124293758dd3abc454db

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00921_.WMF.doubleoffset

MD5 2dadae2f798c2109088f7abc8bdec252
SHA1 379d7e87ac09cc4673e29812a0587888d9524e85
SHA256 809bf3bb443ab6408b5609486986d9016b90ba3665d3075d6435585d2f5b8804
SHA512 4e98f924d3677e62da7e9f5c3b58135011fc1d77a17fcdf562c0ff697c8045a692e55282915e657bb4f1b2b72b43ead9c3cda94f61b3052aa1dd7fdf3c9fba95

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00648_.WMF.doubleoffset

MD5 15b587cb7012541606d325679b997182
SHA1 b7b3d4d98e697ecb30f036dcc5b78d334ed821a4
SHA256 432923cf5d489ffb57b485e5d1486937672d1b2bb136217f9c31feb6075a6e22
SHA512 746997cdaa6b8b8192789b13e647c55883f0eafcd1d75379f51b63d5d601d89d0f2f773c6c74d0f709a0750fec3543295296a2945f5a148e23acfbfe56a4cea3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00526_.WMF.doubleoffset

MD5 aee926b87d55968d88f934a14e2b6a76
SHA1 8947c08280b573ea4bd44524896c4c10b0fb20fc
SHA256 d5fdc3acad26f399425f7cdbdbc6634fcce14cd38aa790f9d8c5efe4b6970537
SHA512 c1faa1d26232581c56eff86b72c66cc17ec1116aadebf72e9882c662e36c62438c2b3d57fc01016906fb2b01fabb27d32b30c72d74906bcfa72861539044beb5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00525_.WMF.doubleoffset

MD5 3b451939ff4e664ac602e3a666735032
SHA1 4a2a2b85c5409601596241b94071306375c1da1e
SHA256 3e9f33bc3e1961016043affcfc3aa27ec3dece04fc959693ebb05415d04b3ee2
SHA512 7b494c1cd6b58a01fa11f87afdfa8adb64d0b6b51b4bc0e3588766c8b7d8665a99f916d5b6cd8cb3d1deaa955f65e929361db09551c1967c8659a504a0f20e9f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00524_.WMF.doubleoffset

MD5 fc3817fd545c89ed59db94cc9ee498a0
SHA1 11e466ab9d89d26c1248fa2850e18747589a377c
SHA256 1c7b838a467dd14e048bbf413a167f16be61fcb03a50dec1c542a465e514defc
SHA512 1db2fbd7938be446cc1741f9adab61fb3318021d74f3f422bfa4fb60635aa6a545e8d79b3e525b2bc35b97c216847e60debb0bf637f8000ef1fdb1270ccf3ce4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00392_.WMF.doubleoffset

MD5 c3e23ac8e9ab38788617e086c425a187
SHA1 fbb18914b163fdedc7afa6f0b230c57d49c5c669
SHA256 f71f49ffc47866b29f33119441a74d9a76ce822a3c689a7a41e1a3cfd8507627
SHA512 ab49ae2ff78d6ab639c9d540590050c7a22d87afd87da1ef674e644fdeedbbe28e34aaca70a5ca3df10c3732ba29951294f8aff14f3c3ba4ffb040c06323743f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00390_.WMF.doubleoffset

MD5 d48700842f347f82a95f62c79d89a24a
SHA1 60638e335bf8b15f21e54aa1f0d577daf88be0f6
SHA256 5e3abff8db4bbaccf199d82790475a32212ec57b4c96299713a6a05961d4c2e9
SHA512 d39db24b61813616df192cdb1e69317baa7bae45e1c0f09f0b3bfa7563871b3f952a580a4e5e20e6d0bd53cd328efd0f9cec3507ac9bce1ae280adf0c7437260

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00296_.WMF.doubleoffset

MD5 13c68fc824413c6bb4219beaf3cd0462
SHA1 3e5c45890f6f18aa9a7f1603f8024ca0e563d47d
SHA256 56ba873692420012735b5dc881d155b7d355a99d0a1e06b09f0396d77a3c92de
SHA512 bd0a778c0c57d94a89ced8fba373f974b321f341d89ebb0a4eb6da98f2ac4610d1a35906e9daf11eb0dc1f37e03c7c619fc740827ef0ae7253ec5181d26a6f66

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00274_.WMF.doubleoffset

MD5 49b06b641132cd42f4052bc24b274d14
SHA1 6a86c98a3a251ea08ec6042118ff5c021f45a4f4
SHA256 7307e0cea34e6be51e1c9ccd9f74ba95678af6a4fdb0f9ef83871daf3e74e225
SHA512 86c463b620cfe67ef013a020a073a35d0a77a89238e91e7cc35fa22a1051e94642b4082917b2170a58c7c5128445a28915120893a165e3a540e6bd01f12e4c54

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00273_.WMF.doubleoffset

MD5 28efbb38a255155926dfe334730fd502
SHA1 3b3babb6a85e5b0c460cb1fb45ba7fd9498ed64d
SHA256 68a5d24e361f5b15d72f19b60613434bf06f10e8425d564890a832785b054cb9
SHA512 303d202d1cc3583e30ff886b94d27fe32304e27d90f28fd31e36863be6ee65658cef61472616cc3a24bbbb0877eabe8723485d872efd23ece5ad5cc27dabe9be

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00270_.WMF.doubleoffset

MD5 b21c2c1b6265248214e700eac884a1c0
SHA1 89c71dbc4cc1fa110c8568149ef15d65e7dc6df4
SHA256 340192188d9f3d73eea899aed1708d97e4fb43c6093bbbf025f32fb91223b2ac
SHA512 229a4597165cb64dbac4a56246464c1bc8a04f03602597de47f3c46d00cdc5b0d79a43a7681e1564455c217b9a6074990bc50fe5df49e64aa79dd01d462e1b65

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00269_.WMF.doubleoffset

MD5 b04878d5a1686f588e2ab55a36fbad4f
SHA1 c4fff0942020b0565627bbba8e8bf78ab86adb12
SHA256 767803d44ea533079d3a8948b3c557d45e78bfdd7b4647fcf321ff07f1bf176b
SHA512 41b3601204ee0aafccba84de4e5dcbb69d82c2ea201e4459ea8915a3f898a642f5cab683b4688b7b9541c8e557dcf2b9222f0f9ec911ab6e7e708b51f17f96ee

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00267_.WMF.doubleoffset

MD5 a66d4789f84303f12299babffa358188
SHA1 b97d02d9ba0ad2436553dc3fd2534a9993550d59
SHA256 19af53dc4852cdca9bb1d822dd7f927744aea5f0c390c0f6fca64ba4e9959b7e
SHA512 31ec58107da32652449e16648be921203b653258e25dbe8cadb1694e760bf03188e4a9327dd87c54bb7ac9085d93cffd2fea9957b0d39d047d2cadb3d3654c1f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00265_.WMF.doubleoffset

MD5 cab54c3fff650cf67718f4162d2d9ae0
SHA1 8e9e35fa91854eb9a09e5e978ff0090c7a57337c
SHA256 d15bd234cf6ee768e3a7e944f5d68aa624b134e9ce8080d3428057abb17d6b23
SHA512 7fd44c486113949d68f46aa5e27906e852f714c5b1782f21659c6592f98884d127373aa758f7c1f00e67c3d8b264757d2d5460c3b18a65589fa997f41db00fc1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00262_.WMF.doubleoffset

MD5 b3e80344d481768584e1015220dcc3bc
SHA1 bed66b62eb3d6237942e97494ff486ffd28273ed
SHA256 a4ded1db17c5107c12c3429066e96145dd78e7a9f5e830c4a52a211f92080622
SHA512 259ab0bc475cf1fac9f631694b290352170fed6d1592cd718e2747121b0cb9d9a83abe0a6e018846c429d830aec67d29dc0674acbb3ebf3a3651204d09c7d83e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00261_.WMF.doubleoffset

MD5 a2e9eb447d1078102fa185ce9d142d54
SHA1 e2c61b82f4b1501a2f589c00326bd0526842b19e
SHA256 7d0a2680de5f50adf8d6a6b4f27313c53ef3028af00c4f0560778311dffcdbd4
SHA512 0d5342a05c6cca5c3a1d1a808ddb307a5f5cc2a5edd6c2fa3f2864f4ff74692d3b193683a361ad82857a848f393ba5f29bf0a736baaeff7330c3a6cd17464799

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00254_.WMF.doubleoffset

MD5 2b735b276112cd93a5bb8936d5bc514c
SHA1 0aa3771c3e1fdc60d1ef93d80a59e787ee2570a8
SHA256 9dd14fdc6609e1c6d301c148d9e396f5e5ff879ef07595bef3a0ea751acf19cd
SHA512 640b11819ea46fef051cabc68c61d3654f069eca3406bd6ae4b71e96f72f2c46caac3dcfb831f0216106ae98f42a099211a9a06f3cd5c7796fd394b5f48264c1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00252_.WMF.doubleoffset

MD5 73323df09aace640a7234465342d107f
SHA1 99fcdbd0574fc8a7d7460b2dad5df7b455e29e8a
SHA256 2fe83a553f28635e31e656f74d5ea34a86f83b3fcfd9bc42ea7746948b77125f
SHA512 ccf17a23456f18da8b2a30b03b0b47d954d15969d04e1cd3dfd93a7014b380f1ddbd29d1c3c0a82ecbf47d8a33a81c8069780877d5b2aa1cc13063b0553a53db

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00248_.WMF.doubleoffset

MD5 88cbe7b504ae5aa800570cb19ea96f96
SHA1 cab5b3591f91f14942eb1ba908de7fffcf41a19b
SHA256 49ba0923d905abcafa4391f064aea3e02824197d0bcc3154be9c489b6a54f78b
SHA512 afac9aa7332a0ceb713e4334029399b3d2c5d2cb45780a129987ee6137644a9e94ac11e024dcc92c50ca3f58a5898d72981fbe5c3ec9616124def258f13ea079

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00247_.WMF.doubleoffset

MD5 6c4ae07f11042b2e884d588234b2f13a
SHA1 f00b378bbb0af8fd5497f3decfbeb50e6d11b510
SHA256 afacbf7e2843b640df5eccccd17fb07339fb8e7eed4cae4392a278f06c53e685
SHA512 b4a3501e93cfc48f8e6e4ff26ae3d57932d50fc9fbc8750e50652b6f193ff3e98e9c5502a6d0af41c13fd935efd73f14ee702f068eda3c93e8c83a56a4d6f5bc

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00242_.WMF.doubleoffset

MD5 15dce7dc7190638f9981684a71178bd4
SHA1 475ef4279001d3fdb7c9ffbb8c6a0dc9bf8cef75
SHA256 068f159cf2b98b2fab1bc2d65912898f5f58b31918444677b32709caa10d4595
SHA512 fb7007708645dc1192bec4e2d280fd89394556845a53d23dad9c42e517ea355adc831f3940079ffd5eedd066af9ab555199747a75e4afd1e704fd75f8147a5a5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00234_.WMF.doubleoffset

MD5 e6d97a5013c4d7fbb56fffeef1090a82
SHA1 22c7992043ed42567bb06f1865c6406329f37d33
SHA256 032670f85138901b17d35180fe9d1c2a20ded518c882fd2534aebddb115707d5
SHA512 67068d990db18fed3d7f6df5ea913ae57f6c8e8b3ce93b57f0c4cfccccd1923d484aa15b2c4db94d83f672e1a82d2607651dd448bd7dbe1ab95637752bf7ca85

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00195_.WMF.doubleoffset

MD5 82c52d146d210b1322263e5ee88fbbfc
SHA1 d444d0aaad0dbd1584ccba28e505db88de125373
SHA256 9a0aeb564f98122cc6a85d5e40abd16e5531ae4138e5ec34f6f88b9881032aac
SHA512 7a67b77215cd15e233b15cbde6c2f0d4548aa818ccd8c78be69f7c82f1420a8e2777083f4a00d59a0f000241d2b1e5ec9802345daafadd078725d746d53695c8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00194_.WMF.doubleoffset

MD5 f81d1f81e9678ffd34d086ece4238e80
SHA1 71e2580e26ac50a9463f29a932c2b11f33ac3690
SHA256 bab9992b042b582bc5371b98b0abb1aa69716249e521c4a49fc6b5909f9f8ad6
SHA512 0e2f289bbe09661859622d04b619f8e3318577a268790324884ea56890a822955f5a6772ee2c98259679c921f2d77be8295a378c79a66845aa0c7764709b1912

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00152_.WMF.doubleoffset

MD5 384616554658ffd78093de3a30624aca
SHA1 e6fa7af3c3027a8fda3943967e3c9038e717db84
SHA256 55b084e5447430a6184e59242b2cbed41e936d0bb6479ffe83b8672ccb817a28
SHA512 762c47d967a77910e3ed01818808d7c3211e98420c7588c7a7e88c5894202514a134f83f88f0547781c7c79b988c2be465b357c1559b9cb3f13c8217906dc84d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00148_.WMF.doubleoffset

MD5 f40048ae09a2df3b0ba22cc553b830b8
SHA1 cddd438078ff17318093dbc584b89712a420c66a
SHA256 1c09bf05efec44f4a5ae8bd5e06e31a9f2ac63f5897f5d24410ee1c4a9b7849a
SHA512 a0145bd54115c008e72fb1dccf7d571259ec245c6eb44cba378fd088d35f85e4ec108dda16d6f6f0ace0a73784097b3868ce6e142fdd22535230e34524ccd95d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00130_.WMF.doubleoffset

MD5 76dd37fce07e7c767c039a418c227781
SHA1 1943ae8b0fca3071ea1912f97d8443941745124e
SHA256 5fb111461df8264220254c201f363f8775ce128c16319f92f5f13d43a08fc88d
SHA512 6b52aedb617642ec70e7e51c20ff7efc47d9684cb16a64040709913b08acb761c64152c67f7262551e0b28ac5b77659cd8eea9c255967f64ce98f028a0879d03

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00122_.WMF.doubleoffset

MD5 95ccb6ea8aa05a9572ee79380c3028a4
SHA1 d53d84189929b46509b052aaf242809e370961fb
SHA256 ff75e94e885ee80e37c2fe388b444d9fa947a3c3deaec53916559bde9a2727d0
SHA512 b2e9b00ef3d31ffda1642067a00113ae00b174085b9bfaa059f8a689d06c5867cbed198e5cbe577e2c9fae6022dc77ceb1e3323671a169b0f3332a24b0558cda

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00105_.WMF.doubleoffset

MD5 221d2ebb1c3d1e85659d169d276e084c
SHA1 554b6ddeb5342731320e976703ebfcf9af488e56
SHA256 f117b67ee7b87521549457129efbfe7b16ae4d36abf84355524b225ab668834f
SHA512 f31f22093ccaa148bf049d53ed640f1d440425f2afc85869ea1408feeb21352eda726b2813c0b86063c5e18e67848f0085514040b1c518297988c23a183844ad

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00098_.WMF.doubleoffset

MD5 d42dcc95fb46416ee168122cd1fd6cb5
SHA1 b901913dd72447827549cee341f52da9f9008005
SHA256 521a852d6a490a174da2f2516037d9f5dc97133c4509640449dce2f81da2f2c3
SHA512 bec7a9f0ae505582075014940015071a771c9fe4ff2fa5c16e9ebac473ee2d1231dd0163a1aef05b60e78825d950579004a95bb2b7f69d0dbc9f8823620a2267

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00045_.WMF.doubleoffset

MD5 65fb2a6758ba50a82c8585dd55040d1a
SHA1 73bcd147c6377df450691aa9d37a928608206ed5
SHA256 b8cbfe9f54f41d789cda530c0e4eb0ad8f9030bd435fb5a0b3bdcba9f8f1571d
SHA512 f60fdb2d1a14b7e4d8d8820f726541637c585d3ba2f7e448d0fca6e562532a9660907323646a6a38fd72863f81d778fb20483385c7b8ae9eaa27e060ff78377d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00012_.WMF.doubleoffset

MD5 873f882710aa33abc68b0eef9c99e5ad
SHA1 cf7fe001bf0a58d320107993e695918e530395f3
SHA256 80f870f4a275fa80aa4b3d61464ca6d822976b03aeed087ce7f719c749b9e458
SHA512 8824af9440fb7c24dda5cb23f4cadbf296e9dd43ab8c057fedf82424a8c37100d834d02727fb22a53392757416058d0f4aa5865f39cb4d3f432b34bc26863742

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BL00008_.WMF.doubleoffset

MD5 8db870fbffc2d71ee9bd5e2e80dbcc92
SHA1 5fb8dc98ac6fb21afe744f3b0a9530fff5205857
SHA256 04c7cea4f9978d0f6aaeb483ee91b2c8714d7c6cdf338dedbc58b222231977f5
SHA512 7be042a25d06f64f8b0781358f8995398bfb29b1a4058221d1f889c6bed37ce961422ede733602c4fd9cc2a6282e83305c8f3084c31006b9dd88a65b20b84a11

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD20013_.WMF.doubleoffset

MD5 ae364f411343e5d3c9957e2f50d4582e
SHA1 061e1c033237dd5830dbe54eb9c9d14ba11886a9
SHA256 b33e294924f9ee6abbebf8d307c9b8a423d6047b217e3971ed0e15b90f5d9768
SHA512 686d44de8dab25b2d109e063de043a0c31f7df17d5d3d35b728926f5973bb217477a5cead4a78279c35a129697906bbd0a0c5bf648e42570876def6c093eab6d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19988_.WMF.doubleoffset

MD5 8c0b37fee77ce957d3c5de6fed8b4545
SHA1 aecf12f796c89e305f5c99e0ea3345259a0a5870
SHA256 cf36a48af056cec38af13a3ee93d51a2fa462697b4d26f0f5e5ef33e307a030c
SHA512 12271a560f6ef29ef532f7ebf6d055b13eede9b74b09f2aec4ec24a3c3964ed313b406c3153c5b8bd81d732d7375b0015419ce655adf58b9e64849459e58c18a

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19986_.WMF.doubleoffset

MD5 4670824de5bd97c03321cd79d3672767
SHA1 391f4f935c44eff4063cb1804ab710a8a7f90e9a
SHA256 c20ad956a06c0ee4dd5df98e3b7ecb0142835d6613e1c5355f8076ded05945af
SHA512 a2759165a3275c9116438962a4e56508854e396b0ffb8f432881beb19e2b02ad98f7743280f4901fca8296995fffb3c55215c4e36fa2dc7572e55d4764986799

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19828_.WMF.doubleoffset

MD5 3da258bb3e36ba115ec9e8080cbe8e3c
SHA1 32cfd051caa96fd19088f254d7bcfd42672a15b2
SHA256 e3f73c3e8eebb2e5d032369cb4cdc1856257e6c9075cc50e6892f1c8514d7f13
SHA512 32c0cc2367fbea6eeff4bd3abcb762f668c0318c7995a6eda2bc0ec3b8978d6414f5d70cc7f1b9a905abe8778e52bc64271a8d467343314a69d86df24f62cf3e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19827_.WMF.doubleoffset

MD5 cfff711fd7d57139299961915aa07c5e
SHA1 12d2e6f725412f16a02f25cf02b910d5f3a1c81a
SHA256 eea254bdfa782ef676a1f1ac2b78542d749cd561e5309db4b3d5c36eec4e351a
SHA512 488c66c715dfdf01c0d2b88a122cdec37ee307709dd09429f55fb8afab8f1bc6df8b5ea0937bef453abeb5231385562f988b5c4ab0b0547c2a92dcfc1ee1c0e8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19695_.WMF.doubleoffset

MD5 442af818d1505eb58b247e0e81fb716b
SHA1 d34207329c4502bebe67b0e7c31c631a487d85eb
SHA256 809b13756889bab6985b4312562e0058e7a1ff2ea140dfbfb620456315b8367a
SHA512 c6d898472a311da1f8c2b8785cb5e80fa5365012397c8f42256b61849cd753fec2cd00f81d442406445158051555b025f468a3f13ab2fb53b6d55795859a07f6

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19582_.GIF.doubleoffset

MD5 4f8b3ff0b56a0ed4aa8d6f482ee08eab
SHA1 aea97ae50629780a997854ddab0bfb36c800e36f
SHA256 11f6269ec650c77a919e1ece2843fdc37c4af8fb3b0ad7f3df1013b6ec41a8c1
SHA512 917f22e827fbdb6f9337af5ecfa89cb75c742da6920ab75210d0d00ab7d09c0965ab432475e8c7c10aacc11709bb4237513a6b66dbe3d96e9e60f7b278dae4b4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD19563_.GIF.doubleoffset

MD5 2adefd739d8c514ae21d5a7be35cd150
SHA1 1bb9b9dd62b37829722c21946e9fbc47f279b228
SHA256 c5274a87daec959575ba74d2622727ab370025e1972e227570caa006d1e4a291
SHA512 228981a6919bc7e19110f5ab9d0bc2c695b373adf796eed5803ab51a7139c47e134293da44832c85386556e3e03c8054a4699fd06136243599aa3fe9f6257211

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10972_.GIF.doubleoffset

MD5 4fd345de410cd1fbdf13f75664abd62c
SHA1 631c79cfb13b915f761c98c6fe3e72d8b96ccf61
SHA256 e9e513116823f532d0722183c03661dd465cf1de53ed53c2b1f3a885a6a1d4b5
SHA512 9ca5b4a2ef0fc01dc52c980b10462d2c8763bbe6256dd0fecd085a30e517dab3dbbf777f7d2286a53518a6f2745832cbcb5e0980aa78a0a00edbf594626a46c7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10890_.GIF.doubleoffset

MD5 a56fdc27297587327651cdafda041beb
SHA1 b0c1eb11f464ed96d79f2c84f828b8c619a9b594
SHA256 79451bd048e96abc445e6d59c885f5e100eafa772d582c49e40e63e770bc9279
SHA512 8efe9ff1a39522fee28590e4d1e2812531d90d63219a25ddfea2127882ab982e1056cad38e645c3dc55f78e7d36a3e0b773d83a68751ad370e386aacf9762e7a

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD09664_.WMF.doubleoffset

MD5 daf63c4e68f397b5a0d247a461c1dd88
SHA1 7358ac3960d2e6ab5ef9ba94135ca1e184becb1b
SHA256 437c7abfa251e7bc0138b8076f9b70b1c9a4fd6d15171286e1d5737b28822091
SHA512 18275aff5075d336035ee8702bd5f44368a70eee196c5b46cf7c66a874ad5785b144288c788ff05176eb571ee05bffbcc436c2141796a99f6210e3f647d73ad9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD09662_.WMF.doubleoffset

MD5 69bbedacbe9eafd8ade05fd5f95abe86
SHA1 f1b2c21f5dbe80bfc171313a867b657261aa8035
SHA256 5c6b5b2ed0ffcee759b964b026bf58e8b13f3c45b9e9fe1271804c9d2e1929fd
SHA512 899463e379a3c79d250de8a24d810cefaff4a5e226d117e94f57c3c1b0cb9580bedd8cc14c0b5798247a7c090290d0bab758dc3b16c18950f9ed839a0970bbd9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD09194_.WMF.doubleoffset

MD5 69e1168d0f250bff421abf7f2f9c3ce4
SHA1 c0cff1abac91a994e9e664d264affb817e15be0b
SHA256 4cf86c584767c2c016b6eb834443a7dddc0464135153f187926177e35f9fff21
SHA512 77e4cfa44ecd2a66fa6a47bd5809127fff584d3be829389bfa3e2fb374e08168e2ed0f936fdf843955dd0a9a522d9842a33289cdd79f1a6c52c71e621cf35bea

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD09031_.WMF.doubleoffset

MD5 ab59fcf8342ec26d92e632eae5790eae
SHA1 48258eae58bc0d3a338a1d6f3c853310f6295cfa
SHA256 1d7f41e0bb5ca64f2c9e694f15434ffb06a3c1c0af1e49c4b5479f2677522094
SHA512 2428cffb4a0b94556f9476f136488f00b60e4c5fec8349d45f23a31d3b87bffb98d9523da38377cbd91199f56e9a5fbc8cce9befebd9d204a4578d7a0dd4f1ff

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD08868_.WMF.doubleoffset

MD5 4c8bd071a0d4abae9c44170c918654aa
SHA1 13def581dd3ea356a66770802c31d39bdeddc2f6
SHA256 07ce7baae5d60d0addd424d6be84559d1e22f3c225d1c7ae598d73cbf4a145d0
SHA512 1944352bdd8102dfee0ef6828b308a7ae95cf06465d09c0b95c3e6832c6f68d77be4848fb49e3a83b814d22238c0a22cf75a5b12500115083f94bbdb8b07bc6b

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD08808_.WMF.doubleoffset

MD5 91c375efae4b0cb7c65537bb3b5a26cc
SHA1 0dabf0544f1672b82ac1f226043c8dcc7f10a5a0
SHA256 5a44df6e199bd3dd8a18343c1f598acfdf44c2b72d3e89ecce33a59509fdfb5c
SHA512 2307ea718651a64cffdfff10e24a3f4bb112099b7eae82496fa5177171c8d02512bedc0488c0fd41e36e26dfaffadeca13f1b55189d9ecd6f658673cecae61b5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD08773_.WMF.doubleoffset

MD5 aa895eac1f26d49d3feeed7db949229e
SHA1 2d18f3e1d18175605fc3cfc09868821901b88e7f
SHA256 de3faa58b6b4178b79a2af5c2d2ccfbd4ac5fb1e2f3a089f2d2d56c720448887
SHA512 50dbb46bdf10efdac4b5936285a683472bb29d66f361d17070d0d91ba40b44625202bc57f6ea7eba0652f9c3c7a5cbc66dfdc19b97c5932f715bb202724d8ac3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD08758_.WMF.doubleoffset

MD5 459b2d26c83ec21742a3e3cbe2d9c3ae
SHA1 c914ed3a3e359d23a505f587d6182e935a730ed1
SHA256 3aaba8acfbef5b7ee82ced3216d463443b3eac07013a84eb14f9f2b10d0e2484
SHA512 0763d828b0573d6fba309bed6a43c2e41a6696ae2b71daed3ae6dd2fb6ba8374bb045f3e7f82283a6a278214e4a4f9e0ff52ec199bd772df7e51bf1f0213757f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD07831_.WMF.doubleoffset

MD5 6025ffd00a605580892294a952f934d4
SHA1 4a2dfed792ce0b116c1742566fdf08dbb5b71fb0
SHA256 788f3795fcb8047017cf9ef25d1d96f5c3227ebacfbea83192d3197ed0b28f43
SHA512 2905215577bf3b90f6030aff296df58a025201a32ff602abf32f8d4a91881a4bd9e918b0e624d233069074e0ff693e7f06b17f31fdb1ab08a0b0cbfe2a68ae67

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD07804_.WMF.doubleoffset

MD5 144f30bb80a715a4f1c076112826615d
SHA1 6a66971f7ff910f7c354c716a159ba9dd7040a7b
SHA256 1e97232a6bceea4b3eaf9df4f6daf563779285ec5412271785b62057c1c8ac2b
SHA512 87d04d5e7d7368e67fd9f5fabf7a461e6960096fef693ab98c482dccf76e2d5033a95a4680f4c8bf119fe7f08e057cbaac968d1449908b0d79fa9ef89543a344

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD07761_.WMF.doubleoffset

MD5 12504a532c68ef6188a32935b596d52b
SHA1 e2c51aa1114a229343e2420bc2ad428ae399457d
SHA256 6a97df2283a595716abbb74f580f63fdb08095ccb2caa8934a95ec9fca44ddbe
SHA512 257752859f2396cc1d06a0d398b317fb437409831426596fd6474f3429b4bf000f782db54a8ccc795f0ee67f1d55c7ccde220ee139df5b7974ce624c3a193cc5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD06200_.WMF.doubleoffset

MD5 8b683fec148be3f529e9ee97a543733b
SHA1 e06782c306a98e6f002994b00eeea8e8da332824
SHA256 7d023afc2b0ad3f3ba2b9e2909b2123a8ba8e1fc61984d2e58c40d2554964949
SHA512 5ac8f6097cc0cf2285ec7175ab0350940d75b247967dd7ff28613f0ca216a3ce312d423eab8a2203020f5e46f569aaedba59a77a1d594465cc88711353aed1cb

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD06102_.WMF.doubleoffset

MD5 be6101ced4301b4c110ad8015f63d037
SHA1 bdf6f7471b85c2be8258f638e268aa9151aa46ef
SHA256 16dbc2b8dddc8fc52bae570bb256d54b948434f34a58cba30b6f9800f015db49
SHA512 8ad24a12191989c1f16da426f1cc07100058cdf99cce9c43d7fc58dd694a63d27ebbcd66a2acd636718e021435d566e71d3696a0e64f8a5c5a007218adaa14f8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD05119_.WMF.doubleoffset

MD5 ec2c3690bdad82bca5fdc6768303ed0e
SHA1 0a854caeb25bef3c81456534b319d18d2b3066f2
SHA256 dce77eb3a64f01da2a58af07e9423d62319817d455eef270115bbb4602dd2f5b
SHA512 892275bdb9f9bd73b8580544e29d73bcc42d444bd967a22f168c2bd23300a7f8fbe384de6ef0e641b0b5e593d8cf9a8ece53f87e3562143cc08a924b6adaa6e1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD00173_.WMF.doubleoffset

MD5 ac22cf22e1ee2e445bda8636f2dacff8
SHA1 ddf197d265f005297f11ebbdda656071ffb72f56
SHA256 6987a9ffff7f2806ac9de1baa1e1710c1b3e3ba4bab21142b1e75e42f1a9822d
SHA512 f42bf484b6ded82f9820ef1a47c562aba5f920c88a4c7fee13186d6ec396d166c31524d31e876abae1d5735583d3632732be0c8fe4c63d395df749056fd1c9e4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD00160_.WMF.doubleoffset

MD5 956bb6419dd52a529716b153136d58ab
SHA1 80cd7ab0229e369b9aae59838331ce429dd4ab16
SHA256 5ce30e72343e5ce0826a9981dfee78665a3d783240eb374d28b026973e01f5da
SHA512 4817f185aca7d07759f563576e6e35157c205f65943e72ce310c83254f0e8a5a6ef41492a1f81830d93731b0b892d703f9d85d2000154eba83511234fd5a4fe4

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD00155_.WMF.doubleoffset

MD5 8b99c7a25c11f069949b9cdc12db861b
SHA1 d6e8a6812ccc2e8f25aab5fdca7c1ef97c2d4195
SHA256 7cfed44dcea2baabeea023783d49311ef1f9b82d3a8bf4e52dafdb854a26c1df
SHA512 9eb4759cdd8d079672c5a923c4769f9e0083f21cbed664e23fb91a5e4b49a5fcd50f1e49be0790778f54bddb606ab8c8b9e8b674ec6c6bf1226a894bf7510566

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD00146_.WMF.doubleoffset

MD5 1ed30439de00d2971a37bca7bf3dde8c
SHA1 efa0756605a3f7e7438830b5f94abeefb59c46b0
SHA256 9252c951715e92d33ecedee10b33f2ff32b0ca423943bc801531838054808f33
SHA512 2506093de210088d31e557d6ae6ce4447501b0a8945a6693f2ab57490ebc05b14522aaf4caa5803a790a2457d14e0014f91f5b112458ab7438a2bc7bc9ba6735

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD00141_.WMF.doubleoffset

MD5 b8e327fe5a9619040bdd27fce659250e
SHA1 681067c093b55fb7cae708874980b5b023a3f72c
SHA256 7cdd6e5609a539ba4bec270f5042539ceca909f8f36043161f59f359c3b9f0c3
SHA512 1bb3a564dc4994c6a0bc28efdc761c8c443422c9e2cf73d231c57d16c452cd09813d2235ec0a6282b5a84adb11c2296a450dbc485e033dbacb9349c35125a8c5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD00116_.WMF.doubleoffset

MD5 5d425ac53a81fabdfb8d344e25780dd2
SHA1 5398a8d0d9c1f5fff2902dbdd7ced0ae1bf5e121
SHA256 b97abb9be392a059d9834f6f42b96bd5cb0bb2b8c1eed4fb95a55e6d6913a2da
SHA512 05bd6c6c5d15f0086ae3c489fd37d21e5dea541f43d6c97fc2b7f934f7c63415d6151adc0713420081bd74d7f9aa814c43054c3ca710548786ce75c616c597f5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BABY_01.MID.doubleoffset

MD5 ca7fd1eabb7381c62f8038d709a5be34
SHA1 f7dff9bb29a5e7040fb053f2b7338308ce26b41b
SHA256 d16dc08b9c2a7d47eaa007cf9778e502cffa84cea3a36f9f802f3a038a2a8187
SHA512 ddc4d1b44149c9095d13d9b74881a020d5b0031c70684cea9d4eb0cec7e139ad90637323d9de0ddd8670c6b19d42d35d663451880e701bc82aeafc323ecff99f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04385_.WMF.doubleoffset

MD5 bc07069ae0bfbb3d7880ed6d150b3ea3
SHA1 33b883650771dde066c830c40460d7ce7a89d569
SHA256 b33769e233ec2d723177e12ad851fa9b1d05dc8688619c365a35b57870bd7d23
SHA512 8fa0c05e3af43b1dac51440f20b0095d24a53b7d057d2b29dd611ca2e906680cb69b6f8169ae1cd54e211ceb49e85db4c82c0ca5f60b68d86161cf80fdedb5aa

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04384_.WMF.doubleoffset

MD5 9789877a41a6c408c5767c5709b4c6b8
SHA1 46f448b6a08f3701e578c6d6d3a4b935c5800a4f
SHA256 4f4048b43d680a16b86a3fb56d8126dfa38a7dbcbaad9a41118ec85b6c2b9f0f
SHA512 12f4ba0243dc73c9707c17dafbbc65718fbe23e642df16bb38e1e3d8581fe104ac3ade85af73944774ef5a15931fb211ab3363857d345b560c5954361568cdb1

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04369_.WMF.doubleoffset

MD5 740b202fc2d2656e10d44c3fc191372d
SHA1 421401af620baea36331e7921b70be5d41c5ec73
SHA256 35df121f3376d37d71be657faae13da24f4e166329c30f5c66d57b4918ed8054
SHA512 65792040acfe3e7ae9eee197402946f568fee87625944e3da0af0d72838e026902841948c431949a55e25fc0b803f79f7d40bbc03f030bf1e9f2823f35648ed8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04355_.WMF.doubleoffset

MD5 438afbb74bcb22822dd3192339e75657
SHA1 c31998dcfbbef9c8ac2e95c2f350e6b58995b0f7
SHA256 1f456ee43dadedb6387efe0cdeb003c4118b014886a84bdd225e6875313069c0
SHA512 dcec22b9b523fc8156102aee7bcc46c4ec56bda6f203b9f98d5a195b9d451251e846d38a2aa7064a8fc41b6b2254468952e1cf70374cbfce0c32c667bb0ed5b6

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04332_.WMF.doubleoffset

MD5 1c31a40197a9a6cd7c1d3a2a10b23f9c
SHA1 2c15ea8d3b6d47e74cb15fe870166897702a4bf2
SHA256 68a802c7e317b21e94fcc513d05d86b807e69d517cd348062bd56e940e0337d7
SHA512 9bd75ce59a3a87a321bfcf1e7d8d4f7ca0c04bf7f94d77e701e9bafb3b1b997192704b812a6023650ed953836447a5af79daf16c40b00d36ce72b0a74fbc58d9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04326_.WMF.doubleoffset

MD5 81c820458b7e6f1fb65362100e24efa6
SHA1 391da0945e5f5da15ae81988aef5466dd6f111db
SHA256 f2621c9f4f5b1eb5eb8c4b0d62ca2731df034b45459ed8cab30dc7fff8d71636
SHA512 99f10449e6004ce6c3fe9a137fb30e15b594e12aeb86b47595321ba9d3a18f8e5b2b5090477bd8ab7229c0fcd28b34111473a5ab8a61edc818ba9631d7b104a3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04323_.WMF.doubleoffset

MD5 ef386f49d7841dc61e2146ad38c683cc
SHA1 00f3a6597d4791004816e63b586024e49f4fcfd5
SHA256 8e71f2e961aa68c659629aa0236f827acaaf3d3c39d8883c1b22987c90f6e16f
SHA512 b4c0d9864f60ff0c28f59c6d5d51547e1153fb5a15720f281237a047d4f08d79d69f3d63f48f0d57b8c181381cc1448a93375238ae0bbc73490cb56b23733659

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04269_.WMF.doubleoffset

MD5 7cf18d14f339cb5af0c968aa9366c591
SHA1 e59d0b9e67951be7e17c890427aa18d04729af76
SHA256 0d8101db313b129d1a31147989e6fc3406dfddb461251b9f27da32e8eaad65cd
SHA512 adb188d0bed9f41c9c4ab7ad7447bd891fcca57e8e68830eacc77a39a858c0d44a62899c96f25c90d31de3a13573c81c861a6a5246e4cc77eeb8388fcac63989

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04267_.WMF.doubleoffset

MD5 c3566a2307999a6beb88abd3ce324fb2
SHA1 c53ac08594c06539a3add614fb7445477b3ab1ec
SHA256 abcbcc6a7b966537058569e1c04a426e34851930394fb22b977b355435a2cd10
SHA512 2eb811681adfe92e9ce7a2386284f19589cbfde8f33773e7a3c3347f69b4ab04dc334f779018a449b285263db8170eb47477018763c7bdf1601b0152b24f7f8d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04235_.WMF.doubleoffset

MD5 28742cb0b53a42176101644ed239eae6
SHA1 d0c54c9d1523d9e68d7a5addd39938d8856e8c8e
SHA256 6716792616ce23249d879b6ad93a71c7341f33293eda8ad67d4d72313dce8e85
SHA512 20d57d37012d434d4cbeec30c5c193e16fd41fe13165452a97d02c2ca800e7c0d93d51e794efe1c56f9df9053382c24cb924e29ce79ca7df68a5aeb3587d1b5e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04225_.WMF.doubleoffset

MD5 b3e66d90b2b21c6b911723b18c99359c
SHA1 475b734e975228f056737ac55b558171c104a725
SHA256 9b7af4e23e57e381cafea5d21fb52effe802ba84d0de3b07f38a6253529876bc
SHA512 1e4dec3fbd9a12abc113c9bd2e433d89c4b81d9587056277e24d512862ab2e3bb8af41fa552ae9f9f0dea568760c19548418bad9a8d39c1a895602b14dc97b41

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04206_.WMF.doubleoffset

MD5 2f92dc3bddc287b433266c12739d3d04
SHA1 4695eac0986264763668ff12356ef386f2eb401c
SHA256 7cf15512985bd1f0cb955e0d511850bf5ebce5e2b986ec796495d35764bbe560
SHA512 93175be9e94eb8fd2dc66c9a2845935142376eba7860030ce15e287063fb35a937ceca51843ac35249ce2a96cad637b07246d96af1e7d0b90f4717104484fb43

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04196_.WMF.doubleoffset

MD5 e312764c5ff5ec99c458221943578754
SHA1 76d4b167bbeac0adf3f749aac4c910f370eb5e1b
SHA256 d5b01b45ad8f9c607a342c1097bc744e5ebc5a51b8be279dead21acba53b4c69
SHA512 96a094f2e545efdee1ee4df22724ccf3402b66cda5a44fe3614d46d71825474adf03c865b6cc1895c8f9670dfebdbbb0f0cb336af639df27352454b75269fd32

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04195_.WMF.doubleoffset

MD5 9d216426a9f4aaa5313a9a3a7ebae3ca
SHA1 484b7104c1ae70993faa1137d6e62297156f84f6
SHA256 8323440859ec7525f69d97e8ed475b0e454f5a02c5641f7849d2af256235869d
SHA512 c0e2e5217615b1fdee10a5d52e4ea7763300001016ceff238370c865763b2233fc79d015e923b3755018197327ac8325fef4f7a72c0870355e17c7f3459f6288

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04191_.WMF.doubleoffset

MD5 4916551ad7e2dd45cc08e67408fa7034
SHA1 6d29e7439a7f23461c0639fb7d3a04470e4e6a4a
SHA256 78a84c4cc5ee5bdb1c48fa5eea38b27d6af16984a50df52b22bda1aeb3f9b252
SHA512 a2439e703e86a48c486e5732164b56f3fe7062cdc115c6883976456c182367b6bbdd0aaaf6cb22632ce7166dee856336e016ff50bdfee50c635893fdba8a8b4a

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04174_.WMF.doubleoffset

MD5 cddfa9bfa24cce2d7ff44189421f0d11
SHA1 ac1f200d995bd2584fcc2f7a87ab901bf53b4db1
SHA256 3060e9fb36c083ff822b2dfafbd60eaa899656dc06014ad47dc6c128de1fe55a
SHA512 dfb20f154aaaec6d05267916fe6048475996c1bff212dc6e0531988ade561b6e5bd772706fefb2edcee53a6fadb0701667fb7ecf08b1cac04392d338bc32dfef

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04134_.WMF.doubleoffset

MD5 2b73efebb0082505ce84757031c96949
SHA1 55f546fc749a4ad7d097f22b508f38fcbb370f47
SHA256 a46ceea29e43f6d8e76b52c7c56b92fd5e4861d5a2acaa4787c5da457d44638b
SHA512 022fd8ec901a3ee51626cdd8fd082ea1d4258c9427cab8ec1a1c1e1fbef5ce1e11dd6f15211af6948bbfb2373562fc88ea5666e090372d96fe6620ed0c3b9aad

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04117_.WMF.doubleoffset

MD5 6c0df7968fd96804bd117aebd9eba721
SHA1 a26b40fb13656f28edc92ab3cb19271590d38d71
SHA256 1b2cc59164f843e220b0208c376f5cac32a9c3e51b2ebfa9ce01ea1c2726196e
SHA512 34654efc963ba56ecc075fbf98cb07f3808bfbcd7cb704fd290fb00f8cee5e6cdf0460c7d6377c2091cbef77c0a654255b13688674009c9c4f4916465019540d

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN04108_.WMF.doubleoffset

MD5 12435ef29aefa607a36a4c962286cdae
SHA1 5db92d61694b8ebb0707f4adf7ef164904d67812
SHA256 3a261f500b05f42fe0872d9906b161a803ca5b65e4a0a249de9b05296c066cbf
SHA512 9f2ace5144043e17ba607f19cfd6bd73d53429b0f80388a6304da13816c3972e26a88a3cae5bc199d81740af7cbc8f71469278ffe1585b600fdb2be4c595e8a7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN03500_.WMF.doubleoffset

MD5 ae0c604734dca10230b8df5c88c65c2c
SHA1 9a0f6c049409cb3cd050d67aede70c0fc408a93d
SHA256 c1fa2d4aa25db51a10f608e203c21b61155905986e5c1212aee628a4f13d6d33
SHA512 af456a4044294ce1aa57f013fe89078da922d0718d36f3b0c510901ea133f955bd3b721543acc8263a9f51bc838a6b15b07455fcd1f6ed5b40c83b831264da93

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN02724_.WMF.doubleoffset

MD5 436b3499e3d128fdad1e98f83e4851f7
SHA1 78d05a71a447b8427a52704e53b56c899db6c6d6
SHA256 dd6269c10da2d14663c78c2bacd52c2b6074b3c71f88dcf40de80eaf647a4f54
SHA512 c5202e428ac58b37280d4c778bbcc3edd832b3c68c181832796a81af806f2760ca300c12237dbd1896b34ab947c652a00debe111f7963748cdef11bc6e2fd6ac

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN02559_.WMF.doubleoffset

MD5 29f6e52ddf797f84a6ea64ef0c9da51a
SHA1 d4aa6d25ae97bb2998aa599a278dad5c6e13e46f
SHA256 2f3900fbebaa5f8d43929ba17912163f7f516c6568889a783324b8972108e72a
SHA512 e674f1d61d47aaab150a56ac6d174b454af5d1d01e05efd487f9c69d4ccd52b5fd1dac8eccd66ebad491a20eef7a86c864e1d4c2506123deb3fc5544b2d5061f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN02122_.WMF.doubleoffset

MD5 3ec0c24f4d2a871a21da8b4795b0e49e
SHA1 e4423d74375f62476f3dc2fe12811efa440a26b3
SHA256 ab9a79803a8d8727f5987ff2c049df8fc213deb9dad17648e9b636393114212c
SHA512 d089f983bc7ad48795b6dbfd52351c58e3f19ba8238def18d831bda938b7bff0c319a0aaa45bc4e7b635ee020679c1d5621a0bd692f33185af9813dd237a4bcd

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01545_.WMF.doubleoffset

MD5 49189209a3f712aecc656da20c165ff6
SHA1 557f1d15bcd2394a938d77af1bd28b24a0d9fee4
SHA256 e2450c11af30f32480daa0c9a78257c76931c400c7da07ee0e08073c9aa51781
SHA512 911b307c3089f1ad82be4fa538e547c170a1446d32c7179f3357b4225a84268ae36e136c094aa6cb569c7b062b5d57b1118bf6021bf79bf8b5016048be8a64b6

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01251_.WMF.doubleoffset

MD5 a48d848016eff733d62776974c76dc0b
SHA1 7394958fa77c95e9ab0f65546ea5fdaedae8cc84
SHA256 5dd5d3a228edd55f42a0745703049405dd6c5cd048564bf47509241e2062270d
SHA512 5c61ab7205c1086e833e88c2ba8eb0fc97c89bbd5129fff0bdb3be80907fa222fc2bb38461f8538c886c907a33ff275fb40625b62adc03760bc0e68efdb267d3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01218_.WMF.doubleoffset

MD5 2129913b1bc0967d194a4648ab2d2771
SHA1 d8d6980e11fab40bbbfa6516d3b92f106bfff21b
SHA256 4e5ac7a2bcdf72d1e827dd409e3360fa9e9800ca332ec07e320512953c2c42a3
SHA512 a9d03a916b2c67c10b20864d2a3b919e86695cb22fcf9959ce992df776b23105b909f268f0871ffcd5716aea992f819f5f8eb25783a7081accd76fa33b28bbfc

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01216_.WMF.doubleoffset

MD5 0914e23e0c70a83721e5ef063ef1deb8
SHA1 f2e00e2d8e8d28def18dbdfa126f77f6044686e4
SHA256 ca240e8cbcc9cb2fa66e840869d3a054bc9528142202243a69b3d4b65769efcf
SHA512 45e398a929614bc490f2752f9fa790796bad26d2dd6e9adef9cf58fa3ae4f4fd0f09886126a5f5c09621efac9b45f91df04508e68835a0cb2c02c3b75f79befe

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01184_.WMF.doubleoffset

MD5 dc7df61e8523fbcf6a41508879bd11c5
SHA1 e7908ed9ee540cb804976ebc6d269b7205190e7d
SHA256 28219834172ed873a0e96167eac443cef9ee253ac55797995d2708a36ca5342e
SHA512 35b736df846c8bb6a640521a672b1aac6806cb0619db5f2337313361a0b8dcadabfa7efa726ae0342fbe38b00c836556b5f13471a947f5660130f3f21be133c9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01174_.WMF.doubleoffset

MD5 20aaaea0d6cd281775a78a750ca4cf40
SHA1 c523f7fff3d99e7bfde97cdde2d9163d528b3ff7
SHA256 6f18814c3e463edddd7299d7425a479aee0bfed63faaa053cb03b656a36ddc6c
SHA512 6aeaa4118e0dca83164ff1addb1405716d1b3aaa7f583db8216b881dc30d4721e41008987370e8d988e603592576888ad7fb0a587997bd6e9dbaa255d76b964c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01173_.WMF.doubleoffset

MD5 c126573a330412c7fe07c2a423a4c8eb
SHA1 bb915be12bab794e10029a0e24fab4b042cc67e6
SHA256 1fbd0ad30cfc26f9ddd0694f32ff283d0160a2d046578506e5a9fec739618132
SHA512 22c2ccd37d8af56ce2007b131b4658e3800e410c0acbd5c99f7989f7ded2e71df9fa99c663dfbb6e077371b94f49a9068411dce49ce2bc3b55080c099ce37cb9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01084_.WMF.doubleoffset

MD5 32f3d89f4cf6c9f9f7b212f226622638
SHA1 0b01806a99c2fb8b5fc325f730eb5d96e7c90b17
SHA256 6844377829e12ed766becb4cb725c8a7a39a801bb3aa73e521ae6a04c711b699
SHA512 5ecaa01d17842b4e35fd4160bb72851b6780b30f3ce333cd16cce4865f3a62d4ba2837457737770042ceb93916394df470c668b40452f835d18e538da5b0b4e6

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01060_.WMF.doubleoffset

MD5 9cce3a6d513fd81a50d3392b1150fad0
SHA1 8c4395400aab46c92902b376ba314d05d5512d6f
SHA256 0742cd04b233cba94a3e6a226c0b245c2f802723549dcc8ea0f3c48e16f1077f
SHA512 d8cc48e7047e24eb218021bf4584af89f028ff3605ee0683e62dfcc7b007fc5cb9d937f85e37f00bff9dd83b31b65fbc55f76ee203e99104d840f25de8c53069

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01044_.WMF.doubleoffset

MD5 6d273636ca7b7e9e16aae082a90d8329
SHA1 b66b9e35a4388662448220da4a200ccd4d8bfa86
SHA256 14033e4be381572f2bf8f6863b0c9880f5a1819a8085d3f49460295033297100
SHA512 87c10d100f8321e951a267f84da2d707c2e374cee9f83215437325bf3130658f220555c2e4438a044756cf5002526f3cce92ef20c8e484ccae68cc4af64c27b3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN01039_.WMF.doubleoffset

MD5 ea1c21ebeb76436dfad2072f27f1d271
SHA1 57bdf81a2ea27deed98e6b6b5c8307ef1edee948
SHA256 948a8b80165ebbbce7f291f7d5380ce4725f8329ec86f7a46cfe64f1c8798114
SHA512 c83b5139f1db912eb935a1a9eae7d00c28a146725927308b63b537c9dde2e3c18c54bc0146d903cf3738627b53ec863624cefc7e32c9d7cef7648409a95aaa46

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00965_.WMF.doubleoffset

MD5 cd0b71d84561c8a148fd1c545dfdd31b
SHA1 f2e60e0a136b03bacc1f28e844f2e24892e7ecae
SHA256 169eba7efaac42c1fdbce3a4d1f60a6248f431f082a3d820968269057a533177
SHA512 e287249c93353a2f119507ffe0459443115f94c13a3d942641e9e3aee0f3a16c1a39be90fa028b6e1e66f7864162b0d7c674711d52c420b2241e99cf86832681

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00932_.WMF.doubleoffset

MD5 22e7b87b522d4cf1121df79bd8953d8f
SHA1 6e0a482c4c84c59fa8df557a0877b92d07b3cd9e
SHA256 e78b9bc84902988684a35fac1eac3d8fc6ce01d7d53eab70635df87e9c343c10
SHA512 326d4b84c59037c7a5d32764db9cbd57a2cdad135423ebfdef5acd63edb7835594bdaabebb875d5e7786c0022997dfc15f034150d50e4f9449c368b4f7845899

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00914_.WMF.doubleoffset

MD5 3387234f0ff423af91d17ec4ccba7632
SHA1 606412866e260d588e7ef7d44d5cd6eed8195f2b
SHA256 eba5b9034ef4942909775c123dd48d2404158bbcd150cb136edc7d7e588ac175
SHA512 08667d51b71d65469da58a5352ae495f9ccc95f2b40bdb79aa5494ff8a78f4511ff0f8b404e0d387d8b0deac4d5a72a93aec26f26544885b1e575283b03d5186

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00853_.WMF.doubleoffset

MD5 98a3e132ee54e3b041de5bde677c8cca
SHA1 a555902fa506c959f77a39508bed8f70d6cf3b2f
SHA256 31c966e37f9ceace7a2a71995756573fb28d11c4a242fb935ba6a9bc31634953
SHA512 4bc62d4ffced1609026725cb8cc27f6462248a4ccb435c0f977faad8ce363bbde108b53d5fe4e8b2c0995900b78abfd0746014524737d5e1bd44128dd0b86bc9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00790_.WMF.doubleoffset

MD5 e0d7b65f48f09e1529154e26fe7fcf9a
SHA1 4ba0e5259aadd952d5ed2483acaf531e45392ea5
SHA256 32a20e577804da67722d81534db719c521c0777ac0ae53c66dc363100eded567
SHA512 975f02d031aae963de74c4110b79b99f0bc424b33d5cb79f883b0a5c026604ffb17331e2af203ca7dc473525f0eecf01286338a7d6ebf1178bc7dbb38e314c9c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00015_.WMF.doubleoffset

MD5 203bf9c61975435750b06d3336c9c08a
SHA1 e6050505fe85b04cd3b6927d94aaea5036d62e24
SHA256 f4a180a53d66167eee27ae9609f2e3b74163404b50dc81f919768795a8d6fcca
SHA512 5791b83b047991514a6b5cb94b99bd16677ecfb4f7b345753172706850f61e554a5eec2056a1da5e235493e3834c8cde801521519824cfa11353d5e19a2c44f3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AN00010_.WMF.doubleoffset

MD5 4c73f9f18ece74a9d3db74bf85a841ad
SHA1 316eda6f64edd9ac55a771e18c16b8bbb74fe214
SHA256 e80604f684b9eed8a3305f7480788dc26860f4456981abcdcfb0ca049ca4ab3e
SHA512 8b7f1a0eedc502a41b7cb71bd7167a15802b75af5e4826ceb84e853f64d4806fcdf77fc92a186c83ccec539fd1cfc939a913bc3d24f3a7c7cd74260b70ffa0b2

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00176_.GIF.doubleoffset

MD5 0f4facffdac25fa7a3f7c7e92cb873f9
SHA1 423e3da681171ddd4ace1f0d5c58bec94f4fb4fb
SHA256 679524f9855c23477dda4ed4871289585f7d7a0614447ae4a7e782c08ec6cd35
SHA512 dbf1af419cb8ff12a0a216cd3493d4b6da011bdd2e2e4421b5a4c71d250449735ace7c18d405be2f554c5c6bdbe14efbfffa47de6a111bdef4279c48d70a600f

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00175_.GIF.doubleoffset

MD5 a83a483bfb070bb059bbe2fc2927fa74
SHA1 f3b037caeca4181ec0e1e2e5012ec81145ce9802
SHA256 7f9237e535b44cbbce53ef81fdb94885efa1b33293f8b0a1d4086a7ea372e241
SHA512 4f5fdeaf9b503266e79f0bc0f2ea7417650104f2f00b39c6e8cc2deba6536799e31e07741b3f78bcd3b5675845ea05e2a63934757c4fa37ed31cffa4b0e02470

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00174_.GIF.doubleoffset

MD5 a9d52fee9e258cce0c1edb9583f69047
SHA1 e4b7f9e5b15bfe6dc2a81ee4fc60f8f5ea7e4c5a
SHA256 3a00142e608f3ce6c36c407087d54012f28d27af754d579e82de5be8273469ed
SHA512 26c837c7869a6ea29956effc072cb82363c3227f38bb03855d40e498195829b0bfe4b2df3ddfcb56d5e37bbb0b2d6ec7c397c2d2ae0edf1ae41b440b7ee34d5a

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00172_.GIF.doubleoffset

MD5 ec091608e1330ab790d4c1aa6b103753
SHA1 d328ef43f5ea881ac01e7d12b6c1e705115b3f91
SHA256 9d44fc0f635302649d2fb483919c0375b4ef7a486959cf456d1f2d633c78a564
SHA512 3497f6342db47ef16dac737730696356cf9a9bd98662afc72b61ca55ee1859b69412cf67318180601527a3fc54f8bee2b639d1015ca2d579b81b15397e0562a8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00171_.GIF.doubleoffset

MD5 1418fa9505f78d18814781597a6f8dfb
SHA1 f5952519d2e98342815173ce5fd3df20417c604c
SHA256 8b54c9e8a2d84175fb96f946318d5784743b23a406e188dc326d017d5c50a618
SHA512 454187fdbcc0eb344fa78897eae543697d096f03a568607a5b4741671cd9ad1d1a7e379ca13ba9664c0a38274391a1c2fef98e90cee734e6b0b508953adab82c

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00170_.GIF.doubleoffset

MD5 3d3e9039b421b552683af1432aa615e3
SHA1 616035fed594cac80d17d73a1a6653932ec0f884
SHA256 f4ccdb653e11a5a99e552d8d5473f89df25685257b3f4cf2a7a4ab6c2d523191
SHA512 3f8d2bc821b9594b19ef644221e2afbbbad41a00754aeb8792900adcd18f1951a4cf897f28e3a9428d617888183f53c064411e540c28449a1382c0b9fe342243

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00169_.GIF.doubleoffset

MD5 b78c3c4cbff3497e361829216923cc82
SHA1 8e8cb9297f898c6e8034fd1c6fe7209e177ae0de
SHA256 993d9bc319dfedbfb650411a1def8b80f41aecd01cc15a2a4c2083a3850e2ad0
SHA512 ac50badcfa9f9320656e1678a049ddf92d94189d044f5c42c589f7d4ac8e408ce7d0169a5acbef1917fbd22684c4bdd306ba8ecc7fd194c3e8f362b4b42635ab

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00167_.GIF.doubleoffset

MD5 b23c07ef9bd4a380d9f69b53d732cb56
SHA1 7cdeee36214cb3cfff63eb9845a91c4e2934c454
SHA256 1632cb2a1f74889b0cd59d1639989a0fb545e71a4f31b8e09961091b34ce7e57
SHA512 dee66362976f2d29abf4e10c75857a8add51b9d94929f15d5b58df658ebf6a8ed322f6cab7ae4e161e7a1e0908a5225c2ba38af84090e0423d6d6bacf213e38e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00165_.GIF.doubleoffset

MD5 0937117c3a9f65c658ae2997cab36cfc
SHA1 ce7967e707cc7810f5bc70fb841a0e05fd5bd34f
SHA256 1419728111922a76e999fd1bb1fc87d234246f55d677dba43668f4fee0328715
SHA512 3b12a03e5c274483942c636b592127c44d32c5e9c91254416fed6418e13a10d7bb4e08d2c0cdd7926c04e201c9f8506b771886cbf6178736d2717afb6e720d09

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00164_.GIF.doubleoffset

MD5 7a96f83a4c4ddfafdc5d56b5ae66ef23
SHA1 9e12ab036fa879ea426f5eeaf300d250f0dd66a3
SHA256 560b80d927fcd20f0b7a83885a8fdff9c752749923c79e8c7d42ffdec146673e
SHA512 3e815e1b68155e139077660986dec41e75fae0d1cbb31dca1852a615bffb6d15e7afa33fcb92be3d630a7673ce272658c8e93bdaf75da6e2d851f1aa7ae9696e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00163_.GIF.doubleoffset

MD5 cafe6d609f819d72b84461baaec61cb8
SHA1 09275e4bd5a0deeee3c0a2d28151c6ac356899cf
SHA256 5b70473356608a86a9b0dbe895e59b2a3679c3e62a3b3dbd0565e3c17c68a7f3
SHA512 5693c7d7a60c34a9a991da25d9b5a41d87dea9d0ffcb48519f5a4eff80a0642714c078b23490a30b5df1a128a04dc6a6617585a78cd0d51dbbc50faad62270d9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00161_.GIF.doubleoffset

MD5 58a785cf785ed62dc6b8a6fe9fb6313d
SHA1 1de6fb417742ed190ef9440a47747e5cf847ec4e
SHA256 f2b062dedee8560223e014f35847e8dc5041d39871cbd232cfb57008b79d6971
SHA512 e393264acb3710c6456bbe577e45ede2be1d9eb8445bc82bef042bd016b3a13f1a94605f1d45258e15eda850850b8133d5f9076d3a2abb644dd8ea73443be6d2

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00160_.GIF.doubleoffset

MD5 6b377c74e68f89f9ac0f17b7175f9e34
SHA1 076c65c5be3c8c47674a11486f0c87160c492eaa
SHA256 09076567d370a29a55e5c1d1ba0c633ad8b1c299312bdcc2b75d3e0498f6e09e
SHA512 421607811dab1ca03e66c78cc0ed17103db9ed17d12ccdcda4008cf3f053b7d645fd0fc47aa73ffc95316fecdff4f646b30b4a8b93021364a1bb5c2d38fe6724

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00158_.GIF.doubleoffset

MD5 da9d0383649a5f1d5e1e67b697f815c1
SHA1 28173c4f31e66226e34743c933bdfa0bb60f30fd
SHA256 f38a8e50da78dca88779ce4489aeb21ca07559c61f2787d007a5807dbee39277
SHA512 77f5d941d83ba21d046420f9e1e6a149c1ed77bbd71be0010d73bd9852d949af9f656bfdd5789c86968fb4c813adeca7648b5a6c0cc0f211e899a4537ec234c8

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00157_.GIF.doubleoffset

MD5 da336fea7a307eff806d8d8744e7cb30
SHA1 afe782ca88817fbf95f71074af20e09b56e6d6ee
SHA256 77ffbfdad1d61a479c77e9efe7043f09675807dd597abc7f8ae08cfa1f67440c
SHA512 3084dc9c5a65df92ba82c8849e274a5e6848678f734b758ba1ea9cb38a25db095011966a112429e1b9af36a55f7d33ce525ecb5bfe04278827d2b2359f3ce655

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00154_.GIF.doubleoffset

MD5 c0fe961886a9a005f2eaa26928130be6
SHA1 1d748f819f88d65dd81ce827536e64e92a5a6e32
SHA256 85b85d4832d22cdf1c26f6ee57e4aa94b8b4441a1da7036e625be033e069e1b0
SHA512 57bb0215bc9e69d5064edce20ba9b6508ccea64a3e275882494698fad83b14afea6d33208a5b6c31f39fef3a00a0a79a0c0b724beaf13fedbd81e0e6e5f0f511

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00142_.GIF.doubleoffset

MD5 c4cbd1ee7f5ddf5029d6441f6f37bb3a
SHA1 d8dee718283bcea1cb154d97954cb74e4447be35
SHA256 68d87a519f8314ded3b422104a82d03babd9977b376cc5f478504edbfc3f377b
SHA512 5bcbb7b3c527d9c0f59005ec8578aa02eceda7e2ae86a5cb8fdc4fc8637f04f22418af5878370dcadafa3f0def368af45b9fd3959c641b5a445f1e28729255a3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00139_.GIF.doubleoffset

MD5 1dc94c708340043a99789ed88445d1d3
SHA1 b3edcfcdc0ce9f49255ee3238275daf760a9f811
SHA256 aa556cc182016333ad7dcb52054da59f1245cf4752c254914613046c3dbc8ed5
SHA512 fa3ee09488c4b1220935caed9d95deacde1f1e6b381a66bd243a8e43ff1fd60e5ad609f85dfd36a98da99df685eda81e80fb9252097f707b782a1a8993cf52a7

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00130_.GIF.doubleoffset

MD5 4ed76fe21340a95f168dc7970e2fdad6
SHA1 fc45121736ab07f459a2ff2335015fd6c494b0a0
SHA256 99a84cb715168ef99ced3726a7311f9149ca1c04850c1ca7abc66b52b9544887
SHA512 8bb4973bfe5ebabf041c38726629921677c14b6ab2aeb2d26678c93d58ceb724bc778d561b20729f70c00d692df3a9fb3a2de4d1d3775a5839338c14f9eb2216

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00129_.GIF.doubleoffset

MD5 14a945fc31f2bd78f4582d726e03bbf2
SHA1 59798466ce08e697e8d6a54abd1a084398a5958c
SHA256 f03b9ff659f9ba7464fb4ae834488b8f781cfe5401e591a66a22e948fedd5e2c
SHA512 a8126712ff9987c70adead29e8e34919b53be4405e398d5b771b85486303c43b65d4cf0533c9f3db099d2c5d9af561560cc209231156f3ef4e52ef76d828a7ff

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00126_.GIF.doubleoffset

MD5 e6dd2c3798673ae7881fad2535805134
SHA1 747cfb291c78cd517800c9342eca6543e65d998b
SHA256 233fc110c6cb8c2e741610ebbdd6a219be2443344a6e57718ad44b553c082e27
SHA512 c1555a4cb8d57a77998af70cfb4038b592bd19276890b79a6c9e9015edd77c35091c58a02bb389763e273eff05574646204807ed06dc93152675d5167501f6a9

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00103_.GIF.doubleoffset

MD5 d51c503a71b4fa7732d9faedda4e4403
SHA1 1219e856bb8d711ca54db4ac8cfd68be48ca2f93
SHA256 a81023c1e664c4462e17f33afe21176ac506722daad51f682dea0bc9f648dd05
SHA512 cc0670f527ae7c29b9db4ec79e05efba226a2118ce9b10f7abb3244dd043e615b205ea1f76516f44aaf97898bfcc1ce1181e371a9fcbf3f5a2a53d6363744b20

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00120_.GIF.doubleoffset

MD5 d9c1c39b2b8ec9472cc0a4aad7c7e30a
SHA1 254ae5930a25bfcf85a0ebbec57fa00c1b500e07
SHA256 a521e835d8bab6d45ec9488e0d5db08ed11b16becacf4f3a92047b3d6abebf22
SHA512 2f03f8ad24b03e980995a85da67a3d153902078d0a17a119be5ee30e0926db1b2a256ba00e37404feb761e829e52846b6b67bf482bc9e51f0c8c6b492d814a63

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00092_.GIF.doubleoffset

MD5 7bcb97d59c4d538e3810742dc3d8bcef
SHA1 2af9ac4bd68135a99cbc577809ee5d345eb63b87
SHA256 fb9d3c0fe2c88301732d1319f7cab30569c9944ea80acbf4b942a0b806ee8fdb
SHA512 b943f25e0820a1429b5824c5ced9baaab15188066a9e3e8db6067c3f23da9e84b2f1a1c4e562bce593e4f628a74453697cd05df5b2a6795951535a3361e950f3

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00090_.GIF.doubleoffset

MD5 8afc4b1417c26ac4c2bb9868235dc134
SHA1 7941274ddcdf37eb9e94facd3e86be946364f19b
SHA256 9b854765cb8b32a3d3769c38e6de6f7e4836b4cec193e7c61ec1b7d0419e9677
SHA512 5d1e968cc705f9ae702dc07eb907b50ebcdd9bb6fc257e0ecc5ef402fc3bf4301e06dda918c4152c6f9c2a8be4d030c5377e358316d0b97ec499e4de499eb9cc

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00057_.GIF.doubleoffset

MD5 af5591aaa7d68263c5ef4c074930ccce
SHA1 ac7a182bbbd470e3de915bf50e4ad2e735876584
SHA256 d27a8e6c124a75ff35672ee71be9efba01f41f09c4af20ad7fe7958c70fe00e3
SHA512 e9e08cf3676f64faf6e2809603ab42a7ff79d3d7ee015cac2e62d0afde8a2b566f669c15957f249864717d9a5228c680206fbae3ba6a6f01e47706e15c595bbe

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00052_.GIF.doubleoffset

MD5 62c8df4235b1319de3b2d64257cbf87a
SHA1 3412d294f6a9ba03b8774054acc1c13f03cd6cd8
SHA256 11cde4714a40ef8c12669b882014d5c4838fff04d36781bbfecf6b9ab68b8b45
SHA512 d120f3372ca251857d230652e7cbb52fb5d71764bee6edafafaf33601bff2ee73a4609430e9d5a19cc23fd54e4fb102c5324e9484d26dc29407508ab477332d5

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00040_.GIF.doubleoffset

MD5 219b3a16d1c48a7676a3531594b8b2a3
SHA1 bfdaceddb1b9a768838b55f900e19593f355dba3
SHA256 6d82f1524859b13d682c121b4c122e89675d1f991cfcaa8237054bc66c8ef3e5
SHA512 02cdc2c64767f357864af479faf5bc06a4a35449515b2d039e6dffe140dd6a01bad9d6afcddcf9592f0c9919ab0a90c8e2a73f9c43f6abc36083b798ccc74e81

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00038_.GIF.doubleoffset

MD5 1c8831778a4c634b994a924b4177bea2
SHA1 0afe96351f731d032a00aef3e794b91e552b8297
SHA256 075de30053e9080071e30a34b7194ed70fbf77a349b88cc5ffb413cd5eeb6c48
SHA512 3fca0f079f4dc36acfbd600d7b18770fe16330b5870f47710c91d519660566fa167409a932a7dadab78bd940b02eabf9f7f1808a925a80d645da47056042509e

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00037_.GIF.doubleoffset

MD5 3f54c7195f926471223eb6893c5067cd
SHA1 abf5a39a457e34497f175586e647e4120b7e723c
SHA256 a66738f4ff6a73d42e3d9a99b0847410b44aad0110272a97be7a5f71e21763f9
SHA512 8231bd16db337447f720b672ffcfd38da1cabb32a0c46134307c5b7bf78ee585cc5df0a1d6e7a6ded412bf4d03d163a811ff9073a3a5a05848332d880bcbc7dd

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00021_.GIF.doubleoffset

MD5 36f75daea99b44bd4b6b3948b728b04d
SHA1 7712f69365962042cfa9eb6d6f724dbb6ee3561d
SHA256 076e738c229edce3d492068baabd830dd60c12081ef313b023f3ccdd7cc684d5
SHA512 4657c7ab745ce5ce5dea10bf4d17880d7fcdcaa04b3c039da1dc109628f15a96c34d1339baba342f65593337a84c8528891b424c82ff6b5e0031d14313031c24

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00011_.GIF.doubleoffset

MD5 52dc2e5b22abb9cae43d32ac6b2c164f
SHA1 92b9123eda95d41025861e49e1a47fb218ce9def
SHA256 28263f71a9bd7ce7d951ee4472aca2080a823cec2138736c41f7c89cd0ea560d
SHA512 8305fc4a74a0b1844a6293859759c037774806bacefbebd3d0c0e1f296ba588f6130b896ec2974563260c78b8c6875469e1f9db3b1df0b28d3d36ec4dbae9e06

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AG00004_.GIF.doubleoffset

MD5 4e5a01fb6dc0b33cec99ce3642fb8b49
SHA1 d6b6812a58166ae17a3757c6f893ce3ca4a0d0fc
SHA256 aaa3a581e3f7f75b46560f50546d87a678bc69eb4d48f3f10b0844ba91aa2ebf
SHA512 115c790179231f730a4566f2e7681a84b5a2a0d3a71a94d2737e904b0534654b0b620a0ed7a6ea3150a2cdbd12dda54b316afd63abfe9efd033775bbc06f6901

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18201_.WMF.doubleoffset

MD5 d4afecf8a42d09646998bbfab51e20c5
SHA1 6a0af8a70c13304ee64550f8de8cb79a00806237
SHA256 01f60f3ff5023a57e044dc47fed3229bd02937ede29cabd72db7d72ed4ec75c4
SHA512 e7af22dae609975568da625fed4e886e4e8cf21533082afe70f1b6033a1734adc6a8fd1549d9b3ffb07bedcb6b4e32eb55677a52cfec421bd91eadd3f3b5aa6e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18200_.WMF.doubleoffset

MD5 ec7465575059afe8c83dfc999d6d7743
SHA1 e20627f446b7fd1e48574506411c0b7b1cd759ed
SHA256 284c300fdd998248ef41281455eebec803d0ba33026a511a27f55dee85d2ab45
SHA512 138ca9346cf7b01eb65cdb70806d12eaac9cb0834d96e7efa4576ca9e932c49d0478787e901952d619cdb8af9a2b83634df83734b51e7d85d03313fec456567f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18199_.WMF.doubleoffset

MD5 27adb0292ba5aa32555393c8a4906a53
SHA1 9808f671e906e0eac89cc8dcf5da84cc7fea784f
SHA256 fbbae9edb9107d622bbaf27dc4f0f4dd3515b9a17b3ab690ecc1b89229a9ab07
SHA512 94fd196c4a05276165e4b8cc8c10c4afa378bed71e91b1596632715fe9d7871ea4c4aa6db34547c47b6e007d74c2d62e16cb58afcf8005c469acdc4b334a2c9e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18198_.WMF.doubleoffset

MD5 4f59166ac16534acec944e7163901040
SHA1 267450ca2ee85f0f3b5c4162c14a9714447dc5df
SHA256 661a1309aa4b1fe9f9a33a6e446cb4a0bf2c1af55934bdc62427e71d55314908
SHA512 7ac601b5dfe802f846a15b4581fefe3508320d0fda4df5fa872e4db67f04b761074a7b9b2b62d741687ec508d7bee1005252cd5c609f4ce4dea43295bef18027

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18197_.WMF.doubleoffset

MD5 31c51966049a5c8c5a8487a1709dd5ae
SHA1 3e3cf651d93b99ab3544f710cfd72b492e367c09
SHA256 fc4f40ad13ba241baa4cbf4b65dcd2fb4aa964d7aa8abbcc814c6e1e8da12d76
SHA512 cbb6acbbfad23a7315e99425b495c48bfe033201e0345a1a7dd58d07350c62fea437d1303b28aa8342ef02131c5edf20b94195e3a0a101e73b1d283634ad175e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18196_.WMF.doubleoffset

MD5 4bdf9a27c3a5270135980d58d06166d1
SHA1 f1839db9255748a1b4c861c30be130fcb0491546
SHA256 f8dc3e7456011102e1191fedf5b32c0e008a21ba08f4ed12e36ca804f8c29517
SHA512 0279b01d65662feadf4a46aa5f1ece0c2c84cbcfcced0a7751b7f7f33b757d4acc33f0ca1d59db60b37350d4f13170010c7fe095fb73f8833a209da688bcec52

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18205_.WMF.doubleoffset

MD5 6cd5b75b11de8120af9e271c5f00cda5
SHA1 d752af94281ed2484257e8fa2bd72b77b4acad90
SHA256 40798155caf4dddcfd5a29324fbe555dc2bfa1a59fbcf48142efe318d331d3d9
SHA512 68a48d41bc1f7215a365ac8d82ddd09ce310928f0f324179f45756a784f4f45205a613d8cac34ac04a42a197d8c0a097c7e95e65a6716a97d721583382967733

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18204_.WMF.doubleoffset

MD5 3276228d7cb58d9c3da0f146c510eb2b
SHA1 ae529eb721d79e3a5d57c0af53657300bd56327d
SHA256 9372ad4a06300d82b0926f72299832397b2abec0a874eb70902880a5895d04f6
SHA512 8ba091494dc607ea6ab3c541bbf2ba79d39668fca42fccc941262328e7973590002126ad6c34d5c97560b445759f718504d803f0c21e1fcd599caadc5bfc3dde

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18203_.WMF.doubleoffset

MD5 f96b95b8e5ca3c3652c5774f6c67f74c
SHA1 e22866328bac4f496e9b5e8e9de49f2544b3d145
SHA256 e89db8503f80157d32e91a6a43b433d855a1bac6ea7793de08bea3395380258c
SHA512 5e53a57d6970bb83316747e7a46f5e263711b6d6ac9d6ad2241e8b497d09612507747b8c420e96dc0b5ca861b005675ccd322eba8f87256bacfdc3991f6e8a7e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18202_.WMF.doubleoffset

MD5 ddef8cce94db8ea516f73a09a040673f
SHA1 1c05f45752acc77b21001bc09d2d6c90d7c70f85
SHA256 49aa425f2dbeec0baa5cb4f0830165ff0fbdfd629e413bc8a4c0c8eeb7fd5c7c
SHA512 27d189e42f8b1eeac5eae2ba575bd7f52ca640d44b4cc0d5ae2c075df6fe71017b76711f14132c3df180ca628059c2311a692458928d4c688fff79e263266205

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18194_.WMF.doubleoffset

MD5 e7dd83fb65674c10be7c3f1d0852cb35
SHA1 7ce18a9130a4e813c99f3401b2f1443f7162c75a
SHA256 53633e3ca6f4e85ef9cf01afce78bdfe782eb8f0ad80b4d89046b88db392e397
SHA512 1222152174b69361c0ae3eb2eab17cd60eec017aae72af007fcda42ee8b03cb607919ed50d4054d0d4a770dff42e22d2b332e6811e368eac0373d490613e55bf

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18193_.WMF.doubleoffset

MD5 8864649f840e75a2d4e953e3a53dec9b
SHA1 6b02e575d429518029445719b4b86d746cfebcf4
SHA256 0c8c715882e13be31e9f70a87962e4b9110231e68b4fbadfb46d4ada0315327e
SHA512 d60c04cb470a620db94c802882c68e821f6e5b64ca0979bf08dc86ba8e3e52001b7a04c2dac17652ec17d822be4d99be2f816636003e7394c0c6ef815893a6c6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18192_.WMF.doubleoffset

MD5 a2ebfd864b13a00999d2e42470de91c9
SHA1 e627728d54be4fe9f8c51cbc7e482582bca125c7
SHA256 358fb59c9b949baa065d99dc60404c2ac636871330099bf6ed41e22427593436
SHA512 277d28cc93a3958ae75245510da257b4d7f01a827b872d29878715ef67d23be4f7c0076009a01a5fa36f3a839c1ea7425845780533d7cdf5847ca3f56b9fc6d3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18191_.WMF.doubleoffset

MD5 e5ac5e7439e067df2caf1f1700c614cf
SHA1 e213a0c66a801c45e5e260625c278d79715d0293
SHA256 46a864716be8cd37423822c076718afedf8d1ee83f58a1b66ca72dbe6af11246
SHA512 88a316bcb7399eab114a8599f8007aac7fc3ddfd54ed5ee68d47f314d2f5456522c757e602f64c64265620454ce66bca1c7746a978ea0fccb553bb78a1034eea

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18190_.WMF.doubleoffset

MD5 1cb6fcb5a753745658325d21d3e57a53
SHA1 dff6b1a55a0d3caf7fb2ab3bf98bce30847d1ecc
SHA256 636ea7ef8188d74fc2ddf86c3eed2d0e0055a6473799934f4285dc416b9b377b
SHA512 eeff91b74270f57779064e270c739cdfe6cbca826ab53f55bdaa90736ad2ce1dd0ce4b2b2f65bd3896cca7b121c53b730f77c2aee7d819142d424666094277b4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18189_.WMF.doubleoffset

MD5 51435ac8089cd5ddfb6d0d3c6ea7cb7c
SHA1 ca525c4bcb48ae0236fa7e89e23f79c4bbb24a63
SHA256 51bbe5adb083d9a00ed2cfd5327021c19766d6f048ae8cebeaf29e1c02b26aeb
SHA512 2c20e7bbc526b3e9f83d5815d9791898546c810198bbca43b6c079ef0c4703e1b1b9e35ece27452fa2cc376ec253b7e7be4e7fcab20aabcfec634051c6f9873c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18187_.WMF.doubleoffset

MD5 5029c3d52e950414c92c78bf021607dc
SHA1 1c55915c453435e83492021236e4a063e2af2471
SHA256 3e41192caaa30d303e0573fb9885fe131f23b211e2025299a97a132ea71ce644
SHA512 669c8f51eed726bf17f0e91578d32bc833ff1c54343e27efbe35caad5898d0ac10d99868da36c51c27d2858b5ec7d22db0d0e52caedc6d273be35d96b335e37c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18185_.WMF.doubleoffset

MD5 fed723ab34f4fdd9a370b34a595b9412
SHA1 ada0773f1fe16b6c9deb7bb426f003e0b7cfea69
SHA256 7fbced7fedcab98a59e4993cb8efdac5737ca9a48fb359e8a1e5f07ac85a0af7
SHA512 dc24646d425eed79057d8e0c51233889ae0f4fd8c86781bbf86fef72e1a01b569593289d18651c1aabfb240341179edfda62e730c624417c3bfd0b95582c7a1e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18184_.WMF.doubleoffset

MD5 30c65ac7166ffe8c6ccf27bdddac3c86
SHA1 08c3144084faebc382f920e23c7250e2b7a96bfa
SHA256 170604e3fb861e663b5b67d077da8ba36a0a682650675302ce7d4a707ee1c596
SHA512 b34df8525770f67c5908287e11fdae2a2123a6a00cc9a5d55a9503e7faf8f46ad49bcf42d2355b5c8a71731d454d31f65e4c315fbbdef7dc3a94cbd82425c9ce

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18182_.WMF.doubleoffset

MD5 213e66c7ddb4c51d10ce3e835e5fb2e7
SHA1 8b27695ff07988e3f8b6069a6bef3e2ef2b653b5
SHA256 d4224f7b722db04f403c44f2ce493d5e8cb2e328539a153dfc00cf802bf26052
SHA512 2fe015a75cea343e38151965a967d25edf5aef462d2ca400892fff34f32a12a4c563d541ede2986cb1e86ae45efaf64328d77f6d1ba8d8302377a62573b9124c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18181_.WMF.doubleoffset

MD5 e4ac9a2f6c63ec5329ba5e22303db1c3
SHA1 dc487e2e89dd2aed38f38455c5207a39a973cfab
SHA256 04a71d3cfe325d3cce2182289bb6024f398e4c9b6bbc3f582fb868a3c3c9de5a
SHA512 0c11fb8bdcdac8b0ea5d99508de0994b824285e004a3073b97927e5a78425e38c41683a9f97a2f951dc83933406cd82975da0fc439276d4c051c272311fba579

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18180_.WMF.doubleoffset

MD5 61126110198afcfb48e564bdb6cd4f55
SHA1 06c1b092fe1e46790aab30ade6058e0727ac38da
SHA256 df6155862f2bf5df241cd40b1bd5c35db044cac07af394334d8c659918f27b81
SHA512 456176625164453ab14e1ab6edece89f70be7fb2cfcc540b7fa551944af1d2c3776fcb41503bc225ac6fc745d63e2b6041e67c618430ca529c9a49acb6507c51

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18257_.WMF.doubleoffset

MD5 86478aca22699a862361c3419b4f7e58
SHA1 8074bb1ade6524e2dd956b40ede247ca3d572474
SHA256 e19e7329e6fa3a737e32acb64e43a306140735d5af1c5fc3810dbb4ae1aa3065
SHA512 e5f9994473c437160b384244ff86b484ba197a5725411c330fe0cae3efe4e936f2616aaf3796e72be346ce5ec2bcfb711a068a07a1abdd6bf045e3089bd6764a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18256_.WMF.doubleoffset

MD5 5f816f0c040ccf86181d31813a75a5fd
SHA1 864a01ff6f9c43d913ce215652ed04be40ad66a3
SHA256 5df246ed0a08a7d3ab1359b64d7823abe0d735ae61f5ea55df55d6a1f1035cc7
SHA512 ed4daff0dd2049d575094ba32c8239aa965cae9fdfa52785ee6495d897b98f5bc1cf071fd8d28161d331933c4471e2d9c1bf63caf29fc722e49172acbf4dadb0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18255_.WMF.doubleoffset

MD5 8b92f3c3df03905104833a876b272fc1
SHA1 797213688beb9ce00087b177f60827315ef26a45
SHA256 a41b2fec6e844162e1abf83491ed87fd6160095d885b164536e897bb6cb00abc
SHA512 674b0805cb71b1f792e5374e5de0715a56e26559744fcda9146c2335a8604930f66b96b522581ffb1e7e5a743f0974fc2979546e16e58fa2beef558186bbb981

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18254_.WMF.doubleoffset

MD5 b78a84f074fecac16255f65bfae82148
SHA1 da62fc2f34078b22aa14f35aa56b6a9f095e2d91
SHA256 0135838f092e3881751e28cd12d501bfa0d19a7fe615ef3090cfd73465245810
SHA512 83309be8faf5eb4f9481d2efc172c8356f3a33f6d6f4bc214b0796b9b2a4af99856d69092a8de2e442034948c94f582cfd1ce15df3887a86451ee18b05ccfe6c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18253_.WMF.doubleoffset

MD5 b66f99143ec1cd8e76621f8b6dad6b23
SHA1 1d1185b40d4e47b7276cc45c08b180690fb4cf5a
SHA256 bae97d7831f0b62fa191246a6aa033608cba4ebe5401973539919d8b9d6b53b2
SHA512 6f2003c5a3a1e0ae52ba589d8d235ecdeb5b91b52cde917df60d89c6b1e39e68ec00423013e703a8175045fa57cb7917ae28a3523bf1386389a1b80354ceba1d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18252_.WMF.doubleoffset

MD5 5d479db0d11cdf8f939729aa33d37115
SHA1 95bd6da7a1a95ad90616873fb70e0d808035b248
SHA256 a8187de6a7d8da88444db0b26de11c223c89b14d09572387ffd540574c4d951c
SHA512 284d98a3a46eb0a5b3c9175981ff84bec6a5ba0ae2e9808274a14ee2ea1576d763c503dac6df4a1d7e6c5781eeedf9f654f6545ebbdf0b0513fee6a0dfc39c23

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18251_.WMF.doubleoffset

MD5 dc56c8401919ee21ea7b4898c7249e43
SHA1 809cbcf6384aef42db596762892c60a9ac94e290
SHA256 42ec642dc9caf4a333a407618461a4ef6530c4f764b50d41b7e0d6e2634b523d
SHA512 c89f0093510d1baf9fe0efd4a25c8bcb1729d1a3e7efdb1c36a1820fcf266890e78a7a6fe41e21db20a04d532fd76df49c76e2e2892ca3b5c15fe5a38e6578e5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18250_.WMF.doubleoffset

MD5 926a6140ecb0f87086e47e96fe04b622
SHA1 3f656797a1d36bbdf25e2ab81cb3c5b3f980298f
SHA256 72ca0e9031f5624cfa4ea84d0a3d38dec2de471b00b80ff40ab6480613ff6552
SHA512 ce7a84b2bde000d38eceeecd46c319041729d39f0a711c7b6bc6baae63bc8edff85999bd98b0d537bf5c797f65923760864a06e058756169727bef613dcecef0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18249_.WMF.doubleoffset

MD5 e9485c37cde7c165dae34dcee5ff9d4a
SHA1 72e60c681914a8f1bd0ba4c97b422dd1db69d861
SHA256 de1fb2cfbea246886006409c00e55a4f4f709e3a9a7faaf290de0c2db9fe968e
SHA512 4b1e62555802d2925ffc35135e0e077e12bbea598f716ea99a9de7c9d4e6c6059583f03475f0fabddd0fda5524afa179d7686927046c398308e4ca021d448a04

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18248_.WMF.doubleoffset

MD5 6e42d8503ff83a0b823a469b8dd20cc9
SHA1 e7c83614df4852b24cb9369412f23a492383735a
SHA256 6cf0d00534d151be78af8e42a133faf8975b5710bffe4f4e8c175b122dcb1dd1
SHA512 d4c2d43af78da0ce1431e055e1ccd16b0dba18f52448b9959baa4d3aa1e02025f5824693c3900d92481e0a6e48cfff5d3cefc7459ef5fd920de316c6209d4a46

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18247_.WMF.doubleoffset

MD5 cc0509782a7bee22d57bbd03666f4ed0
SHA1 f91a520b7537df69c393022d0f9db067a93e97c7
SHA256 fc6e6a228f82abc5ca00d23dfe8771e1d3c45b3224ba02d367f4e550e172f9f8
SHA512 599c05f1e0b3d2658ceb37661caa56c9f88533f19f1d3970baf0cfc55ff0bf5b40d15fa5d64e6d3fd83d3d5293a94b0f882e455e601693710e7ec7e4bda2076c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18246_.WMF.doubleoffset

MD5 a3733c50c465e597cb3405c7a0cdcc68
SHA1 dc1059bdabb4425a06e8a2e9e033a9cbed38385b
SHA256 2f9f2da298f04afd0d12dfd488c5d86e01fa4c1ce852214cc74ec964ab072714
SHA512 c8abcc8f43c93242c996e7ce32e101f4925c0636702c0a6b468d6767454b7af933b90cf892b37ca79930ed0c4c463b589c0149033e3844dabbb75965eaf6fb1c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18245_.WMF.doubleoffset

MD5 9cb59488bb1be9a9decc8c90eeed0a33
SHA1 cebfad033a3acfd4b30f851a6ec62794beb3a8cf
SHA256 f6152c8a3c2fbdfe82cdc372a6e7d80fa0c2af9a35029a605ab40d77535aef38
SHA512 d05d8bbac420b717a7b4a6a1c542938994ee7b94a18aa0e1fdeeaa1dcce0d224f81faaf858840cd267f8b36e02ae08b137073d2a84069ee10073645e726471df

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18244_.WMF.doubleoffset

MD5 c9d752b0914be4bd2bd470027f5cec81
SHA1 bd0d2fdc9570a21ab11da0ae98a9e6f20e4c3e8e
SHA256 ae92ed0bab8edc7bd0534edb8409166929011178be48deb3f6c6b7e565463079
SHA512 763a3a163ac1af4995b9d3be623f1aaa4df2545c674f68d0e84645fc99d73884b5623bbfe6731372a33a7ea20968b173a7d39d82f38e65f7cf05ba42e2d8cf69

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18243_.WMF.doubleoffset

MD5 637f534f6f2cd738b72ccbca4f77948b
SHA1 9b6e84447037a16b3e82cfdd7b3949019f301565
SHA256 1697422ea4c50e442f2a465b6d90e2f8d3dedead4d39fa5d8cf37fa0afb38db1
SHA512 1960b51715cbf15cf4fcd3d4fba1c0f16d6153186a69a9bad5f9a9a927c49f263f0697e0e9f8613354cc27a4f4d70c08a788cec9b4320cf1aef18ebdf9ed3287

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18242_.WMF.doubleoffset

MD5 a879ff981dee38e92110d6ca4082d975
SHA1 c8da475aff45fadc96e43011ea1a20154633007d
SHA256 db6a80b9fb0d89c516fc483d740fa1993c8a3c54a75bcfbcd2a7c503864accf8
SHA512 570e3f9acb598d415438063fe507b52c07770db0d7adb154715ed8013c6a9bd7e6d99891d04927e3410c0635c11e01d8f3251a8f756967eaab9ed1a2a7a003a1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18241_.WMF.doubleoffset

MD5 718b3f9f96005b24c213fcd261a931d0
SHA1 df81cfcf0bf28133e3b2820a071e2b225f9ef6ce
SHA256 7799b94d6a37b84cc6d84fe265ece9c358075f86c4df59545f6f63a42a34cc5e
SHA512 ab814634924b11e0f89e327d75b4f7fc777d9b8d047a3c3d21bc2cef2324527f89f89ff1e5cb51c524da98f8c4def0428b6a056db5c63c2d54f6a51329c051de

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18239_.WMF.doubleoffset

MD5 ab99952ac5b35fd537bf781d5d3d424f
SHA1 646dcfdd15b673113dd35b4a70f0b308d72cb79b
SHA256 86b47a95243c1ef5f79cb7d61dafdc56f14104024947f6e469389806358ad06e
SHA512 038f09ba663c00f29385caa97fc00adcbb69e6564c376409fc0d673e12b6e7dd5d30e34d0625db3ce4ea802b038b62361fa20994d3ffa6a480a6066bfbf5f432

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18238_.WMF.doubleoffset

MD5 b5d58e0070df065a33bd1646bb6401a3
SHA1 65030f96fc4d22898756bbc3fa418579c6477ef9
SHA256 d874b8b2b7acdc99471117dbad3279240517c34e7a144f203981c3ce73be4195
SHA512 7e2d93b37e5f51b0f8027f5a957f3a88da9627dc081883387c035289449f89f72eb14181422f9ccc17b66ae3fbdb674e95db1e2f746175a92398c3243fb438fd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18237_.WMF.doubleoffset

MD5 42d1636908ff6b9ace1a91cc3c1fe9d6
SHA1 4ed24e80c8f33136d67e5fc66efd9a50af34cd4d
SHA256 7c4306b8d49002a741b5803ea761637f95f68b5769fbd2cfd60d442cfdf63e12
SHA512 8419022e3549689276b2248aa9d00682b8ddf778f46087e80d4b6c2ea39bf53180dbaf86f6050db2ed9b6208ba25acfe9a63016428e79c07ccd2f3a5317a78b3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18236_.WMF.doubleoffset

MD5 ffb97a64f9d29731012c5a8c999c5d1a
SHA1 6fb33af9c8b0e0f046fb41ed07b6c543c6bf6b9b
SHA256 ad8da448be934205ba28d935b6001c483e70afaa843edab056986f1a4a1517d4
SHA512 0f98597effbea8393b4e1cbcd684d7e5d35fe5257d4e2285ccc4cacbac03d9497ac78398de5a7c5614c9cec01bac2085a177cfdf002d00aab0ad4aebed4a0e4d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18235_.WMF.doubleoffset

MD5 c6e2eb7397228a0b99629f9d39594bb9
SHA1 bdc6b11226305ebdaf446b02b2aaed740aa3817a
SHA256 15e884174567298ba7bb0bf87242279ee61d0ba12b47425208c0d3f691a0ca44
SHA512 30517d34ae0c7114a7272fd8074fd2270e401c3642d90049cf736b8b13b6cbff0c7486b3139ff7e3ee8947c5560d33e37014f4016992551f49fcfe9ecf3bb596

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18234_.WMF.doubleoffset

MD5 83157d88b584e374746e08ff223a4410
SHA1 ec101bcadd0d67dd841e5ec817f4421d9b6cf23d
SHA256 7c87ca61b4ac7dcc3fe065137ec3109b0e48c1d92bc00232b3068921c7d88563
SHA512 5940bd0c1c21aae54f82a94a3041afc5500d6a1dbd8b6e0fd26d10c9c9e87ee71b64066c1a3d4a248ef70f83811b1e4a164f5d2dae7e635938f7497ff0f5360b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18233_.WMF.doubleoffset

MD5 124071b39dbef510da4d11e1f7e32e8d
SHA1 454f57b8c6a1bf5b7d71a986c4378b87e72a29e9
SHA256 dce38597f1ca472e80d95ccebe09ccbc64006e40c6922763296b7ae6475258b4
SHA512 e333215c3884a3e9037a9daf394a1f791e81a21e393cd6774c27652d6e24184481125fde2b96d841900920e2e441cfb7e0ced102df3eb5f82f0e43c5ebe93b05

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18232_.WMF.doubleoffset

MD5 5b351da23847926b4e677304680cba2b
SHA1 79fcbdc3a66d998a1b98374cb1331d2af7c52c8e
SHA256 2bcf8518d543465e7308a1013241fbd343c1f899fc14ced6f99daf326c03d154
SHA512 3494a828a7c2bb1202bc438a768fbc49e6adac576d6a3c8c3953cb812268fc131670edabfe69d677a828fa6c339d43319b65288358a29ed85f0fe69ef428d9bb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18231_.WMF.doubleoffset

MD5 8d225fc66c59a3a5d5fa5442ae436931
SHA1 befc72f0f03e7a42e2db11b0ed762f2fce10f589
SHA256 8fabc37022065c4371a16247b51c8fa41ef26c0cae81e866308ec21f7efdd87f
SHA512 8f61d1c74cacd411cee0f63ee501b610fed673bbc312a4fe32864a57324bbaef9a0ed2709dbfd99f5b9eb13386b233d103a2ba574005db18149126e19107b776

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18230_.WMF.doubleoffset

MD5 61953b6c360353f579296abf1442d07f
SHA1 37746f025da1c903921b3984d5b89a9aa6448613
SHA256 fcbb1d44f5f7eb9db2232f2434ae0fb4255e67d2260595a7241c55816a819166
SHA512 48de6970ab788be07ba84185e6457caa781c7e3fb4395f38024937fe34cfd9e04c77dfebe8113e7c92d55d6ad1b0a05127596151e2675a162e3fd28340b7d228

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18229_.WMF.doubleoffset

MD5 06cb295fecbc181de432141fa9477b55
SHA1 116448c616df31ebd18ba3df10d063693703f525
SHA256 16ce2ae5e7bd3a0b7ef3b119d71e6faba51a70243e011481440489059cfb906f
SHA512 b99f26e2857939a14b637cbaeb05c2795fa79589a26b369afa116254c562bc843c68a5cfd793108ab7c568acb83787490811c65769820e9c234780c01a29d2e3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18228_.WMF.doubleoffset

MD5 6de38350e011c4ba027de76411ccabfc
SHA1 f879483b4097cafe457f97658b5ef0a989f93c9e
SHA256 57130709fff6cc5f6156fa36d8e3ef018d7eb68f6b1e8844bfd0bb1a6f06238e
SHA512 96a0478b0b707cd03d41c80c7f87cf5ce632375deebbf2e0564403468e718d09b2a85ac1df69a7015f58b67d849eb995e7df33e201af0e110e7c3d0240296bf3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18227_.WMF.doubleoffset

MD5 abdcd893321a4f63dcbf3f7799aed857
SHA1 f814c00063583f4121ed7c3ae563a8aeca19d35f
SHA256 4adce6de6cbbb7b13e9921091058fba7bbd4d5a3d1a178c7bfde9229b523c393
SHA512 c5e4211f649e6a2e3d1eb136cfc8ca1199111c2b0ed47d2cc2037e7438028470c37af173294c7b6b10083b9485970b15d9feaadf8078d44e57d77445d96e411b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18226_.WMF.doubleoffset

MD5 73e7defd1bab5d93d2a2b77ade259ca6
SHA1 0d0ba42bdedfa4d1abd750171eda8c9e382d68d3
SHA256 660781cf0142ba0ac60cd12d25c250fc0f70b60aadfe3ead42bdf1db6ff2c340
SHA512 495d22b25f0b8e19515731afcdfe0da28c656060dafd4dc3804038b3825f65109d95476ddd257d23bf6b3f7ff573f51077e50e6ba016d6258939a132d433dc38

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18225_.WMF.doubleoffset

MD5 46c19670b8a666c6faae597b49bf911a
SHA1 4aed9f2ca930b6078424de1f2a92314c9074dee6
SHA256 511069ded6e48ebe59ccb10ef82ef36f809c52e9c7a2801bf02f612f7ac857f5
SHA512 9b6f628e5de9688b47e80e715b6ae539bc7fe7ee5e077062235dcaac87475661b28d54f1b7a602e42ecfb34e447d1d38d53022e2223b68140350743de764e6c7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18224_.WMF.doubleoffset

MD5 7e37b9c4ebd27e6ed461b37364152792
SHA1 edac99fadb6fdaae490fb1fcacf549ecc7600cb9
SHA256 3c9b7fe3f5fb5280435c84f8b367b981b412f8541e3cd3d2d7a27c8e392c1acc
SHA512 0d9004870942e62501347f75c11e17d329d5b594ff4e613d66a4fbd023fa6d6118851defce78bc34e9e538f6c5c7d1816361a7af8d00157da367eafd250d5d66

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18223_.WMF.doubleoffset

MD5 f523c07b0f73f4bf1c4c714267977fc3
SHA1 cc9ba0638a5a4bead5fbdb23d2d8e8e7c7a164db
SHA256 db7cb792fa63e7388e6d5b00f0a7c59eb980dc6e985022f38d054f2146319d2a
SHA512 ab97111f7305335e2f5b1de3588147590c2b7981569fdd6e8c13bc6d3f962f334006ac095550f4d14faa928849361d21f4125d47f889cf00d7ee5413b502bfd3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18222_.WMF.doubleoffset

MD5 e591befad5426da45f3698c44d0b24c8
SHA1 918e85a9424c434a38db0ec7a130e1efca64e423
SHA256 39051413201f2febea9c1fdd2cbe59182397a41529758889acb9d3244853fca2
SHA512 8753268143bd24ea309b75cd897406192c424e626a9b829083694abbfc69a262182630a86455d07957e39e6ef35fa1acd8c72e175d728a604f34628806a63df5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18221_.WMF.doubleoffset

MD5 b5d9e2ffdc1192ed78646b18d8e37209
SHA1 83b57c0310bdbba44d3aeb937ad2ea006b82d35f
SHA256 e75037b9ab3ad75dda43960b57d3c3e832a606cbc94b86f6d0e10d42d0f5f8e1
SHA512 d24faf51851ccbdc40e85c007efa7c56507bbf316a7acc770f3a2586d37a020d44772e50e8d34415e8252b5909d02361ae17d00baed46579a7227ab7181fa105

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18220_.WMF.doubleoffset

MD5 157eb0bf603a4be68f4243445a9ef0c1
SHA1 77857327ec997b4e0846d1fe619ddca51d361f53
SHA256 78864d53eb052a0c6f3660a58a1fe4a1aa0d0b7844eb60cbaf5e9ceaf19aff11
SHA512 b24b9c572fa3d079f07523075776dfd22fe66160e1206dd9e675cc6ef88a280ef40ecd0cbde11d3ea95cf8d2d94d114191ec75aa2a4b407282aa1e73c41bfd62

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18219_.WMF.doubleoffset

MD5 362c79e14337b6f5294f0d170fedf4f2
SHA1 d2c44b0fafaec500a1abd8d399b68f7bf2305714
SHA256 e62eb20ae79329d112a6089df534c1eb73f9d51d5e3c7522016604d5ac614f30
SHA512 5270df217a3fa78432bd62bcfcabfb2d1140e3c202fd37c99f36a4c69df4bf6a6ce9e6cb32b310b25caf53c76b78cf3a7c5779ef69cba0706fbf6a1096e9f483

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18218_.WMF.doubleoffset

MD5 3a8e614f38566d07c0f526340e7f2fa1
SHA1 cd5d03adefce4b7b1859bfcfbaf82e21845da3cb
SHA256 71dc35e21e26f0e140c28a33df3d553a0710e5f43a49587184a32217a09696d8
SHA512 6a847a1a234122985222a0bcff504cae6cb46a523506f876bf9d4d650b8705a25166b6e6ddfc10cd674152c6f48cb6521c29569ce057775876b3598ef7b5b727

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18217_.WMF.doubleoffset

MD5 c09bf1551634b63e934dd81d43176e9f
SHA1 527cb40f25ecce033eb6fcac55770cb7c435de25
SHA256 20bc60d63cfdb4a126ea2033ae4fb1ddc36a7c939d3669e4c2142f6cfb235ed7
SHA512 402458fe0ea07d02d3aa35ee705ae3540738e5265b5c75738bd7d4bf36b084f127c0060db8e23a7cc63f93f010417b2def0646e100000fc328d5a72dcf05cf1f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18216_.WMF.doubleoffset

MD5 111ff0d343ef4fc96cccabf32f355310
SHA1 d3a81e85dabae4b0bf2b44bc0bee1365053ad01e
SHA256 57f7f34d44a3a21ccb0c0da672d11f51829076fb7e9f2dbedefac21c379818d0
SHA512 8e707ee34e0bc10d4664db8e5ad12d453f5fe190da344255d1b003b6b78c6bdd941fdd1c47da6fe6cfe300710a411f67cdde5b5ca2137c3e8ff72491f12edaff

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18215_.WMF.doubleoffset

MD5 330d6a17a292dd829af58953e9ce8e01
SHA1 bf195271ab6a825b994ed7c4fdf991dd79c643e9
SHA256 5d7ec363e4bae8ebd883aefbef6e9fa21bd9169c614aa1854c4c5ebc00ef032a
SHA512 d796b47cd775df1bf1015af075fb409d300ea98979a557423b349187d04153221349fe147ab22b035b4bcda8144b6d95fb48f10cf1816ddbca8621f284b7cbfb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18214_.WMF.doubleoffset

MD5 de98d6c904c0096b3000e07ce7685317
SHA1 44bbf0284a5c822a514028bbb12901a6bbadacb1
SHA256 c14e96d3fe8efa581eb40f9cf63e5c7b75efd03145de4c8599ab99a96fba536e
SHA512 31ef745fe5b11741105f95b7e11083f98185b87fe95f61722635b06cc6aad11a6665968a50edf61837ae3ebafdf997ef8eb79e14205874bbb5f2ed30ab3ba782

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18213_.WMF.doubleoffset

MD5 fce737fbf0925c5e7a4719c6d9c012d4
SHA1 3a13e065a139fd1f7c0518fd3d070b0ced696314
SHA256 657847e7b811f0c0c4ad587671353dd8343e585abb6e1eca797417af3913a10e
SHA512 d352a0a9bfb0fea109cc235bba353dc57fd06af8558ca3b17688471cbd22386559eadeb7d959ea12a79fa9780a9aedbb5908a960d83640e91f45bf0b7283bec3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18212_.WMF.doubleoffset

MD5 2bf34fae926dd563f069023f7e704e07
SHA1 1bfb15796161f807a0757ba60925610bd94c9c48
SHA256 38fe7c23fda70dcf866269e9a0b7a2c1c7a19c6b61a1d92be6d1d04e68ae5364
SHA512 3202937ef77ce2369b33735cccd31456c65e02e7d45ec7674148909716c2b97323fe36dbf1581aefa25f1b1f61d631ef51320bf6cb293529d0853e26dd5d057f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18211_.WMF.doubleoffset

MD5 5b1b065d71f575a1d00928d05177be03
SHA1 eb350cacdbe7b0853605a92db0f7b2f12cbd1bac
SHA256 fc9ecedb78e5cd9f36c8dd29c7de005dfec93059209fb450b94c22a88a39a63e
SHA512 2e23762aa2a7da6c388b8779a428e2b4383531ee10b67a1e6ca4dde0df4de608ef1a71106c5626f6cb05dd2e040468758aac50f6cb6c82185601ae1132987dfc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18210_.WMF.doubleoffset

MD5 8515c18481d4c37ff51993b9f5f64e0d
SHA1 bdfad38a205aeaa6d2f606e09b8b8fdfa0505139
SHA256 88378735e72a51cf424318237e78b478993dd52770f5b6dcf030c8f89642cec6
SHA512 181afa1bdebadacb1f28bf327ba9c4699219c176809a925e00cd0c41a4ccc62c49182ef360b82381753651a372187b0cba911e11ff1fdd8319f329fa05303479

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18209_.WMF.doubleoffset

MD5 afaa29be9f64b99390d43536f4173f85
SHA1 3022daef39a15676b8e434440f171f8627316349
SHA256 ded4095ce58073c3af71e1a98893b4d71b6c75494124b9d84b94957907c24004
SHA512 40087913bc90b563e3ed2e3e728d2a03116b6d18ec841b238de2f30c9e8e4e21b02e5700b4c942f102f820b31339f48ae9b9ed6f14d2da15e83f49deaa5b3536

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18208_.WMF.doubleoffset

MD5 bf8a6be9696e069357486716610af3c0
SHA1 9fdc01ed14b8a074a1b4312627cea29027529507
SHA256 e2b71f8da40d2a5a4f7934e2fb803d0103867cef5a07318b9a712c243a6cf0c5
SHA512 81a780d6fc10f3dd7dbe2ecc8dc2f5e7798d94a15105d0b2c1f2f8545759cf29a825290a2470878e3db5735ce00025aa98307016e3f57e01508982a75ea8c70f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18207_.WMF.doubleoffset

MD5 6c9bdd312b2e17619e36c057250ae552
SHA1 6fd2c8d176f4670174a617c80e78b13fd1e4ed75
SHA256 917215bea985e506d02eb88aabbff27672c98f318919992faec12cfd2672b1ac
SHA512 f2eab35a6f9fafef7ce54b7602ce1b4e1d435a5e37534c52a8df36c5ea36bec766b15c89601f55e6729b273196f97f918552e2a2fb50399f6b958d775453d00c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD18206_.WMF.doubleoffset

MD5 0f72cf066687f41c24cf3d3b889972d1
SHA1 de57c185d448d91d341cdd82d17e0695d477cb6a
SHA256 43413db02983b5bfb95d8b8e84bdd7de6829a9f0f879fc669445302809dc9536
SHA512 68b5077f08a59675e8cae59fe654961612c4c74c2208c1f4ed9e1d390110fc2b5eb4adab6bb4f36d19ee61093d3c133415221e5e283f928b5bf3d36cdc147fd4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10255_.GIF.doubleoffset

MD5 7911a33183669493f75aa2ec1c63cc46
SHA1 becd8b850e46fd8cb5f6fc3eb60f676a0de2a3d4
SHA256 31762b65ddc2aa4a96c83ae6ca5cb249501f7b2a6b6b207e88f539de059b03ba
SHA512 dc59a3d3f1eabb22d011556d5cdabdaf9b599a5c02a9bd17c4c972ac84b21b391cd470d426487ec66ef307ef793dce86139a88702d51d00c4a92af1c59e4793f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21535_.GIF.doubleoffset

MD5 81e4be2a7ca857c09bbf0daf8983191f
SHA1 e3a14cba6b41038eecf8504f4672498422bf434f
SHA256 141f2f84fdd08d2696a8cee2ced2474297e3df34bc94f2ffd8f4e7220ff5c3f3
SHA512 042abc5370ec9c02f046ab202ddd612be9f111cbf60cecfebb67da4c0bc8a6f066f37f6a59a513593d5fbfda513d2c8747bba3acef35e0d6be3355c6dfe85c98

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21534_.GIF.doubleoffset

MD5 a308a674e0fb17547cfbbcbc75f75744
SHA1 8eda7f9cca1d02483ed6e482d788003abef8c3c7
SHA256 dca2d280f787328e1092c69903b1e2d2097d8aac680a17ca936f84afd8a0d59e
SHA512 2ff917402820c6e59bf5f79f7c50d27604ee45940abec92e99f1e44c857d1226e075cd174d07d51ceaf25c04effe664fc2b0d27118487a67c76ff15b3bd5fe20

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21533_.GIF.doubleoffset

MD5 80dd8f5c1534bbd73e3b94efe18dde53
SHA1 ca13fc26a3f4e9c7ef80500fdc461c1ee4adf14d
SHA256 45028a9e188c7daf494dcc165b20791ca9d4496fda2ecc6c8da125058966493f
SHA512 c2a6af529c5aad532afa8c1371dbd3eeeca0e9624d4da1ef40296b6d50cb0cda45714a17201c3daf41c38a2fe95b6d6e697734fb996272d7b39dd748c436b3cb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21520_.GIF.doubleoffset

MD5 105c6303d5e4c771d0a7ce2777ee9660
SHA1 b15f19c508324c496b2e77c8f7e4b3091a8c2936
SHA256 08fdd46243f7129074581b5cb81c3999c4f18b7b4d56c0090dc158b918a152d9
SHA512 4303704011445e471ee5b770e895489c07855e2c89950d792957aaaecb186cb751dc1c7ad10a6a5e08986953ae66fcb11e365548e4597217164d351901dc966b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21519_.GIF.doubleoffset

MD5 f6c536bbf0cd6cf0cc3064bce6805cd5
SHA1 8986bf6f6a814ef9445b4a1b34067f4d2bf775ae
SHA256 a90aba14baf4bfabf9585c696c026da671ad0686fd266b3f3b6c1df1ba6b29b2
SHA512 facff5a436178dbd99e70f6e809d9165df7f912231376c3fa576e850c233c6058f3c2f495b27023c46dce8bbcc510e6acf9a7e5c0be17b00893066d6a05f9f52

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21518_.GIF.doubleoffset

MD5 b20ba2380e0752429835e840829f8ba8
SHA1 94bd234357c11c16263186e77daa1e5c1217cd73
SHA256 85319532469e913739ff38a96a5f859bfec0cd6669b46aa6e0ab576121a036b0
SHA512 7aa565b8c2eacd1e7b1d24abe26854d6b8b5991db3e8297f41d7331088224a14f6ae3fdcfabc7e84eb49242f8b9b2b02fbae49fa1eb398f89337e1ec2ddfa328

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21505_.GIF.doubleoffset

MD5 787d28cce75a5e7cb12dafbc3bfe9992
SHA1 2c87f379f613f4e4cf3df030f893386cdf746951
SHA256 47b51e3031217fe07fcf927f70a13a1708a7c21ed0b76824f504695c0364888c
SHA512 834d131f708834dff8710a00549ada2c2d0006d4902848c0d393ce6b5e8d4c8e6fa6f9d5e816da0f85718d1c26a5a69e887757410867905e0b7fa4c16ed06eb2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21504_.GIF.doubleoffset

MD5 195588e642d6fcd76ff480155bcb9232
SHA1 7383c30132cfb1df722bc63f6dc162e2b0d3b145
SHA256 095f6b0f634366ce8cb0ba74474e8d6ae849bd954989f8cfa6f9447799b97e6c
SHA512 5b99cb7d3f266fb0612c8f03c0d4183ab70ecd077da8fc6704d4bb70295719b4e5218c30148f628a3f870479b0b39bafbc5aaf27b89f365f4209c43e702c8504

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21503_.GIF.doubleoffset

MD5 faa520375cb76875c80083527db3f0fb
SHA1 6fb89ef82085814cca2551e89166f5c13ffc9e2b
SHA256 f8b4a38c38c0b4be1ac21f2d4a488498ff19c6a8bca61183cf2c18f57eb3223b
SHA512 b45c4d9a88ba980b679f8db0673fb6fefa95444374e89ea2e3926a060d2737701b7991eb0d65780e7bea893977fc9b420ff871e93acd61fb4e82adb3ddab46c4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21482_.GIF.doubleoffset

MD5 025592c6436d1885238f503088f79a8d
SHA1 605a94172f4530baa1e207c663fc998c02bc2768
SHA256 47414a5caac6007ecc566f94371b1af0ed5d44156101e8fa7784bb243e734a11
SHA512 26c9afa0ff176ccb2b19a0fd4af631df407a974fcf46f1f8b02c75d761c8ab32e954087a13da8ab31eb188ef54421adbad1f801b960592a453a837e762904c0d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21481_.GIF.doubleoffset

MD5 059666e767b4bdffe3a3243df85aa021
SHA1 52bc8e38f8503aea0ac43d680d6bf8e9c756ed76
SHA256 b3e167f74c790f3b375cb6496491f9dd73b3587490ba7d1cc3735a0b8323e936
SHA512 32c36fa3ef4150cfe9f389b8c8acf2272839563848ab2c9204658de821ae292254697a5b36a45d2b8c4233688fb4be7735faea5a6b5fe418632790815d222a0b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21480_.GIF.doubleoffset

MD5 642c2029f25ff2d477e4830e91fe6002
SHA1 b72ee9179fa9adbf87b6ce54842fa334aebfa356
SHA256 b414da8447800b85146dfacf2e910900d8ec8e11857656b9bbd92602ead6b026
SHA512 3bc55a63bcedc35edd10374e95b5aab5b6d3ef593506f836247382d6e39d3b15b78e3d58eb579b84f74449428572c8481913b97a2121fd91d2e2221a6913c925

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21435_.GIF.doubleoffset

MD5 e024b7b411ed71af5a55c3501a679bdd
SHA1 3777827baae7b895df6a797e6071ad2a5db8293e
SHA256 49c3d788ebefc8cde749c64948036ef8a17d4924221b4aa589222635a40bede4
SHA512 a27dad6efc8192b0ba326d9c81a8e4a3a0ebebe236cfd1e683c40a26466469c73a514f27de1e51ce6447fca33d188aea8d68f0bc8cdacf0f801d4336d100c8d7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21434_.GIF.doubleoffset

MD5 97cae3532622c8f5144d0c956f3afeab
SHA1 c1aa026f2eb3d01bc03aa9b6e481feae0a5fed0b
SHA256 8e59cb6cbbbbbbc173eef515310b92ba85816a6008e60ce3063bf5ed6d7e5da6
SHA512 53f3f9af7412f1f791f4909607d58db13627be212cae11d66884f06aaf569321eed967f8b5be5917f4396a01fec1e0bd1d8efd5c6f65c28074d67e995f8de36a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21433_.GIF.doubleoffset

MD5 d279a58dee0892f392d27ba2f6efeb74
SHA1 b71b27c33ed59c8d49de0e77982771d0a9a26bfe
SHA256 202262d817a0cc8109fd2bac33ea01ad76f27effa891f0b3a71c63da82e7a440
SHA512 3e6bc581b57e28172947376c75990dcc6de927d72c7e1e2953034e063da4d43323f8cfddfc93546c3c470e77e34e549f26a96b8093a0ba8de6a986efce9efe41

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21423_.GIF.doubleoffset

MD5 4a0a0e6bda93b9c2068bdcf9319e977a
SHA1 2fac812ee892721c19db871b4eb7a45f6002789f
SHA256 694f35da61552eda8bb35077875c3c67b1e2070b81fd7f1a4d7fc0e159d7d47f
SHA512 2a532049b065c13ceee249e70f9cb0edc3a22bff4588db282b471b3a043a0896078fdef8a8522c74ca82dff4b3127109b9769babb2e2664f0453728c9cc185ec

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21422_.GIF.doubleoffset

MD5 bfc31fe1a5aa70bfb3caa233f2a47461
SHA1 49bf9d64eb73b999af8332078faee51761849648
SHA256 8a1597608a0785604fe854210e57a1530ce331ad0c0aaf639bc68b1beffb7793
SHA512 7c2e8cd97294a655c5a1eae381ebf23e59be9a3ac568eeffa141121d888e42a79c9c192eeeb74d7c19b6e879ec2724fe8fc643ac2309c87161d4acb733c58f31

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21421_.GIF.doubleoffset

MD5 9ab2f2dc11b371b56bce3dca536670e8
SHA1 7581b1233e83b8a05d8f2940e6db7de6028b5d78
SHA256 569070b661a6e83a1fba00308f7e514f4661c6eda47c2908380b220b5d3740f6
SHA512 20b24495302739e183be1de6efa2e1e96e90647cb6830d7c8262e468a6c274f23b662bd54f1977c57fd52c34ad1b53d931017b5357a4a7147e5fb903a8348dc8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21400_.GIF.doubleoffset

MD5 ea87bfa9fbe73e9fd188b59285daa88a
SHA1 4ffe503c014e3d202868a4d7511c79c5ba0e50b6
SHA256 74dc3ef2bbbc6497846f5223c12e1ac889b0fb0e0235c6e8249322bfb7902589
SHA512 6a4331f3e7618bf6bd3aa3b2f57aa619a0cb0b38b01b8a91e22ebddad28e9e98f7547e8f1ad4d42b267b1ac4af88561569edaff34dea1d0e5902e03fd452623f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21399_.GIF.doubleoffset

MD5 ae228d0f1bff98638c1e2849b754ae09
SHA1 357d56321bbcd5cd85e9a3e8e90950fa3262e79b
SHA256 ccd903ff3537bae55188fa17635346a4ea0b19822ecaa65fd797a8a3b493b08f
SHA512 cd70d7f0d475254cfd0dbaaeea3665ef7880a88c61a8f0c89f94a5b770a1bfca0db439972c6f5df91762d7e71e4c5356d1ef9ad209ca04bcab0fd951a7609554

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21398_.GIF.doubleoffset

MD5 617f7d6824ad6ce94279db407d483588
SHA1 7996776d06b339cd18dfd9a9957b6ad73ff3e289
SHA256 63108cec94d8851d142bf581e3eed1333a7506b0896a6aa940db1b9dd697ad69
SHA512 76f17878646504ac80d93f33785bfadb1e7f78ed204bf783a2999d1f6766c8d1d64b70d0c2337056eb55b25ad4150d3f56c002af202f6d187dbc78e30fb33ff1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21377_.GIF.doubleoffset

MD5 2a834a04f3987e6dc8f9c0ec32c80daa
SHA1 c02c2739587f5be8236cf2b0705790ca10d0d9a6
SHA256 59c13c2346cc743e0bcd6eb0135db85f987e371e046ba35fd533949718e10acb
SHA512 7251c1e2f600fc81fd12791e10a44b5910e1aa5c741eb209843e496c2a541fd49913b481f25dfb77f90ff546bbb6cd26a801a3fe54cba0dd066f4a7345ed7730

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21376_.GIF.doubleoffset

MD5 7e6c2098d61a63028e96e3b8ca6df4e9
SHA1 5b7b3e4a32dfa6b9510397caa5e8484e817c0487
SHA256 6e6ba75c2c1b6faf325b94118678db832e846ae3df8d14d5a158fe57cb07bf58
SHA512 cbec9b2e25f5653170b2927f70b05fe137416f5e024fe16869692b273daa63dd744985759a32480c783986c8583cca73648420fa8e9301811b9c67b71ee21303

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21375_.GIF.doubleoffset

MD5 6e512372470baaef33336eb8e178015f
SHA1 c60eccf4aa3eefa93245a15be0ac6b0f76ec92ed
SHA256 152b4efbd0638d8b47f39e1bee6778db2db137a982615ee1b14344fc03b08992
SHA512 627b1a358413894ff7740bc7063bc0fbaa41b8a449c1ab238242b7ab780170c128e3aa8b51eaeb5a0913a604a5b53e65b57693bbb9b20af2cb229dadc4177bf1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21366_.GIF.doubleoffset

MD5 3ff828139d7ed027f4dfddf6310e9305
SHA1 cfb00237bd43757b2b66f5915378cdde2dbfa90d
SHA256 6c18e9e5f2a34b78fb730a12a3faf6791ff78551d0c59ef17850157d5602c3c2
SHA512 352be9d1ffa23666efe69d4265cc9ecde3cd6429b3d30f1245a81dbf5afaaa01ae55e83a097a65b663945a6a67ddb95b7fdcd2958edbeb8e3346a67a86427d8a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21365_.GIF.doubleoffset

MD5 6fbf31c84daf75441ad04ba53ae2e1ee
SHA1 feddbf7d8e964ad0c133566a675ba958a1fd95bf
SHA256 1ece1099a110735e168bcace753787abe40e32f246cb470ec1ef1a2768b752dc
SHA512 88e0dc177c6160fa5f0c6bcc9a0dc5dbef1e82bf7109b6106876d3173091b18aec6b5e0127024a8b5648a5a035fa5d9fdc9dfe8cf4317d45337bcb7f4d378423

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21364_.GIF.doubleoffset

MD5 47eeab8e40209739e47eb53fcdd5aa12
SHA1 088ea674771356d79d87e60dbbb3303433dea01b
SHA256 6acd5eae08d3f5cbcc55bf141852d9cb335cc2bdaef6aa34af104fb5df771f55
SHA512 d8a31d6de025920004421a811db0f34c7fc8e8ba541b4abae71025765b1c53a98833f24c7a3a714fb8f99fedd2fbbea99dfb53f8d4a58367908fe51d34566e59

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21344_.GIF.doubleoffset

MD5 b88dba4884e3b955bb69e55adb765296
SHA1 ef416010c571906d44e43dc33fed96fbde5f602b
SHA256 0edee9f702a18234a56d275eb2a4ec6104905b2593f37aadcedb54fd93cb0474
SHA512 24de428cdefd6c770bff41bba1290aefd4a34a71031d65563421afee07b1b424c2df54f1dca04688915a08bf332cfc1f6e39bcc5d76672523666374a8a80bb98

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21343_.GIF.doubleoffset

MD5 389a38167ff4d502455bb6f824250f1d
SHA1 7944fb61ba410bfe3ecc834e633178deb17484dd
SHA256 dc0e8837205b602cba407bd25ed26aca48c8b669828ff9804fcd61e6c558011e
SHA512 b51b2b6691916c657c62d546fce1c68417f36a0514a614f3596aeb8533a1e731552efca1a694f9dc9b460c26528ae7f61db5fa0b3e82e45082dc0978d450ae8b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21342_.GIF.doubleoffset

MD5 cd70a24c3d6a035fb35371448d1176c2
SHA1 0e54136c1905c7ffa06182dd0699b2d8dd1c03ce
SHA256 8b83b6cf73d46af7ee18bed49bb9f7913f6830cb8c618dfada6dd9e4cb727007
SHA512 430e09435993c459076cf1a1d6d72db22a548cb34f1c07b0d1b3aa7508641906aed794f0be4c153b28d709a6970d28dadf401f7f728d61ed526e679c6c05a22c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21339_.GIF.doubleoffset

MD5 c4bc5cb8d702f850b0b42128775ae902
SHA1 413b74b0b26bc002257d6ed6723bf5d6caa0fae6
SHA256 74ba5385a3eeaf7e54d90edb7d615bc400abd1cb5104ebc0153ab96d7fbc099b
SHA512 f492626e930b386be3dae7f5e38ef0ee14d0943dd5023db32a4e6e2a865fcdc0259e487abb4dc5f546dfbfc5546e387fbf04f7aee376dc7e75fbe97560cdc5a3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21337_.GIF.doubleoffset

MD5 bc0ac3e778e8b75fa442f5ad934abcfe
SHA1 a461e6899d6cf82124d2ca897faa156a2a80ef7d
SHA256 b6c06e8d5903a80b4b7f9c6eefb28aa02c61b48095d3d369a0509ab8464bc1d1
SHA512 804b25d48b205b70e5d140ae0686bed131c06217f4e763ef55aee5ec3dd3b7d83c8687b5199b3d46907617520a8046765d868062852c531e364edf9715661106

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21335_.GIF.doubleoffset

MD5 8e35ceef6dc64ed74aad89924eb4ea0e
SHA1 5205146aa04e76b80c853bc8b6066e97e3b18b07
SHA256 3fe859c324bf3707259c5048c731031c32b8902c314fd869e62fbd6aacae8aa8
SHA512 5c6f38a2bc6b98b3288880768055fb94318c8ba02d589f5574c548115cff95f0857bc3d49be3e1f89947f8b0b7703c002b18412a28221abeaf9d4c24b70fdf29

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21333_.GIF.doubleoffset

MD5 03a4351cad2f7771fc78299e26acf9f0
SHA1 8c28949e6138722ac14267e3acc087c6fb64faf0
SHA256 ac3fc897814633c35eed50681d93dbf48748c45de1b5a94ea131593e6bb043eb
SHA512 0578c0a7fd082b6c4b7dc5d2fcdfdd956eecef0d8ab945b5ee862dae8a606d9538da709a4a4564b69f38efd03ce95ed705bc5bc90686c27ddff204bf565999b9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21331_.GIF.doubleoffset

MD5 79d184323873aedcd6cddfcf35db79fd
SHA1 043a59272260e08ad5e5e3f0cae7e5054d86c191
SHA256 c92dc5f5d0c9c24538b1ecc213face324e5cf6cc3bc553251bc040ad3989b28d
SHA512 c6a0db50d1237801efdd1c72c411f064075038dc2387f3a1f01e8c0c3a678db1d3726b25f0d0bb4ff2b38a22d65fb0357389e590e9ab3c789d5bba8ba3f09db2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21329_.GIF.doubleoffset

MD5 fc19619d2d214cd9be064ef7fd58d27e
SHA1 fdc6caae5028e417d45dd2113178c5880599fc76
SHA256 607762c65c83c3a494dfb358d1ef85cb0ed709a4fd4ccf723b1907454e217498
SHA512 dc5f7760a4188025cb65852d05da450dcc60f477113808e92748cd33f5f3e63a812816c66e72945daba9a1b1b69a38328ebdbab9c4fe254e06d1096635276e52

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21327_.GIF.doubleoffset

MD5 3b837d1e67cbb4949da06874b117e0bd
SHA1 240d4928539b434ff5c8edaa1bf1ad1967652059
SHA256 76e67e099585dbe1f2851a0379345d4f27d307721edc545848da3480189eea5d
SHA512 e7d0c24976f33b9d7c678837481c212780f4ba17de1507e1a0d6c2246087b76dc3b495f3d5373e52c99e1ce84c23348c947f712a3ff1b30a0a0e98f5091e677c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21316_.GIF.doubleoffset

MD5 b4e9f9515867399c3041611aa65835e0
SHA1 53704d194a414726d450d8ac82af0bf5b4021ea0
SHA256 07078af09df422ca3c22466ff7b323b610a99b9d94fda3b7c9f8a1d132e67bd5
SHA512 8d8e557969feb52d770cf216a44480937bcc7f08d62a169ab2bdef24959e068d8919483dedbfa45d96f2bcbfbef2f2c90a9cc3dac3bd08ebef14ec89489633d1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21314_.GIF.doubleoffset

MD5 ac9a92ccea95e73614b2cd19b8f241e4
SHA1 e477d5b635a6cc77ab5cf4aa29b7dcc353887f86
SHA256 0e249a752669289cbb7e3b9a5b09c65528fcefd2d9f12c11ae9826e522a44b1d
SHA512 f94e9a4ad0163fdf9d914272c19ed243b61a69ff59edb161ba82966bf37a68f5442a6649edccf73c4ece12480366627f860bcd1c9ca41c8c0a5a1c3b2e69f46c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21312_.GIF.doubleoffset

MD5 bd2554bb40507561650acef9a71b546a
SHA1 754b8df60230df9cabeb8a42de929cf9b7322041
SHA256 959909068472cee4abe4761b9b23564d0147e528c11eaa3ddbe4cab226ff5453
SHA512 f220224e07f8cc1c9bc64b0a0ea9af08698e49d1ed60d15efb81eedf395d4c614ef8f967299c9878393ee494c5546c501d0892bd8dc749e60c700d379827bb9e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21310_.GIF.doubleoffset

MD5 f29f7410b645864526d8c2b35eefb03a
SHA1 7a0472aef897dc6022ffa701f4fc0f2b255954ce
SHA256 33993fef7b93d029dabd0088694c94760e30dd6e61bb56e5ad6ee49ee41b9b80
SHA512 ebb36ff0b66741f66b91b747196318f5cf57eb1fcd395e27c40d623ecf01338616fb3491852992bdc120c7951340a1bea322f0f6c18772df5c3e544902b74e43

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21308_.GIF.doubleoffset

MD5 f503309879c8b462016d35e19f3e4fca
SHA1 43ef80a8b25b829b0f64b7417b395f84987e7700
SHA256 6770de6ccfa75c9ffd28110c0ec598cff78376c6cbc68c35a8368a2bf43abfa0
SHA512 15004d84de006862fd0ab9d4100a4fd59baea1aefd6f3eb388ed4b41b548ff425179e70d67bf6ed753259bc3ac904fdf9ea0067be04dc091e033721ac5c4ffed

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21306_.GIF.doubleoffset

MD5 8d471056fb1115d2e929f2ee7af4991f
SHA1 2ab99cb2489651566857dd5546881d49d12c667f
SHA256 5c0497f9247bb2fcbfbb74968cf1bb055ffda9b66eaee9e86680e833e7ac0477
SHA512 673ff329a96d4582a64124e5b49335ea50217dae7bcd83e326502cc8ae9f1d40703da554bb1233c7440757176aaba5798f27f0b8e1802e71396e8de3f281df7b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21304_.GIF.doubleoffset

MD5 feaf3d9624b3e302b5202b19fe498018
SHA1 ab06b3cdca2a3c1c241e62b8cf2e3115f85876dc
SHA256 42e5b2ccf8d305857173983c7430d99966eb660cbea7c014ee97b800381356da
SHA512 8930cc81507c12b6b632de617b95c04a2b6991ea61e97909f99a3570d741ab3deb92ea43514fb504ae93a18fe4dce628074d7bb4c8d0bb2b8f557fe1f4a62b3f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21302_.GIF.doubleoffset

MD5 05f376f569ade7ca8abdd729cef3fbc8
SHA1 efcb4907e705c0538bca57cf4f2d99a18f7932ef
SHA256 4624ef7af067e9358d11099ce828ef791501b4b6cd5d0f94e0108c77cf2e582e
SHA512 c0240e75f25a121ef10852e59f3905f15b547618fd9dbc9d539f3739a6752015b89042fb600b8ce080f00d6d460a46f29f2330b94e625c4aa03026726ea1cace

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21301_.GIF.doubleoffset

MD5 16ad19155b9bedb0573afe4438b399d6
SHA1 1fff0fb8d09f768fd63a8770ec5939a9e74e6050
SHA256 16f511357721c1de92b088da9a1d7c48df999bee43bc013d07db1d232d2e8c84
SHA512 538146ee925bd03d6f030b7d51ba1b2429208134edb9e73553026a5fd9c8baae8a8b53767677ee6a8d87086aa75850907b8f952e1307cfad85f67eada1d555c4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21300_.GIF.doubleoffset

MD5 01ae61362f53676d558bfa7351d4f54c
SHA1 9fe34d7256c1b4df743427caba8a0f4699914163
SHA256 94f0cfa888496a3f22401e0efa3e9c62e86d2423bcab42471e30f6bef9e95ae7
SHA512 fecae9d4f85ad244bc00a73f80a06bbbf53e34333b2513c2c32c647410c55a1e15116aa0eb25e436b361e86cd6dac4d4e156cdb22ca854cd975891f00037aec9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21299_.GIF.doubleoffset

MD5 a84e19524eeec2405c2ebca8bbcaa245
SHA1 ddafe7944a8fe26748642bcecfc849c23251bc71
SHA256 d5bb9f25aab28c193c825fd286cf480483596043a9585a9831efabd744b62804
SHA512 a504be8329e5f52cf3e729daa9791774a3fcbcb928a883fd4faf72bc633a3de7329bbef9282e32f0a05909b3f0557191b87e81c12f9e0cda0de9b75a20962cdf

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21298_.GIF.doubleoffset

MD5 75be4c35c45f7e76f24c402517aab1ed
SHA1 ed941b1be924b73c6ff8c93f6b712977b134352f
SHA256 32b9e1422962d24e153bb7e6dae13936349b301a1cad598b02543b6de5d8581b
SHA512 d2ef3854cab2a82c489d8d7c8b50c845932a485d480a2d55dd3527a06a30ad6b301845a9638e8d00d8bfb01ae843cde97e13d4afb0d166e422afbccee0f968cb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21297_.GIF.doubleoffset

MD5 0f11a206de68f58cff34b81dc7d16163
SHA1 feb7e07d3b02076194b4ef46b1a1712dbf525db5
SHA256 274a6d9fd9b2614536fce69442db0ef726bd7d423926ac3f5fb5ad9ca98c5974
SHA512 cf6f55cb33be5f0b86b3afab01777e51e4925f796289ac72e86e8602600b6007e47aa7d0c74d104cb8b7bb087d15860418d8e536c6547a2ff59c5e117c775608

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21296_.GIF.doubleoffset

MD5 c2605b6fc200b5365a191e1806fa9fd8
SHA1 7c2460a7c1f7b8f53b75e388498d7bd9639c9da8
SHA256 3e3fce43a83d74981701cd4fa4f3d3148a9b752cd664ecc26da0435c3bd25577
SHA512 0a234e84bb4b8bbba23aca92b4734b979501ddbe8b08d1408350020c1a1cff84c504351020a3944c5c447acdba88aca94273bb6724a78ad2d0f36e9c0edfc302

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21295_.GIF.doubleoffset

MD5 c72fe1c7afe02863ddec43ed611da395
SHA1 b09effdc60b39ad2a40aaf3c3f1c3b5643b42532
SHA256 70ac469bd10152df1d6e06ef9c00bd62b78c1a33decd584fb53e8825e8cebc16
SHA512 a5fca7f9225ac10fb67e07c82d99575492fef1d9f3a11754208286347f12ee607992853833b124bfde9983b1fea8dbbca0954f2fa599586436bbbc0524c0aa40

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21294_.GIF.doubleoffset

MD5 959b6c4afda04a8b1f4d90627b6e3865
SHA1 70e3efe0be696b19e9d9f38e17f161ef39e5ed92
SHA256 20259db266d5b0ea4d266ca4b4b8d3f1bd771fb8e7d748205d078cb5543e5e35
SHA512 4b029d59a07658ff325e9416ba93b8d6ad1fabcd78870c3f10eeabeba378811054442f0357b6a3ee68fa39c59a9851b013d1ea154718ba0150275f9fce90dc00

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15277_.GIF.doubleoffset

MD5 a16a22707e78744a4881b2244ee826f4
SHA1 5beab63d301573f105935ed95d809b359a4be086
SHA256 e79b9ad570a6468d4ac1997f14e1cb5efe14119ffb8d81c996c14256a21115dc
SHA512 f6ce5aac32f8586d6e066048f32e235887b95411a0377c92d1739a19143bd37114fc3e2f23bee876fa4a2c74984ec4cb2b1fa1459de98e30760c3168a3c2fe56

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15276_.GIF.doubleoffset

MD5 028b9290b92d41d7a621f8a29f50373d
SHA1 3fd753cae47ce8fcefaef5a78a3a18b12463540b
SHA256 0a7429ce053f95175c48c8c8a6bea8d522a5b805ce93b2a07d753e1d1a2b9ceb
SHA512 ef9d816f0679918f244fa0dfed343706e05ded31b029e9cf684de39ae7768a4ff1f0dfaeea7eaf9d97913404a624df99613432fcb9265a836fd055782669ed3b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15275_.GIF.doubleoffset

MD5 73dfc1d5df7c1eaaf7a67412d45fd4f2
SHA1 e8d534689ccb61f0f414ba9b0172283f6d82fd23
SHA256 a094b2ac8746fff96cb7f1df32d5b9396b6148b83d88941e62d6c0c902688fef
SHA512 e20ae23eb5b0b1ea48549c5a0f6dfc1851cb8793cdad59538fe017bda9bc87bdc03e19ca2f83f425a48dce31919fe6bad3df02f6aaea2defad299afdbf1130f5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15274_.GIF.doubleoffset

MD5 0dedb3514d8f1fd3a6c0301c4a2d3d12
SHA1 39583afa8daa80ed17d625555281a965b01323ab
SHA256 7161cba2202151be53d5856985464081ea18b4e42605e6c0a2b4dc8afe0d2d7e
SHA512 7215f2bd7121c52122f96a1ed8370cba1ffaf4907bbdd832b912bdde189ce65037c6ba6352c92071688f42e240a3d3b4b5aae2379ccef6fa834e127773d212df

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15273_.GIF.doubleoffset

MD5 8daccde341104c958b71d53908183b20
SHA1 fd469db08c0c6f98e61909badba442f48e0d6949
SHA256 6ca5d077c4066af02f51c1b4a1804a9d949eedbeeefc60c89d1aefdc01cd40d9
SHA512 d63e2300088b2338aae727dac9f49facc104657d8c340749ce2515149aff563560092eafc792da8ede0711f86701c6658d10e1e119520ffe3523de85a99fb7a2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15272_.GIF.doubleoffset

MD5 d3911cac6657cc1cae5a7490dc304c75
SHA1 27094f278b471fb398c0b208c6762912e4241bda
SHA256 35ff24ad47df24cd49fd51e2766062ee6bc09d0df86266d04b9229231521e580
SHA512 71ce0a78f9570ca56287ea68170386efc6da4445239d3bc6b06f704769b0a7d5dfc66d5f7ed6a5c07d0bb76128be0970e82ed4b561df2db70e296ff84b47114c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15173_.GIF.doubleoffset

MD5 b6971795706e8935bedf18e9ed76f1f8
SHA1 8acac0da00827249f2491bea9b6f6624962eb47a
SHA256 079960015f265f755111bc12de47faa5123cfe2f2a9327d679d234cf5f83a226
SHA512 2b5008e93924cbf1d696b0fa208f8c945d80dc10778092d22dacdc117eab0b76c254b91085bb31f4345fb674013129e0d93978e7a82b6366afbec164dd78580a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15172_.GIF.doubleoffset

MD5 43119430fd535b30a448ee1c60188f02
SHA1 f434302af940f9f3c3c47f23ef779c7e0e971526
SHA256 11ac7b82613630a100344a79c3f529930cc67cc85da6382b46f66b0f1b81450e
SHA512 be4b096da084a39fee3dbb2000f4730db313fdb962018057568693e27707e65f5c92f3adbdbec694ff602b5c871bdf2e5b7639516d1d398c29ea642ee3c5bada

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15171_.GIF.doubleoffset

MD5 3efb627233fb92a705696c5a61ed642e
SHA1 a73e7a9a68801502d12ca7da6d05fd926bdcd12c
SHA256 fadc2495e3899ded30c6a955867f414f20e4f70323e838b8e5547bd71e91ecbc
SHA512 00e78adcb60c29fdf80cca7eaba9c08ff8cfce6550686161a1bd524da2b8df4db7d81620357c273aad100767966a19d83bccb9b4184816fd783dbedeae10d5d9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15170_.GIF.doubleoffset

MD5 6f5f4a6d661d0135fe29ad93d5a4ba03
SHA1 bd102b7c5afe07b3915d1c0d79cd1e9bd4336d3b
SHA256 04439e740e3ccc39bcdeeaf9384d677a4c1927424539deb34ba2d84b0694acee
SHA512 ecaf94a3865d1299b1c5cfea565c34eaf3484ecad49e407e2384b7233e1b71b472597960bfc2a7a40ef206920104545e93ae4ae101051a3cb8e066b885c572f8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15169_.GIF.doubleoffset

MD5 9a571149479efb06163f12bb1940023c
SHA1 223c74b870ab48852fa0c01e93de17e780171598
SHA256 a2b49e2f19ffa1d3ded5b9de4f49d36a482ba9ad7d6533f75ff9e4ed80973347
SHA512 474374e64e85b4b51ea696466d030b052977c1b1904c7cdc41947a2652c65b476ad7625622226f16d2c4c67159e58996c139fd65211c1c69b1682f1a3a18898d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15168_.GIF.doubleoffset

MD5 ad741af09ac5b44828c890dcf884afc1
SHA1 7d94e1d10231db5f7967942f27a94c69ab5657e9
SHA256 78bdb9cc964138afb8b1c1e0725ca0be4483563fc85a1b837fbea6e014774111
SHA512 fc914318b6d953e67ec612e403e2cbfd1c35d8d17cef436d5be6e49dd19330ef0acd91be38252b06cfba0204cd2d16cb0d77b0d772796d0603e9fe192d859856

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15136_.GIF.doubleoffset

MD5 a28e8dc9cb956e908bac367a65b3f764
SHA1 12a6eef9accafdd7cd933d6ec1cb093665766318
SHA256 756b30bc3da379ffb228b192563a8c07f698965fb1a3416cbd7eca05ec58980f
SHA512 d065b0788e98b262b8bcfefdedb63c27b8813291c4cfeb90b36cdf5d1e4fa8c4ecee8d461c74111aa12c329af99df1e0f8048c962458d76ba464d58bf8bb8e37

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15135_.GIF.doubleoffset

MD5 b9b7b84ef036cd35a3d09c5c726fc062
SHA1 ffa73a6d00b1f4272be4a155b8e5295fe07260d8
SHA256 11bdeea323456a3bed3b5f177aab0f7926577a84143df7bc8d4f43243a94a97a
SHA512 387d4f4b53884e31b3099b008acb40ca012ccd998e1b930e2bc1a22223b8eae2f160318fea2013d89442c85af8ded893d5a33335febf99c83193f02ab9835534

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15134_.GIF.doubleoffset

MD5 64fd004b1a0605403691fea2b67d012d
SHA1 7f79ea23a62619703ba5e57d33f1a11fd00317d9
SHA256 e122b0000c791e5136b696c63b3286ab03ac5151fd8658fc75c7594ff55eacaa
SHA512 940e56b948b5d91a93311c9ce60a978ca077823787d5cf4f166c0833419c3c8c25d400b07e2168148ea56542a33f38ff1587d1a5070a18263ae5593259777ba7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15133_.GIF.doubleoffset

MD5 20c39e1790801166dd254db559a99534
SHA1 4c2e811692cea0e0c752a2d3cb5cd8f64bdff92d
SHA256 b5edc8317afc4ea4f9feec5e82042dc114e30df5afdbd5258b8517dd79b13ed6
SHA512 9a86243070a63ee3062d412b2c14fbdfcc93dddac3e5188efc70032b570db8cc54ffd13749202640bbb29a4597dfea864294d0af0b09ea7f16a90ab15f14c5fa

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15132_.GIF.doubleoffset

MD5 53ac5199791ae5fd8b93fc3f70163689
SHA1 a87b81b39306077a19cfed945d2f28267d371a38
SHA256 d5f4e434c525a47f74e47c460cf21c67f7856fcb160c877369ed9fcb911d6cf9
SHA512 7988fb5c3e3166e51b814bf6b94b0b7e67a5f265949bc23837b750932967f4dd40127aef8df170c3ee5d034ebc37ae8845057077507573e998e142c0654821ae

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15061_.GIF.doubleoffset

MD5 f8d48e9e4ab6a3c6a9f5e2bef9a8e45c
SHA1 8aa2f90c8db77ce058700294e44c7645e884fd52
SHA256 bece40e1bf3c8b038e2092498f50516d4a54c9c2532239d8f746f9a5595d5ddb
SHA512 6c2e2af8d8ea560aca43a25a9280d4f9217e2548a01f53669df9928e623ef92c2aeee6a18f9ea427f9a711aa2ca16ac05045c8a8ddb4729db9b8e19bbd2d3387

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15060_.GIF.doubleoffset

MD5 a0617c18bef61ae5acb45ffe56a6eb34
SHA1 03ea1d62ce3c438fb54e9c5256fd55e9cefd7721
SHA256 48efeee4d805f70bc57f354eb88feffc63822be2f8291e36dbe2e9a46f195e75
SHA512 459a369350f19c4ad861322b016144a478911ddaf4430e0acdaa8a438d940061bd7674b9733bdc148d89757bd80f1c7a8f5b2ed4b4ff65706d5eb7213b480da2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15059_.GIF.doubleoffset

MD5 579c22612c57e104caa8b0fc6c0d7c56
SHA1 bc1df348ee9abe29f8477507112bd340f755ba5c
SHA256 ca9898e8ffbd749f1647c36282ea2632759edcd84828a2f3f05b999b56460bbd
SHA512 3e774233468544c1a92f41f9ecc0111caea8bfb083c6460e4cb1dd17b0541c8cd9fa94f458fac8e7b869030804e09ad3c62cbbc05e9ee02d5c239cb9e2ea75d9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15058_.GIF.doubleoffset

MD5 cb8ac2ce6dbd5d89db06bbcefb8afcba
SHA1 e676eb2c1baa48a1eac7fe8a1c3355b4f6c3a12e
SHA256 69341ae437815b70cb41b035194705ec0ce57a8384279bc72d89b1e2cc1c3819
SHA512 ece27a9c8342922c396ff14399a700caaf7e0b5954d327cb7da844cabce0c1b579a180f97460e37d56dd57cb2a0f3bfbde82e093b5d6e4f1d05d72c50dc33fb6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15057_.GIF.doubleoffset

MD5 36c45d6f4cf09ea3c7f0710c44761929
SHA1 97e3bcfd19c54aca2303946d00689c0a59e49582
SHA256 181611d332d7b172dc29cf8daa063b52f3ebacf0fa4c87029804947444f083b5
SHA512 d7506cf02ba1b54ea81a8a678769e3c67df5199f630729e83e300654fd60af15ddc8370fad0cf813a13c63f28692ca4f36bf98f3e501f5d44966c925b4c5f5bc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15056_.GIF.doubleoffset

MD5 5d043408472026fcc5e2cb399d8b82b0
SHA1 fbe987f3bdfab76a1e3cdd6bfaf62637c408f33a
SHA256 608c738a999a05db59f193331c97497a94512e1c19f6e491f82aa60f655e9303
SHA512 8c8ab78d02dc75d8499f9f068650ce803eed2ef4478656a00890af617a520aa16b8b22af0aaad6e7a19d09324639b83974bc8880afdf517b9a200b893baa7887

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15023_.GIF.doubleoffset

MD5 2e6f0390eafbd254d465315a73f73b51
SHA1 5460a4d63bf9b51704e7fbcbd90fc066b0b6e488
SHA256 f80a3b6160143e91b4fd33ed41ef72d777b8aedabe8111239218ecf32ec22c18
SHA512 06be3a680029097dd0bb254648c1dd92ba8358e9e099b18a95aeba86579205bd7bcb208121c709c988fe1ce6402e4c64e39944f101deb1a4f045a48984c53a73

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15022_.GIF.doubleoffset

MD5 b22d9762b1d58d91fcdeeed08e7d5d42
SHA1 013e3996b5642c93467b5d416cfa613c7a9b0625
SHA256 7bbe45a21e83e8350643be5ed0e338c5566c3330a24c51d23e237c894bf91406
SHA512 f5ce2cc9d6021aa4b93080c810c9be48d3f616a938a9895612f49691db29cff5bbb1cddc96b7636464bae261c9ccfd3fe418925be8d6651a3119fe7ff63f232d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15021_.GIF.doubleoffset

MD5 be10e6d542a089924f072f0a53fb40a1
SHA1 828310dc47f4ee566afcf6e5b879afbff8ed6bdc
SHA256 0b5c4c5ea2734d4147a0468d3d793aab40efadaf84662193a84642e323043d98
SHA512 e53ee383807cfe1d07732a669de4d0547e615fa0d74d3ede2af8655263d0090309ebecafe0d71c7f5c921fa90e6bd2c482db19f8f89e9f59b7722122a32e86db

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15020_.GIF.doubleoffset

MD5 d892275ec7198a31dd0d07ed617c7989
SHA1 9d366af33e42e9a31c04b33ea4d7eb931b7b305d
SHA256 738e78881cafa202f044359ab3142908b9584887138b194c238a6a7634fa8903
SHA512 902d40864b0fd22d47809b0b01ac76dc4b636daae645807fc7c30dd7a4cfcad2db07b2580e450d31c880bc3f13dbaf7de204fb4622770f2560ad4407631533e7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15019_.GIF.doubleoffset

MD5 6ae1b811d13fbf508e1413a5fe7fe125
SHA1 bece3658f319b2e5e05bc59b237731b186f90f98
SHA256 01cb75561ceeff3b2b1795590516a12d9c5819ecbe1f9b5dee02a6493f4eef5e
SHA512 f187c24c141e6ab9ea92455a31707906624f15faaf645088cde0097414ec87ff5136bd14226740c95fbf02184a116698023a3f1dc062fabef0f4c67c94e8a86a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15018_.GIF.doubleoffset

MD5 d4aef5fbe818f8e3d596dd9d16cd73c5
SHA1 29f82832ea212b37a16ea9ef8ddbfbb73e5aaa8d
SHA256 2ac1765a66cfdd23e9d79a0d49554f8d30bc92b3a9ded8266d3a9f74278026b9
SHA512 14809988847912fd8029accefe2c5b9796b0886da9421a498d7e4a014dc0056ce2d601630e06e847f893e20217d359b586daf5de6c29fbfee499aa5dfdd1e2a5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14985_.GIF.doubleoffset

MD5 2f0d7221c39a31f1e85b9c6084069395
SHA1 ff4ea71bd6e3c8ce95e703acd4b05b9d2d26c43e
SHA256 7e7e08e51e4dc497bc29a5ee8ffeddee4f3319cb066a8b6e58eb09c6035ae8fa
SHA512 b6dbb8743cce89849f1e96ffb7a34684d4d42caee657dc726c34a88efafe4353e4cab2a80e2ea777dd2c2a4cf8ebc296b602d57cbb9f6e0cee9372e5499e697e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14984_.GIF.doubleoffset

MD5 ac3cc494be213c6a220c0d9d40b5c7ca
SHA1 b62afa6838e29f5ebcd5aae83c9be80d5081c053
SHA256 12f55c5a9623ac1a063a2df01573925dd44d42b85fd3fc58733c2f1de72a0bda
SHA512 fba6566ae2e0533e81335a8a2f9f10a885073b096c7995bf0e4a8edf95f6729a9d7ab220af2403d83fa1cd354b6d2b76b1cb369ff70451aea13357a237417ffa

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14983_.GIF.doubleoffset

MD5 797c100da2071a4e43f0711fa1caf48b
SHA1 f55c8a731d4ef47b2f0ad0b0ff423696e7db38d0
SHA256 8976897d351ecbda2599cb2d03b671228bcba7c3e1a7ccf8a27283a2b4adcc04
SHA512 d5fe256952e2c43e49f300f0aff5704dfbb18ebe9102155c6065d27dd28d276661463397a9cfa6bce57d6b189e6aa5445f58e832b881f98bf48598fd2d6f78bd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14982_.GIF.doubleoffset

MD5 ff927b3a77389588e10dd769dbdd24eb
SHA1 aeb1c1f3d1bc7748350df3b24e06a072610f86ae
SHA256 6b7b8d217211fefb0a545bb296db11193067d5123670c4b144418fd6616a696d
SHA512 bb4059f6e808eff4fedb36cb90aaa9ae06fd3b313028e27f6efdbf66030cee6c075f293eda4fad21f97a270a0b445ba2598303b84044834eed4dc8d28a0cbb3c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14981_.GIF.doubleoffset

MD5 ffc57f93d2587f90c04c9d76c146e3f0
SHA1 4fc18e3b01e70c7c9f5df40f429df29f02480a7c
SHA256 1657ae9ee4b6e6eb1cd713167404e3e6cf8e59c1ae98858f2b5e7e5e73fffd5d
SHA512 f0528cd32326c77dea7cdb179ec9aba2d49e66a72439ca93992a514e8f64f80e86676721a5315d4e1201faf3e98dd450e9b25cbc5406eb514aa098ba37a23670

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14980_.GIF.doubleoffset

MD5 4e5f3df166912b1b4b0071aedf3f69f5
SHA1 96e2f7e1860fb9835e27742e90e986fb404c009b
SHA256 89e41a4ae71168f4194fe8593c6aa5ece4575a60fcd566b2f5777e08d3756aad
SHA512 518ef49bd25f8b41adb5a07e6527b0dcd5e3de9f96ddd7c813026da114b0469a4ccb8a9f0198b567596db6f60f8768a083098dcbf943dafc831824c24f4de0d3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14871_.GIF.doubleoffset

MD5 e931a3ab568969bad30e4233f8aa7a8a
SHA1 67c51dc164c01a495960ce64322ada2377680b6b
SHA256 9bed564f9bc242d43d1378d3de9574a5f42b4ee188722db50c35b2cf37e65af8
SHA512 e54131d7bf0b27f460d56b7c53ab78b203708c3254c80d72ec01d5bc21e9c099044c93cdc8c6630a6160dd918fddec9ed40ecdd0dba9e6b86dc245684865c9e9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14870_.GIF.doubleoffset

MD5 2d27d36f9cc4df5b4aad0d52e53833d4
SHA1 c17ecaa9f69f78ed495a4d6a762ebcd7391b06b4
SHA256 7623ebd138777b0a6fc0e90dd2f950f26c6cfa045865ef7cac10960f90bb004d
SHA512 1af6d3f70393be7fd797c477169926ed8aa609151bb952e34eeea96dcb119ad7eaf81ab5992535b8c42deb557a4bad1956fb88b3c9eb24d9fec63f929dc60cbc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14869_.GIF.doubleoffset

MD5 5d87ccb8aca28173b3d25e2bfe9890c6
SHA1 b063de99c90a6b9bde5af6e9d423c57963a36334
SHA256 7f944c93f4f4273a68b0cc519210ef485a34ec644143dc61e038f9cd3be9e95e
SHA512 bdb835924e5a88c3368f757dd247683db69e4267c2f7cab265ea5d9ba60f19bc981409b7915930bafe1073407c9ca92d3b19f8fadc50f5f4b162ddb9a295879b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14868_.GIF.doubleoffset

MD5 6b4c52d06fde43263f28634ad6f5339e
SHA1 7e0919772f764f68b87f983de4bf57ecc072146a
SHA256 6b16d588e4f0ac527ba9e0076ba9ecb7b96d9aefea4ecfacfcc08e242745e096
SHA512 635e97f55a333b190e1a9b394721fe2fc7d0016091e6a8c3866554f329fa41e1587dd5767ad4ab182500e9c2a1be5785143287a17ab5b454ec1ccf45f3e0f3e3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14867_.GIF.doubleoffset

MD5 067e0cae059b5ab2c232a02e0d14be73
SHA1 1856c0af865b310be08fd346b7b52f33b2869289
SHA256 1e12ab851318ff253768bfc972dfea34f0973a0ef8772aa2189424134d83bf07
SHA512 cb64d97abfc4e9c058920b03927bcfe2d8bcbaf46a7fd8544e872b75aac4eebc50d841273d7de3595bcb400bbe790ef0e02bab660ee66a023902aa83e3b5dcfc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14866_.GIF.doubleoffset

MD5 4d21629bfa1bfd191401b1bf49c17758
SHA1 7e48b2b883e8a1468495e4511082d6e0f981a7ee
SHA256 3682e2de6fb40c28d159db8e1dd210a3dfded8f314baf474a0f07a69089663a5
SHA512 07eb575d0038b141c1240049bec857c6f9c95a1cfb7d5e988df37d178d20cf8b77874f1fcd291ade583e9a22bcc7bfffee92e255f7c1836861c2ae359a27ece4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14833_.GIF.doubleoffset

MD5 fc91c3234e9841aba14babb2d58d588d
SHA1 2285382c560ed422396ffe0217dc4bbaf1b1a8e5
SHA256 3847e5cd62bd7994b357198cbddf2830d782765da5e9835c478740c0b637ea46
SHA512 ede8dad6730831205ee0ec03d3b4ffde8bbd49f30303356ec33e368b771bb963dd011f876c5344516b03972cc8631c6d1f881ca54d82120791a31da99db5c186

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14832_.GIF.doubleoffset

MD5 fd7256b1c1d18c8d191bd254bf5ad115
SHA1 43a437bb0d0cdef492024a0fb6bd8be87436cd57
SHA256 4e65f83e5fbb4e5dfef3584067e3ae92fbb68a1889cf2b1b7a765a6f08b1d53a
SHA512 c608ebebd36c50b785a590109404ba5f2d78ae4e5e919fcc4972ca48014e4a9d269bfd818117ea40673421555f0138f6ac62d91b620efa2b73b0d54183a5cd2d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14831_.GIF.doubleoffset

MD5 6fa99a16bedcfe003a7357368b002501
SHA1 ce415c41ba558edafe40ebb47f6d06754ee5741e
SHA256 a07ffedbebd14442081eb4d0c9bfcde69e7577a173e487a32609c473e5ccabff
SHA512 35c4bcb0778df09af3ccafc1fdbf23bbc43829da3f22c22630ab6ec31a334989b38a72b4fc2d2e1a2036a03e479139e02b44a9371025fed3b7f157faa951b843

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14830_.GIF.doubleoffset

MD5 ca68f06e7277b3dc54f06e40e1f65f90
SHA1 86a1a54d0bdf2f32d4afd7728f48ce5ff07230cd
SHA256 8a61ebd3b1d3dc96627c26f67600f146e6edb88e56edd2814182cc9b1d2bde60
SHA512 b9beaa55f9ffd156292806b216653cc878af9b388d8050e2bbe9b15d1bd4f2f24d381e5c6f8e2d01c2d22685f62b48a707ab34327bf4836c70fcb6765f0b6daf

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14829_.GIF.doubleoffset

MD5 134da7946bae94a3e5b1060d1622ed91
SHA1 17870a4a82006518d556ac79164f12ccc079aad7
SHA256 33a6d3de65610fbe74fc15380c932f24f8dc65cd23c61d1a139e3e7fa6e984c8
SHA512 e7af2deb1d04f388035fba0cb08570a900f25425e6f2a501ff91739ed7c63f4a530aeda5be6cab573c03441f8a4287a5b82a101379d520de801bc5867bde01d2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14828_.GIF.doubleoffset

MD5 2fc92feaea94bb79da59166fe24d2c63
SHA1 d124241f85ccc371295685153c30c279379ae530
SHA256 74c2bc18d4dee43f133d59b5d02725c5d73174bf15510f1f34b3bacd3cef23df
SHA512 2b75805f416d21fac7c3a3d03a2b8175d3cd7ad61765356eee72ffa8f60149760fa8dc41ca88cc1ef20f2c10b48c6fdc3d318cbdc2eb4c669f5fe9c8ba9119a1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14795_.GIF.doubleoffset

MD5 b8791cdc0967aead2a73c76df6718e25
SHA1 0150b6d827afa15cabfb155bf7ee855c45677636
SHA256 41dbcd2cf73952e5a32df8e8b9f41a738b4cd2ae01a6764bdd59e06544facb90
SHA512 9287326beae67e1aacacb2f3fb0b37d15664162801e7da7ac2112099c75f3785306f2ee62c1fad61855e5e32db1ad7a4309588f70b1b182f63ed1d69c36bcadd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14794_.GIF.doubleoffset

MD5 8120c8aa05b4ba07997252a23804b1a3
SHA1 b16df7d76254de7749df5560bcf6594d805c346d
SHA256 a1076995f51a5d1013d65e82b7620432a3771eb2b954736a0d0ba0fa1d7ea62b
SHA512 c0bcf2066a80bc320523ef3881518444b75002ab2807b2d0f1fd4e2de84f15212a373b70cc5a4f82a3928b0a2f7ec78c40559320d0a6adc87d98b2362e425734

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14793_.GIF.doubleoffset

MD5 2f4f86170038d34fb55273a48dd4197b
SHA1 b76f21814d44b8fec1275a43edd38d64815aa5f0
SHA256 8c0a487924dd77c6ce86bfb90305f00d29cbb2df230e5c1a884ccebd77d86d90
SHA512 8e69fe112ed43dc52ad74742190c2d9e9f8a270952002c6c220ac59698eca9721e25c656b23c75f840ea6222cb89377a424d3c615880d18c71c6d664459143c3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14792_.GIF.doubleoffset

MD5 ca5917fda0709249d5a892c2026a1dad
SHA1 9b3a39d3e188488c92705700842c6adc9a3aa3c5
SHA256 0f4e7adb3635a008417a681a4e8ee78e1842d748cc2572a6729b0a3a570ac8a4
SHA512 6c064fe7b7ac8ce1f887b0ec6001b6eff966108fedb3e090843674f711d1f9c1a3da2865a0eaed91bbd5d26fb8a45270e450a5aae22f4a59aeb34da1382829c3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14791_.GIF.doubleoffset

MD5 8244c050b195bacdf0858c38cb7f3195
SHA1 a868f14c3635c5b7221fff78a0a006f92682ebd4
SHA256 fc564830e101bcf1b88d79269156957a0223ec6f08eba3b450b2b5ae3a9d8910
SHA512 2d95b8bfcd7b7035ff05662ab961e4072a60facef03c0b4eac2e663e74c0a564635e0ec884065168661db7dd78da05bb09a868aa43c488a7384adfba5ea684c3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14790_.GIF.doubleoffset

MD5 66362d724dcf9210ab2b3bb9947282c3
SHA1 3832c4dee9e0a5d9261ef3af54218cba2837a2ad
SHA256 967f4c0e092ffea8d2a98eb0cb3e52f11c87fd54d288c2998b1c7c2242fd189a
SHA512 39af84fafc409a52daf33f40e085bdd577843ca79e5499438aeef1d0f8a6c9364fa0ccaeb25b391c01b7260cd62e6526fa2de85c3ac43ae24fb694e9bf9de762

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14757_.GIF.doubleoffset

MD5 802633a76b8703c718bb62f4ccf4d10e
SHA1 44eb4797fd54363480ef2fdadad3065ca378eb50
SHA256 cdce234ae2bcbfc95d66ea43859f04a11a48ebf8c0ed80c23543c76436f10f30
SHA512 4d1f154806a956d8a3312d57be14dffa18b2947e123dd3a1d31bfea4019030933a908dd728a69f7b24465870b9dba214ae4f98c8915f23c4f9b22b109cbd0f98

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14756_.GIF.doubleoffset

MD5 5fbc4ca9d597ee0c28e1b02be6a921ba
SHA1 d0770be0cbc09cf964d44d581015b669ecb0f0e4
SHA256 975957fc2bf15ebc393b3542e12b3118068d736df9b1bb3b97c2ada36eb60028
SHA512 6d098e1e732f36819b9f7b74c0f3249f7d23dc8877cc36272cb2bfa0dac2efd7676a0ca0df7b735f5a47847bc5a7a70f158f5e1d366ba5df4a3992831b7db4f8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14755_.GIF.doubleoffset

MD5 b2745eceb698880d699ad3dcbd7a4683
SHA1 f18f3a34b99e89838eaaafc9e1a7237069534958
SHA256 f8c95c027c3514ed16fb30638ca376ee03b5d57acbfb0fadc3a53ca5545c0b32
SHA512 420a97338781e254d586b1a331aa4ebc967c8c79961b7c95dc146880d2595fed3bec352b9c707e3574624c31ee2a69e396fab5ff35de52654d5058f5ee270fe4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14754_.GIF.doubleoffset

MD5 028abdb1f7ac826a5ba8e8bc91b1f3ee
SHA1 30e329458ef01dc6feef649bdbdef91228ade977
SHA256 b731c267d1cd68a658af4b7455698884c6a95d270ada9bfe361529375eab07e9
SHA512 fc69e001692bb6f4db4b5bda1b77f45f9767ed5ea42f0e9d21ea621719c72c3f5afbeec56c0e2d815338c65ec80aaf25c8c2c526d384bace0da6457fe368c473

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14753_.GIF.doubleoffset

MD5 81abfbc26758c0830ad815f4578899b3
SHA1 886fadc216203d0da73285e5e8e4799610d70a0c
SHA256 0ed1a4ede6b0d120621cc17bd364ec3c7b301f07d058abe1677ae744d3843072
SHA512 831cc16ec0a04d148947b4d1bf0c44031ac76365186e0dc1598915a923e27f27977b26e07f224c6ca07a5f62f62c7ff524855effd6a7cb6e2be511644fbad3fb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14752_.GIF.doubleoffset

MD5 39c644632db02226f99dfc44fe003b20
SHA1 b6d54efa0ae132110179bd95441ef6220421de1f
SHA256 e734316629f0d4b7a1c85dc0f7d3578b05f57fa9627dccb0e70f31c75e601baf
SHA512 e8364f9b5d98aa6c492ec516ab4a503c394fc6d4241c4247179e8c6d42952cf66a26c7d3b820aba78bac2e1ae373831acca0aa1ad821e3c2510f9fbaa8003bd4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14693_.GIF.doubleoffset

MD5 5ed61dc3967cda651c63208c3ef5362f
SHA1 339589686d7319a9134bcd11fc1ee04fef11e6c0
SHA256 5f87e584e8d6125c60fc3a83171c879bb7cbf2356e3ea01511953b220d9951f1
SHA512 ff4e025044d102bf3df8852b0e90c62017b764152ac165c3d930103fcfb8b5d3eae93162f40cd0a4a7d005e7c0b4414a5a37c5e2c5977b3edde0043761be0e6d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14692_.GIF.doubleoffset

MD5 46a43ccb723060709dcdb6e7e531feff
SHA1 b235a1812e14b71e8b0634b131842fc798d6bfb9
SHA256 a49261fa92712d710ad7e04e9ae303d874f19fdb0fc2388b649f14cb6d86cbe8
SHA512 2ccae9a7b8c1847bf7a2d2d635e0af5ec17bfc502d38372909b400f835807f68c206c1dfc9c9eebb8194523b3c2efded84789c9b01f0f642455f05a42be29327

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14691_.GIF.doubleoffset

MD5 313cf2f8c40e8f71ae7bda541a725eae
SHA1 47dee461692035f62659310c4837900ca23ad8bb
SHA256 a4ee00c5607897f9e10e680cef4a152c82757343091acf5b1a56071811ffd260
SHA512 056717b3b8ac63b6954f080291d37b6e2985cc20f2da514b440acec0ba622a623509bfae48fc0ec0d17e63d3483627354ceecbdf8691caa0205e82e7583614b4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14656_.GIF.doubleoffset

MD5 c18d632fb82334d9555c223bf5715df2
SHA1 dede58bc215c04cdac8393eb1a83cb347a5cfb04
SHA256 990425f5a13a73ce551f263864727335d2bc2146115aecbcbad5beb33e5fe4ff
SHA512 84d04ec5bf2e092a58a292046f880e8590478540ae83a9f46186a4fee37d7343ec5324098fa9947b492a0a6e051fba823522f949ad346ea9f650b5cfd303df66

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14655_.GIF.doubleoffset

MD5 83963a28210c248684223c41699403eb
SHA1 a8e6426d5b4ce7beb9b77e6448b5ce4459ecd2ed
SHA256 5a49f3ecdb927383ad752be8b1e972ddbda922f166d3817fcdf08d13d4bffbb2
SHA512 e93c935841cf7acb22627aa2762502451490473aeef5a188debac22498195ea15cf7681bee7e6de6ca8ab59456e28fae174ad201b384c5da2c40cc522a9437f1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14654_.GIF.doubleoffset

MD5 844598fa9a26ea64937a201db2772b90
SHA1 07202a7123e8f8fedc4746b5a37150d68153d013
SHA256 702b876fe872bcb72f18e20159e4757369dd4825e9299f7dd3dcde90130a8b42
SHA512 c4c5bf801859f89364699293bff73ec1fd7c60aafac0d25ca62e89d5a6490635d9a5163a145c2a92a3470ba3f3f48bd7d765fc557cbf54e1a3d3a9e8b138a8c6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14583_.GIF.doubleoffset

MD5 9fe0d368f29bd7f1dbd14db579ac8a2b
SHA1 a5df94fbdd8971368aa0c6cd1ca45dce2c8a6d98
SHA256 a4a2b6116348292bc177f2f6d4878b314c849ef6e1e10f62bc915488cda2a053
SHA512 e4103689e0d12ef7b5db732fe98c2c928853406249cfe3285500a6b7c84994c0922bfda31535b12b06966b3c6bd3a4217e105e12cf83e90f1feac43515916fff

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14582_.GIF.doubleoffset

MD5 1d25f51b4a67a111b51f921b6d055f63
SHA1 661e8a277e67e8922db3ba0ba63ea9c8b352051a
SHA256 2dd95b4f6a1696a0c833b71dd910b0cc514db6fd6dbd09dc776ecef5c30c67a9
SHA512 c7b31407bc196445edc6e3635f9965f9a0492426b122fc9938f8ca83fe2a72d5a0fdf189517292374520306c857fe5362ea451d0054c36fa2ce75c280b6106c4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14581_.GIF.doubleoffset

MD5 3da4a73057ba3c1714e2bbac4b0192bb
SHA1 f9d5c0cdd1da4330848e2df6da057e78524a31ce
SHA256 843f801b7ec341469485eed56fac20479a403c49e01751b96ec96e0e04a8841a
SHA512 6a1787f20ed784aed2e36bfdeb3a97063a2954c896d0500ec35571702e5093e4bf33999a3865f7810615e5be09e19dcda8dbf079c9c90085672dc4b8caed746b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14580_.GIF.doubleoffset

MD5 b3449400b5a9a259a8de14c39f9e8730
SHA1 390edcfa550bf043ccce15fbb9e442fc3454c374
SHA256 274517ebf658c52670be6dd342472f000b74a6f73e9303dfd93cd5b38782f968
SHA512 a3d7666b77b95995cb9d54a67cc644ff67b29e42922460a7d6fb62f48914a57b363fbe8773ee944e83b2f2098b76401ff831313dd56d5bae60f7ac47f3c67b6a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14579_.GIF.doubleoffset

MD5 277946d5881b2b5eb3a4642bc73dc54b
SHA1 a008c239bbdd10c5f5030cc27d4c2e6030d92bee
SHA256 5353a296d2ed30631b97a799e53250112edb53c8acbffe0964fd7340678518c9
SHA512 444b370c2b700fab445bb357692bf66e1aa964231cb090718d0bc9388f3e9203d3e149e4bcc8cf7503f907b7ebf7c72e55b1218fef190cc0b021586b81574c16

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14578_.GIF.doubleoffset

MD5 0876ab757fa06be7f4f56aa022cf505b
SHA1 4cf079565367123153e29604342df577472d2030
SHA256 7a7bc5df278911036f5635f399101c0ddaa38d71a18035bd13542c73cccdf16c
SHA512 59cc0ce80c09031527a29749d5f1431154569828e97749bf0a6ab36c4195438245b78a832a3554cd2e60631d8837abb1ea44e37d40d3b2f3dd2c000edbf187aa

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14565_.GIF.doubleoffset

MD5 05116d5b87bdca273849d840d2c3ec6f
SHA1 c0994dd080f14f6fb9a90f4001ceac04ac75d40d
SHA256 2260582e65947ff024d45e48a2de1bd9f580ee9bd43857fde925d67c98fb3ec2
SHA512 26c8ed701724414932d83ba884db57eee98bb3620ae8a754f68986afb7ccdf45d11ed6ffa6b250a0bd8aa2600f5910dfb47e3d9465838624c25ffe6b7fec5f45

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14533_.GIF.doubleoffset

MD5 3aabe9a3644671b22be5e20252027cd0
SHA1 146adddd87e96dfc29ff6380b9693f9a07598252
SHA256 6d6b3e564c8fecaea5878b96dfcfb35061bb3f6d3f7d5ed4f51243bbb615e2a5
SHA512 70749a063c56792e739e302521a664d6ff28ac1241df7644098f69d2be5ae821fd95245ea88cde013d68f485cd9513eea0c520320651b4fd7fbad07ad64d08d1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14532_.GIF.doubleoffset

MD5 36eee277eada6ef93473e768706be805
SHA1 e1a4ed97aac5a355e9515415c9035bf6d3d55adf
SHA256 cb7fe4a8baa4d87c843f795270be39deef8db967a3ed85953c9d62b851f2eb80
SHA512 7635c2a2468ebab3aa96fddf6611966b1d510847a3fee277641c1a60ac34a2b3a432befb6a0ae1d7d5e7b1503f68e8e21ab204d3f4bc89a1129492e9fc06cb7b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14531_.GIF.doubleoffset

MD5 b1537f6896a4adf9365a5b6806e8491e
SHA1 cb98286947ae12ba39747df0bf164f1d933f33b4
SHA256 cc544218105a8281bdc53912b0656e4863e40abc917527c8bd8f333064264ead
SHA512 bfa63ff19b32953971b6f0d93c7b33df33fa7edf9e7aeb48af18160824fb31cd2ceab82e24f8b8c9bb9c22b2735b90fbb9c3b35848fd221544bfd3e3c39b6a83

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14530_.GIF.doubleoffset

MD5 3983ee9f134f560d1de723227ef7ce7d
SHA1 6212b5294463a17567812a32f503319966317467
SHA256 2d86cb338b526ac828d4231ac099b61beec547e614f74c00cc1c0ceeeefa9cc3
SHA512 c7f9ef91f324c0ef7864abbdb1344f8e4d850de1618b261f51ebbf5a1ce220739796b27d2b66617ecf9195870812b4740dc297182f2d038f182b856e63cd0328

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14529_.GIF.doubleoffset

MD5 00a815e70aac397894103a36df111bcb
SHA1 d484c9d37dd89a3055a3caf808bb575cb97fc9cd
SHA256 4d02044fb251903745c9dc586c2c52f5861e909d4a3a71709731fbda4b255328
SHA512 458df39817b787d51b5e164633c589734a03682e341aa483e2cbdc92f57d0379ac0da50ce29a5c86896f2a5fb3fd5c350c91a85678ea8b528f0aade88fc41d60

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14528_.GIF.doubleoffset

MD5 9f96ef446166ca740869ae92b9ae72d8
SHA1 b85a1b461574773212b8295c8da7b1b7c31282cc
SHA256 131498ede9ff8bc14e1053176e0721945ebde2e2bf0afc7d7360ac48520c8a7a
SHA512 aaa6b7ccacff9e76ce8495722c3fd776df124c187030816c4bc83118df9953db7f17359f3af10d0d5834cf1ea5467163d53118b98eaf385e5de7ee071d3ad099

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14515_.GIF.doubleoffset

MD5 2e242af3036746acf16ebbc66813e655
SHA1 27e3903c5def93b7b956664e388fc93d60fc8268
SHA256 6690d17ef6ea59fba5524559c750ae8cf95a620f0b9e2f4785b0b12455f36551
SHA512 0e3e33da927fd360f7837017e0d90b1a79790c0f9699e6dd228d92cc5adf57fd6b032da4e5110d3bf76986e309f8db0fe287ca740498165af8d4143b4f308a2c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14514_.GIF.doubleoffset

MD5 220518f27e738af36426a15e1e5094c2
SHA1 13888a0158518b8857669c79e656fac6fb526195
SHA256 3c201c41000dc80c63f7949d36f6011abb9feedf9a579c3463a52c521835712f
SHA512 c39d001fc79536dff7c08e7eb3c368679bc5a56786aec35b6cb422c64570a385b8ba2dc956a4fc1431a1f1c8d48e9bbc3edfb0f4c22124360a1b33c49d7b8d59

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14513_.GIF.doubleoffset

MD5 76e8c1b4730f38bedb1bc4190dc98923
SHA1 4ca955e5e0d68c5ea64707b3e08d7d099daf7d5e
SHA256 bd83fbdfa49c70b6f98893883452d34c5c7b3265f0e8a959eb9b9c436cc8719c
SHA512 94d00b1aa89227a169858511c85b91b123213f68cd9d4d49ea96469730cd8c2cf275e7d842aa5c2afe6a2a8e1975148d17f8780fc9072cef056bd0456834a1fd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10337_.GIF.doubleoffset

MD5 d63d8ab1a8d707acb60784db088b29fe
SHA1 207fad67cf61a75bbea1e84ec43a1b7ed0126712
SHA256 03eefe1fc96f7d107d7d0259db90a7ab0462bf4d3501e4f2f1429dadfd5754b3
SHA512 dd40c569e5eac2f5dfa31a81f7aaf72c9a97bca4be5482b3cf229432f43d0091d67a273cf2bf892e9a762a6adada46dff26d9f07380626257b9849066d857e9e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10336_.GIF.doubleoffset

MD5 954a5e6fd103be181b582e5c30c519f6
SHA1 ba0e14fa10793dbf31c57c80872a560f00065b69
SHA256 01e14b1942de7e10bdb25f75e7b4977f4d01058cec913792d0d04087f40a308d
SHA512 9ce20f1f769dc551a6e786cb22c97c2dc84bc38fbded5c8c3a1e2f0c3af4f04849de6ae503a5b575dbc42a41ebcaa7a0e46fc23b4f161522eba180cad8354747

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10335_.GIF.doubleoffset

MD5 a65694cb69f1884ccdc8ca6b193ade48
SHA1 a58485c70ef9bbc3af8ffd7e90a4b9870631aac9
SHA256 5485de4f7fb37ef03ed13bc0576f2ead1ad9218f8fc7460f21fd8e18b0b8bc23
SHA512 eeef2b1f655a4aad3c4fa123dc8d3560860d448886ac1d53f2a6b9e7c2b5b349060483a17d059ee7ff941ae90e3a828002ae5a3bf286f03a6af715d2e5d8f26f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10302_.GIF.doubleoffset

MD5 4bc870caf758845d353390d0f47c3aef
SHA1 5c3859f7719aa37fce8525e30cfb59ee960ce4e5
SHA256 5d81c86767cea8a4e0e25b321cc5f09e5cf09d4391e425e5ed5ebde8f5649e21
SHA512 54e67d32b14abbe34ab8649636c790e92aedc8e598081ebe7d2cfa8a6e029249182ca88cc499e4714846d5f5b57b490ed57ae2006976eed8bd663b7a40cf7ebd

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10301_.GIF.doubleoffset

MD5 8a45e470cb1aed89b7aa4e6a2737af3f
SHA1 6e50b05e0ac61b649f3baa93f9178bc5e2d8a031
SHA256 1739a69003ec970464f5f73fbb426e4638145b8c9a0d19019f5c0df76f89e6b0
SHA512 f70519982dfa800332af6883b7f729f53d793e103b457a30f14513fa3f19d0d58ed1fddb20fa71c7d67e4f51638cc843e8673d0cf588b51ad2b9b60de2dd64a3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10300_.GIF.doubleoffset

MD5 c7d50c2419f01ff1f17e1d2653cf7011
SHA1 58933d4d7c686aa901d0c09745049c4927e299f9
SHA256 b12cd7fadb6e99999e7c48ea38eb92d2a3c296a781a2aa3a5a6627cacd76847d
SHA512 4b805d86b1ad89825d2febb4551389b8e44230ff0b7ecb7c7dacdbe55a7f9bcaf3004ad1cae61f2d82e86747035aff422ad04baeda112b8b4221a10e9cc38bcc

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10299_.GIF.doubleoffset

MD5 fec57a94b29f5dbaf72108657966ecda
SHA1 30ad2237f35d8004628941a49cff471eb86c13d8
SHA256 a44a18f046a11aebde4c5e2e763c622e6b475f907b0c22e03f2fbc3181ab21fb
SHA512 2678f327b02bdceeab30b001196ce553e88da50998581a29840e8f7bcb2ba91d755c81961b0529f4e64af7be291cccc4d09a8ea73d9bdc706ca631885deb2e9d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10298_.GIF.doubleoffset

MD5 07845876ce1883814597ae5d62bd5c1f
SHA1 2a64b2faff3374c47461ea8babc2ae9645e88d27
SHA256 34cda863b46c49159f7eb78b26b36a067ed9254262c674b5cee2d0874d97a157
SHA512 1b52928874afd09b0adda355bbb931da6cbfab6af2a0943a87dfe24ec7a7562dd791b4db341567b96c9810dbb9d22bee19f1a1c855f8549abc761f36169c64e9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10297_.GIF.doubleoffset

MD5 95c60f2577cf78b908aa58940d2c6fe5
SHA1 cdf4edfc1a940d02e9b2caa5a43f77c453d97ba1
SHA256 02bc0af18982907bcfc091bb9eeebfa8b18154d85ee90b1474f3af40d145369d
SHA512 8659d4c19115f5e7814a38b7064281200e4084b2d20097ebbba003e71b8ff5d8936ff950c344256a87259d0990d8c61ce5b2d92dd7ba542aaf62511fd3daa467

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10268_.GIF.doubleoffset

MD5 9eb63bdd9b4c0eeae23993ef8004f0a6
SHA1 83f806764caf53a8ef93da40ef7663714ea0f733
SHA256 3ebba758a67c18bbb9126d9eeb18e800bc832a2430e31f71ed21cef78f0d8dbc
SHA512 c37c50810582c21036ab30a416dc850065c5df4a4d2b423d6d6ee47ac23a36da9c6a83da3cf8a00a481576cf4fd5def1ac06d633269265cbb63e4339a5f48d87

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10267_.GIF.doubleoffset

MD5 f376d01cb3767f1ba7d44431bbcfcbbd
SHA1 396178f1b740a831385109fdaefa763802240286
SHA256 c3e00a638e5f2be19c2053a59d73827828550341de2446a01a78f462964db846
SHA512 f048f013030d629c450e45f8edff65196ff2e491a1d36ce8736efa51a4c48e74651f908d4ded560cdb6f03cf28cefd414641346f0768f7c4c061eb194b5f85a9

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10266_.GIF.doubleoffset

MD5 ca0a5c9ec2e780acd0bbc7fb95156890
SHA1 2a1ba4f740fcc4dd058cda49b15ec29570953ca0
SHA256 6375d9c9ebe2b3d070707b1a1b7ef8128fec30420ff9060b1b0d74a74d6e7a47
SHA512 0aceb2bae0fc2ebe178293113ef4d07428de4fd030dbbf480a69ebfaab1c5238f8b2a7e92b77534751d6a7a4ed7a49515b8ef429f353e9a8048f0f9ac99fc822

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10265_.GIF.doubleoffset

MD5 4a38c49045702f45fc785f3a27a5ed06
SHA1 d94da09f016026ba2caebe76a2514b6a9a863a43
SHA256 8f743cf5c322dce45c979137850c28d277fcca5199f925372e9abf934ab919aa
SHA512 634a19aca08c154060c2aa4b50a308ad38c9d8a92432377884ce04c8be54458bf724e07747acab443d21d87c4ba4acc3a0222c047c486b3370a5fa362bc07b3e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10264_.GIF.doubleoffset

MD5 f74ac2f3c92a7293204072a99949db96
SHA1 b7a65b58945195529ad8e7fdb11dcdef81c99186
SHA256 5905e314db7b7c80db25634cafb12a16cb7d1f646e05f8d3fd7a395654ee7fc8
SHA512 c3f2e63605b536891b5cd1fdf520b12c53372f469f587750ac8c31b81764acab240e9b27cb6eb435a7f41d73d6af0e15fa899fee646cc3d6abb92f763ae3b7b5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10263_.GIF.doubleoffset

MD5 f0a83f5a451805664a1b7848ef34df7b
SHA1 6f5da21c2f92683045ad860acfc3d3efd47b0206
SHA256 50a40b2cd707cf8d1b0747cad58f2422469bfa70c1daa2d45d12f32858e78371
SHA512 1dfaf4113f0a16f9614b7e76b0ba056f71a9155471f48c0c6a77b45b1376186f9f3183dad3b75e4190ae9c544767949828f1a3b2ddae1a65c5d22873638fd858

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10254_.GIF.doubleoffset

MD5 994007a818b3577d053c957b09863b03
SHA1 727e0f25633bd286fe8941378c4c8c4dc2ad8ba5
SHA256 514f5f320c3b461c6c3ccf0764ec0540341e01bf36aacf9527400e95ac66c07f
SHA512 cf59ab7126ecec972c5b1fa89f736ca09b80d1fd3109c2fe9d19ead654a255f854e276fefc72b7628c1fbc71f61e3fcef3e31d73b8ac87749102314cbe1907e1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10253_.GIF.doubleoffset

MD5 d5b4b18158a097559d0ec1e640826d86
SHA1 58fc1f4ef0928145fc4af29c1253e04d3f4c1c0f
SHA256 37e6eb6287cd1a056e66fc12e1bf0e8d6bfbc2992863be16502bbbc85fc7099b
SHA512 f722dfc75684218d8c246ab8fb35e06a6add3b755322afe244975eeb1329267615e571ad63c27da8634ad8741f0fe1e6963034f2c4a5fc952c30636e999014d3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10219_.GIF.doubleoffset

MD5 49964b419b3a0ad4402203939333f66c
SHA1 e2c636ed9e840a55f42dd6364af5fe9fbeb16b75
SHA256 5c6d778621e60245eeb9dd9c3b5f5c5a91a05eebd034231d2b4bc571f2753d44
SHA512 51cf688aa8bc83f6f7340edd7c5b56e8ccbc8ff3012eebd8479d8572e2f26922d4b201e67812f43960af2750937e37625467362a8a3f31773dc042ea0a45cc3c

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10256_.GIF.doubleoffset

MD5 1f6027f201654d7e7e399234f73c0030
SHA1 059842eaa5767c02a5c2bfbda619fe4ffa389fb1
SHA256 1bf7869449eddc3c70b168716973120b9bed4cf4041f72e6ad6c7f165062ff88
SHA512 5a5a6b415ca6c8f8f8cdbb7dff6a2d93eee9764e15d6fca3bb8ecdeb12c533b7e8788ae6a14c0ca9efd824d9a7d354cd6985004af7aafcbcf226a9a60ffaac44

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10289_.GIF.doubleoffset

MD5 817ad3b3829a4362e36d42a3dcf49952
SHA1 c93911b77eb52e9b8b3077c7a88351c9d275c98b
SHA256 8b963aa252641f9f15700e5a201ed7672b6e740150b6fea16828e7482a7d4f9a
SHA512 04dad933adb2d018c01eb1ac4cfc8fe4fe9249381be040af0065a0cde760e4703bbd034593734666c29b03be849c66449d6d16c7fb6f0975720b4d5d4448708e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10290_.GIF.doubleoffset

MD5 1adf2eab812ce5f1e67dde5ce99eb0b1
SHA1 9e0c0903f2debc261be99cbab1435d342d5c6029
SHA256 eb7698042a68392bd371d0df91428ae4740bbaabec8b4b97ecffcaa0d9e25feb
SHA512 60e618e7028df23d39bbd5925c778e830429c41b03921227e35c70bccbe2b113ccea5d76b0bdd7870c735fe94c86d79df8d05d388ec50b3f1d32b607900cf8c5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10307_.GIF.doubleoffset

MD5 709b185965532a3e6dd2963dae2dea34
SHA1 09a0b56dbca1dbc4cf074858c1257710261bb89a
SHA256 5bcc50a1d74e1d3573341e16406358f2a528575d630083d24657e043e9e53d33
SHA512 13714dbf00165bc4d6e343f9e0116f81232418eeeccedd57036c4a6804afa809e1a78c7e067011bffa73929880ed257523302a9ec746b43f60e4746dda2857fa

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10308_.GIF.doubleoffset

MD5 ec3f6b225df0e9fe462cbd3985af4f64
SHA1 64a051a4e92c89b9d0afc04c6da91ba12df0e344
SHA256 5fab46e982b8dabba68569860ef8995f6288414286909628dc5bcc20f820fa1f
SHA512 afcb6c2a4caaa6c8c4f2e07eef3fccef0ca8fb7da5f7b8a29d9d925496f8f5dbf3a5c5ac42344cddd043280b01363b5aa664c4024e84a82ab8028c52502f844d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD10358_.GIF.doubleoffset

MD5 b72a8db40317ba51310d35f2179780c1
SHA1 5f8d4c6015ef3e19ebdf1d1772d47af87168fb31
SHA256 6a62f0dc467121053188c2426157d2a51ba1ce6610d77a049fb147ce7025c604
SHA512 241ce0579ac0f23d3a2b287d021ebab3a43bd2dac927a49e3ac23ed560f9b9eaa26b7c2561b7bdce34216b377b36eb0955c065ff7f6baa8163db197d4bdef047

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14516_.GIF.doubleoffset

MD5 042ed8e834c6d327964cb06563501b73
SHA1 5e75785dd01812a1f2de67309a9a6b173e2e8f74
SHA256 fa0af44a2aa8bbf8f0c767dc159e3064a8c5a79e596d1ee5779de54d4a487629
SHA512 9bd4c5a6f0e477715c62900593911552ab8893c6569300e1fdf8b7b9d2c64d5d13b1100dc358d9a2bb54efb6ed89a4877a218d77ea02b97f567d9ffd0f9a8731

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14538_.GIF.doubleoffset

MD5 793ce0d3a5fc31cf53aa2aa0337e4acd
SHA1 40caa43aca074a074c5fe3a06581320c5e97ff2f
SHA256 a5d9bd352b994f63e9b65754ec06609d8ab1a2df5b5f771191a2ae80f3c72be5
SHA512 6a8a4369ba0ec659647f30d0be383cf5617e8dcd707c5b77003068a2dd57bcb8555fc24012ce5b915903f810fd5de020ae34f50d26b11df9dd3a4b4145916a11

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14539_.GIF.doubleoffset

MD5 9dc9dc8b31fb185027266727d31e70a4
SHA1 d16d618b42f36f92a83e443aa3bc6ef28e8fc84c
SHA256 2f6fa4cc6405c1db26ea30b8e3674f544bd0fb69ed82bb14bad5900c178a3776
SHA512 2e6c1af3242d2de6ac1f0714a7afcdf31da8121b89c287f0a5f1f9af0d1220c3b7b136da426cc9b07e78f16252382b5ba43a36aa84aa6b5c207cca75176d91af

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14594_.GIF.doubleoffset

MD5 7dcbe8334e68db8da49f11ed97b213f3
SHA1 26f175510862ea0e02ff419036d31505023c50d3
SHA256 c48660d3f577044eca4964429a942266c4e612d0ca3bdcf7bee8e109abfeb2a7
SHA512 12a333c9049694613730c0558e94171c1b491f067fb3f610982463b6e96fdcca0825239829a6f96c22e2d2dd0146d11e722c38b0954380596bf4c84d08f432db

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14595_.GIF.doubleoffset

MD5 d788b5c698b0d3994bf533c80b60dc59
SHA1 85b604a68064d7b7348ca652d1e52e438310e5fe
SHA256 e5071456e92a07e78341eba1653842fbc49b0e6765b0ccfd5166af57f001289a
SHA512 b7a2a3656c5e3e5a94d94cb24d729c6783ac49c6dbcef4967f2f0c921300997a768c5af1c246e5f66909b4ac23e43928ac454236fbeffb663eb8f0576113fb31

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14677_.GIF.doubleoffset

MD5 de32d35dd5178265e50aa30c56acc386
SHA1 cf8fe34e8b1f4f12b943dba7d696cd596a9e95bd
SHA256 927b5dc36244abecc2c175385419a31c7f2ab501de68c112341a07bb47baea1c
SHA512 3087be249f76261550ca1cd27ccb46db6cb70858b6e185170227d91a04d583031bfb00d01ab4592b8706d62eeb1217c4451c0fa4c06d456c07b50046c51fe275

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14710_.GIF.doubleoffset

MD5 cfe4e32afbe7d951938650701426b7ac
SHA1 21dafc06b5f7b8213b626a93cf56f5d7fa39d164
SHA256 b42262ff8aad34282248f3731a6df25bd9c391e944b5c34fdbc170a43f2a2378
SHA512 63f9a9ebc3f070597dc7987c5a3e78137c32a907e042c4e73573b5a33ae30b130700d6b88a9bfb2980227b66631a037f0dc70a7e16cc35d3f47b476fbbd5601d

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14711_.GIF.doubleoffset

MD5 259d24404c70155bd83933a761fb9187
SHA1 149bc75fa8d34d74acf93f096146c4890545dac8
SHA256 c73ec98c056de4d32aa46bb73f9646e39f473662735044bb76218ddb9960ed8f
SHA512 dc9e26f48076722ffd726a169039673ddf21d22ccd5d0bccaa2a92d37e4fc31f8c1221ad1792b4f1718954852f848ffcde15063b84a40a141b51bf1f1ab023b1

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14768_.GIF.doubleoffset

MD5 72560d1eee5fb01139de9e5135f36b88
SHA1 6b44b87dfc6ef4781012a8c259b4d64fd75aa991
SHA256 482acc92bfe606b9b92be613713b08f9aa344e1b660dcaf19d2937714b157459
SHA512 9fde8c49d73b5219c42f1ef68cd2b4adec2f56229774c8e0da9db230ab134aa953670ce7711cd198583f360ad2a2078e31f3b04a1d82bf24b91381bfce86761b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14769_.GIF.doubleoffset

MD5 7e088e04f9ed780b29690ebb4f9aadf9
SHA1 fc94687a2b4c95c98524ba0915db75139fb51321
SHA256 bfd568413c65e5400981e7d2192df57157dd92295a95253126bcaf10c7ecc8c8
SHA512 b3cf9524ef4372aac7d0af224b15e6ce269f3f7caf84a4a4289ca02dacc5db9826af7a31df29f0a438fae9441027a905c15134cce8cc8fa1d34002af5eb9ccd6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14800_.GIF.doubleoffset

MD5 4c2cc6e7a23ddea60925f5520be58378
SHA1 780938cea866e580b6ce1c367c3ecc7187db0db1
SHA256 2d01cbefa44126f86c3c02446a9eeff451aa21c40b20a224b5c23d55ed06aa0b
SHA512 40d846e7957273c6981af6eb5e8921dfd4c5668e0202bbb29e2579f4544c292c1ee1d6febff315eb38e950ca975cb213c27a7b0e10c8358d98500010db83c7c0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14801_.GIF.doubleoffset

MD5 a6e9105dfac414f38138949d439deeb5
SHA1 7756dacb33548811466d299a8aeebeb1771b7faf
SHA256 99929592fb5e0414aa8db68916ce3aaa6bfc312f687b39333b9f76038a298e03
SHA512 379b3697ceadcb75b31b7290020ea418f8600852f5e2492ed34ce51ed6b5b55be01f8570abe3edae71d7eb1c332ef851f2dcaa4be6bef545ce86282bbfb83fcb

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14844_.GIF.doubleoffset

MD5 76f4efc37ff7433470a2dc87fe8d2cff
SHA1 75b8d8dcc2c33d1a76f8242347c3bca6be2e4216
SHA256 d9ae5850622de6b1d8f2a56ced8017cced4f9f9a14918b71c03d1abedada019f
SHA512 767651d1869116d929d90f3ef8ebeaa9717dcf9a35d2e3d6f4d0188617cf8c17da870b4ec5fc455a67a9db47086340c2ec1a547b00573dbe1db2992e00e1cac4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14845_.GIF.doubleoffset

MD5 dd1453323a18831fba5744dc4d612fce
SHA1 1b1e3e7dddbb992702a102cca3a048bafbe0d4c1
SHA256 26e88c110d009dcab10e85298305203dc2c9ea475cb324dd637eb901f75e2715
SHA512 5c2a07c713505bfe094e3835ccc7c1960c18867b05ae9df56f7c0d4ba96ae2fee49d9a1b2642fd79b8f1fdc2f45d0da597264ce60e7f13a32d5b4cbc63ad8d49

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14882_.GIF.doubleoffset

MD5 9cd976e9de134ab01e122d8b3997ea74
SHA1 34d90f796121cfcccb01ccf84341bb32bd350bbd
SHA256 1d68cfcd7dbb03e0bf5bc893ec5509e187de58306108cfc1d1f4e7a309b3ba64
SHA512 88f8c420ff020003565675d825d0a22cad1b3838d54919d5a4347f23e951482549edea89f44d80a7ef29973294bef8be1803b18f170f828f01741768aecfeef3

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14883_.GIF.doubleoffset

MD5 86138b18c0e4318a1d8be86772d75adb
SHA1 11ba0b4c8ba61db9859a58de18e40257499ba83b
SHA256 1b2a126d5c0729a6b5615f04adea6a08979b40b3ac92b548c5ebe3a8d2155125
SHA512 3e019c11d708237ee2fe09a4c61253b034b2187403975219ddc9de8f76cd59cc3381ffd8a74b2d0e419b1a3a93e8e8e6e9eb18f780d74a7693ceecc17c286f78

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14996_.GIF.doubleoffset

MD5 25b59cfc14f0bc5707f6a997c51d0fe8
SHA1 b2c912ebf18816073ee1051eb4d78a8bf1d345d6
SHA256 ed380143870c07ba595d477a8515cd2caf7600ce0a16610d4c019a0f056cc9b0
SHA512 4fecbaa65ac2d83225662092355d2d8942a9bb7ec8fab74dc2898902203e543969e1855e5b858e22ab06e34250f9ffd41191ea45fe33d80d21e73c05086f0aa7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD14997_.GIF.doubleoffset

MD5 89f0472177fbc9420a442444ad415601
SHA1 5ad11794ef018ec29a0208b3503ef35df141f723
SHA256 6f82d3b055966d2cac9b8ab1018da2d13656f9371faea519092b5e2b2af5be2d
SHA512 b9e17fd67be727bd44c1fa87e32959a7a9cf4bfc40284f5c6eafba9bfacd0a38e25a1d8cc60fa62ae57929732c8a34775c4f16d0545450a670989e7bc52279aa

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15034_.GIF.doubleoffset

MD5 df48304c0f2027f28bce79c7049c4275
SHA1 02a17df7e7d4be24ededb99b8a0867659ba5ed35
SHA256 ffed47369be07f549d3b2796604bb397031eaa5ce9014b94faaccf1dfb79d174
SHA512 cb0d3737ae344c11a6a5c896c1deddb3ebb7979eb0e3a68c35f05a81529777e0e820cb5ca951c2379c22d84641eddbed74a7d3b5a52830c627960d995b4cd0a7

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15035_.GIF.doubleoffset

MD5 ae0d97b2766adc1fc99a8c388de55c49
SHA1 41ee28ad38876220d1dc020ab7b41f9c5c3bf2d7
SHA256 55ce7fbcac6888a61c198caf5ddd0c7d98cec1e51bfa7558c218db7563268589
SHA512 7a13e6b8e9b9af79c2afc39114c5ded34fb1140deee7cc9c4a604a64a692acfc83881d3ebe86743ccedea924d50491be5df33e06416ad81041bf9fea03fc9c27

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15072_.GIF.doubleoffset

MD5 470c864b7cca85fe0f26596dd98e4429
SHA1 d35de3a3a9fc8a9ee8c54f54ae2c4b105b94da13
SHA256 eaf0c0f0d501d2137c5abcf64ffed8e6461446303bc5d4b90b4e65d0a58d8014
SHA512 67fe4784604e5dfc833fc7871860eeb18405a9a1c99f74aa1b83b6ca3bebd1907e0c9f9b09765193d92fe5da7114556459bd5617b2bf546c17db19678b53b0a6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15073_.GIF.doubleoffset

MD5 ef52a937d6518d886a510e70913117ef
SHA1 1c237cc421fe93670241da0fd082ff2f10296640
SHA256 76e79b8ebbb6c105aec40e077a54c05966b3d1a4aafa44cba802ce9805416ad2
SHA512 bc0c63d48db50a23933c96148946b9bec5ddcbe7209f13cb8483849b408cf07194ae35f540000ba63568be50b2beef31ca13a84f155b6022ea5572058da4a099

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15155_.GIF.doubleoffset

MD5 37621499dc57f81be705daaee6015b16
SHA1 c7b92f03a5ce4aadeaa6fbfdf0ba4cd6ad6869b2
SHA256 81818390b9bf1117a4144d3be158a937973c7c0594714165d89b43a2e8973be2
SHA512 c82bf360a75e5cc260ff5f1a0eaaa41e5c35807fe0fa7f4ce45b240711003cc0284e461c6017b499a4f6b803f0507c24e1a40321b87ded0913ef0cbbfb1374e2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15156_.GIF.doubleoffset

MD5 07949bdef7a56c50e9518ee522470a90
SHA1 65a90a438cd2b941b2001b294a6e852440ef0a5a
SHA256 98ddc1b081c714c92c0245d27eedb46c95e8058ad48c51947c90d70e01db3c7d
SHA512 f27cf32ba90c28ac86d69a948f8bce27feea1416e8fd1d712a58411b962f9d1bbf7fde267b61e8ee644920b327cea2f6be36e2d8ecf29913b9428fd2e42f90e5

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15184_.GIF.doubleoffset

MD5 33be5c58072b2e9d534fe74213e07fbf
SHA1 6c6bf6cf124de7f0c9249d428ed44d6851a5f098
SHA256 96e101d0dc8c2aefcd91fd3741efc85c4e9d09014b908e388e249a7b8eba67f4
SHA512 6467ee06c2fbc875473b6058d710200b58b294a7172a74aca08ddd2565f8126954631c3279fdd7c784ced483bf31856d5b5aff926ccf8201252c02cb76f04dc4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15185_.GIF.doubleoffset

MD5 46138f2dc19a74ad2657464b4e62ed94
SHA1 3dc547d1cbffd7d50ed02e6bb9df76b56c4f9fcb
SHA256 425186eab31c1bb6d84c58909ebaaec9fe963b7decbfdc585ba595e5ea7e0e29
SHA512 9bdb034d80672f7596b279ca2e435ea9fb09e5f4c148ae831a803561837d8daf789d80f2ec74f8d7bfec2b48986734d108684ae8217dfa9311023b5a14056715

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15301_.GIF.doubleoffset

MD5 7a583a6de6c74603b108e88414821b12
SHA1 7e1bfe659cc0033b9dd67c8be7b2fb08c186e8c6
SHA256 82c5e1b0864d4dbf77082d1385d7d0a0a15c7cabb9d77a464211d4b92ad8e180
SHA512 1d7c2fc85c1de7bcf519b1ee51063bbde0352568e828a6cdb07f959261de7eef3587562af427731c56d62cf8f9ec37e194ef8bd7b2c9377a27a9b438f40a5fbe

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD15302_.GIF.doubleoffset

MD5 eadf6f2ec6b97b4039a737937e39474e
SHA1 4ba7bf2d7b84c4d70554829ce82abc3bb3a436ca
SHA256 31c33fd5aa5cffe8bfd9898e04728760599e9f0649500f6c001de3b29baddd99
SHA512 6eaed19e56eb1a867222639956dd6c192ceec43cb9cba4f4511031e9172bc68ec23156aa42ab960877c249470e5e82315b491458bab34656ed9d9a2dbcd15587

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21303_.GIF.doubleoffset

MD5 525b28740ec8f330fb38af1671dee8e3
SHA1 6858c13bdf4686f231730506c8a53e0e08372d97
SHA256 508179f1363eae3a839d9060a53d83c1bbcd4ebd960b4b3db13e0c18f89bf8a4
SHA512 e5eb938791d3ee04015c648a021c07ec678a83dfaf59ca00a1d06902529b04988af163eb27c6a059c86e291994fd735e977ac607a54baa1195cd3f2bb6caf621

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21305_.GIF.doubleoffset

MD5 b1bd34f734a916e0a80aea8f7a08d817
SHA1 2e03ddeac923b2b5cbd4bdf5fb92759f2754c4ea
SHA256 010323b7eeed8d2ecd93f8c054ee1cd565a60fcad7d51b9d1db4e76a42091789
SHA512 45c1c7eb38ffeb15ddfef7256ef3708e6332ed4c3919218008e688876af115ce6f85c756a8ec680497f6d8c3b74ec862da6290dc7298f7ba24033cb32ea67e5b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21307_.GIF.doubleoffset

MD5 96fc8e358dbd484ab80e5a4197e0cf78
SHA1 e07f6e0d893edcac18a106c4bde70b9d05f84587
SHA256 5e577ef48673ba1fb8e6a84bd2786320db97065f3e6d5998b0a8e5bc34b8e8b9
SHA512 4c571c4eb1abecc6f51d269c3b00d303b1990e830ce4ddc67ea68d0fde8ff5940d422c4aef126e09b1eac46d3fd266f5fd0697d4f466e50ba969a0f791d55770

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21309_.GIF.doubleoffset

MD5 49a6ce736dfd45e3f9b10631b1833631
SHA1 8b46e52862f6e2dac5422e80a85d705f6edb18fd
SHA256 bfff007aa0d13f900ffc86760ed14baf96ec38c749521588b7c890001854bbd3
SHA512 610a9024d6f6484dbfdd36ca51ffef9e7316134a4549aad62135272e9f5100394f46b66dc6c292798a9243148c86f9ea81fc09b578b718bb695ca3fa7a588860

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21311_.GIF.doubleoffset

MD5 cb9a95722a816561a38fc8826c3d92a4
SHA1 f91bb660ebe5216a5afc77ad4cc9a98dfce76e5b
SHA256 234c93463d063d7cb14bf735b2ae5790aa183683cfde226d8ea7af7013873698
SHA512 e31c7d505fe96b7b6620b02d8655d2b47de7795bc7efde144083a5802cd73e262e4ffa277dd01e9dc8769ec3d553fa9822c9f727d66dc1666563a095dda90c2a

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21313_.GIF.doubleoffset

MD5 02afb423296d04e8d27daee0f94487a0
SHA1 535d7e10d565f815ff3e5c12c98434858e5eb7f3
SHA256 d0bdc5b495a8ad9721c38c34fdb833dd1fafc58fa883b571483b2f2924d48c75
SHA512 1ca1fb0f2e6343fab6c1ae588def306539fbe2fa8fcd572f778e554c70a1a637ff2051f6e7834b75bc2997148b5183209aa04192fbb9e715ea7b3cb465777ad0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21315_.GIF.doubleoffset

MD5 2ea3fceba479c22ced6661a1419d2a18
SHA1 ca3b55295ff843dfdbf36812d96386d4936057a3
SHA256 bf1ec6daf005dadce68c76a576985e2ab8dccbae25750371bd2dafed1c8ead8a
SHA512 786dfd3ab3ca6aee803f7ea20d290046aa40fe8c7d0c7779fc9ee8a00d5da36095b6b5ba05c5e8377327e95ff0b23f4dd56b9d096dd8b24c2a4ed5babfea8931

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21318_.GIF.doubleoffset

MD5 c4d94f0718359c6fdf3016e26b4ebafa
SHA1 ea9632ca7cbeb0afc095efd865a28042d70cda9a
SHA256 10860d50b59bc4f153b48693590486d3aae40c9da606f2c2a3069c5562a94666
SHA512 bf1dfc72b74466f5c706b7dc76cf5d75bc6b8ca332ae8155de7b98c01b3f2945441b771f40bd5bc6e0133b58e07cd67642ad6f488c0677156a30347ffe0c5031

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21319_.GIF.doubleoffset

MD5 4c8e04f7f25f388d7e48d9e0553164c2
SHA1 c85070f866c93a4fcdb32ee7b329d053193cb2f3
SHA256 3ee87304db4db0ad9e796b0bdf12ff895e60e02ee838d3c7006d1e4e63d6ce7e
SHA512 d5919455b4caa9e79e2eb461aa906f06a99062e1e8d0e2f409d2887a9aee2a51752da87ddaa67aeff63c9304aeac7c0ce2089343d3c3121f3945defaa74f0f1f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21320_.GIF.doubleoffset

MD5 5979a6f54d6d850becebfc792f856e13
SHA1 7bea12eddac513f04685ee7ada3d980bdbfbc8c5
SHA256 dff71d76e27b7c642440b7ccd3d4d5dec559669b6587febca8d03ebca5b26cbb
SHA512 29f6839525bc228ddb6211d48932ed1eabfb6f88cf531eca0ac3109d02dbb031f41144d8d542246b0bff788efdd2e7ba8b0acb87b8f6336ecebc5f787a9cdce6

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21321_.GIF.doubleoffset

MD5 0bda4facd3164a993f3360dcc3217add
SHA1 b55af4071ddd3e887e1f50cc8152d841d328f0b0
SHA256 b91faeebbdb898ddf9de91b8c45bc6de783e92eb9614625f23833b9013510e1a
SHA512 80c7683f2c29fee672c55326e1cda7d3f62090b69a8db7f675baa32a97365764be8e140c067a4fe8ea5c0777bb7362809b6691b81226cfd228e647f04dc039b2

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21322_.GIF.doubleoffset

MD5 dd8c2127b3e0a5f1c2b1d33f9498d428
SHA1 17db8e2806ca47b0b08473f8111e00f70cb56c5d
SHA256 bbe1671ef993f720692ab2e5c27a11cc0480e48018e93aa46df6eb375dc38099
SHA512 3572feeae33e9b8d30ac0b508eddc5f7f258609eb88de68e39d8867bfef2999800bd1b87b4d40113dc06b369f7e3118ba0a2a7c367bf6b5d80990a517e96cd98

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21323_.GIF.doubleoffset

MD5 857faeecbd53da660e2dd316ee846c29
SHA1 ca86ac3b4c36ec8a1c94dadd76aa384967e1e939
SHA256 51469fb5c26b7c6a19a7529a45a04f89f51ab142e080b20fd72831d8894d9898
SHA512 30e205a9102e80d5260a1c54f234a59b375ca9b3d97b6ec8a37bfab0805901d1fef95921d28524b8ea03aa94d63dfa31ad1373baaa90b6c27f717e39e1a202ce

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21324_.GIF.doubleoffset

MD5 6112fbad0fb50b0c697d89cf75ab9d09
SHA1 087f322dc3bb554110b46b485d0eb91276e6bc95
SHA256 d5d1a639acb56aa47ce6121c89c63efb0ad4b7d4c4bbfe2a5c1869aba805f796
SHA512 18b2897aa676197c4c3da3e9395cba2eefaa8be503086772d4159a8facfe5aa96df21ec1db471e1bab95b36256184e1807e0193401927d0d1a9ba5e51f995750

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21325_.GIF.doubleoffset

MD5 37e37489132b7eca88a63b4cb6e653a2
SHA1 c43ac7e4a5a307e2afa9b3a17ba17119a857dc42
SHA256 b15bc80034ec1bfd87f2af9e6a066c18c14afe4d824e77497c63bc6dddb74d29
SHA512 82602c854b04553bedefa7b4aa82e7ded40868dcf3297bd65194eccf85e882f42f3a7ac06753d1efa88752f5f25d6a36f487910098cf0a8130b466736b1ea101

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21326_.GIF.doubleoffset

MD5 1b7446158297e9a3b2651c43d49ecbdd
SHA1 7e70cda099dbbc486e7ca8a3b6e5e767503307d7
SHA256 982fb163773fd849d811fc83ed66797a4406c58a8475ec5a242622f9ccd3e61c
SHA512 9c67d332204b17c0248dbf15d4f953ef6dd0af33dd09446533cb6e57e3c6809409172f26dfe013bc3cb6dff73229defc8aad6c98e1bfb383844eae1b1224dd38

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21328_.GIF.doubleoffset

MD5 d56d60237439b57907da0a9f492b24e1
SHA1 27b1acf55a3b62b9d108354d0ed967cc3f5c408d
SHA256 9f7c5db769d0b3f23c9826a4aad558169785ba1cf1adefa227a3a5ea245e031b
SHA512 663360c7243c80998024f9ff5058f54cf71a3f8efeda83ffad096c1e9db5c8ce7ddfc1196eb064af841585ab35c61a3d2d5a7434307d96ea8c4025ee09d43d6e

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21330_.GIF.doubleoffset

MD5 affb60e4ed0e2a510604fe81fc334cb3
SHA1 58d1306f4c219e7e04a920427c85ec28fb4d593a
SHA256 e6b4c1a63259609109729ba16b4e1efaf82b5e1d896c194a277a6fdef791281c
SHA512 0796ca101af8412ead4e8c18c20a061a8873c078e541ada5e359b39add77e7bc0ac09a54856f9cdaa8e4612f5f38e4a08094f888634288d053ea07884a5d8029

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21332_.GIF.doubleoffset

MD5 a33dbd4895ff85e30590726a3e57aa73
SHA1 40f01400366b95c0ad48d470e20386c5117e6b47
SHA256 4a45b63aa687187f98307f029503cbd6afca9c10bd1080cc3704fbf043165f7f
SHA512 b45aed609c148981fd92b68e3c1c4a4d0766ede9114176d6417c3f66a27af50e98085590544f446ea118337de4c6cf62a39d6f9c93460d4da2c63997a04acfe8

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21334_.GIF.doubleoffset

MD5 47d12b39731292c79563b0a74ae5db35
SHA1 b4ac13401481b730b8d1e1d419b62ccf00f99244
SHA256 980bcdb66061fd8b6c2ce39b453d582a594872486dc572087563a98af538ed5a
SHA512 d2f6296497940a2064dbe70c94d8fe60ab10436f44087b564d5c90a0b545e2fbaf407eb55ed6fda444ad8bfee1fb5971d44b5e917c260742c16297ffb9c9002f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21336_.GIF.doubleoffset

MD5 8e9ded05265accc50ac82aa1968cc1fc
SHA1 78cacd890de8ef0cb75f228ef31cc825f5893d89
SHA256 1f42df0e9c552098f708697e3689ee343f7089bf7ccb0b024c954e3122677261
SHA512 7ad145ae6ec68e2b24ee5ba2cdc745c1d4875ba2d9b2929abf70c128fe00e8fecfd9fa50fd4357e7b732ad24632cc4958d8e3e4daf50cb1558ea048833689b71

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21548_.GIF.doubleoffset

MD5 6eabcdc1221fa8e1eb518577b18b5824
SHA1 5c1a22162368d6b16b61fa9f1a6b8904b65dacfe
SHA256 7117cab0e8c180f3c086b8ef7b49f4f3f0cf79e70398d2a922a72dc8a37f367a
SHA512 8520285e86146663697f6712f741c95471a79091b94fbccdef09a34b29b277df1c4139e0d43cbfa3b819c294177b790b3cc5937eac42444a24bca69b72b18399

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21527_.GIF.doubleoffset

MD5 719453c6227aad4f99ea1e0c6bcf68d5
SHA1 4f1202da92180cb2fe6d2476f783a4047bbf8ed6
SHA256 74d445e033249ee5149174268e6afb313db401dff7c6de7b360566985fcf8696
SHA512 bd48b390d10862880f400c2b485b1cfd66ccd13af7c36da0880e7fef05dcce861ce352c20f2329d2cfcd2156ac336a8c0fe5f2a6029520c67af99f1036add728

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21512_.GIF.doubleoffset

MD5 3385389de66770184bfaf956014cce7f
SHA1 435acbcbbcd32f784e46346bc8007554aa9ec93d
SHA256 7a5ea7855c706270ae84803139e47cd693810283740ac2606057342aa79ac7d8
SHA512 02dc57d6bd0a39c0833457408a988e4efbcc88b90f581493365a597b4de9897061ca5d7010786115946ef5e52a1a799c94a892fc4c727b44cf8a0e88d075b690

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21495_.GIF.doubleoffset

MD5 37bc33a3fb95f340bc6636cf8e9dff55
SHA1 42a9e0196e626f1ab1b87b6ff19cadb32ec65e5a
SHA256 e9bac7c0363411988657ddf0d3b1cc6f8984c74bb4737f2a9f53e7d9ba68f808
SHA512 b72975f4ae205916547cb67089f7b27302cf70128e5ea591331a3e8f0d64148e182275eb81560fadd0428c0cd22a687d2337b617dc7ffe8771d332c89674f7b0

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21448_.GIF.doubleoffset

MD5 e93224c1baca923a0831c6e9e04018cb
SHA1 6b689e5f3077a22f6f42955415bd4a72e8292cfb
SHA256 cabb4b4a07d7ff7656484852d33a9cff533d51e3eac8bb2d901f0f6eec85366b
SHA512 037c8f45131d496d65f1712b499d25b83ac3328913c5b00c8cf6e7a6a7dfed7fe1ce3a3be9a92d5f4021ae650892e5bbcd77474d9b11ff506931eedd90a71b5b

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21427_.GIF.doubleoffset

MD5 66029f174281683f57d524f30a35f6cd
SHA1 8ad4cf76c42fe1e77957046af21a70d44ec49c42
SHA256 27fbc82e6d221b824e426cd2a76fd4a9e477b971e30f894f9435a329f90eeb85
SHA512 ef7f37ffb34acd7eb5717212048a930f3c80e03e92b8c1bd4e53866839f0e8f44eda11bbe78f5535091402c64ded773117738be1ba7de3e7b5a553c123d0bbdf

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21413_.GIF.doubleoffset

MD5 2248afe68875a61b26ef58c4e4dd4568
SHA1 a5a34fd81da4ee246eba62f0c796ae3dcd6dc7dd
SHA256 837baf4f20199dd3b437aa77011eb8823a14903dd72e5787e7d27b1cb5f9b4af
SHA512 75e72ba4d25ff0043896f2d00466b61af9173deb92300d6ecd05730205a2a572f26b6ef48c61b6e446ad4bf64b69ccbd0e7e06311b5c8cb771eeeb0c1ce9337f

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21390_.GIF.doubleoffset

MD5 fa512fb7c8fd37a6d8aeab113ceb8bda
SHA1 d2a24a0fba3b59693b682257b5ea3de04e3b6716
SHA256 cca6a35681925f65c758ae85a47f7aaad0e560c06e809d1b8868c216541eb092
SHA512 2398d475f36c3b8bfb6ae131ce19aae7748efcf559eccfdaf12c3e7472106bd52f0ad6d6bf56a76540700903f33e1175f594ef8c85d9c2dd8b569826d9098415

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21370_.GIF.doubleoffset

MD5 9e9c724f742c117e8e7c2cf96a283cb0
SHA1 57a6453c1031c6e9846a203934670c257c47f78c
SHA256 3c2f68c4a8d218a69aa6db6c27613d3c145e11b6e5ef9a3417ee08ac7363d81e
SHA512 0da63d55e0661aa34bb873803e4dc94ccd03fbd8f7f33381ec12692388b274a8fb91cba88e0bf3929574116dab9ec9d557740ebca0e125798745ac863c9f29a4

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21348_.GIF.doubleoffset

MD5 b5f3ef9a1944f34e8714856b47701d91
SHA1 e925b5fded9768bd0f7f80f428873c06508f2e6f
SHA256 b887010bb3c601e30ae1a51ff20a3f04fe0e2ccc523d6c73b104a61db896046c
SHA512 444938c09c0672141b10f9ef3f60dff9159882dc9b58f56ad1d016a585a8e92691c1a367a263d5c89e76610685e80a23c367352e6be1bb77b8979b4373284187

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21340_.GIF.doubleoffset

MD5 050712b86e4a3a8f11ececf3a000b3cb
SHA1 5bb24e577597ca1fa649675d152cdd3e42ea0212
SHA256 e427b60fe199e200ba4ac8169ef6bc44e871f159709f6e77a9bd0f6c60071602
SHA512 b07040be42c7d3e23bc810c6b303a08dec9454b67294d5c25eba0de40b1617755cffd289e1c72c280cdd236d199d8c1ea83afce506e840e08ac682ae1febd490

C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BD21338_.GIF.doubleoffset

MD5 5fcc03b89a3328c17a6c6e5d9fc76b25
SHA1 217034537c7723eafa30a0d6eef330b410bb9455
SHA256 c298f5f60ca7b440f99742f2b7dcc9bb7b09bf6324dee280c15cc74ff9ba7fdb
SHA512 58f265abf94124d9c19455c1e7dad688b9da93a25396d756f9cf0b6c961acae1cb5741d79b284fdc69f0f1d75c364739af0b1ce3f420343d81eb481c55760d69

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ACCICONS.EXE.doubleoffset

MD5 97eca9f83d810efd90d3451e848ecf6c
SHA1 3aebf5f421df20cfb889c61189553411d6c17119
SHA256 653713c13bbe87913563904a2b954569f960825a5259e0876c944aca768b8e23
SHA512 bd74b41cb7776cc741371c467bdf2314b60d4d379b50bbb3a9b258f16fd4a556810c8aca783cca08f233ac7906f010453a4781e803af0c5132238938f333a4e6

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ADVCMP.DIC.doubleoffset

MD5 ce65878723fd9c69a2652c7f456b8f83
SHA1 ca51b15fba1abe20ae8d407642f459941159367c
SHA256 4abbe904e00fccb57cec058f68e4e4a4644f25d27facbce56d117243a1b8c81f
SHA512 fda7367e93d874e97bb4a62a79e2849b7da2e57decde372790a21dff2e3dca2933c58e6f78728ecb6b289d79e94e6269d857f42c37088811ab7cfc71f801bac5

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ADVTEL.DIC.doubleoffset

MD5 613693c21ef920bf7db51edade9bdc4e
SHA1 27a9ec50573557136a885239300a875fe467c105
SHA256 d3311e0ae8e67de9195ce7f16e8180f6261dcac5130d7c00e165d3678f1c3198
SHA512 e181c355c6d0f4e9752e0114135e1364c11bcbafcf1d0d88e8883f1720cc3bb7641976fee27e2c1a364f227d68bd288866d25eb7bfe0027a311aac613f30dd5e

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ADVZIP.DIC.doubleoffset

MD5 a7203bdbdbbdf05d689d3d14303cc979
SHA1 0f5dc08d64272e94fa38f23a65882dab983ddd2b
SHA256 f6c2dd6cfe3faa8df6340369d17e6212b2795b9dcfc195b68e533f81a650e7af
SHA512 173382fd14e6e9b260a3728f06467dff9e61dcf84a6fd9d50e98212050868ac7febafacd9113ddc6f0f109bba7620805ba0d7b6bb26fe4d462a60a639dc48122

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ASCIIENG.LNG.doubleoffset

MD5 3a231fa757bd7bff2709ca67792a7ed4
SHA1 afae4b732c4cea1a540270c2f11f8d9f935c33b1
SHA256 2a6e649a06dbdea91726267a768bfa1d324f4baf9b0eb7242a29f4817ce85f34
SHA512 9aa8110b0bcc2df57ab80d23e13c62050462ad46afea651ecfc344d82c68fa25597f6b6cea31e5ff81980b815cc041319d2d38f9b7f53b35244df8b3af5036a2

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BCSClientManifest.man.doubleoffset

MD5 bbaed33d8388d9658fd0eac73a3e3bfd
SHA1 5053d91f03f4f3ff17313c623bc029533a2f0e33
SHA256 2064b324008a59b637722e98892e70750077ca3802223fe4af45467564efc632
SHA512 7bbab7ae482f62e87600eab8c3e52cbee79d353d50a70dfd0c7b1c4385082ef56fc5853d3150c33adb9ee6ba94aeb2a3afab176354dc62dd2e39b7ca1fff4e82

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BCSEvents.man.doubleoffset

MD5 75a1a07c9969ae9f8eaa4ec80c39246f
SHA1 08556b5ecba2945b0b48d2a3c45c5ed9dc43e46d
SHA256 e3f26b4110f95a818d4e418a0acdd5949c00a4dadb61d6330fccd7e2712f3cb1
SHA512 6e15968ebd4a5c1891a67bec15388d74cf5211e0e97f0536fb4f8f87a7d0cd63335406ceea0e17e149c7fafb6a5863656d771882fc829a40369c489f57b9168e

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BCSSync.exe.doubleoffset

MD5 9bdb95d43535eadbf59f21ba10c15c0b
SHA1 0f1050dad3597e9782f2c3995b28b53c90fee5af
SHA256 7f17ae8a9de6433e5434a7112a6cee913ec50b90fdc1ab801e4cd75d9d56b014
SHA512 c1867650151b732c48d1f3bdacde16f00535349536406725c04102bc55c192922b15c0507f60a005f8cdea854eb7147f2690bf6e0b9578188391270ba6331c77

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-bdcmetadata.xsd.doubleoffset

MD5 3670d839da6b7f162f3f4a53a687e03d
SHA1 530713f860b9ac4e192adc85a4745cc9760a4159
SHA256 318ea1b7979b858bc204e7181a81d948cf648357d0139068a36f8a120732321c
SHA512 eab900e5837cf0ac9aeaacdb0626758ac6e4f79652a5f0a68ebd39daa3cc321296805444bcd65b4962541a3dd92bccc481489fac4213a1e29bdb10597ad5ff47

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-bdcmetadataresource.xsd.doubleoffset

MD5 bf57222af9608c66b4f47e3830a6af80
SHA1 1f1120001e68921ff6570296f3e71f611b6fc024
SHA256 20f64db44b61fb9d665578c050af43e8c44b4e590acf037e1b2829baf2747433
SHA512 99b04427340f047b1855582040fae661c4047b8ed5780be3a161466b2fc1233ca34935316b5ec215ee56581da61369d9a24ea7cc0d580c6efed13d846596b9ee

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CGMIMP32.HLP.doubleoffset

MD5 98273d956eaf182f30c5ee90a4cd1368
SHA1 3a4a99db265cb9cb191335b0966763ccdd55ae50
SHA256 ccec99ca155eaffeaa6f64b55fe64e0b2b1d6fd48edf1640d42aae3cf72d5e61
SHA512 e0aedc7c8aa1bff12fd1ad09b16bf0340af62e2ba88a5a3980bc9c6c88173574d3f1d4002197b103ee9dd3480b2da9b3f8d16a7c945d011e4dbe22826145f5aa

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CharSetTable.chr.doubleoffset

MD5 9af680a3a1d99ac96755f053400cc481
SHA1 50703c4c8e7bbc88aeeac33be70a9f5018515d85
SHA256 a3af55b9b826bdb07f0963ca5ef348538a1934e9a4a6f1f1aef1264d734980f2
SHA512 88480cb90b75743d00ff71a7a6a369f0f8d208203f285c9e84cc07735e54e132084935860c25e60900b73cd45d50cd77a525145a31240e175c1b3d1b9163f28d

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CLVIEW.EXE.doubleoffset

MD5 883131b26708a21716eb4169887d567b
SHA1 df7b0c86b8d0228cd9d78e9225e17d7cb71e9f05
SHA256 5faea9721a01a13aeeed3fc9f910c7acc96ba0765e67ded3e0db9fa28c0c6f39
SHA512 9243e93bb0f5db8f36a6b58b21b4a513c88a39dd90737bc47df1b6e469e721da64dfe43e485130808a739ebbc41a1553f0d5cbb26a5c371f623d51fce4bbae6f

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Custom.propdesc.doubleoffset

MD5 969ec7ab2076a25ef33b0cc407b95aed
SHA1 c1ac320a2a439b9e9cac352bd05a27af838f30e7
SHA256 3c3082006c9035564e0ae6989efff1f8c0c65bf0b824a99aee568e4756a9b39c
SHA512 87c55cb33a5a91546a4e2786ceb71f0d5263b48bfa3364660a655fe001fda11672144adfd40c5dab77d01d724e6ec2179242a088e592c676c17b0102ef30458e

C:\Program Files (x86)\Microsoft Office\Office14\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CNFNOT32.EXE.doubleoffset

MD5 1321e65f19bd8ca392fb9062b7f8ee77
SHA1 a30d73ced0f1ccc0c37fed1ca7c43f5ab1c50f67
SHA256 22c38a88e27e8459d360887d6ba234a728ce13234523d03bac0f7bcf79935996
SHA512 3ef3cea1225525e9d1d047a738187ff02d7b91541b7ca240825358a298f4bfc62340b35b336028cd84f727e35a136bca830233b8a6b6e6a63a064fb5854d4597

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DVDHM.POC.doubleoffset

MD5 da7cfeabe3f0ed3dbea0309d1c8510df
SHA1 a911e6ca0afda2b08cb42e332f34ee2491ba9fd6
SHA256 958c7c9c907ffa0797ab99dae747bb4cd46feacc74f67dd2a15fdb6f9deb3455
SHA512 5833baa8219d5ba050f337c8870b06bf0b0f1b1902628ac6441ad348164ebea1f0a51a560c5caaec770ced8c589c9696709f931b6b08b18ea265cff94fca2266

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DOTS.POC.doubleoffset

MD5 15c79b5af892806d17f149abab1742be
SHA1 caaa07b8f064039974f86e2bf0776b5f6cf7ac75
SHA256 45b5c4b6b2f144ee354690a54e57596a9f08a5e120ec8b2622fa53de6317f1e9
SHA512 6274260947127ed6a087fdba6befc6c83e041a58a932ff812600de7aaad027b5dbff7fbca2b895b6babd147d3f3ce62e6ed60294993a9116da5e409cde9a714d

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGZIPC.XML.doubleoffset

MD5 29cffa2b7ebc4124823a58f4bf0be8d6
SHA1 97293971429cd295e2552e3648b9ad0070cd6762
SHA256 6a3660614bbd2df00995e1789f7be4d307e6e0727319adf894c38f8977b2a253
SHA512 eb611d5b5a5f08396e3e9fef26024388bf67b3bdc5b9847a8b1a0430d688fcb4f63400609b623a75111e44561934f9dd81608acd07b946fd9ebd92399742824a

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGZIP.DPV.doubleoffset

MD5 d3f5a6b2650f7923bdead30f8c291b98
SHA1 157b0ccc49dd3f6879daf40abc03fd9c1d75ae19
SHA256 baf5a12113145ff52e8ea165bc0a87a3e8c4cd750fbcaf2b20607029f1facd28
SHA512 bf2ef5a6653c857a1364823fbcc4098f76180b90fbf445540d746a06d875a34cf61c48d330b7a68ddc38bfd9f569787d32ab72c04ed21624106a21d83f04f931

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBSBR.XML.doubleoffset

MD5 f9d24f9926325e704fa2b5cc5267d310
SHA1 b8f049f0e5a5ebf654ee050df8a6220e0f6f93e8
SHA256 673d2d6ff19efc8ec97174e1627d7e83566b2fb88ea761907442fd5956ce52fe
SHA512 39f5e4a04bf29cbeb018cdf0746f3eecf528f04454d220aca917a9da3bd331d5a000c12b7df6d9c4a196fc9b1dd4acba9f15eb269d0219a76018a3f5a19ae7ae

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBSBR.DPV.doubleoffset

MD5 5a2e0af3ba7bcd2f871fdd2b76fe8d25
SHA1 3c4fa54e02e4bf3e9ff48cd91489c2e9902de025
SHA256 09bcc853a3250c7cba2d8d381c146b53b20a50c3d1327083a701f0c043769532
SHA512 15b6d1036e5e010f7a59d69989c86f3ee3fd1bdb9497d1b30da4046cac2ffe9764ee561b69fe5954561f5b46381f5505a002b544c9f7a5ff30f19512256c27b9

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBREF.XML.doubleoffset

MD5 e6c8e3d5e4eea6d9a4266b2cdea9f3ca
SHA1 2c9514364a4aeb676edbbffa300bb2074df6d57a
SHA256 6178fd81c6c7fdbe9e04f8ee9ec5300e6bd77ea72ea564c0b6b415eb3e303af0
SHA512 4b5237d68121e81bd003c80acd76d2e0857c55ce6894ede15159043149ccc8764e4bc426abf9f33b60d005304b9a832f67ba3ff2bb8f50c1bbe336f0a60cbb5f

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBPQT.XML.doubleoffset

MD5 2b9545bc490d72df51c000f7e8d228ed
SHA1 bba14325c3473f222d32a4d73f42bc053d2a552d
SHA256 69ef4d5d9f40ab9671c5d2dec96508fa6d5b3c0f8ba7574f2f2026d39ed3776f
SHA512 967564f26d4740910f3a63ca3a2b2d5cc92300d86b1ee6d26810746347b71b6dc6f0999b3a44db2c874db89efbcc7335a9f7307871c208e7cf5d9de0fb8b6214

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBPQT.DPV.doubleoffset

MD5 6766e35b7d7a386f4685c329415e0802
SHA1 b5414ddc08a85198bf7afc19da4b44e031e741ef
SHA256 87324f85c6f587a0125fbd0fec658c05a19c7b17f40840b4541ba7482f27b564
SHA512 aa5c714423597e72e7dadfda899927cef17bcca4b8f2a882f4df4a6a86691dc2ea1207645788826c70840050db7f539b5be6fbe8f0d0f48911295d6c52acb87e

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBHD.XML.doubleoffset

MD5 a6cc120909acecace00506eebcc0aa8c
SHA1 3c825b583abfe2022c6a18eef4d060b29fe1d2f3
SHA256 3e52f45adef7f441fb6b0f55acd2f18a7b198b9d2205652bb8925a1da2a7db68
SHA512 16f2be25f3a4b2287677ea191061be15ae992f5ab1828b3b3b26443ad4bb23f89ac089236b128249415486bacc6fdea497d0e02abb744a544fff5027312ae370

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBHD.DPV.doubleoffset

MD5 89ff850d72aed64702b29823c43847f8
SHA1 f0b723a8cb3a511a01aaad443870328811c4ef17
SHA256 b2c722a391f8e7b90facfbc7ccb2b5982f557fb98877846899bdf6fcbc8fc696
SHA512 75618222793b9fa7a55068acb2b552803ee2ee447147f12fc6d9f558c5c3981bae8ceb0d8c99402fe87c57242a0c8fb29e1e2d24727349018089d9989610b08b

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBCAL.XML.doubleoffset

MD5 02c1d575bb79907a0cc77420b6d163cb
SHA1 4d6b7e2e2302ae932b1ea15503aa06ad6968882d
SHA256 a7f36460eb25f0fe44936d8891b7db8ba313a6ddb5d8d8166bddc0b84927c808
SHA512 3790fe62f261a6ce1b0e7b8bcafa8af9f2316fc76c47c2d62a67ac4688fe3ce3a0b42486747f2a0cc7fe9c54c2c69bb2b14466e175d803db1f4b490984ad068a

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBCAL.DPV.doubleoffset

MD5 e052bc3ac71b669af45631cdd79973c5
SHA1 15fe3aa9fd25edcb9be6e0cbea933b45cc9c5453
SHA256 881dbe60d074e0cab084af94b9e1e3dd339edd9737ae7e5a1d61a0fb0673c2ff
SHA512 65fa7a78f2973375b9c6c742a3cb306f30497cf4dece631220c33d641479d93c43db43acba0a97e42cb01e6f4e7ee8668733372ed7c8832e99e8916088fe7bf6

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBBTN.XML.doubleoffset

MD5 51c141848a08dbcb91c62932234098d2
SHA1 1dd45ed73a0968f4064e2633af93c2f9843f8418
SHA256 1727d6ceb2fb8a2a3feccc9dfc8f81b5d97c832341cb7a13d35f6b6b1633f110
SHA512 7b0ec0c892140d1ae71540e29654cddc230167011b0f8c4c581d3f4b7df31d15e8a3dd8a8688c2c13efda9d0f7cc0bcd667395aef3cec2b603fc001e12f4df92

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBBTN.DPV.doubleoffset

MD5 325b753d451699c347b46436214d27fc
SHA1 43d4950d14821d7e33f7c4acf0a10d97b0d26fd5
SHA256 cc74ae376c62755dc85cc0c1d49aa6991bf124d6bb508af080081ab5a3dc3571
SHA512 0736914bc89fddc674e649a2c25679ef4feff4f2935ce0cb031593f86b70b82d907ce204b99f078cd78928a8788d42f1397fa333c9d059ad8246d04dd4ced7e0

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGWEBAD.XML.doubleoffset

MD5 3de8b4025511c9494798e7c2823811ea
SHA1 d18c33fa97133dd684f77de13a2466d9f31d0a13
SHA256 aa95bf429d036be5979c1743fe26824bba840b446a1d8b63863cbfa81d19f7b0
SHA512 700daa972f21cf9282fba8d05839e76c70759f92ceec564a92d624104ce151f5aad2c0d1fc716a9122f7f572d1737e0a1f585ed4b301dc2f469a0dad0bcff291

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGTOC.XML.doubleoffset

MD5 e5febb89a1e139917153a63d2b3a9e04
SHA1 980aa19fa9a4174becf284c865715ef939d653e9
SHA256 1aecb546aa0d6ae3c3277b0d4c434a128c6773921f7002232f068a76e80794ea
SHA512 b1e66986fa702ee527fd3569e1d1801fceff666be272f7153ca7ae64d69861c54eef003360df74c84e81d252f74e83e6c545161e9200c9ead4d1e25676ae3cc6

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGTOC.DPV.doubleoffset

MD5 6faeac6abe225d773dbf7cb342d38ca6
SHA1 778c0d8ff9bb57450647c2cb2241f59420ef7f41
SHA256 a8881c63247a2d83e94d5ae877f4ff06f6d1e257174919f1b45259c311014916
SHA512 b1f665e6b5f2befa58abb444748422d0cb2c6081699d48db79e2ae9c96164684cb97aa68fad94c0485e0266fa2b202418d99a50a9a202d38c67359db03b03dc0

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGTEAR.DPV.doubleoffset

MD5 e7186aa4e3255e0962075fa8bad663c6
SHA1 95ed5860ef1181ae6242a21e2cf9c68fa4db06bc
SHA256 f25d6f7971e7088c067444c877f74f8d9310d99d5e5e3d6957fe9bf1f6ab04bb
SHA512 68a49154840005275c0f6658d2fd61017744fbad89f39384dd875a0ad04703835cd443d1a5328d9cf45c1cdc10d7ee8097f315e8079c8ab083af0a78b56068b8

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGSTORYVERT.XML.doubleoffset

MD5 1dc10678d086505ac535a002d62f3635
SHA1 1a5fc2b4d7e10d01312997d8c7f61db0317783b7
SHA256 9638dc66b77de723d2ac56cf84a14dbe4472f7593b530b189b9a4432525deb90
SHA512 91e6ceeb41ea904f9dcd8545f663345e5f9f3b6231049af638ec0def7aff186d402161dc9113e03b42c7d972e4d8e28425174427b251b6d6ac7ce8ad19e7956b

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGSTORY.XML.doubleoffset

MD5 9f8339b406f00dd1504b70ae64e19efb
SHA1 b848070f93ff81754203cdbc936249b4c931e9d2
SHA256 34fb8c5afef958dfe2b5aa4840a0be1e175603ac168158173846f52fb86f2d8d
SHA512 9458136588290ccf62c7e6405a17115fd34065ab8167e2f4b9bbfd14db60a76cbe19dfd19045ca9fb00fbeabf0d7377f49740c6cd41d48e58f974e7cfc95f5c7

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGSIDEBRV.XML.doubleoffset

MD5 0ffcd59544f1ce5eac1e6b4477266a48
SHA1 eeed366a476e82ea7039ce71743a99693cd309ca
SHA256 3c601488adaf420cef97330583628f5639562cadf9fa0a3c2eb9f36e4e1851a3
SHA512 709115bea07ba76fb8d01d8382d98be2c9ab40afbaf7b813ddbbb690d5445de286d03f7aece148ebe2082da20177035a7e24fcc28681c1492e576e5142b798c0

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGSIDEBR.XML.doubleoffset

MD5 ca7e4be582ef322a892fdfc910a02906
SHA1 a4baa538329f1a59944160c03854cd027ef941a2
SHA256 71883b0b366d668c246d2bf5f9bb18263e654326179e0a81290817e47555ad88
SHA512 7408149d9717479d4cf325dbc49c1b553c752c389f003b681f902a1f534f60e042bc4ff88395f5c4429718dabadec0320e302b390ba8445c274505ea6f1e929e

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGSIDEBR.DPV.doubleoffset

MD5 8d3dc6c9fca26820b338908076a29afe
SHA1 c6b2cce7afe4ccb957007952f495dcc44e58c044
SHA256 3bed1a9782ebacfc45c4474a2068252890c97ba46440b4b2882843e99f7b9c05
SHA512 12f90bad9772e180dbc132051714e6e8ef30b0cb49e6cf8646fd69537155badfc01d08665daef49d0e3b368552ec1d1547e12a726ded5f0f2d5ab70f17b3294c

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGREPFRM.XML.doubleoffset

MD5 68554fa3a14133b42a5bda56c70c40f6
SHA1 1cdc14e726bb30e4bf4f19655c1a5dbd5b6cee5a
SHA256 d117cb5a1ab247b204d4fe0b9ca836593b5c881c4067e12c759317241991d0b6
SHA512 e91083d0d30a568f97448685bf623b53c33b887d6b2d3cc21baee7964a864058b451b11306dd4aeb8ba0a963347f31692bafc7bd01928e1377b0e31c83c16301

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGREPFRM.DPV.doubleoffset

MD5 95621e2939c87e4874b4b376ed710cc3
SHA1 a417aeab289eaefc843dfa105969e7aa5cd09d3f
SHA256 53f589a6ef897a08bad5847fbd8a304c6f3dd4388639ee9e40081765d778d6ce
SHA512 5298b52a5e1d5a4a682ba300963ed873236a8048fe5f7e19e0e3b6b7813520c4a5536e8d40251f62b7cb194897fc2dca5cab475637dbeb4b6559bf1ef0328168

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGPUNCT.XML.doubleoffset

MD5 97afc992a76d33cb503a3fdb25976f5b
SHA1 295178a830ad3b940289964d110b735895f77724
SHA256 44e8776e18f9b1110d359be62aaf08989e066f51b0713cc0e5846fb26a4b38e0
SHA512 e8016d1b17fcd13fb7195e37abb5728d6d7b7e6fbb4712ba2632debf7dab7abec8b5c0b5a13246ebda0eee50f6a7b4a4e20e4d930edd5c8e8de5e00f4ed423e0

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGPUNCT.DPV.doubleoffset

MD5 8a76c703119b6d5819fedf9025dc15f4
SHA1 a855f6e98b72c76abe36f23342a7acc129573c9f
SHA256 6ef2ed46e91f0da439ddeca3c3b82e5ef83538c4ff37fab2f2ceef3bd8aeba45
SHA512 d0f86fc6a6aa245a74f0224239a2f035d5d29b76b92874628a43f0e9d8a473c242aa242a0aa1416f45181bb399dea22565268057632a66210aa7a1c4294729cc

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGPQUOT.XML.doubleoffset

MD5 bd6fa80ef4ff20061cd3a7931f0ab830
SHA1 a86b4a364789ba3fc205be996be901bfce14b6bf
SHA256 e6d78b10deea55b8de1117a2b0c23d16c2fabe117712a20af865671406459dea
SHA512 2b41242c73de6ac627bcc00b94972da1ae4e5c9165c8107fbb6ddc0b3e5a0ceae2f10e32d14663140d91512b5fbfea8d659f2d35d704891c07e1450a7d3272cd

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGPQUOT.DPV.doubleoffset

MD5 ad940e355d7ddc4c61ed1291be2afda5
SHA1 544ef9c853370dd01a7449485ac37fe260795cd0
SHA256 2d9a56503ae5e0b587e077980f7eb583a86b863c1263781a2ec923634226c1b4
SHA512 c81d3dde53dd17e57f869d7d54a1f2a222cd37379de9880c0c5dc847b6d62808327c6de00c3f23a28a370717551391a525a5290e94a5aa1d2acc714dd9eff679

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGPICCAP.XML.doubleoffset

MD5 b0a58950d8562190a9c004dd59117d44
SHA1 154b8bf2f8fc7cc9a8d9730c8ef549dfef627383
SHA256 0994f669a56f6568a2b160c14ce96d43885d482ee8b6f0502666adc3f81e9739
SHA512 d727e722b5c3bb50e04ddc8d0d534d3297e591f62d7b590e6f0ff7eeb4c28bc4cd81afe3822106107b8204a194de4161cbd70e03c193bbb43c1b039bce9d22de

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGPICCAP.DPV.doubleoffset

MD5 898d2289c5bf7fb4d85c8cedc72377ab
SHA1 78dcca8f27107d1597b342bc22bad54c0fce82a4
SHA256 72afa7bf9cea4325496c3f25ca7fca3c9897bde9560d8a2d873a6a85c75cfacb
SHA512 f3a2712d37fd984823cafd16703ecd8f1cdddcacc4f7eb75f99e4d016f96266111ce088574fad96ee0cd83e53ace5cd1494f83b095308761e59807e37f5b32d3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGNAVBAR.XML.doubleoffset

MD5 205117e5efa5202b1b432e0b15c5b27c
SHA1 5d443dd55038335339f512fc5036add95db3a62a
SHA256 3f8959c1f7800e346fc13a0163d5fdea3a094a54143acd69bec8142949dd2d03
SHA512 b0fce5548e518ff55703005edcde86bd5a5bb54b77f5bdd9b85f6ceb2be72c638afa57be68180d6a058c0a89afd316c4323d33fe7031b370edfbb5babfe7ecfc

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGNAVBAR.DPV.doubleoffset

MD5 4384175bcc8a1a0f74a4922da04b1760
SHA1 5e22c5e3c744ec8a0bea83fc030afe699a048792
SHA256 4b3a971815e3dcafac72e38c19d0f7463ceb6afcfa4469e216b4c6dbfc228eff
SHA512 a150be99b0dcdf2104ef260faed7131a8622646e948ae85e55696010081f78e89dc0d0a56ea3d5ca291cc2e867aeb3c2275b1d4f9d5070964c84385314bc0c90

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGMASTHD.DPV.doubleoffset

MD5 cab6e1e3d28d16e626a4cf66d4c0fbc2
SHA1 caed415d6613c49d65bcf3a69ae78fafdcb727b2
SHA256 bfdd5f970a19ae86857bc9bb5ada8908c1c38de29790e001e45610557eabc464
SHA512 82868d695fc5cf67c62e62c90b4d4ff73f6089f2494ec03b1eb99d71d909433aab84bb7c4352ed7f064bfe52708c63e8cf5e1206b330d7b33a86d4d6adf10bcc

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGMARQ.XML.doubleoffset

MD5 9c9f15715ef4f8bf87095c5c948b622a
SHA1 1bd9f078d27bf2f561c8a7d3a7954f796a49f403
SHA256 dfcc8d3aaf25157b874f9aedf692fe0f45741a7659f7f7e26a15c1ebfe4d3e44
SHA512 0573b65009a47f535f87bae7672efad02de61a902a98d9eedc345cfcaa135e963a808dd3d1074c6ad1d69af3e8a814a0f0ba7f4e506bd6e599bb8ec4b911e0bd

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGMARQ.DPV.doubleoffset

MD5 18bd7aeef33e1fb63e4460e7503e31a9
SHA1 f2f6596c3156278de5054b4ec6826bd46baeac12
SHA256 3ddaf415dccafeda64fd89bd5143508bb8e5771d3a833186fe47522c8ec8c6fd
SHA512 40c9484a7cf65ef88ec71f2c8a0822bbbe9d6d808913afc87e69aabc1e2a6f1ad1fdd44a15166a161542c17dfd9cf370514408b3a18271130c080cb7966f5f74

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGMAIN.XML.doubleoffset

MD5 2d133cfaec39c93fcf977909fc79b4ff
SHA1 06e91f3efdae76af085043d08702d1cc146e0afc
SHA256 205c300b699c177ea73574681cf73148f5aff1171335a1a9f0d221b1f9ee0643
SHA512 213c67a75fc4a22737457c458570f18d2278bbf77e4090759848c080178ea6d8b13c726926995800f25fe30a8c845a202801f8f827f7b27a7dfb393956608cf3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGLOGO.XML.doubleoffset

MD5 9a077af7c47230c2945c93f65a300fe1
SHA1 ae7053363be9f0c976df98b92401330dfd724ca6
SHA256 59c05f36e4f8494f4af9c832bb9b2343a92a8225ccb080dd3479ee805a063e67
SHA512 c923d309a43f13495bbb0528820a93289637203ff2bd66970ab08f38cadb670bfc32a5b14d2e3a3463ff2def2706f62e1f93cd7a4feff4146113d21c3c84cdb3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGLOGO.DPV.doubleoffset

MD5 ccf8d335712ece5eb28108d426b8445f
SHA1 03872133761f44e365a2e92469c73512deb512ab
SHA256 e021c33ce0eb82a4eb8a7619e269b74e4b34c87cb05fe31a781f0c66000baee8
SHA512 f70b8e6ab16505c9539c1af306ac2af2a99d3cb04b9b84c97a2f70b3f7833e10f8832a41ffcf62081a75f3bf2de476395438ce7c8db8285cd567236514a4708b

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGLINACC.XML.doubleoffset

MD5 e3e2d21e5bded2401b1bc4556d29bcf9
SHA1 34608ce914fd9b07a8002bfa69aada1cddaf2a51
SHA256 ca8b616970e0cd623221ebce9add792d65e6acac352ee3b4f36183dd55f19697
SHA512 20960e79e40f3b73c3d3c058021c833b0ef51b2e17833389f45d70ce235073dfd97082cd93080000aad52e4f7c9433d7e6963180b9d6fa5c778c37cd20ce569d

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGLINACC.DPV.doubleoffset

MD5 34592444535c5a485994bd5226047896
SHA1 36238c3cd18d269eac99560acab5eb27215cde56
SHA256 309c8d3d7415bd63f697cfa689af58429a358fcf5d1106e45cc39bd0180c28ac
SHA512 a90b9aa98361651390676a9680d3a282861aba55d0e239b027bd25c27c84775d5337550ac6c3457c7cfe563c71840b88b0ca1d88471b196d7068ff3982007466

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGHEADING.XML.doubleoffset

MD5 1b9bd563ed458fb6b5e345ae42cc31d0
SHA1 669b6c1c0eea34abedc753e31c337b752f98ed5a
SHA256 f296f22c6b0e99b15db3f45da0365a3425b7281de50ba16d12d8476c86c7a3a6
SHA512 9a4e757e6f3e6af7d55a01181bb7a2c4d749c1c5834124236f3f12550bd1d207bdcd9fc93c648d3ba5b3934ac4a67fd69c019aacc85ace04b256378e558aac63

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGDOTS.XML.doubleoffset

MD5 bdcb5d2d02b4cf0134299c51d412feec
SHA1 60ea049b0a92bdb4353893064ff9130f1bbcacb7
SHA256 fb00af31e2ce07ac80170afc3eb8ce1dba26400894566fc5b07fdcbd7c33e22c
SHA512 64d05945575d8cf81e282c7651990f229c23db70c2bb73545a257f1ded54f4b8a63633048cc6432063ba2b3c8d2d495589d1c0ed2c6a83312aa04d0d01fac226

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGDOTS.DPV.doubleoffset

MD5 1ca17799957106fcd70e93093235b8f3
SHA1 70ec87271ea79f680ae6db723f8b4c93dd196fdb
SHA256 9b7cdc1f7800898bd353a0629bbacf73cb165b4d447f7860492a3695daa79d81
SHA512 d92611ff2b37046a98cd8b7b09742c3cda7c426310191c28f5f5c21bd448073b966a76410005ce570cc1e844fa8909294217d85f2176bbdc2de89f4dad7e5c1c

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCOUPON.XML.doubleoffset

MD5 2377653ede086396d1b5eb1ab740ce13
SHA1 894442b8e27fd46163e2f798e24b302627d46f21
SHA256 1dd9b05631356c68e935666991ff2371a9f48d49a04e87326275958e98346360
SHA512 7325831454d3efdf98f68bd28208d58a9b565c10720031e67a2541b56896b8329d9e3ab8369240f1e145c99155bc6194693da678a7b69869c03256e857b70772

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCOUPON.DPV.doubleoffset

MD5 89c70e146c4aa0402c8b6d8950ef9ffa
SHA1 6127460a18de341fb3930cd0234ad028c0d3e2fc
SHA256 47bd46cb4d06c9deab85e8b9656a9100df5614921eb34a34751ddc56f54e87a4
SHA512 4748e05f65a923a7b2b0c6f1fb88342433469bb574d5cbbd78550ce5d8be4b43553251bb005f5ef69d1eb68b4534986155aad1dea26da8ac75fad9456c491e10

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCINFO.XML.doubleoffset

MD5 ae09c6bf990582f7dff02348d73ef78c
SHA1 c942fe912b66f93947c3a6942f46ed3b8bd32791
SHA256 c88195698d5d97c57781a3da669c6b86c50d65774a8e0014ab541dab4e822c9d
SHA512 f35e7939b191edb2cba66d220a19deacb5afe9a8a4eab602f453b6026d8b12022277232e76d7735a7603e9949fa81f32008b602d5f076b7987cd4bbfc00a1c1b

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCHKBRD.XML.doubleoffset

MD5 b3313edaaf0f3643078fbbf2900d8a75
SHA1 fb345fc662ea796c705b5652fd3229613d8ff92b
SHA256 2220d6d726b3c1de4ca3f01240a42207dafa24b8525757f529f7ffbbe498268f
SHA512 51c66bd9d1a5f3cbce89adc608af7055d4b3096d481a3f36aee8e4c7b6440d51dd426dbd13f0d9b90decd7b85af91bfa499893884f22fb903001237a2dc055e2

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCHKBRD.DPV.doubleoffset

MD5 e3e0764938141527c23596fd1d809ea2
SHA1 640573c2827926710c708610c2c84db028b1cc5d
SHA256 1ea15dd00afa5aeca7472ccc40db4d902be0307c3b3678a0ffe33ae799be3bdf
SHA512 156c00e3cf5b4e1a97e60ce1773e9eea3fc7e14d04afe9233fb9497e1ce15b913e8287dc7cf2e1fdbd76905475365487510370f310a3edd14b72d02c7c7907cb

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCAL.XML.doubleoffset

MD5 3c5e6f0a30bd6e653b82f6225afe4096
SHA1 6e30a4b0e0e305872adc6125f194fa585ff8d68d
SHA256 7fd570dd5b8fc1481cdb53cc4e9398fc6b6e7b2abe2da80158d1824f4893621e
SHA512 20057ff45e453c49a8539aee6ac4667d1bf5eb4d468e5972c71ba74bd40823908cd85aab7525437fd8095cba685af97abb78d84eaf166fa3177df9dc2470e3ea

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGCAL.DPV.doubleoffset

MD5 f3f9b1f2620443c7c1070cfb635d35f9
SHA1 ff3780e2c45986a9d193f896580bbfd5f7a7656b
SHA256 5d8f3cc2cb2700f20dc258d7a61161653fab21b345db819b6af3abc8b2a20243
SHA512 35288c3e6c7c9b23b712d8a599789d10a02fda008b4b240f6a386bd700c438c9d1195090ee6225421b5d4c46a3b11604b6ed84f62803299d693fad305bcab412

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGBOXES.XML.doubleoffset

MD5 a954fa14950b4adf6385cd658490eaaa
SHA1 ec1e30b00378d60fd7afa161d3bef4d97e544526
SHA256 6046643bbb7d099932f6f99d464b8593306e760894015f4918549c98cf55f872
SHA512 27e4b03bffd780d6e2e02ac623e439fc4b75c5a23292326d264f4d1c2b38b959dd745aa15494b413938e0ce1c1c6101c66f19f754dc9b35928e8227d2f770bf7

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGBOXES.DPV.doubleoffset

MD5 b1e8c61005e47b830a6391b371bbcb3a
SHA1 39cd187886be796d65d3caae9ae9bf0a0c1dbd8b
SHA256 b36d305590783e83b393254c3537a1b2fd6de70fc3b65c7fe1f8dcf54cba448f
SHA512 5aa045d130ddfc9f969c67e5f53a47b97faaf4efa4420071328727897faf0580822575e5d766e8a7d8b8ea87ae560200a8273076b401005ebe550ff7baf4330f

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGBORDER.XML.doubleoffset

MD5 3cc05c9e236511f84fea4fcc8539cbd0
SHA1 6f82d5fecb52361d5682c8f2ed71b6b74221dc59
SHA256 6ea65cfb0f65aa2a0ecf008b696c273cbeead16eda1337b7050477358cad87e6
SHA512 dfcff6675856db5ccab7fcdbd9729fc0ffb5423700e89f5746019f15e707cb601c8a7b14680293325e44d7f997ee75a21a72a75b29312f88f9d9f1c8dbed118f

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGBORDER.DPV.doubleoffset

MD5 4bebdf83743fa0d57cffb37b94fbba76
SHA1 923bfb567735bc8274f33c560416c7022c6e9e01
SHA256 a793d577f15050ed32613757984addb0a3c745e7232b0698a2ba6cd8e23a4ddb
SHA512 05e993e27402488a4d5d8b72942dce6ab52c3fbcab243f15f76f3d4ff6d30b814e97f20021233f3eed285a40363197a4b587d9a1101c9680a541ef73b95bf4c7

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGBARBLL.XML.doubleoffset

MD5 3187b5b913b11963fc6864e83d8137e6
SHA1 6235d4d1f170488b162100b8ee88fdad9500a750
SHA256 852ae99ea4465018f19c8e1a7e9e7cfc548147dd90e3900b79c490475d2b39c6
SHA512 875fab9d0a0aea341b7377195530e2b4f5d774cf5912a872bbddcc6d6f218be551cdf22ce575e8f37e5ea24f78303829094f4450cbe0ff9413d2a0c2457e28d1

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGBARBLL.DPV.doubleoffset

MD5 908184df41f4454ccdf91d23ad20d062
SHA1 34053fdd324985ed4df9aada354c52f46a94deee
SHA256 a5372338f9f2035b7a3d28081df26edb8b3a57a93a36e33d5e5c0de244f97475
SHA512 ee478cbc086bf65fb350ac111f3422cde00f3682d721c7b6e61720d10f26a98facea154626ec8c13e0cb2e22785538a09518165b2a0547a03cc266178dfe80ea

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGATNGET.XML.doubleoffset

MD5 3149dff0ba5717b1e8b6cd5fc0abc046
SHA1 a208d17ebb9685a5bd86ecfa74bf6f4545194e84
SHA256 d7f45f0521736f22b0de5f6819454f497d85cb0f523287fc8d7efe7d5ae1bff9
SHA512 79057002d369db1cf46dad8413014c0254154bc32a727c281a253ba19136eaa9479eeb0f52e242ddac349b88b2f6c81066b6d3d6a4f65daa5def384d83748ba5

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGATNGET.DPV.doubleoffset

MD5 84cef94a966328dda068e673e197a6ca
SHA1 8ba78a3bb00aa413dd097eda18fca2e9d5a34d8b
SHA256 5b85c258a45f0d57551c452b27d1c72e0303d095e4436e98c8dd95e49e0e328e
SHA512 ff188886356a24ce7c0d40f129b981a77321cecf1e76b221673d10d4fb7dea136fca3c5b998c4bbca0f8d3e930723f7666bb1894ce4b3f027085f11fad4661bf

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGAD.XML.doubleoffset

MD5 080b163a4c0ea88c0f8868768e8dd534
SHA1 bbf07008b94eb20c1701da7977fe2f0e5957ce4a
SHA256 a8cb5bdbf65708fc58354e15d09cf023e26eb20f2a7d3c6fc277a285573cc29a
SHA512 7f4dab322cc2262a3471560ebf6bdc58fd7386f3654c4c467a4f54a9002451b6d043cce5dbfcd7ebb2f9f48a5c53e3b2568a723cfc2fbaeeff76408dc2eb72d6

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGAD.DPV.doubleoffset

MD5 f4303ccab41d115ab3891951e195e8c6
SHA1 1d861253944ad793963ea5e4dbf4bb1f80ddf333
SHA256 82a40b30afe32991ff59be840342011f964fc79e46f0b44aca2a749bb44847cf
SHA512 ff1c3651d6081af6b48796155c56ce4af5385aba091953f4a081127a1cd8e9ecf80f142bd400b305411ac5683a195bcbb5b4d564196bc0cf3dc3ecf91ca115ab

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGACCBOX.XML.doubleoffset

MD5 716b6d61281bacbab50761e84a707ad0
SHA1 9b266265fc35e6210642396c42717fd7efacc614
SHA256 d39cdac9bcb95dcba31864d65288b44ba30925348446e324832e6383768a3aca
SHA512 8f454028e74d1b4b0cc305f1c57955384a26bfc5c09eea1bae4ef68c0a2167e987afa8e0d495d2b97c3956f6687d85a553a06652cc3566ccc5579f36b0306867

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGACCBOX.DPV.doubleoffset

MD5 9fab113ac147f778fb115b60653aefca
SHA1 174bb596c8348aad4b77639554bfc7479fe68681
SHA256 7ba124bfb97b2e8d82069a24b7f895d87cf12acfb517c9c75d8ae4ef94388b4b
SHA512 1066d3fbe6518519ed9ef6d033fe2395fa3c77b0aa0caf7e648fd2421dfaf4b8839a5c2536b3cfae8012232f21ff1392453edf4eceabc5b9c639cb09da435a79

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGACCBAR.XML.doubleoffset

MD5 e3e84e37b91d70b0c82c73570f845711
SHA1 f02bebe1be7e8780190890a3e0457e17c7a40484
SHA256 917765fe3148eb4f45c3d5123e1d50507c4cb952970b33a7f82c8236e5ed5f07
SHA512 712001c4fa7ac2429cd088c970cfdf6f2ac04467cba3c20e99854267ab824f3eb9560b3289589c34575f4e04f89cd130ebf2ab369a807d830228db5ef5c9e3d1

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DGACCBAR.DPV.doubleoffset

MD5 89e8c8b730cb5738421aefd1af8c1313
SHA1 c295aeff19e1d206ab7f42bb0589c669e6409981
SHA256 a857fc337fd609a87393d62a7b31f2c579dec8089e34d3808ee3965d8954b37a
SHA512 aae8b9334cb3856acfbc4210b97dd15eff7a16008d9132e5bc027ac2c9403fc6ca288348c0d99d80d65e74d74533733e703323f710a0f33fb5910aae19b80b65

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-COUPON.POC.doubleoffset

MD5 296e0eca723a404be498c55314cf1692
SHA1 2a54912a78ba7bc07b1ac1ff765757dabc071769
SHA256 9ab51a8759300767ef0d072b8c3be898682dc40b8815418381ac61ef6580aae2
SHA512 6f1d85b3bb522df8f58dd6f9aa9345f7a1bac87bd23a671ee93589411602c2b91c87674331968bbe90abedcb1276a1ec23b0f87a063953c30dc711f7c1d443d0

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CONTACTINFOBB.POC.doubleoffset

MD5 70e650d650a26b96166864128c4b8251
SHA1 55b1c6a92a80dccae1546dcf9ade43e5830690f7
SHA256 942ea3ac8d2f0119d65fa2ff3da362b2a537e2c001646b9769f2b8c7c5ebc366
SHA512 3335b9239a1a6e1002f0f0b7a667f65358fa2d81789cdaceb7f3cc6847063cab24afb7fe336edeb4456d1e0ef5bc9d74a75c210e428f9b2f130a11da24f5c27c

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CONTACTINFOBB.DPV.doubleoffset

MD5 d31b5882c90929d95fe967a024420ea9
SHA1 0241e5bf9f7b2a80f5df84acc678dd2bce8ed76a
SHA256 2e2e833955c4b3218ec9f9ced0e23b98984b8f38ff73f23836d990fb996ee604
SHA512 2be7f927ce166f7b95b65410377f59a085862a21797a3d5ba5eff29f5bf80ce28c8ff63b9394cbb9310a0a01141694ba02a4a8d28acbecea154f6b47d3f34343

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CHECKER.POC.doubleoffset

MD5 ddbbb9195849e2329db5a0fce3124d63
SHA1 f6d545b5d77bf719bd6312d0802e53ac2ef9786f
SHA256 25dafd89b10aecbd8036d1cea8bc32d8e73913f1dfa79cae7ed0c17756f00984
SHA512 425d722a6bc6a6938b100caef7d58a6d4a45fc71cc5277a11372f58ffbe55f13fed6b33156d2b3c5fefb639a6e35ebf8b18fe2def2c8803f22b49c207d2c360d

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CERT98SP.POC.doubleoffset

MD5 644f9ebe6b8bb428d9311dfa0d8efdb0
SHA1 6d1141afcb0ec7c4d64ad1947ddc0d8ed84465db
SHA256 143f4b760b5440e7643299fdd2a5bb73881e38a7db5d19436412cea40de8ada7
SHA512 65bb96e06767a2c0f74541ebdd5a6b88abea016b83b0bdef00561be20fd6a2b19c7ab6f5c75b1052930e58e448fc3ad33ee82936a96d191e98ff3c46107b5fd0

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CERT98.POC.doubleoffset

MD5 7df93654339815b5aa5fb54d2eb47ec9
SHA1 8bcc2d3c799524b069a6416b7e5c9b0ca14f000f
SHA256 16653247741ee4710a81d11d9a10cf044012ad697e3d180c858817160496d5c1
SHA512 788dbe81fa15d488072da67dcc5e9ecd7df627ecbf771125dc7e943aa823f59a596bdebb9381b376980e33e6e4b2f948ab695f0916d6b773c5d70b6293a652ad

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CERT.XML.doubleoffset

MD5 6a0924aeee20e86acdec0d3fa9d72f39
SHA1 93f9f906bbdc3b5043df0adc62805c1613df0f55
SHA256 6bd603adaff24caa6994c7308ba4346c40d01e9564c49ff2d6d6f97077075675
SHA512 ab0c47eee93a8c697cc7125beb64444b1044e58f09be3d004cecf16dc2bae5d0c7a91636c3d944fa9baa0051b3e9d2b93821d9b1501b5364165f25df62e7d00e

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CERT.DPV.doubleoffset

MD5 502562982d170af96f55d919a9c84089
SHA1 7c84a575883bcca5db8788cfedcce535b74ae65a
SHA256 98c55581010b7d017f6bd69e1d520b0489e5e4909011c37414ab80416f81c7e4
SHA512 a4cd0c809be314155f1ee1458f089accf9a6d749d2e2f44883803e923367954448d3e4766907955364060690fabeec213a79ae27a00955a6ec7b9e7d7a78796b

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CATWIZ11.POC.doubleoffset

MD5 8997a73786561fa00b71f563ece6d80c
SHA1 2cd4798a8c6a8d566548b254ccd4d49abbbc7742
SHA256 b4bd12de875dd32de10a6986a7dc480a2ad523afbc0d2d1262f386988ba89cdf
SHA512 38764793c58439cb4a9dc4b7be7ed40e91391ae78ef9385ecb850d6fa9bd5b82903564c727cc8c807d80b1aac886c02c4f188f8bcebb3177912dc07729fbbd68

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CATWIZ.POC.doubleoffset

MD5 3a745d7fe5ed49eec8c1b2b0beb6c0d9
SHA1 de29580df97b3e8676c90086d135efc3369d1279
SHA256 02dcafea4eb253117092e1a6a63759b5b623b55c7b0b97db48d175454bcda016
SHA512 d6ee4c1561dba9bce7d194799906f2375f3d007c3944c7061e83ea3d7bf7089445fa40f5281e8352045bbbc15cd13a80a1f03671fd82d7cd46d681632f1cf3e6

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CATALOG.XML.doubleoffset

MD5 af8b70ad4436492b318a66ec4e492af9
SHA1 87e5426a53eb53eda2bfb7e8acac353dd4b52132
SHA256 de98fc4bc00b5ea2c3643b747bb2efbb0574236e3da32cccb26b7fad77daff3e
SHA512 58d85794f28830517e516470a56a7169f40f7d3e92bc028b67ed686040f64cd53ecb893b2d7951b83dc45cff2eec96503884a5f5be313767038e98786b45e183

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CATALOG.DPV.doubleoffset

MD5 85b8fc10de0aa5f64e7ac6566adea6b8
SHA1 1c8cf61b651bd980926f52fba8cd935708e454b1
SHA256 d17278035a4045d1fdb1a1be45114b982e69de19f22492f82c71ffc3294e2d23
SHA512 7e52bd430868e04f66c9742fe53a3ba7d80a81c1f426cab41ef39697ad22b8667d135f37cfc124e00da3120c184ead2191d212e3be594d40eff8744bb1684bc7

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CALSO98.POC.doubleoffset

MD5 db0dca14c12aad188d4b7a3f101efcdb
SHA1 5aff2f414ea06416db13f810a9043c6582daacec
SHA256 7338b70d2835f952e15e9d376bccdd539f08c968044b20d61b5e5ba30c3faa34
SHA512 3fa73aa01a5eed70dd1247c22fe208b1bed167437cbdf1e82b74303cccc5fc8fe64ef34decabe5cde4fe98dad107f1bc148f77d0ddcc73bf8c30959cbe505a70

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CALSO11.POC.doubleoffset

MD5 9a4fcb94dfae8662cf031aeac69efdb0
SHA1 bdb271bedf85c4ce1e0299134b3b6caa58b8e80e
SHA256 091de29d7abb790b2c437c36a242ccb5d17438742d96d3ae6a72dfaccc49801a
SHA512 888615d0ee95237e1008cecbfdae593c71fd34d34cc95147b27d1a5ca2ff70bf44fb521b63a7b533076252ca6dfb7b44556a6dcddbd2b9d4aa1575702e21bada

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CALNDR98.POC.doubleoffset

MD5 99a9d9542afadfe9620561c2ffa078aa
SHA1 1b968675c55efd7c82d8d50adf68db3125d437b6
SHA256 6f313a569eba969c8daaf32930a86ab21bbc0125ad3e11887c3a380c0f3e7316
SHA512 36091a14e4ebb95d5472154b3251024bba19feef937a218f10d9dd2dee058397ed935fff1aa1c4d53dafd50d2ba2cdcc0da56bced637260e518032ace1688549

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CALHM.POC.doubleoffset

MD5 c4528589d2fd57ece653e278a310d0ef
SHA1 101da465748da49e86556ad9ccdc817b81e397b3
SHA256 fe298d5b686c4e857a9b72ad2fe13230bd88fc91d62f44ea3e65e359a9897e5e
SHA512 7a9168f7e5e7d09391a30b423a52db58466d98b9ad5b2725398cded0b12cc14d1a6743d50e623ec0dbb3243c579f45566bc37251ba9fe70bd99a8ef49013a918

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CALENDAR.XML.doubleoffset

MD5 18685869d3e5381eb01fc1075840f3a0
SHA1 a4fed8a97d88a00053c2183bd01d11f57f7d6bd9
SHA256 708e22eab4b52909840a5cd712948417e3a205b664b2dd0103c9c0f42b583a4e
SHA512 fa17b6175fa7656bb26b1440cd0f4aaebc874090b6a0ab6cfd2ff187d7263c1c02b687ec644ea9db294bf83f1c4660001cb203a405b447a667363a027ca459e3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-CALENDAR.DPV.doubleoffset

MD5 28dd0cba5ff01a812ae0bc7e404adda5
SHA1 63fa6adf8e67aaedaf9cd72597a0ecd00a08bf14
SHA256 6addae5e80117006792d653d8925dc65a85d7bbada6de754a7c531d504379dd4
SHA512 8b7739e4a7a9c2262493f3fb88254af1acaa8979884cb1b422743555db080ed30b71f26d2c783735ceb4ce9cc1470d1ba78b175eecc25752a9345d33faa36d63

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BZCRD98.POC.doubleoffset

MD5 c5b3c42bca4160ee7a697fa99657c277
SHA1 2a68330404329a08506deeb7d90f5f5ae4eb768a
SHA256 2f4013e8b9ad92e28f4a162452a39b9ad6253d631c91805abc36154de4191b6c
SHA512 0a0b9bdf25778da3bb08f0aaeb64c47322a71da0a66488f0b689a23693eb632031b1543b453058ac8778fae0afe8e274777fbd3d751d07973c78b35d39681703

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BZCD98SP.POC.doubleoffset

MD5 c9ace5268371cf90e4f21b64fe785c50
SHA1 b9667fc27263f03eedc89d60d207cacfd40fdcb3
SHA256 62c0bae3b4bcd569a7b76b5ea47e3c116e5991766a07a7c38cf19836831053c6
SHA512 972a2aee60a9252be011a1d4f0d9220bf76da36b8c5c1b52fdbe53661a79b8c37a4cffe8fa7a25d1bbc3ca87377ee4c8ba20336752a64b62d018cc56914a3ed3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BZCARDHM.POC.doubleoffset

MD5 69fd2608a33bd51101e9a158ebabec47
SHA1 d4f01cb6e4538626e8114c280ee2c30c83c96179
SHA256 f2393f83917abf4a9d2905cbb9704a11d1eedd181d6567d6189b872d475bd188
SHA512 79f02bca8711e4e5c7194fa26590edbf81541d445b86126c4b2ef2b656780058d975e08c2f73eb11e898b72a837c104915dbc3e1612b43799df4e21802f30287

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BZCARD11.POC.doubleoffset

MD5 c31904366ecdc2db09f09c25896c149a
SHA1 c4ab31a2e7e05955b47f68c077e7c73762688720
SHA256 8f0c98e8c26b3caa24f0da109cc3f8a280428bec5ee4a0668d773b3052971d42
SHA512 b22cbfb574022a5f1051d45da53e88eaac83deade1a9ee4e706c5df79addb8e464c53b0ab0dc0e0c235786d30e5d1777356e0c4ab93c176fde269b8e41b84c5a

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS53BOXS.POC.doubleoffset

MD5 31011b69842596be56069aa2e1438b62
SHA1 e0bb756b2afb8f7a1aa6baa2660dde155ba0a137
SHA256 d15d3b28bd8a4161e10e7779bec0b547fdc8fa2e6b6b751667ba79312de289a6
SHA512 eab956d246405f80636d50e613a0e4f5ebdb9e75edd6b1ec3c90c43a112d7014addfadb1b95260dd62163abb370771f66a16d892dfa7393efc77dc8cd5eb7b11

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS4BOXES.POC.doubleoffset

MD5 3b5ac0ec5e3bddee317a31cbdb3f8467
SHA1 70a293d44eddd0757b7dc37beda071579aa00568
SHA256 4b2113e24b2b93623ffc3a45b853baa6a356ce6ef960f10b109dcf02af5cff75
SHA512 e2ba3cd3498b366ecf474b80708ca097131d884a00e06a4c65a8d08cd79dcc49e178172707ac82d6b88f4bc9be5c47056169c24b7c20eb9e5a99c7e79b1b7ca8

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BS2BARB.POC.doubleoffset

MD5 4b239694411a475611a9cbec5bdee5e9
SHA1 44ab16d2593a1c37404511d712dda99679450d12
SHA256 7640a986b4cc1add0383a4aca72b8a280f2199132e2800c25efee6489124e216
SHA512 46b3e0bac85b5a1991dd31c21f3de6fb41891da864364973b55d00d58a44c69a29ee66f695b18631e3fe01712bc9bbc5b5c2fadf6e23dd6f1d93fc5f5c7e00e3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BROCHURE.XML.doubleoffset

MD5 36002813f3a0d35e675334df7d3469f5
SHA1 f425730adddbc4cb5fa821097a4dd42e47c4c5f8
SHA256 1e86133b5ee80e4abbba08d98e7b604aa5bce86c8ca660a726430fe80213caf6
SHA512 da74ab02c0faab95f40b78695545dc680c2751572872a20af5e8e420fe940f24c4a8d27e5b3522de12b1a2017b63c79467846b461a04b6ff309b244cdf6ea67a

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BROCHURE.DPV.doubleoffset

MD5 713b3e5d1f43d45ffebb86554fbcdc01
SHA1 388dd1a97a37cb7ec5026db79e3a8e38adeea3a1
SHA256 510f0d9981663474a8b7e6c0c1ae04728c46246a8ae7d8209f2a3863f3283289
SHA512 dbe8319bd22f95fc624aceeeeb0805f6f5875d416451abfea80b86226de350c9515ab7765d1e79dc602e581ba3a2418e59efbd22270636b0f213547e5d95b935

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BRCHUR98.POC.doubleoffset

MD5 a5fc2e22c49a7b78d9aa6e24195ea5e9
SHA1 1ebee18d0849e367c1569338b2e69f60eb9fd445
SHA256 6ca6e4a8db93894da69ba030cdf046b48261f274928274a088c12b854fa5cc58
SHA512 4baa9e44a2234428932deedc5b5654aa5317a594cfb6a12fdb1808dd73161d3098323a26749c730ab5a2a9b04b3c8b50d6112cc3e8855398fa99537bcb08380d

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BRCHUR11.POC.doubleoffset

MD5 4db270ab30863785f917cff15129536a
SHA1 fa5789456d4494314a1e64941e4d24b013295a62
SHA256 e06a11f03256fd2c366b5f4eb3882395ff40ae2b1ab0a392fd37f2f67304ff9d
SHA512 1b46f5c0b51468b1ee2616909c8c3e8b7aab0786e9dc12a6253f4344cf68c28a0091860c9b12061b3863290b609978601d16aae5ca15f5e9f711cd8b6fda68cc

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BRCH98SP.POC.doubleoffset

MD5 ad313064a8df332600db19c414d1aca9
SHA1 ba560c88b9fbf54cbf1a274ce834a2f4fa677e84
SHA256 62db6f7afbfc9d697940ae55115c0de977e6b8dd4fad7e611a8293961ca248fc
SHA512 15479aee5244865251c7077df0fc0dcb78a0b8edb9f7b55307df0dfff2ff06ddb3e20625064154b6094e10f5c0a4bb6aa88649030d85059e1e558b705301b37e

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BORDERBB.POC.doubleoffset

MD5 40e3c6741a0a813649e40f37755de308
SHA1 b261beb737dc0cac887731b52eb6db0442f5dddf
SHA256 599475bbf6bc143aa1227b8a9d8003b653bbf5c7b24bc4b3ad2f20a5404d04ac
SHA512 2db88ed22ddbca2aadef1e40d8cadf1f43fddb2281661c80ec4fb1079656fce7d8379e15ec9d89039fe152f76f8ecb4d2dee5e06b2ff2fb1918451bb7677e18b

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BORDERBB.DPV.doubleoffset

MD5 cb90577649b060f1da259c670f6dc335
SHA1 0982cd875313bdc53e3f47a72a4342e1611d7dd7
SHA256 e8579475ec125cfcb95e9a1d8122243267a80a3e78de391e24a6a9778a60afaf
SHA512 4e18b226a81262221aa94d7e6d05a3d381d0214cc7891514ffc41d76a90637de13d1a1ea492ff92d6b59f09f6763ff70f9807ed5f17c00c237f64a9ec63ec900

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BIZFORM.XML.doubleoffset

MD5 d28b7f720a59e6a90f2cd962564c04c7
SHA1 a41f5820cd6b5928ddfef075003d28dd77bcfccb
SHA256 73e3bb6db3fa67c3f6845bf969529729797839047a08d6d037d0c8d0955f1a92
SHA512 f1e673553e55eb0217031732081b0525a5304570ceb646523787eb8108d76f63af718b7257f54fce66354d28e1afd84fbff5ffa620ceed88dd212b687c408bd4

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BIZFORM.DPV.doubleoffset

MD5 88a68e30f6e2d8a40bfbcc5e81c9843d
SHA1 012bd08b46505fb0bb731bb77d8424394f5ce7c1
SHA256 3805fe8398af023d4885b6e00ffc686f071c9ed1bb72535051b3678ea00307b2
SHA512 d70cf3464b19a680c69002d4c40bcc9fb4638e4e4a2d0173faf53e2193f97d44aa5e67edd882d92f01f64f09aae198d6c77c191e5e0d27a9deaf624859999abb

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BIZCARD.XML.doubleoffset

MD5 f84a62b4a746c93e10ae53328cdaf140
SHA1 e696b898327989eeea72e4c44df0796d7fa89cfe
SHA256 7f00012dcdc6e349157675dc3f7070ac6ee864fb66ff4ab0a2ca642d3d69370b
SHA512 387143517c4d07ed3f0f4844c77691b5213d2fa7c8cdae47a95acd968693cd91a8961686fe1fbbc105bce94f8acaad57f6ddf10fee6fde1cd2270dc6f64d9602

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BIZCARD.DPV.doubleoffset

MD5 87e6e6c7a78fcd4061740ead12793527
SHA1 d7e437cbf74a741841f9c5201b2a271f28b52124
SHA256 3bea84a46f32ea09422c7530fab05b18b9b10de4f90b432e7a4df4e8b00ed3be
SHA512 142d0fe032af98604ab7e1f8deda9da3c12a22aa5d367483108d91ac697d67949ccf0c4a5527fff6acee6d1f026176e6cd2729380c7499647ef51c31f17b553e

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BDRTKFUL.POC.doubleoffset

MD5 c5c2be34c58ca1a0b391cb0b69a9f117
SHA1 141bee64fa609083f209ce02858c6ffb53bc8663
SHA256 9f943365c7da9169bfe2d6604151a7beac37bd74dd84b3bd3a963f8d32ee4928
SHA512 84b42fb55428e4324bfe6243a6816f7fb30df8c5420817e7805a75b94af61b06dc67af02e1b4724d73fb96411dd302a8c418084b85ee29233e7719088bcf6dab

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BANNER.XML.doubleoffset

MD5 092d38cd64ce6b988d2484f5fc25fbca
SHA1 cb675b9eeb8437effbd3e17804fae55135e6254f
SHA256 3e1dc09ecb93896dd0ce71bad3d90c5c3d9d2a0282f130233b5bfef45277ee0b
SHA512 8103c37dd58a8c94062f1ab41aaa8cb68434a769f1832739ef6e06c8b5ee3ff3f7369e9bc1d75d672a4748aba7a0567b68d427bd8806c12f2c0dd5fcbf6d3ad6

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BANNER.DPV.doubleoffset

MD5 ca2f0f353a7f13a37f1841250a8c2d64
SHA1 18beec7af2168c08f1f138d850a43e7eb21f036b
SHA256 4b19ee6a14dbd142a876d4ff815ca1def7645b206c01d27b924928887133a9db
SHA512 d30c64f25477a2bbe504646c64004970dee809335d0b6d8920be1a68d150a5ad78750562734b68b4c69ef684d6e8ddfa6e249f4c1a9f79bcd4993a9ea6d9d6c3

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-BAN98.POC.doubleoffset

MD5 c47b1e3f0224eb4d3ce88f0210048d93
SHA1 ddad300e4d3493634296a6ba76aeac2054899fa9
SHA256 3a9744308dd9182e12b50500d06393fbaf09af7f189b2cf6669a1d80e48a201c
SHA512 9613498f034bd6444d486a42ffc11a0c086fc80a1155e76f31cc0ccf18ded1000f1205f46d0dd7352aaa62db6108972371b5acf174754287fa1fc4320ebd91af

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AWARDHM.POC.doubleoffset

MD5 5a7cd6d849f8cdd8eac0b028203ea0b3
SHA1 eb522adb0148a9164ff15b15fc982baed1a4d593
SHA256 b4ea74d34108d7ad9e171de0d523cb801809189c9525759ad5c294ab424627d3
SHA512 bc08bc8477ee5f29934aaef896e78f0994f3f99269334b837bf939d1d02033c78770760f6c3222c3bd62c599f4b607124ab44d1ab9b88d61d9d6fca596e18960

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AIR98.POC.doubleoffset

MD5 235f01aeadb3149ae3d7b845535c4246
SHA1 f357c29845ec5417ca4c5c53eb2d234d8a4cace5
SHA256 1375b82268bb947f5a18050680663a0d9ebd89170f8796cb886dd0b12c9b09e1
SHA512 cc137e7378569be769b90b72e685f25f20d43bcab1e2693dd39e065ce7355a5347190a30f1ca51d663e52a98cc9503d253f5fa6eec58c74e9a4b29544eceeeaa

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ADRESPEL.POC.doubleoffset

MD5 f0c6e3f59204bc77189a139c28633875
SHA1 0bfbde8cd036f55b0122f4d2439e3f8767e91dc1
SHA256 22f7e3544462c426557e3866eaaf75bb6534adfd72e45e63e24df6a31e815f84
SHA512 265772cc9536a41fe2cce05dddc92829a3078819ebefe67efaa7a603bfc13c4d70c766df07dbff0c345cbaf3ce1b6444ab369f72ff11b56b9ec4284ef1ca1781

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AD98.POC.doubleoffset

MD5 4f0abeeab08d9c0dc63bb48ed3966c47
SHA1 301a8a414a888cbdc322b0d82d750f86d8b99893
SHA256 03b2cdde0784e4eda9aa1adacbb4c48bf257781a81b6c077a2fbc69d615f785c
SHA512 6659156040286655041e3dc37232a13486ed085f2645bfb49f12358994116faf03abfda84f2a1930129807be42173516ea5784afd5cc1c8bf282a3e1cd1ae433

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AD.XML.doubleoffset

MD5 e3caec5a1eae1b32ff16c168e8af89f3
SHA1 44f7e0b2180f7015401f91f898e55a149633ffae
SHA256 aa8eb76030e264bf13b1a45ea23e56f2203d41bb32cf4d83dd7040d406bf3f3d
SHA512 f1aa9ba1c565eee3ed46b67cbe5039d4ae7a343c600b0eb0075b902299f05c382594ac54f341e557594eeb3eb5fe53f482b1b22c5fe851368113236f509da4f7

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AD.DPV.doubleoffset

MD5 111adb58b3fbcfa9ff0ecb1b6c51041f
SHA1 051e3e89a4b86f883cea49f532612fbdf3207f0c
SHA256 cad0cbbead40977ae0dee5662240ea618953fd52dc48c39feb86736313519a7f
SHA512 93a959629d2f00dd61add828fb5e178fbc08505bb565c4923c480b8aac8eceab34219ee3a2116a681be67d282658065fc4ec273d7c33de52c5600ed7db70487d

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ACCTBOX.POC.doubleoffset

MD5 de71065af82408b61015201fb251f76e
SHA1 5711971c37ff214721288979d9d41ba6f2469e20
SHA256 91eb44c44c03b0a22f0d63245e92c2cb3b9a457186593007b392af26c5b001d5
SHA512 01a561cbdaed484b671ee2b8fd81e8882f6ceaca472b5b485d1f6abd4f5c66afc901eee039496e983140bf42fcca1dd10adc9a6ce4882bfc746d8f31b4d6a02a

C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ACCSBAR.POC.doubleoffset

MD5 89633600aac37518cb1385fd7eb68b2a
SHA1 72cd41d11ddd94a6d90792e3b85be8db5164123d
SHA256 98b7d503271a367aabc55c6ffd78acc15dd9492ac76de5c73ea2526b76f3b41c
SHA512 bbb3a9111beecfc282fdfb89b2e9d92f65b7813613ce50e19bbfecb35005a3b39e92a7df1b9da2ab81bf8c4b8fc5b5b14e3d090960c65c34db044045c3ee8114

C:\Users\Admin\AppData\Local\Temp\scoped_dir1476_1695620275\9dc30607-5f2e-49e8-9967-b53cabbd5289.tmp

MD5 d2662f9232eb5de572d1641bb7d02566
SHA1 112f16237cbb36a1bdfc382fb69dbe7f763e5473
SHA256 1326f889456f5076d16ecdd89947e2f2b9b37bba9da22d9c430fa9e5b02abb07
SHA512 1804507587a2f2f368d0f8d8075e5ccbd29629688aa28ad62577ba0e2341147e91bbfd779d9b1d37638660c31c7192ca9da2e134405651a774cdb4eb7b7c9ebb

C:\ProgramData\Adobe\Acrobat\9.0\Replicate\Security\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-directories.acrodata.doubleoffset

MD5 e5f143fef55b9bc4959c60e723da8ce0
SHA1 8a2dde72c0d9a192f539c475ed28c22a255a244f
SHA256 7c5a4bee5df704d538fcb9fe0de6e78aec2e1b2458f055fa118516bcb44d774b
SHA512 a2de1698279d0a04ae11117f0f3c4cf3ff3300ffcc0712081120fa7a21745dafd81beec387463986090c8e274d9221343f9bdc5695b837eb8c0196c80619706b

C:\ProgramData\Adobe\Updater6\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AdobeESDGlobalApps.xml.doubleoffset

MD5 eeabeb4fa26e7ae69d505d07d434b3b3
SHA1 56915467397c191f2f8f879067979a0675518fca
SHA256 3586c90691a499d281651a9615931b761d369829ad38573d5dd8411f24d1e334
SHA512 6326cc6b6c782d82ef4c3b3dd3bf2518793669bcde0df5e1c0d9837597c0f1a6b36b792be3bb2e81cd95ef643cea9cbadab898973339d4a651b4242a60b3f398

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_CValidator.H1D.doubleoffset

MD5 7533aa7dbb6fdefd29c4395225882d3f
SHA1 faef0e14cc3b7ee5cffa1164a690c91a694722ce
SHA256 a981e3e29201115acfd7aecc61d7f58c862a883a834f299796d8033107f9c3d9
SHA512 99eb8d957d6808107a7892a903439479997cadd27bd24c57d26d63dad6983e4589fccf0f7b9b025917d76b30bfd7dd44920059ba75a16ebc44e636823a0dcf6e

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_AssetId.H1W.doubleoffset

MD5 2de9d8140a5b9a0db2201d0fbda59f80
SHA1 35fe442872b9631f906f5aacf6d53c15b2957545
SHA256 767293afeac6c6a3227006bdd282638ec21d97d5a9d0ede66913d8b4c48ea283
SHA512 66bcb5dd699c11da2fa202a916979a2ee008ba6e597332031e879e5563432587de7c6b77a4d257f4b894eaec7f3d3a8148d8453cbc16b15c8d4715fc07f0c410

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_BestBet.H1W.doubleoffset

MD5 fc8132c21e154ab2646428af787c6a4f
SHA1 a4fd7b1ecbe76c038e6fce0dc1dfa78a92060598
SHA256 b4817463f31bda45af8e60bb42c655281b3c1eab92c8bb06d3f272d1810bc934
SHA512 952afaf3aa1bec4e0effc0fb59cee98115353f6ac53503fcff19c984e4d4b44dd57810535ce17a36a4c77ee38ca6aea29b4dde0071a47a8470c2c822d96f8c4f

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MTOC_help.H1H.doubleoffset

MD5 2addf0f5087f9c34ffa6285714d73772
SHA1 5355e4f6cacbb1f7e37d7e1aee7766b91ecb1357
SHA256 ddbaf99297ca1e6727467571504e91184613340410e9f7ab1759319eb45bb770
SHA512 91fa803c3438b0257d2570481e4ac9895ebaf43cfb05cf40eb3f2ea7b3cbd69110a7f76d1b96d2879fff98dbf21d481475aff85ed992e0be0912cbb52d54e4b8

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.H1D.doubleoffset

MD5 19d66f77cc603a5c92b0bf3f8d8c8c73
SHA1 af74de67b0628f3ba006a0d76bce604a36dfdf85
SHA256 e43baaa2bbc0096a6eb7bdd35f7826f3e80a74c0dad0b9c2b3c1b0cadc2bc1f0
SHA512 4abed366e9e5c72d685767c0792f690280a7242ee8e2b38e0584941310d1a13f495d11f524de998008d93fa4e5e8d089e2afc56d411c4d82014b3de762f7643f

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.Lck.doubleoffset

MD5 85ebdfcb9e4d68d255c0b7c8f2c6fbdc
SHA1 2e879b91f94cefd7ab76648d7312890fe399d77f
SHA256 794a91071e4dd5ad6c222bd826223f08bb63741cc220cc3923d19f71e3f47c32
SHA512 e6f9bebfd4434d66d813a0737882f5c3501019f1df6897b96e6e54650d4bc874d7da72d4715a4e9fab624ad00eb745bbdbbce22b4643275e25d5bdff37fedb5a

C:\ProgramData\Microsoft\Assistance\Client\1.0\de-DE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help{45EACA36-DBE9-4E4A-A26D-5C201902346D}.H1Q.doubleoffset

MD5 44c6bcf8d092f49c425e8e9c3a698bf7
SHA1 de128a51eb1b043080b3a3552c1d5ec28c9bbbed
SHA256 e3c353f31fca79d9d49e270291fd3823745c314c991b5a7436ce6494b7a39b10
SHA512 2c5a24205991411a42d2047a4f7e24767833121c5ec539ac55bdf9cb44d7112f957428b439af6082108141e084c05fe200ece278ffe4d4d1348ca46a1bdbd5e7

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_CValidator.H1D.doubleoffset

MD5 87da6bfb384dad0314eebfe5ad4ab420
SHA1 af03d7f1b2927f6cdca42515c407486a1ae52c58
SHA256 8efcdf094fa7874873c61bb426c80e0f732bbf54111960988cf6479be20ef249
SHA512 89f7e8f321bb2c523c5795728fe01c2318ac8f277d811eb5a837b0ff75980965242f2b18e74f413dc5705ec36bf76b295155226fb1130e5104d55365556abd53

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.doubleoffset

MD5 1fb61c8e2aed3eed68ecec8de554e743
SHA1 b248a5006aeac67c2e125f2d47808c2692adb12f
SHA256 ea6005e3ac664d53e45d4b8572a890b51765924fb822e08bfab1ce94c0bc9317
SHA512 12488ffb16dd6cff393261d8ca77862d669255e525cf1ba76b55ce2b077276fad9930c45fd89f2146033fa891ee0eb8bd986735e8e3bb8cb31a3b43335c20e92

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.Lck.doubleoffset

MD5 632b5a49ab83491fae7f13e1869be51b
SHA1 ebbeed710d516d409c9b77292e5bb8cc5be449d7
SHA256 2a18c5ac1410fdc853310cdf4e4746d94f9998834a2a8c965f272f77a24c7102
SHA512 5b1ddfbbbb5b3d9627f267faadfea4b110ec2e4e5bdca845fa0da64d64d62dee367ae5aa187f070c43b0e2fc3a52f61c6a547d723b5b531472e5530af466beb3

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.H1D.doubleoffset

MD5 2cc3fdfb9c60614c7e1d5b2793c0a4f2
SHA1 66bb3bb2eb546d4df976d1db5b99ca2af704babf
SHA256 43c0e4c400af88530106882de4aad53a4fbb85de5a71a5f8e871e4aae3e4062d
SHA512 d941a59e73ec9aba359e9592d41cf8157d26ec0255ce8d61de3abe16799334e7a2e7f6ae1a6b01853cb811626cc4be37056bd413d20a49b692576a1adbbb77c9

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MTOC_help.H1H.doubleoffset

MD5 e8194beb52d429c1edba42f4f80e2196
SHA1 c2d8c4427d8c274bfc5cfb16dd94017b4f078f5e
SHA256 de161352269bdebffb4bfe714c80b540000fcdee648b00941af3fd2196e6d108
SHA512 ddc9320f9d6b4ae1ede89154957abf67debd397bc90bfe4fc1dadbc7f6018b9bc098b231f13af3112dff6049bedef86e7ec9f2712bd6a0eb9fb535e59591f40e

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_BestBet.H1W.doubleoffset

MD5 53dd63875df662ef945ea8d4b50aa49b
SHA1 8301f40cea08a08d713c229165b4163beb47a683
SHA256 ce89c77e884b84af6cd248c43c8a0e09b1db227395363046c718a0960565e198
SHA512 51de037a84564b7b9bf34151e021a7a4f9bafc0b98370de9a7c7e158b9f82b3adcf7adddec8a50b760471d67b53825dad166f16116a00eec6d5332e067edd394

C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_AssetId.H1W.doubleoffset

MD5 abd14a0102ead70ad16888ca500dc9f3
SHA1 d47f388cf00150fe6cda1ad3724129e01e7d5d05
SHA256 4d8fb9180d1465e3d891fc364bb636263dc0220e3dc471438fb0081096b4c46f
SHA512 591bc9f9d25f735aff3910a0f45ff2c8217395c4d15f74b18e7148691bb111b9c56eb136f3fe6b4b4fe83f0f5d115c2c9ca2baaa5a16be6e95e0816b608ed55d

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help{E1E8F15E-8BEC-45DF-83BF-50FF84D0CAB5}.H1Q.doubleoffset

MD5 333f575b132ef89864d757807dded50b
SHA1 33f275974fa2f4685dbb40cc21defdcd6361b5fe
SHA256 60753cc6dec1bebf80be07091ee1c8392c1d259b92564d1687bd1ea9a8c495fe
SHA512 59137bd0577333f38c2bdbe241c05bd97d99e8db9aedd9aac47944d12a5b36f517c39893ae3f10ebd8648f0e2101706eacaa1f3220d151a1e98a129a41078f54

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.Lck.doubleoffset

MD5 81dcec56806c48b51fb9d98bd75ba118
SHA1 e5913f0a4ad997c11d2c8727ebfe6b4be41492ab
SHA256 355219c7267da1593a51c22a736dcbd843b6b1923cdc6aeebded22fb3a85ca4f
SHA512 614ad00a5a8a589b7b2d68baf45f4ccfa63c22c813755c1fb36b7316b52aa07ab5dc80f4c59d345d6dfb8be3ebea83e140cd412d4eaf690d65d14b2e696b04f5

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.H1D.doubleoffset

MD5 bd0b02d6013de9ee1cd4a9b78885b3be
SHA1 4000c1155fc5a37f3342f6dd04682d1cf9f39b5d
SHA256 a209614a4eae7892ac749d7343e67500e73b88c463ccfd010ca292d157cd2adb
SHA512 072baf9fd008c1265d23143465726303d222dfbbf12127e41d26d27eda09ae9377cf485d93f7a196fcf9cb4305afb0a759698973a881a256c053dde79f1e3c7c

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MTOC_help.H1H.doubleoffset

MD5 03a45b12cf55ba125b38ac453b07ee4d
SHA1 8e142a4874fb9d93b26c7b7e1157c676644694e9
SHA256 2578b4c59b5eb06b0f819a29f05c1236d86f8fe9f09e2e34ba070eff93d3b7d3
SHA512 294d856b1b5cd64d4d93dc50b0af1fcb9b70a6ba5fde5efa40853c1efe38b01f287554e4db1aa665b74d5c121392d654db090190aa09053c8eac6d8e0c4c9652

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_BestBet.H1W.doubleoffset

MD5 304bc55a209b8e953443cfdf0fdc902f
SHA1 d2b6ab394e458873ef3db923941764a6934583db
SHA256 4254af41c72b2e4bcec5b7fee10628d9db0d2eb6e5c3621e6ce6e05629e2b457
SHA512 e3cf801d78f0e989892ba197f9c8cfec208e4288a6a41a87ef86c09cc4fe69929a23f417f936d176b5007c458fad7809c3c6147f63ecee508ccbf6dfb3416332

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_AssetId.H1W.doubleoffset

MD5 911dbc9374640fbf5a8bc3313d2fe093
SHA1 45fe3f6b9fc595c90571230b7200bd076068878e
SHA256 c9e44be4480abcc42838a06ed9784e5cbb6f6d0cf25ee6a13f717c2f5e64abf2
SHA512 80220aa0aecda7e7402d4924a3421b65e1d5fc7b86258a67a88f596ad550b215cca2956724d9928728f0b8f24a1132269ca0acf391d19fe3d39806b36e84cc85

C:\ProgramData\Microsoft\Assistance\Client\1.0\ja-JP\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_CValidator.H1D.doubleoffset

MD5 c9eed8b9f1762d6e459e05c32f9070e7
SHA1 c9d60b528fdbf1818271dcb1c973e23dfb0dd223
SHA256 f731551b202fb425186fd0bd67140de4fa809ac95afec608e7ec4787b6766eb0
SHA512 d7454f18aac1d624aeb48018b5adcaf3f6737df29ff6c40f8d319dffde1d4ba906c063c2e8ee07244b2097ef3831af5fd89a6476c4b7ea5a77dbde141da836c5

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help{7E352021-69D6-4553-86AC-430B0D8FF913}.H1Q.doubleoffset

MD5 e71458f9420f6b30e9e8952bbb8c1341
SHA1 64073f1dc89ff878b8cd417036faf53ae5a6d45f
SHA256 de97140466254102882cd6e7c1b5d4f60a0d3218afb4daef1c2c989587e10045
SHA512 4325dbb3102bfcf949e96bbdfbadf574ad0aa1fa2011719dc789109ea3115c6a7c67837ba2354a7b5b79c50041d199aee7b61471e079f903987587bd58471f48

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.Lck.doubleoffset

MD5 141f5b1666b6189274454cb8a9b3509f
SHA1 68f878f86472b04b8d610a5981a46eb2af021207
SHA256 910671f8332c560046a053c32966cb7f6cfaffc271688030ebd8118d4ab8eeea
SHA512 c5b2d0a099b64463f9db178147d31b0c7e64c06bd19ad7133e474c729d7aa3cd03deea962271763996da8bc2717e355cd728620664ad743f6bf1bc72864774f4

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.H1D.doubleoffset

MD5 efb266d835d4018ec6e0862fe834093b
SHA1 aa8f8b24e75de70e516b0da1d70b87d4b1d98087
SHA256 ba9cdd63758cd4f2460b4c82f0487c6aa8448db93e599caca18446ee66ddbe70
SHA512 62a6b87b40afd620c7a717b42a94d77c2192d5d6c875505809130f03c214074fcec4265570b46f236a8690cdd200f0f3a04b78d765c47f43ac00a58741a95fab

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MTOC_help.H1H.doubleoffset

MD5 a41250593200890e46ae2d02e74a34ee
SHA1 d46ff3222627e266a155012ad43e34f44d975f3b
SHA256 107fd59cbab6cc61f8b308cb145b27595ebfdf244797a2a4af05edf136ecea66
SHA512 fb83600ee82ce3596cd0990d46ecb5c8c9a356cf1fed1ae2bb877ea8f8a5d60a70bee78eda9187ae67b5df63bac79cb355dbcab3ca3cbc4ca062425902ea3e0d

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_BestBet.H1W.doubleoffset

MD5 aac2fd14cf073b152b99d63465b3a440
SHA1 260651742d9547360ef3c592a49b96361f39a050
SHA256 a424199677d16b69fcaba30c68426cc596af9d5b96b7dab17355a342ed8acab0
SHA512 969f1bac3603a4c0d8f7b04e20daa85f74a98ad0212dda7caba6b7859a4b2f01d51895fa2ace2f982259a229ceed01f01517861194196607545956ce77409cc9

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_AssetId.H1W.doubleoffset

MD5 383aaaade19c7414f89bcfe9b1b1f548
SHA1 d9c6b9ddb5cf47ec69868095c146f237ae48b78c
SHA256 21bddd55661de5e8ddfd3ffe01d508958c355631f89c0d0b498707fbd6b983b3
SHA512 f7616533c799acf44193bc97dbc220f559b1578bca834485c26bd0230616a3a26f3a32586958edc8995f2928c119c0a425c3264eed8a045e9bd93a4dbb6f8105

C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_CValidator.H1D.doubleoffset

MD5 0c93ab77f61b4425d2b59c1e064fd7f9
SHA1 75289e0ba414c816be6813557e10c23357227638
SHA256 cb1fd1a7570666cd6b520dd88524bc6194883b1d109a543542ae225466871f61
SHA512 7997fe69d9b064373cfbb081107c28d997bc9f503f8688ebe9f1b2ffbaebc02d92e6613bae19174df08d28012f1e37960c318bc97826c9125c8cd8b786c07792

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.H1D.doubleoffset

MD5 af991675e9d0d2875cadfbde91f41589
SHA1 dc46c3b0092425a0c810abc999ee145e85de6c47
SHA256 ce0e2eb6893be73943ccb8056de629ddfe9e9446b9c9e67a4cdfe6e3359de6de
SHA512 41e31a5617902177ff82201ea53cffb45513234902ed4f23a02d3ca7b0418926f73b03282bdf17cc3dfca63c15dfdc7c73dbd2a91a38edafc0a0b7c2432d9f82

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help{92F2118A-E813-4A4D-9DE2-F96A9DC02C53}.H1Q.doubleoffset

MD5 477837272f3c5dabd90b95a6de5cb0ca
SHA1 556958fdfe2de038e4129413fe305de8b37cc12b
SHA256 ecb4209955b63cd8c0b4296a553285899a4599bb28c97885449f9ed214314cae
SHA512 080adde44e99fcbdac87b656c3736fd7fe3bea0693e0406ac033959ef0086128e2430ef131c459da0c9032655f3add01fe42975d034967e182513a461620d480

C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-6d14e4b1d8ca773bab785d1be032546e_d58f30ce-7498-4544-8c46-d67b11e386bc.doubleoffset

MD5 2dd2fa46da269786bb11647966278c65
SHA1 0df97e62bed1febb105f9a612fc9e4460a2d3f2e
SHA256 ae48bc0aea8a5d947f184dda506f769d03db9e5ac5bfdcf9662f8b762f2312a1
SHA512 0bce37dfd372ebd9d07b29cdc83503966e6c743f4bf3eff98d899e242694b799f448051cc87cd8689b50dfad0aa0022d10b03257737a4572944ad1204a344a27

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.Lck.doubleoffset

MD5 3a00a30c267bfa259394a5e9a9b554a9
SHA1 f8b040993d369da7accc10bafd2a20fcb05b5109
SHA256 49e5dbdf5868159aeb4f880ef85fb2ffd0110a8ecfe0684ecdce79db942d9caf
SHA512 f4116c09467f3a681b1c0f1cc63691edf116ffc5d87950b244b7c3d1cbcddf547530be38c4bf2a62daefd59ed9b076e6cd0912a80875f613e4f3996ff15c086c

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MTOC_help.H1H.doubleoffset

MD5 e39a10001fc54a2f1d8a78b88beaf725
SHA1 2f80e58ad1dbb85bb629f328acd1780ca41d6256
SHA256 1aeb2d667cb9932c84a7b975f1235ed797da54ff5e0486ec9401d8367d1131f1
SHA512 4e80a7947074868d48949acb836eae3f5588ca08a6386b1708a14eef4da5817c754f1f6e77b9ee548a85504f97f5541f33680dd948d8d283ed97c52344ad497e

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_BestBet.H1W.doubleoffset

MD5 90d4f925128434fe755f517229696ab1
SHA1 f953c540e94566f8db5225c80ecab37629ba7fcd
SHA256 0e198915206d680099c1b499f65667e5ba8c24e51a7efbaecf8f8cc7584409d4
SHA512 51149504d71136191aea4cb45acdfa004dd33d2c4c5cc892d5eeddff932ca3924c657a10d30d1a69ded176db27827964a97fd50631b87386e7b9fad504ff896d

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_AssetId.H1W.doubleoffset

MD5 ac2ec8b5a529d8f14d57835c3e42b9f8
SHA1 686aaa6e56aacc17ce507ff90aab6deeb255b903
SHA256 9667c87bce922320ec059e0e04a4ee9a98a5a88528e2cf1e30f5a0e3c5deb926
SHA512 0fd8fdaed1d59f12b9cf5bce6e3e0f630961e87c6b6e64374b1291c51e6cc2f3ac30fb73720bd3425ab7f3cfb66005563a6238eeab4d6244a37dfbfa1254e04d

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_CValidator.H1D.doubleoffset

MD5 8f192588e7bfc6c6e5e78dd23aabaeee
SHA1 939c851ac03b6436de2e0257113b0c8706e243f2
SHA256 77e0678f95b0ddf04f2f32da691bf5e772d568697d51730dd2a43daef5cbdbb4
SHA512 5ee8a3f78b56f01566265eebdd204d82ea1175cb0c6c22811cdc8af4e9d676750d9d51d0badc72c287cefe4aae166cc9c55cec52f026a36fa1f110eac854ed50

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help{68DC71DC-2327-4040-8F03-50D6A9805049}.H1Q.doubleoffset

MD5 16c042a3879dee47163979aa64420f97
SHA1 32e564c9c92a70800a078d46116d18f0a62af459
SHA256 81482487ee5cb834a0bd6494062595614f7cc71b71c90204ae099811d7e17033
SHA512 2247a4704f019c6679915f508f4332b088ea7eb59bbc1fd3f285b4897c964fd5905f0b0ee35cc07b2739d99f8234791100c346b5e6380b720d820820f91f66c2

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.Lck.doubleoffset

MD5 cf7b6542b35ec74f5171d0c6fd062fe7
SHA1 6a93d1d6b20a46587676c646581e07b34b8fdab0
SHA256 482f4243bb6da267e930c900707264fb9fc9f3f74b385899ca1df21f3334ce88
SHA512 c8b328a4e626b5b6368f8221133a97cebb677678a24db262fdbbb01bf61b10c3f48da395d2c0f5e689fe58b504d90d9ea7fcbcf678b9fb1d81c6410d5ffe3560

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MValidator.H1D.doubleoffset

MD5 cd336f54f0b94e66f139a06595f0ec93
SHA1 9878b391995d1d538b6baddbb1f43e50a2432ce0
SHA256 9e3d4b999c6dcb72f372aeb2b62de9460106f7cdd766aa8cd7ed76c467002363
SHA512 8d6b7c66986cd68aae5e43a28bfd5acd1203d1a04ca26ca0c272d5e3abab891626fe69a964e249c374e21fc7b5e336f251027d5bb24584c87a4a1aff7c58583c

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MTOC_help.H1H.doubleoffset

MD5 ebefe36e7c15f39dedc397668eed349f
SHA1 f61d33470c16d9d49336d4045c3efbdd8b758807
SHA256 60fa74d7d959343ea9d229f1c2188b8b88c7fc697d5d795cdf29e70d3b820a0f
SHA512 56c10064d5e288d0d9feba89b24c468f5ae98be750aef486a7862e31d98971375cb099fecfe7a8d53f8a2ae2a03ceba0d4b4e91f1c72e99e0e3b6c37cd5beabc

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_BestBet.H1W.doubleoffset

MD5 829734e86631f9dcf4d47f4eae8d047d
SHA1 c240971474716f96b46a264ba80c0afa3704dda7
SHA256 86dd956ccd80d374cd413c491efbde1762a9e810a864e05ec12ac39704fd265a
SHA512 f373709d8a92c322b67274b5be2ef1750c8847777a5144af72c301bb841b947e4225e51a94d292e796e4a4ab8c73403f3082e9272d2e30c2003fe6862f7deb5c

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_MKWD_AssetId.H1W.doubleoffset

MD5 aa98ab3b6d6c1c60d5b6832372ba8be8
SHA1 9ec14cf808dc5e8fa7f5236cba464fa089340422
SHA256 884337e76e58bccb5d91fb3298bffd3cdd07f18e0c039063d7e7ff85cb8eacf2
SHA512 6bf4ce272fd2722c702aa49540cbe8e79aab267eb0a45ea7165ad3db9b12fc93968f25e143b9944d71f17402da33c72ece4b7a0d9cd20a5cf68582af2a7f4cd1

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Help_CValidator.H1D.doubleoffset

MD5 82aa5b5f70ee92e621e52dfd5c029874
SHA1 c064b159013591dbcfee4a38a0173ae4302e6c0d
SHA256 1f28b84e75aadf560c58cc72ae2cbf9cd5ebb19f557c914df312d4589d4bc567
SHA512 3ba0c2c099a9f4852522d391dc49b8c7fe94881b71d19238d41d75bc773931f850ada7acacc349f79a9bd890a16cea6e94cb7f11ec85fc798913c62342c72a43

C:\ProgramData\Microsoft\MF\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Active.GRL.doubleoffset

MD5 f28bb553b9f94c5d89f6949583c3226a
SHA1 1031a0ef58411997ad71e3a2e830870161a8e270
SHA256 5c5112956e7c53094272014528158f4791e2689a8ace1e7777b4fbd031664c99
SHA512 6d0338e9a89d623705ac8ca3ce82f968a183cb61596c416ee56d0eba75885540b43a9dea2e1bccb8f8eeeb73125a46e833a0798b16ecbba12108564ad118db78

C:\ProgramData\Microsoft\MF\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Pending.GRL.doubleoffset

MD5 cf9462c88b9f45d08b6925679c73d765
SHA1 8114b6301db2ce3b9a39baa8cdff03967136e7ca
SHA256 6841cb80828c11fb2e605b89af8d9688c61e5ca7d7d602cfeff0e0107a1b8a19
SHA512 e0aaab195de6ecc84ec565b5bb8f04e40befcc28b1fb2ecd3d295d5ab0f9e6d2118298950c4ae4552937c1a1da283b550d053187354242c3da3edb2db44d39a8

C:\ProgramData\Microsoft\OFFICE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-AssetLibrary.ico.doubleoffset

MD5 1e1776dd49dc43b8c0e0386a6f0d855d
SHA1 8350e74536e9d365dcdff4f76fa42b6e9a5f5283
SHA256 c23267d445a28bba19165cdb32c1b7b8a8f8ba858480cd5ad5846d8f31acf8ee
SHA512 44ce9464857d5ceaffa1b5c47a2881a4cc03b250865272f5461672957803830e36abcca9e26f3eca69cba17bbfef08dd883380cfcb948db5be08bd87d09a0fab

C:\ProgramData\Microsoft\OFFICE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-DocumentRepository.ico.doubleoffset

MD5 34794204da0a4478b604a10c4f69117f
SHA1 a533511e9f1b25c48c19862ea8386975ffda21c8
SHA256 3c2b0e5f9cafcfe9b7a01a22b3fdc40af67c780c36b6dc55a3de93e4d944a7cc
SHA512 c3c9726524fcecdc9dc7f7a63bf11d86492b67afa8fea013ecad524fb9f8d78a01ee11510490cb782ce7fec7e683c036fde7a13bf9522982af5388b88c58c0b9

C:\ProgramData\Microsoft\OFFICE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MySharePoints.ico.doubleoffset

MD5 2fe1a7a3f5f418c3bf3b1f3405c02dc3
SHA1 2ce96d2a3d7b7f0ac4887b0f63c4871987069193
SHA256 236ccbc5ffe8df2fb3d1e13042da5f6dcf8da7cf794efe22845b5885a5c3352c
SHA512 375cdcc6dea5dd6e247f9a55fddcc9a19777ae6b3c84b4da00cc8d1bfd6d6b8b6073f5b470d88f9d304ead99f28d8205a3009f10fa50c1ce619f7bec0003e66a

C:\ProgramData\Microsoft\OFFICE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MySite.ico.doubleoffset

MD5 ed98e1e1a5d623f91ebdb5af0964416b
SHA1 fc8dbfa23a2ba4dbc8741deb03b3358646ad0419
SHA256 7dba9b40b4f3ea49fb608a1d7d57056fff86d0ec56d0151e3c42355c72851d30
SHA512 35913f3e296e79db59292c093ba193dc872e69ec414f1fa9da8b0d951190f84926283d4aad0d790ce441e4a9e68390c8b80f237c7ae92df4514cae303d1c3b03

C:\ProgramData\Microsoft\OFFICE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-SharePointPortalSite.ico.doubleoffset

MD5 1784092d094a6fd1234607de149f4ba2
SHA1 1d2724ae443f8956e83c912495b8f6ac0df03995
SHA256 a13589b09d5859374dcebe84ea8b7c8857e87aa64af39fa4e6fad2bfb9e87044
SHA512 7ee682fe44314b75d666012be3dc8f6eccde42b3bb25713380f1bd69fca71d37d5cf9f7804ac3388579035c5dae6fbd4b25fcc0d2f0d8ec1a44dc20c22f3b62d

C:\ProgramData\Microsoft\OFFICE\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-SharePointTeamSite.ico.doubleoffset

MD5 09a22dd560221a4126230bb4b7d3db22
SHA1 da2b86f2688235c7e359d85bbc9f35bc66323dd4
SHA256 0d99a95d34dcc92c9b963627fd2f99c4702b8927f8a376e0236cec8f248ba77e
SHA512 7d3e6f28b095c413bbbd50cded4087077d7289cee888e128b08b4693f1677b0fc305929c632d76b12618def91cba333c3ff2392baace05b3d1cf2b880a3bc3d8

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ENVELOPR.DLL.trx_dll.doubleoffset

MD5 23635f5ef6f483e4fc8c703677f3bb89
SHA1 8515490102c8b041cdcb5dcd285eb9ca8eeaf646
SHA256 142010a1a59cc684b20f532cfd735888de6191c4ff594ecb5103ba8ee1cc7152
SHA512 e6a798c3b442e138f30e49911feddfe522616c1a76bcb3729e61135f2f6777c3512128098d927e12dc7e9a59174d7d5f37a2f0b076e72eeb2d850a85ee4e9770

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-GRINTL32.DLL.trx_dll.doubleoffset

MD5 630c2cbb576a0984db834b844421d4cf
SHA1 f417121138de4110ab9c396d8b8073e7f6e6624b
SHA256 b1e7570cd2a96995d558ff802ca297e76069168ef5f16e263214f71397b1f781
SHA512 9658d50ea455c7ca9800e016a08a1b42a73832f91231b0fe1e71d30034961d51eb8cbecf373f53b15bdfba4ae1b38a7a2c3e7c885495ce353ad307224b73c41f

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-GRINTL32.REST.trx_dll.doubleoffset

MD5 853b7fac167b68612fe4506d20a583dd
SHA1 e951864e1a79e6e75a21f8d767cb255120139e0a
SHA256 30f6b20b9d43d1612c51e9110b754c0e61a7c61f61c6db5661704094eb12c53c
SHA512 0ffe0b5aa36eb12f42ca16f3992a8baf35efa08b6a1e174509a6de7b7616bd9ff73df4ea227a3924c27bfe517fbfefb0d6e74b18573fa555bae5644ba3273a38

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MAPIR.DLL.trx_dll.doubleoffset

MD5 f3ffb7663ca2a5618b727eb545b340d0
SHA1 880f1a76154623a5b19850066d496c10860ecf63
SHA256 a59835abe3fb818969fc02f95d868168cffbdc4ba1f497c16e142962267d93a0
SHA512 775ebb451237214318c3a403992da48eec435db2d22291e3104f607999e5f37f2846742d7056f0019a1491dd5a90872f88fe91baca919f2a7d093266dd6afba9

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MOR6INT.REST.trx_dll.doubleoffset

MD5 4afddfd10a1d33aec0f55cae179acd44
SHA1 3f53274667c5174f79358832b6cfe61f25eb2b26
SHA256 8bb2c9f8a8762e49daa670a187f36c9299919b34dbeb851a5d6e97444ef4b320
SHA512 a1aef82ad77b1caa4cd4622cb41685782eca0dee6c2c8a5bb2f171bf83d3a2e8b636dc0183d36d3fbb804077559bc12fd9c7f1de503e55e42a3a2a737f5760f8

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MSOINTL.DLL.trx_dll.doubleoffset

MD5 a246975ed2443bdd6a4af9255ad5c14c
SHA1 44bd74eb9523adb9efdc4bcfdbd46d79a2567dbd
SHA256 46682caf680db6eb13aa0134e08ba23f34e785dc422333ff58e9fbd2cfb18c18
SHA512 b027f5529c9047f1fec2e2ca33a0f5af2530f94575a0477c45d3485ea82d677c901bc0eef75798df24c061e62154f509f4d66ac983592740bdb443ed4036a021

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MSOINTL.REST.trx_dll.doubleoffset

MD5 1b8548be0cbdad17927f99664c208023
SHA1 3bafe3b0805769f3a52b2807e0e4f20209843a15
SHA256 c0e6630279110492e6b640b4d6c199a624797392161395c6c41a8994cf1ed0e0
SHA512 8fc49bb5822240cd3577927f5f5a00850ec53819413097c95218c93c18f7e1ad93d993dc72f950f7677d9d935c2ec43832a36ad9d8f4f888a4ddc7f00724a87f

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OMSINTL.DLL.trx_dll.doubleoffset

MD5 e8cbe9856f128a3fed29ec83187cb9df
SHA1 2d698c5bda94872f08c3953839cfa352e30ce0fe
SHA256 1b0be6896fb7950389a36b9e23a1b32ce2b96ead5694762ddc3b4eae2fa2a9fc
SHA512 c66659abbdf57e48e0b75182d2186c5b0185bca3dadd577d439cf99a4096f285336db37f35695aa2d979a333c5c35bc1df547fe6035903733d6b06ae8bc6dd6e

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ONINTL.DLL.trx_dll.doubleoffset

MD5 fbd03288a5bd12cc79d20127cd7b9de8
SHA1 3ea58a8693e33501190b8b868e3804d03446f31d
SHA256 dab60da849958f5d97e56a0d3d9fba9efb0c5838cdef4b062c8978ee3704d11f
SHA512 ed477b7b3f19e63e547fbc5edf59cb409e0fd8e0445c789dd5e72f6cf5268dd7da1a63e952c99b0067405491089804a997451f59dffcc4ee517d2f110f1d2747

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ONINTL.REST.trx_dll.doubleoffset

MD5 60b38a435a763ebf2c051e744d4be231
SHA1 e27142d4883511576bb0c005575acb2715f0c992
SHA256 39b2d6e2196c345fd5c33f056d4415e39b397942e742741e946c7ece51e8fc65
SHA512 baed47442185f6a844c4c889964424e3a8ad7b89f74f0ffc1dc6e25732e286fa95c1711e500d5e0a6d21f24eac5d0e2a1f5574a43ee31cb65b4ace65d5234721

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OUTLLIBR.DLL.trx_dll.doubleoffset

MD5 0947d8f4d92418dd4c8c42e1962e975d
SHA1 d4fa53037217a325ceda81a1d04e522bf22aced3
SHA256 ebc167d2b1c7065b2bd17f7f61ee39a6d01f116d793b2f30dcecf617268cde60
SHA512 0a6989f1797dd4997e1873ff66720980723a5f292d56c45d7edfb97371ec9816a8b731d66d9e38f22bcc38965cb5dddb8bd2e1479052e584eb1b926d8916f236

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OUTLLIBR.REST.trx_dll.doubleoffset

MD5 c6691201114da7db36591c4de45978be
SHA1 c0d8af36d354f218eb0ae804f04eef392cfcd5a5
SHA256 8c58b910543e795f290210a133bbe1bfc823e282158ad0b0374a53d6479abeaf
SHA512 59e8eeccbb149cecf08a14e7bee9dada3e73c8ba9d5b07eced950f1c2555174296731c7464a9da79f2c90e98994f6eadf33a2b3a71cc7877b4e27c69b7b8da3c

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OUTLWVW.DLL.trx_dll.doubleoffset

MD5 9a0f47ff779ba150656da252d5ad9fd8
SHA1 5bf782dbc5773c82bb0c20ecd7faa3e0c8945e2d
SHA256 c2b4089fd8a0bd5202fa8d65740f4a78a34409dacd0f96000970ff7240dc78e7
SHA512 a1c397a21511bb01e91c1afcf3793f380b03937f930822a9d57be2bad92aa1f92d36b169af57f9dc0c655ffa5f9dff4e5c04bf6d78e21ccb41bbc710a3397f47

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PPINTL.DLL.trx_dll.doubleoffset

MD5 3312b4e3c9245b709fd9553f67bf0dd9
SHA1 b09dd8ec637176ed738a008a5cf1c55476849bfa
SHA256 93b614ae5f7d148d8085cf04b145c08b203adaac413218977d1237c07f3db58a
SHA512 6da8bb3b9d79c6676d9931834bbe3124775fca9afcb8437b98799810b3e8340c50b8691e22d3da9d99bf6ed28e670bdc9fe622737916da78fa395035c690820a

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PPINTL.REST.trx_dll.doubleoffset

MD5 f2112dafc62b4a314d6684c64f9a8a77
SHA1 81e2dd53a1facd13f0d2aa506dc3f5e04fa84549
SHA256 a8ba974fd7b6786fd180b9cc66886f891ae1eb718e1c6bf506df1fb7ccf277dc
SHA512 99d57b218b13c728cf7ec5ec701fb7ecb199269110db337471647d19092c8ec2ae93d251102cb82a7fc4b1757354ba345254621dff9e633812c587aeb5fb2f91

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PUB6INTL.DLL.trx_dll.doubleoffset

MD5 604f06d3c52fdde15c0a4c0ae50e5ba3
SHA1 491e6759d7829c816ff36fe7717b64a4b35a78b7
SHA256 3cc6caeeca3cf47e728dd577d88891aa91d4db049b314732603404c35f75ed81
SHA512 84c1381d28679b7d9a53617861007b592b1e581d1d7c2296d05565934a0e2d26cbf3b878880245022b0ce1633bbe2a03a868d903bb18ff95e3335c002fcbb513

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PUB6INTL.REST.trx_dll.doubleoffset

MD5 8ded0ea2e4997f9fb4c957f9c9f99f68
SHA1 98ce1e2eecc70ec391b08d60edd1befa63ca7d45
SHA256 3a69b31f2e4c87b81e22dc63164a88f8990f9c90d58db8b7d883722f89c1b792
SHA512 52ba79cb2fe979b8f18fa8b7760ff92816c62b7e1b1ad2f01f56f0cc04e4c7a655828ac2830ecb64307dec8fa5ce354ff646462c4b863e9afa9c72911fbe9db8

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-XLSLICER.DLL.trx_dll.doubleoffset

MD5 608aecaaddce440a0d341f8abf284020
SHA1 b32331e10bd780ad03024a5ceeb8c2f4bc815c30
SHA256 2d68b3b27775d5502f9f2a4d6752e0daa3836dca4a8dc3ebc4942c40eaed327d
SHA512 e1b10e1059c049333d2be17ec8b0cfddffe9342aafae4985f7fb5e84deccecf4f37e7e8a9569ebb08eb9be7eeb254c3c4481b5b5ac66556e125c4570e91fed60

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-XLSLICER.DLL.trx_dll.doubleoffset

MD5 38bb3938693b76e601ddf0e37db166d6
SHA1 84f3029e91097669de29861f589edcc0580ebd67
SHA256 89aae326f2db3eb31fee845b14b5561f42fab81dd87ea4ca42d67de5edaf5b8c
SHA512 e8c8b9dbba053119f02f2d7d6d1546a2fd29b189fc7027f6c9e1594af5d64262173deb9970886d731df20dc90f9e71e788c46b50f22c1dc17d0fdb96eed834cd

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cache.dat.doubleoffset

MD5 cb09a56dbbe903783793facf73bf8d0f
SHA1 818e21ceb6d7f13074dd973943d7b1ed11cd8697
SHA256 0e67d7e8033f6fbf6e84f87ceb37c2ee10eb3169195133e31634db6fd1cd165c
SHA512 3c1b38b862880c9f7fcb13cf5925288cc99ffa82c6a9a7a9fee8c9bcdc3bce43c95ba3dd3b0e87f534e74ffc657b6c1dc873eb4067bccbb8f48f59667aa0555a

C:\ProgramData\Microsoft\RAC\StateData\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-RacMetaData.dat.doubleoffset

MD5 d68cd9316325793267fa2d0332e4525a
SHA1 683182c9b6d177df1ef3d83c9ab961bec284a315
SHA256 684b773e42bf39657b67ff74c6bf28f96d0ec0a3ccf340d174708b9bdf658dfe
SHA512 9f9ea75d39b237bc9ca770e8bb5ed1a534d9c7d8d49c1632c06982d947eb91e9de2d810755f8df62fea2fa5ed6fdc4e1a105fe916c095e8d73634662dd8aa2dd

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-XLINTL32.REST.trx_dll.doubleoffset

MD5 371b22334eeddf3616ba5753475df771
SHA1 0a5ec39f43d6cd2de7ab5c3d38a910f30a4a8289
SHA256 a0c6980a32bfc1579da4b49dac29f8f84268e394a66dd4b60351494f5b7c61b4
SHA512 7b926af0a46b36c66c2561e4ec1b0979b44e24b1ee4fa117cfffab9e5129edae0dcf670314957089d72008e0aea86244a77e3b01b1f85862a9fcccfd2b7fe007

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-nslist.hxl.doubleoffset

MD5 2dadfd46db54abb8d19a81a949cc10a0
SHA1 0765ff5e23ce9413e21a2323c5174a735b4b1e8c
SHA256 40f05b1a0c33af5958fb7fc9421780dc44ba6ef13d27a2149300400577937305
SHA512 7ad9f9ed15d1bca4cc3d92302739597d2c8907100bd955b34938a700ec8d29f67393b6c448e030c01f4bbad4eecfb77973d94a6f3eef5ba0b15f83701d9cd2b9

C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Windows6.1-KB2999226-x64.msu.doubleoffset

MD5 fbbc68f346325ed828af58ad853eeede
SHA1 2d836d57812f4eb4e364a738e82909afd12e0288
SHA256 1e2667fe0b3751fec8418b828f69044eb3132be4ac360d83334e127afd52c6de
SHA512 5ee67cf89c35eb87b033448514dafc25a4fa964a0eb20b9c45d570b9cad2b901a8b9e1c7363e7af49e6df05e855f669f1c3c78e71ea74c0f320b9f6a4f15bb2e

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeMinimum_x64.msi.doubleoffset

MD5 db57a5e9ebe05bf1cfbf0c16d3c78fd5
SHA1 d7692043199555d969c677f5f2c9dad63ebb5d0e
SHA256 bc2ad072e2b27690cbc90242610fa4a30f5ca8f22f0d824a25d595e5a44e5b18
SHA512 ccc0155e58fad37c65322d6c6da4f347376f1048ce386978e572d78dcb0f69fa028e4588b4a77f2f58c198eb131a85bf3a81681231c710970ee0da782c4a0635

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeAdditional_x86.msi.doubleoffset

MD5 48d19375c94f9562c92ea3e3fa1b220b
SHA1 4f88c3021c4ba48d03b80a6a58e4206c81e56f72
SHA256 e4078900d9bddf852fa9da9a2ef08c4dce8763eb37b4da11130a33229b7468d2
SHA512 7b76e27ddd8544a3724fd66e2ecb89b8fffeb263e5f3555167458e336f0436ff0c6025695f74d5dd3b8365b97eaa1d38890438fa6f2cd257b6924dfcd404ebe2

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeMinimum_x86.msi.doubleoffset

MD5 f6762ee4c550fd9bec455bd62991b93d
SHA1 e4930b25800d45b44c2872172a0e8c1ba424e946
SHA256 8c7b71b93ba41be94f6b4382b9fa0f6fd14950f933834e7e4f3261533007e3a7
SHA512 768dd67e658125d0a7839aa88383e868a5a4a46dda04c1f49fe89a17697c172f0fc3e7041373b00283c208a8f5dd460033cb5084b50ce2a168afe6ab185bea97

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 bb7a7fb386e7ca4742e8f9ca084ddf1a
SHA1 78509df4aa013de1dfa2cd6a253d7a0821aa036a
SHA256 0e215d507d552c7cd3447f01cdaa53040d86a2a9fd56f9c90e030165b0229626
SHA512 99b6a6b0969e2b4b9d3b43728ffe5d97aa5439fa99c5691fbcec4ec870cbaa13a7327b270010ae9bcfda85daf75a32b1b5d0b22ac921296199a3855e26cf9f51

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vcredist_x64.exe.doubleoffset

MD5 6bb9b4a54704987bea567c94ced1807a
SHA1 678962380fbd7e717be52322e9b44c891cad5887
SHA256 a6d7c79a879224b8242c0b1ea44374fc783e45bd3613aa46d04a5e87c7e1e1b3
SHA512 193be3a237f58efdd8b93cdfb8908c9006dd01d3484872f4842ace5208a395fa303b9c82e6bef6f165c5fbe637a76d03feaf2e3ff0264c2dbca93e8f040593c0

C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-state.rsm.doubleoffset

MD5 87949d2fd24c1ac3ec749af6dc04d289
SHA1 ab8199f21d5174b5d43c47215e0d8782b96b30f6
SHA256 c06db7ea818dccd7c8cbf9fd2bafb3947e183f87352b60b264ccc356087ae389
SHA512 8cebb31df60134182c0b1acdbba5a9903f46842a4c10d6811d8a2c1edc47b618c69ae1f3f37a6a37c2f63c261df5a0973b87b4a9029b0eeab35de22116d5c18d

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeMinimum_x86.msi.doubleoffset

MD5 4c0ec20b499254e15bf783853ac7cc1c
SHA1 1e53d1ce0ebe055f52188f5d37290f14d8ce0cbc
SHA256 6e931b7003f66b2519b3a977d6125bf0a9732402c4fc26be68c4a5e3a4ee6126
SHA512 aa50640975dbeb58aa63f8555cc1c54786825bb2bd53bf97877e7edc37904f5d113c34319de453cef37d634345b76b4324f3177f9d175b0a4c3d9f9e7abb6155

C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 7cbc5c876e775e33bf81c8bb94cddcd6
SHA1 51eafeae9c4f3d25200d3407275e054eaa231d60
SHA256 6ebb0fb861082bc0edd9c05ab02eea40a01415f7f80c63f67d5a33d40ffb417c
SHA512 5c2662e1dc410a1ea175e0cbc22e4dfd1bab87d480704b504cf398ff9d9983f62f9922bd89d4175c9742cfc83c342bd0b0c3cf975ecb41a304b8ae71a0a5a846

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeMinimum_x64.msi.doubleoffset

MD5 bf340bd50f9c7872cc88d40c5c6872bb
SHA1 d615210743160b0a2e55ab71561a4698d34f67f1
SHA256 442f47a91dbd132ee5626cbfe58d9d2a7759a86e29ac9fc5ed4f7880067fbb69
SHA512 2c0be80e6c7c3c637b5af78e5c1244a7a42cb010b79f8250995bc510929181c2ffb642127dd5cefa2796a88c4f04c48add0155b537691bad0149a1655c23ee1a

C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 0520523211b63bb7f42cfdb0a2487e71
SHA1 16465f7b997c3c88c9fec9bcbf6747d6553a8440
SHA256 75ce6910f7d3ea640c2acf594ab2069d61f32f05d1ae436f9c642ccd5eff9af0
SHA512 b4c63b1aae10cdb37d77205389d7dde24d48d1fcda785289c42502efed122444e97f7773a88a70a20d27d504c7903e922d256fed1d5cd2d96d56933c3739a722

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeMinimum_x64.msi.doubleoffset

MD5 96a71a76c300c84d82fa2512d919172f
SHA1 00a55d575121f3c90f60538c727ac43e59f9c921
SHA256 4125035229a3956229d56d2543b3ebd074b53fbebdbfb1f9e474aeee675e4bc9
SHA512 77af9f70290f403eada883852c06a1b7c11a8c58f077253dda74d487683c0eb09c12fcdc14476a76dfb74f2b7a5851d7d2c430f24585870897fb66c50c2b581d

C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 a44e1732e15ad60edabf8996c1ebced2
SHA1 b4c319308143e245c28300a1bab833fa54067866
SHA256 15225d6f9520ef427031d5898a9615cf562bb58a14826b4006317f6e65c5d0ea
SHA512 03423da95f94a50b4deac2df50383a77c1911790965fa36f48c1b4541acaa9b230bf9cee9025ec67da5d3fe25aef2dd571c24d50c8cdafa80c56179a453c7a38

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vcredist_x64.exe.doubleoffset

MD5 e09e1d6c10207bdcf8f2507b40a43f54
SHA1 c3669b5ac5648d3c39c5767e47e9b4507b98fcff
SHA256 7be9722daae6536a37f3d00f0caef838eb9b03a6be8e25719b1ba4404394f7a7
SHA512 3b540cf842c15de5a25b7f72efc2f51c8177fda94befb762bb23262e3e5c391d5b7689eb44368dac4385d1edc94393b863c8e326685bd24c9d3801932c5729c4

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-state.rsm.doubleoffset

MD5 9c282c36cd4e2f5919ec4b112d731399
SHA1 f8b0c7fac9152ff84c59fa322e46f688aaa9ee38
SHA256 413abfb85e9eac9a805fc3d166e095bb70b86d61cf08d4ca1909bef4fc28e55e
SHA512 fe50873e63cfd283bea2ebb5ef2e2605406323e340837fed66dcbfe9839551002d93d49da183dc715be063ff15788aa605420157dcdfb71d82aff23a467df664

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeAdditional_x86.msi.doubleoffset

MD5 0d8324588a879858b32841db2fda3b11
SHA1 2d35b8138f200e708a7ed5498bfe0144f73f25fd
SHA256 97394be57c7979c0e41d942fe69ae9c34a904ebb5fdbdcfb4cb241cc7456c2bf
SHA512 dcb26961d61047847bf8b5a5befdae115a921db2e2772874d08e4a08bae42eecf7947e22a5bec501871dfe5091b9650d29745398975631336687bc6040c6bf02

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 1383fa70d083852bf89d6e21c93d47e7
SHA1 ae55f8c68d23e8efc73b672c911aab52f3d8542a
SHA256 81c73d7aad6625be393c2b582e9adcff3aa81026256eb10e3ce1c9194fae0829
SHA512 17d1ba608253c0bd809dd009c79596894d48d64407fb4574dd47aae4b3e2cc2c40da8829862138f139fd819a32aafdb96c0a2ca7cf081f15da5d89766085becb

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeMinimum_x86.msi.doubleoffset

MD5 c22fcdc195d69cd0896f97ecd7b934a1
SHA1 fc3a445ac1b278e6ebd6a86eb35e88c2f6268c27
SHA256 329100690632ee8e18fdf0139433b2b85e90ec771fe1bd9f542163963df10a5a
SHA512 d532170f4066a819ee292adaac328c78eb29abb55b5f5adb041717ddec4be3720a52ffc96bddcd658e42ac45cc1036a996e75949926e485135073482729c08e6

C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 5fde635c0eadb65d1477da384562c69f
SHA1 c1e16994c396f01defe8c04bbecd7fdc7701d2ba
SHA256 83a9995594cfbd7e7690614cba1f2f304c65ebab387072db3fcc5bb13d1537eb
SHA512 d1c242ab2987e0fab34d8178fbdb9ec973553d901eaf320043f6ed9c86d5aaf77876d0699193a1e717f280d53b681ccc138b63f707955d76f4f69b7aee94954e

C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 3ea09920f5d5ad3e418fd97f894f64f4
SHA1 c1a0cfc7e81212dbbb488c958e31f7b855af1f60
SHA256 abf4f6634326c49a78ef8ebb01b5ff012060469af2069e2743937141655b8c82
SHA512 cc5e3c62b162b3440eed27c9a8d48efcdfc762b821a5367f19d8527147dd87305065d3552a3397d4e9a995b3d3d82c7724124341b4c5551136f608c79c6698af

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeAdditional_x86.msi.doubleoffset

MD5 c7c64263fa68ca7d4bff98327d58427e
SHA1 43255faefde78f6022311c731ffc11f59570414f
SHA256 0e048861924d55cf7201a0779f16a60d5514a36652198753db656d43c4fa76e5
SHA512 9a3125b2ec9ab9c4d237f9810fe2bad2138090ebc14560e26c1c6e79704513215c14c6401c726d4b824bb8e6d8bc8e116b81bf437f5117a37af712d10a232c43

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 ef98e755206a43ac1e48c86793693208
SHA1 38e2dfcbd0f5198b0256ba74aae3e38afaea2512
SHA256 ee0138d596fc3799087cc64ae1bca78b7bca52c262741f6cb5411c27fe4d4f0f
SHA512 2ca02126c8f290d9acc61bdeece43c4080e3b21e6e10044766dd29b7661c4ed0605df270fc1728fad3a05cad7450ed13a692335f5db55aad177a97a0e9cf1ce2

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeAdditional_x64.msi.doubleoffset

MD5 9a7611b5fa414df6eeb1a02858f72b6b
SHA1 d35400d80e12ba9bb05d363949ff026163af5713
SHA256 b105d17dcabfbf18d11775ada2439b618768bc2d17f73cdc5bb8e13adfe660ed
SHA512 80b3023dba7f2a64c7d314d687708d5bd253ccf3644242a79922cd80490669def75f0a227a1b5607d0037436ad3ecffbf7fc01f3e50e4e53b4d9ff2703cd3e80

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 15d99f47e0a2ff08c91860adae35d0f2
SHA1 319ceb227322eb0e9a2c1665a1b3c49f5a8e146f
SHA256 1bc33a2b0480eaa7813a78161d48ba379ea12b5dfa6985638895d1476992f30c
SHA512 705e8ca3587fd3cc884f95ce3723236d37dc1f827fce5ef29be35138b0443f248f7cdb1665d299ce9401a41d6761e28518c00dd45c52fd44b8db87902f013a6e

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 dc8eee705b63df2f8c4494bf04fbd180
SHA1 856a65a0bbca281fd93a69dfc7789789fcfa4e09
SHA256 1e8060008ef0b0db56fc0cc8c0990fbc216daf2920d3714af01e938d61e2e1a7
SHA512 e4b6af7c135f9e119b6cb19f18e8077ad7cefcd9bea2f6570ee5107603b9b8a655c35240254fcee8819fc826dbc36ee4e179cd5603fd26b05a79eee7c8532e50

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vcredist_x86.exe.doubleoffset

MD5 ea585c62728aef2b578a6aae31bba4eb
SHA1 e704b8fec382c60552ba3039b21bceb3559cd8d6
SHA256 690af36b8582d55e7da996c98de6b82f67b179850e0a53a2c605ba5e6a1ab53c
SHA512 02ee5b7ea11baa6589a7af15d9bbd83c8231b69a27efe81ed42aeb8b75506cf427ecf4d7ce5a0cbaa0abbccc3ca7be860f6e1e033641992e5841d9edef59c22a

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-state.rsm.doubleoffset

MD5 139c90d22b55a54e9b36260c204e924b
SHA1 980b7a519471a484837a0627481a9e1aee9650de
SHA256 20e4304b849e007884c262438c0b7ab6ef9d94421e6f729079cc1ab132833209
SHA512 31d1c9c6b97914fab28ee32cdecba15e0eca90a1bab2308123884817920d57d1bae3e23a7c4f47c993d2fc8526b32b394677ec6ce496eb2408f03fc62b441d99

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-VC_redist.x64.exe.doubleoffset

MD5 36ec0d7f5e5cfa0ce89dc20c9586bc57
SHA1 595f1d9ca1c50c94a8f6e8dc0a96befb42fedaa7
SHA256 bfc760e12f0fba744f8c891dfe8f1189b3a5770f986f99db82634b8e057f7cfd
SHA512 804881c6940a3df82029b654371846122237deedd9ace88fa40ecec488fce09b6205f50b84c76766d9922263eebcd846b761dba51d29bbac3bd4165dcc4462e7

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-state.rsm.doubleoffset

MD5 ca34cccc6c1696a980a0c98effd53adc
SHA1 3908157a9aba51fa1fa02d8fe036cdb6c0e4fb6f
SHA256 72d9134545d54c44941646ea5b8af15cbac930190d8d8b6a61266a3f26006e25
SHA512 574a21b0ba571f85301695fba302254149179262aef24031f3e6c4a65a8fa6d1c48b23e833d73f286bbeabd55e651d2e88e339f626571ba91b6357123be10039

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeAdditional_x64.msi.doubleoffset

MD5 c5ebfe46c2d019370b13ea28aa5860bf
SHA1 be7c00e88c3f3b60c5a9aa36db10d4a002c70ac0
SHA256 e31d771ab6486f6110dfc737c242daae796ea7a2a4b690a3a14ad482345a79f3
SHA512 ce212c0c2011dbbb1b6e676df3ea6e56c9b1df192a2f6ef2b89356fac426e1fbd3cde24fe17550d0772830857992bd3017dd2ea43c0af615556e2f8383b4df5c

C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 aa9b87e88651b17721640ead1a0fa97d
SHA1 097ad770c979db390a32ba2432afc12658eabe54
SHA256 debcc78ed03a4bd34701ad56aabd7521569c13bce3a2fab766bd0d38c31f50d7
SHA512 34c9344edd9af51dd5258afb1f51cc6139ba2a592fa8a54daebe79690eea7c51af5da8c59d7372ac6a2b6f16f06232056b245ec77f4a579cffd9f69b524c1c8e

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-VC_redist.x86.exe.doubleoffset

MD5 ae9d07c4c476611dbbe1ad656b9a906c
SHA1 b02511c66957f2f63d91e4ace304df534d61b338
SHA256 7d388adcefe30d69ffc426b810067c2bc784692588e7b39779d3f921a575c0aa
SHA512 fb149e48a71351ccf21d034b247e42d51f8de2b8b4603227fba4df220913b535293b7de66e154a163dc9e64ca2364ed8d9829ea03d76ebc905e5956b7a0836d3

C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-state.rsm.doubleoffset

MD5 967c938d963b3c6c6041252a05f1f84a
SHA1 0c97f01da2c22d2bfa22f782afa08807b40df274
SHA256 7e2b3da04788d8cdd77704eb0adaf36d776094889d8d661bc6f31aa92bc1cfb3
SHA512 3b3e73177a1332a0cfe1de84004d50657190746bfb00a7418e9b95fdbc7ce82966ed7dcad9700a66b717e7c86b7af7cbe909abf32abbe1064af5cc00fb5bd7b4

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vc_runtimeAdditional_x64.msi.doubleoffset

MD5 0d81a7b1d3d34358243c7ef411747f18
SHA1 c1098c28e168931129d559f5d428d3a3ffb0649b
SHA256 d1a40197757e8234ddb105a2d0246524a51863958226ed13c8c9e0f1450eabb2
SHA512 952b1035f9cb6b741597a6e769231dacd5528b97492eb9443ed3dce2586abd9b614c0879d43910a8d5a7f542c524fa296f466780e92a7b774321d702c96d2a10

C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-cab1.cab.doubleoffset

MD5 cc669cc70fe81ff31c4150456c42022c
SHA1 fe71e7d4a0d00ddc69be50da3f7740bf98193654
SHA256 e47464bc19756f87a8a5f4e432bb509a90900e212937dc0686bd4aaea14d2992
SHA512 b5f93b291dc849b5f7163ccd0fd7c8c17fb71f8292b05f23d54cc17455631e97188e85b82a8ffa9b87026e586620d1538d8c57f15f84d5bce47dded6e6096c2c

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-vcredist_x86.exe.doubleoffset

MD5 62bc88a505f16b4b3b5a6fefb161986b
SHA1 2920c233205735240e397baf7d87a0a6295c8905
SHA256 6af1ba421d27b908e58d72955361e8954dbd03859319ede5e59cbd3b0849e468
SHA512 85558a2faa355f7fddfa706b6caca8109ed9fc857e03e5be579b372894c91e957f8da5ba351956b8596f9c546b037dd4d70f9ba6c54b03c1edef4f97496b8c30

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-state.rsm.doubleoffset

MD5 0b3af3b7b39358899dbf089cddebc3cd
SHA1 2d676df8d30252524035e71df8462bc8cccb8028
SHA256 7bde86b01801ba8ee4ef5b408864a9ee394aaed78367f03f56db706c73068ece
SHA512 2a4a7ce88bd6459e665fdfa2ab9f212f03b801c3581b4c2b7653b6022e737f37723389e185e1672ca6d37b36944efb172f0c28f47137b0fb6b0da4eab74f73cd

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-update-config.json.doubleoffset

MD5 61c50bb690dd2d0ec81b220b30665e8c
SHA1 3bbdb57481f8dff5fb1ffae27f34dd0adff5050e
SHA256 df8e6cd1a337d4e41912ed6d2b2268c39361db9b15b48117ca819e8f99b0b575
SHA512 970050c61acdbec912732ce25f0c573d16ed63d22709ac89ef42124a68a48760543a42f0eb2399d9c003e8e6d1caac13717d275bfb0a1eea2f5a639a9a6af5c7

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.WINWORD.DEV.14.1033.hxn.doubleoffset

MD5 d3c8ad0399a3d24248f4d0c87d84433c
SHA1 72992fc2e8e660fa9b5f21137c43419d98f0fae6
SHA256 839ca8a2a68b2b162c016181a833a104904c1ec38b7a9c66912470816117ab3f
SHA512 387a46b799945541a45be1bb3b844128c2b202832e755138cf82d1d4bfcbb49562addb32655b2fc7eb1f3c4ab1355d3fb1cdfda33a1a35f8a023b30cf08c9513

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.WINWORD.14.1033.hxn.doubleoffset

MD5 97b357b4c6ac426d85bbacef7ce0c765
SHA1 1f89a990cbf4d63e2d49bcb0d7d70a568071fe79
SHA256 2453b357f0a4a1c77ae7732ccd1d5d7587d5d72bdfa2155607f3173f04fb424d
SHA512 c29002b552c68625857beccf992fe019ea2bb76ff638157031ce5fca6c4bbe244ee9c7a87c8f61ed800970643f2529446b5416e6f9f80ec1ee5cd87fc4ecaed6

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.SETLANG.14.1033.hxn.doubleoffset

MD5 56fb46dd373a6d2733259f06c415fb03
SHA1 4cb98025358603d3a63b35c6f887f05156349e83
SHA256 6dfc7d25ad3e4f2fb39db0c1dd53f197d5ead9a567d597175ea21d2a0527e5cb
SHA512 825e5b79689402c3748269489ec39a0cd0c99b09691d5385fefa7c315a0121c4bf87616508ca8ffd64019d0ab154bd818b6d382eca54cce4909dff312177c1ba

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.POWERPNT.DEV.14.1033.hxn.doubleoffset

MD5 83eea1bcdb4ec9f7af1f7a012bc9db6e
SHA1 92cde504c507c5eb97e18fed752bd93cce33c093
SHA256 b37c09dee39f6e4b192c4d070ec0e05c385ed315b2646e7737f0e761f7095ab0
SHA512 6111a359536b69d3e11c894e47fae45e09d1d97f16bf180b798ae21b3f7166da1cbef35a160670c56856cffd7442c13380a237bb6479d0696904601131e37de4

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.POWERPNT.14.1033.hxn.doubleoffset

MD5 73da31efbd604cc9b95f3b706f15d85c
SHA1 fe4d3edc819c330ebc40e14d81848adda3fffe9f
SHA256 d3f0553d029af1a67f9188b7daa8e040275a2528052332a094cf704dcc947af7
SHA512 8d3b62cbebae2d13001a5fa95a6eac530f402876e12d133ed7adb7d9b7514673ad23f59c0b202de8652256ce3d83e7116b67a14dfe753ee05c5a175cde890615

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.OUTLOOK.DEV.14.1033.hxn.doubleoffset

MD5 99130ae9d1f5fd184dfa813d7e7441e3
SHA1 3e983ea066e0fc34027025b6c249d066b8fd1ba0
SHA256 98b88a9bf15e6bcef5098dd1daed63ed91911f8c204f243901100005b8b9705b
SHA512 6705bbf910b674df334e116ccd16b6ab06b7c9989a0a18df23709903a9a78fde49206aa80089c63c09ee9e5e42eb0905255e516cd41757d942cf91492507b42d

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.OUTLOOK.14.1033.hxn.doubleoffset

MD5 55e6401074eee95fd4ca31b7260091a5
SHA1 6a6f2495727d044256b46e6ee1b0944279e9e8b4
SHA256 ebeaf6f2d71ee1ea071a2bb2e406f93db87f7edc6651be2711270c8e81d9d34f
SHA512 2d359447bdc9ba2a5179faa489e45f04c42b2b79510628f1ac692418329692f34247bdcdd3dcb2c589c96414128a8b904d1df4e430f758fce09fa6f3ee02329d

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.ONENOTE.14.1033.hxn.doubleoffset

MD5 d9b10fee7753790b10ead3d9aa6f620d
SHA1 a7d9e9427e56b8915caa1b8f270b5befa0d250dc
SHA256 843b933da04b8c56099b1a94d5cff19b45b11c2b10bef58bb2feabd543fd36b2
SHA512 852ffb32c0ba6bf13ac9b318d8be9e732c95ceb3da70b0b5c509aca2fd4f64370b8a955eaef29db9873c1d0a0af261de1cd556da457a208f42cb0da9a186f68b

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.OIS.14.1033.hxn.doubleoffset

MD5 9236f081cb528092c71bc63cde15fbfb
SHA1 d38218eaa7126e85afca989fd5295b6007ef20fb
SHA256 c43283a723e2be6fb0b08ea68f48ae12808b4a4f410c729f06789c9cb64665da
SHA512 6542b4607de3d8e739e2a8833c0521edfa585cae3d21e9809abdbb730b7171b3f72ce5f6f27401008dba300931d121872253686d3088f4287e71e414efab78cd

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.MSTORE.14.1033.hxn.doubleoffset

MD5 aefcc4a1632943b8a3929dadc882eb6d
SHA1 df2244a35e7e8ebabbea234dbda097bb4b45e19a
SHA256 f04e9e87d5408a8c677905dc75e8dd2d14ebbf2c20d973e4705be1de28fd9793
SHA512 476ab61badc413350bc772c769445f2f33af95581119cddd9efeef3a977c50a78e3d8e9247d7ba15a73c75d464b8df1ccf5f337ade8fa790eb147b8db2e4f748

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.MSPUB.DEV.14.1033.hxn.doubleoffset

MD5 e160506ee340297c700aef729cef7eb6
SHA1 0e99070bfeeaaa281d970e1c9c8a19b94d63d176
SHA256 5010c279ca7ac90043904ff0726e4e3256f7af8b42f7476c7c9a7dfccdf7c7c2
SHA512 4c34041243fec9d1848d83009abfd5f73a750d73b6f686181e27d756473ff2c449a48d24e325de3f61e356133aea8386d71a834ba91aa5b069018caca8e70baa

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.MSPUB.14.1033.hxn.doubleoffset

MD5 dd6b8c273a66ac71717cb635fd65a0f3
SHA1 ee8ba89a60abd694255bf4b3835d29f3824e3636
SHA256 fd375f65de0580a5d5c26aec45c726ea1c03977283a7985b01838111712b83c5
SHA512 8d08fb7db1071075a6f66fcff7560295967c899331c0be50850ac0ccce1088cb675022aea1b84729870f556c51eef66fe5322424cc31f4f1f1976e7d779d0d25

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.MSOUC.14.1033.hxn.doubleoffset

MD5 1efcdd8e7265af7b7eca489a82f8002b
SHA1 1b61c1c673c2720f6f767b4406d76b41ffe85e95
SHA256 89182586bdfd24d202b07b19cdaa43263b9e89b016b19f8610e1cf3262f286bc
SHA512 03c803aeded9b47e670f26ba0fcf2c01914c9bfcc9f2f17cbf17913d12082cc0216df1f480e636d50962c391ee11fa22fe5c822ef28b48639fd23870f1afcbdf

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.MSACCESS.DEV.14.1033.hxn.doubleoffset

MD5 83b2b906eb4104bfc81b15189503f8c7
SHA1 d16c840fa6936e2f88ff03ace4a03cde9cdbf647
SHA256 6215179410de86d7134e1079db58687de249cb17eb0c916f46133d294b3f8c2d
SHA512 b384432c72bdfaffe2fe7d8c1cd13ad730f3b955c1734ac1130f2c6f537c73f108bbaece4426674ed44321d0804c9cedcc7f7431deab5ec85c8705be443769e7

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.MSACCESS.14.1033.hxn.doubleoffset

MD5 a906db4a57f0040b641619efd0733e4e
SHA1 fe012618fe71f686e19bf77d6d68e351e2e662db
SHA256 319679681d3e3c15a7cea37c71419a041a6629ef40f4081fa9562b29435ed51f
SHA512 0cf8275571da8b097c1eb74b12d4bbd5f9aa7591aa7180f87f26b5f13a25101a23d40216b66568399dd0d21873bdcfd110a25f425dcbed401998f441ab7c2601

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.INFOPATHEDITOR.14.1033.hxn.doubleoffset

MD5 ec334b224398c6f6e26a5e3b90209cc7
SHA1 b802584f9b6d5d0d66aa1b37c7850c615bc9e971
SHA256 07f875b1c3858e9d788f30c2d9adf0ed2a67f10f725bbccac6db8c0eabe82793
SHA512 b1f2eaae305a5433e4268566303b532a0c1c06294a39eb70930cf64d7ac31ad14afd68ef8055c0725a18fe4a52e9b5895d61df2edff71fe69cc413131850e4a7

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.INFOPATH.14.1033.hxn.doubleoffset

MD5 90856f843ddad289963330f555247ece
SHA1 817ea633ed9e3fe81dba10210e92629cacb55a4e
SHA256 610526d37c7f2c073412c3107e36ec8a7457955a507462168e930ce50372f3b1
SHA512 268b2095b5513349be445a6f41fe46ce3ae297abb9a8a213b5ff863a0806fb8e5326bc488d7dc7e690f7d0cf5976a9a2256f1c8477d26678b081184a11d6177a

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.GROOVE.14.1033.hxn.doubleoffset

MD5 39c2720f5a95a9a54c3e23f087abd855
SHA1 87fd690f816855f7b82693c16b652adc8cc3215f
SHA256 887704144e1e4bc969a78dd4f67fda440b4136d782d807744b26955b5c4ff708
SHA512 088165581967c797e1c1d51dbdba572ee122e1f559e03ae71fff3b3096fa2849d7ee88cfa4e28e3e4829acc7dd2e498633a834ce7f5758341100d76eaa50fe13

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.GRAPH.14.1033.hxn.doubleoffset

MD5 3490f68c1464c444deb6669059cd327a
SHA1 77df047b24f379a525cc9203199562e45fb09131
SHA256 007b5d20f2fd9ff96c446147601cce9bc3bcf179f033048733ca176e53b26a58
SHA512 9ea1d44996303808fc25d48a72edfbd0ad84765978d4ce91f385950d339bae85ac1b6ee77a77825b12923863620fd31055aec6d88437070b64a2e1b64fae5cb5

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.EXCEL.DEV.14.1033.hxn.doubleoffset

MD5 4618d0a2af3f05cbe4b584025ba0def3
SHA1 7e95258a6bb173b7e915fa1fab2d77858cff4407
SHA256 3f2aa8ef9303ee996da024d12ebdcf0cec5664206caabe76c5e35e70d1a8b34a
SHA512 6988783d4767b5712026306fd6b1682680c420703b8eaecb96e01cad7b0ab40034e81a2aa4484e750b8f8023fe5c007e2e8657e6e2445f5767913111d90244dd

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MS.EXCEL.14.1033.hxn.doubleoffset

MD5 f860f1bc807662d69cc4387457fca859
SHA1 57f20f43ef1ba24338d87fcce97a29eecaeb88ae
SHA256 27c4a0c95cd1cb6917d755d75b5bd77c470513183c1c6c1f8bb5e3c0a7c9bc4a
SHA512 3de25913dada28c6e7d624f1b903247eef833def6cd6749466ebc849cefc1b650ccca2af2f75460334bb7eaba96725705b168561609151fcd053dd9d1b905f36

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Hx_1033_MValidator.Lck.doubleoffset

MD5 5e83de8405d74901eafa0e7f12afad27
SHA1 a543df37460950e1bb73ce93ea88502def49ff38
SHA256 ed8dd467038ada7db324b8680e32f2c734eb33e0a12d4735f916e43f691f5435
SHA512 fb7541626dc0bd561528c869c0c490015ebb327c02577dda9530d5df37983e112f8805901bb518c9e4b21e41556654ef9fa4d99688e622ba1727f109cad6b6c3

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Hx_1033_MValidator.HxD.doubleoffset

MD5 bde7d8fc004d122d91c86e793e0c315a
SHA1 f0632aedcc342d0e1d810e484103bebd0a87375c
SHA256 0b8eaa59d78b58bf37ff48524fcc27e5d7a45308c5d43bc95d643658812a69b3
SHA512 a081f185559c8d822e3286642da64dac702bb2eef606ac390bb5bb9ed161e1a4f2ae7af92629c8517c0c4c6c322a0bca301be0288e3c36835e17d52aecf4e799

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Hx_1033_MTOC_Hx.HxH.doubleoffset

MD5 e0ef046e8b95ccf69bd5aa728b2c5352
SHA1 01802c85e1b404db72ed7b418e7e0a49434a1f33
SHA256 c2eeaaac48a4b63f959551880e84d59150c01c69339f3f005f6e38fcf961efe7
SHA512 0b8d2edeb1e9e731d4db8d6e9264c0c99e25fd86fbc4a30d6ac2224c503100fc93b8f2cf03c46b065d108c7e5aa69505a2914665c86b9acd17acb92e9d7d00ff

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Hx_1033_MKWD_NamedURL.HxW.doubleoffset

MD5 7506a050c574f1b7deafa9fd7a5b7d1d
SHA1 e932c649ce7d10f3142896942256d13b8c770b08
SHA256 af6a98fe67749145fb9e8828094c31bfcdc9ba89d77992c93681a823b35a0e7e
SHA512 dbae807514442783cc256fe85a20d1b78ae19ba83b4ad1095398033371327e1699a28a9acd147a09ab2fc62f4bf33a5a51c2db9992ad95cfa3ac290c35481ce0

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Hx_1033_MKWD_K.HxW.doubleoffset

MD5 42ef41b7d8ae8d05581c6f3fa31a4ed1
SHA1 b0637c1d6470c5109ebd33fe24ac3de537de6b9d
SHA256 6277738ec05cf0fc46480806b8aa81f9b99bf26975b272d720e2ff5ce9c5acc7
SHA512 1b4a47010f15f9060fecdfc7223b1c51a1304fe5348ec6b2ca889a187cb612ccd7a454da6e5ae975adb1401c254a8ffe003513e4c4be5dd94a1748bd8de1abbd

C:\ProgramData\Microsoft Help\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-Hx.hxn.doubleoffset

MD5 6df3b0e66efb81dc84dd168de58e47e8
SHA1 98c4d3e49f26c76d71f5eccf67a50d8ec082f599
SHA256 ce12d03efb87fefb53f59be7ee551848f3edb2badb85b8520ec9d4820defd459
SHA512 ff397dfc4099b62ca274bd55f6cbfb15c7652ab3044718edbe54a46de6e53bbc14929a7fd37ff52cee2c3e2594777458aac95cac7c10285f0e9699a611878c24

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-XLINTL32.DLL.trx_dll.doubleoffset

MD5 ebfa4ff5ffcad91a5984014ca4302878
SHA1 704b5c70129f020b6fcdcc1da4241856eadba746
SHA256 4914ba16eb4f4182bfe6d523a0119576535a88784322991ab44ef6b94e772760
SHA512 a7407faa7b042644d0b9fdc9507790df2a046e4958551e9a4a07a11eb17c04c9419f465f3ba6150b613465e1d9a28f0d4ab14bbff86ccba224e031ee3a472c80

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-WWINTL.REST.trx_dll.doubleoffset

MD5 ce6dd080c5ae1c3eb3d22e9e78b4983a
SHA1 589eefa02c9c444c28c092ac1b854c97a18a404e
SHA256 cecf3c61829d9e7d69a4758e74af73a2d2b3ab36d032ef27117983accad8af8f
SHA512 d946894d03230c590d48d3f99adda7fb09a459e8a389f2bcc45f123b90133f8c452486e009b5bff7c442c1221ba5f6ffcae7dc889dcae2df6410b4d28034359e

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-WWINTL.DLL.trx_dll.doubleoffset

MD5 bfab3cb81c990ae35ae0efba2ab32107
SHA1 20e14107464be39520838860a6bb7023781720d2
SHA256 62ba3f5e58c5245ecf3e9eeb6b02f59af924d4e4c91ae287ca0b3451bc72f918
SHA512 4cb762f2734ce21a307cfb4261c397031715abab2a67092d2461418b6ff318316d9e1b546b8c7f52e35dbbe89f753a3c4c7f78bee487f9f3a13d5c65d3f6e5f7

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-VISINTL.DLL.trx_dll.doubleoffset

MD5 bf0d4134493d3cbdf87337b9de39798f
SHA1 40db4ad952578d733e08d216b399eaab14d08567
SHA256 f205ee50bcea65763075eb54a6cc85630a939c6c4c06f3a2fe4b368d30e11642
SHA512 f52d7f05f98db45c7d9c8abc0c860584496f26a738a457c0cdff389b0e26edade0dbe5937669127c6bb1f33b0c50205273400a97081db08dfd004c3e3d8472fe

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-VISBRRES.DLL.trx_dll.doubleoffset

MD5 6f38241e6e1971de4f0640fb852ea7e4
SHA1 6c3076d8c1a196d68639c6fa0f10e85a0d4d3fc5
SHA256 f3289518f55897d2b9413d01fb6014146eb799368360a4c46f96e237913f0eef
SHA512 860e0159cc122fdf76a6363424fe7dc1301159e95323a0eff256ee6c9e0b418102bc39158c2ea9c868f48ca539cd92c6a86b5fa6f650fff65de9fb3164555268

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-STINTL.DLL.trx_dll.doubleoffset

MD5 c77a4e206575381ba06f459ddfec0b70
SHA1 c943ff0e10be00aeb02f42bcc32695f9e0d0f31e
SHA256 60872b21960b1d5099eb62eb62a3362bf2ec25754e1667d27d8cee2816b6269a
SHA512 b6854267be3e6aef012222c3141e01b614cca3ae08cf7919f81db8765a677cf091131b3c1ec2fd5a6daaea688b742a74c1bb682eb21727e5fe116da4011ccd1a

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-SGRES.DLL.trx_dll.doubleoffset

MD5 a7edae396ca5c18eebff7adb2825562f
SHA1 228e504f293fc506010be1d96e4fbbea1ad3ef88
SHA256 1d352968ccc94d446019ee6cacec42cd779b60ff9c35b66307078a39b9a3bf80
SHA512 924ee88dfb3b57227711fe7b03ee060f81a8a48b063f4c0108df5ef83cd3f84ac594d8a194a1616853ab217901af0dd284f92a21c63e7b81eedfaaba03f07441

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PUBWZINT.REST.trx_dll.doubleoffset

MD5 c2ef51ff4961e7538adaa323dfe18d40
SHA1 422430c6baf4caea3097638d66b6a0800072a002
SHA256 96cda6736bf555c00db26f36ae10d274db5b30cda4a837f2b1643124197c471b
SHA512 af826823b85c25cd31670ff698f571d3fc33b6a04462ac341b653b03f7fc87975e6e1c70c1ea560d10e9c747298cdbdd6bd4ef65ac5d5406f80a48219c438e2e

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PUB6INTL.REST.trx_dll.doubleoffset

MD5 dba2f5159481dfc225867f987fd3bbeb
SHA1 2ecebea97ebcdbd7646cab4a46c594cc046f52b3
SHA256 25e906fb1a79ec0784503127e6577a2b1e7987b35ad98e12f76761cf8dc33787
SHA512 76d2bee1fa75c1c4a04dd20ca1ac325d6298f3c53f9e6051bfb200739ef9fe7e111c61c1eabe7fa88bab29d449a85e65ed6a7d99a39d7fb11e409acfb5a1e357

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PUB6INTL.DLL.trx_dll.doubleoffset

MD5 4cd37e933fae6eaae7ce863496c58288
SHA1 c01bf1fb66e1fe051e4abdb26a5082cd6e7850fe
SHA256 311e94cb49041ce1984bb66c4f4c89974361f2e6bbfeabf11eb3f122c4a94b68
SHA512 daf717e56e1c4397c5aa72a8fd831a34c1ff2091424ce75059898b4466224fc345f0add3545c7acaaf747255d59caba979f5138bdd1165f5ab1b4e392ca2d0b0

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PPINTL.REST.trx_dll.doubleoffset

MD5 b01741b8740516d9c24a54e3ec55a188
SHA1 a42686573a115695055754a8ebef87e000766b69
SHA256 e165e3a99520561342918bf2cd0efa6ad7cf4c6d1a11df61fecf9c9f957e1107
SHA512 44d2fa07e29048c5356d36879381d675fc30f9caf631e80d6758fc78a18e024f1cfd6359da1b77f63b17727c762cb5c34ac4a27cf608f01af11fe36015fb5f92

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PPINTL.DLL.trx_dll.doubleoffset

MD5 f9c4cea8270449ec5efff629f578d697
SHA1 bf22d98c64c29e21bb948089373e759e997493cb
SHA256 867391b518294ec7bd972d875ab3b41fb7b134234a496381d874a22f63da7c85
SHA512 ff4de6b475abe871827d2662a1e8cc3b165b9fbda6ec9a83384fe3fc8e5327ececd8225db088a7a717b95b2730670148c245bd9ef4065d5aa25bfaea61e40c31

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OUTLWVW.DLL.trx_dll.doubleoffset

MD5 5f2b2dd0e864139f6cbac421116e4d2a
SHA1 b4ae11020200c6314bd3eca71e99d5860f86f02b
SHA256 824683517447550c66939f4604a237900869d6bc47dd4a7367fb38ba512617df
SHA512 8f40019177f4047a48d2fdf22abccfff1a9289fc6f6ad9b399649e991bb0ba0bd30b9fffff19dcf12007de9e32e63a84605ef672a18b98f601d804cb90fa48ad

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OUTLLIBR.REST.trx_dll.doubleoffset

MD5 150d1b8e90dc6f679561b0780fc73704
SHA1 b839d3737de335c111227c57fc3047eb8fd4ed0c
SHA256 9574bb67cf8e2873d84c49eb8ed8c090f9489d15ee1c8e48ca714ff6a89d1630
SHA512 b1b09ee09b16aeed5a39448292ac34920de615657906e4a405bd96daccc2457e8bf6c8192cdda27d8a3d181cecff72baf35f5778932af27cf824d45d1523c9b9

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OUTLLIBR.DLL.trx_dll.doubleoffset

MD5 f10f5991305923f0fcc4181fb0e8aa71
SHA1 153b935f5146949cdd09d46e0d801d66a95a678b
SHA256 ea7f60686a5b32f3a3c704a9516d25506a8310f694f81d14c6d26025f558ed4c
SHA512 1aca8002cee31cdd2579deb13336047f369b76bf8b91be5067aee6b40d679b07376e482045319f80140becc5769d475d0ea310afdf60c79966326a681b0c73e4

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ONINTL.REST.trx_dll.doubleoffset

MD5 aef609e2d507ce00cbc662938f473cf1
SHA1 2c4b5de9e1c0080621060b195474b3162e2761e1
SHA256 55ba2954c1b44ee557778dcb67abb2401c8c6de210e96a510e8e98704af39609
SHA512 339667de1ca5a1a9303f9e7264bf82009a2982b78fbb4dd251675cdf81a89cf11c42cb1500f1807d5c3be0a999e04a0a3ac85542eb45cced3228aa6d8cc10b96

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ONINTL.DLL.trx_dll.doubleoffset

MD5 0c2ccbe291db2058627b0a16b309b695
SHA1 d8241893e815f975f9d124ea75a4135d3c1d7340
SHA256 b08bcc49b865bfdf34d904c0205a36e6b255e796d150b56c42d6de5e6a76710d
SHA512 8955ca048b9ca1c8651239519427573835c338b8d072c9e6c5d065ceb063bd8984f1a3be3b788873cc6aaa38f6fc9a477fb100d8e8e35202b11d80fd053fceb9

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-OMSINTL.DLL.trx_dll.doubleoffset

MD5 92134606be75ec536c57fcb2342fecdf
SHA1 011d9685baeda5d8270511e258e18566bb2888c8
SHA256 11eada8787cf9423389f3124cd9bce1ae8a8abb0323b0710d7a799331d689df8
SHA512 f1e871c0363fc3acad812f315d4b1d6f07ae5d2174db538dff754bb204298258cf1f705afc4c2e7d935156d8ce2060f8a32a42972be7b8829cf8407ac7b8c5fd

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MSOINTL.REST.trx_dll.doubleoffset

MD5 fa8822b3ba9ed2de316509735640d555
SHA1 53b574078d7a3cc69f2795f286b8d34748fde921
SHA256 802b85c870fd68eca3f32a427a06e72cc8ee9af352d4696dff1fd273a58c5c43
SHA512 f58343d57f733fa5fdaa95797d1715e641b1521b28bf43b541509ff3d14719a639ec65abca051e783b1385f81b18e74e09c471a927844579d686fd6a6bd3b4ba

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MSOINTL.DLL.trx_dll.doubleoffset

MD5 db6d0aeb85cb7952648cc73f6d8a4d42
SHA1 3a3f9f97c54aa8ef24b3920abf009810a3b99344
SHA256 a2ec03a7e0c515ae072ebc822de013916062a7dbf65c12d16430bbbc857f7b53
SHA512 2d673ee433a39c425db74e35421d205d1f4a3a0b9a16ce8056d1178f33be342a764832841c7cdee40067a9d668a4fa101d56e5598e47eaf9a55304e42fc91452

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MOR6INT.REST.trx_dll.doubleoffset

MD5 98fd453a8ab06357fcda5d8a7a3fd01c
SHA1 049bcbb027d39c118fdc573242f1438a11d7174c
SHA256 8ffea66f19971429476b53a9d9ba16fbc7343a6bc5a4bc7bbc01deb0fd67708c
SHA512 d33faa67f8e77003e9b41ee06b8d0beca377476d26f2659f8330f2ac2c72f3548803fb23365edfbfb632b6b3c1c6a2f1d8e910a1c1523abaac95df681303e43c

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-MAPIR.DLL.trx_dll.doubleoffset

MD5 9cb3483e1f1aa1b3a42ea62eafebbb48
SHA1 023d59ef7d6126cf28528c1d5c244f1ad5772788
SHA256 812f8f6e3b562426142ff13efe53505ed0c78a19c17392170c0cd1c0970caccd
SHA512 c314291f56219d0b5d470d24753cfb1078fdc4255c9b91a39a33012f71e8ec12da7face4ce5462c1fc12ccf85b975fce30e1af76f8225e7fedc288b3b3afd8dc

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-GRINTL32.REST.trx_dll.doubleoffset

MD5 a20e8cc8a9978e1327061ccdb4e23cbd
SHA1 966518e93a1e9d34bf2ae0c18ac87606305d666f
SHA256 f56793cde6f3d9a274fc21544b1e7f4f377f9e07be5870c09d39ab7bdbfaecc9
SHA512 e05e6254472693f7764219d1089689fd437c0b40b72009ee9b89aec8f63b9cfb788cca6083122414a0db3170200fe910bbaebd4340dd80200e6364bb509f1b70

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-GRINTL32.DLL.trx_dll.doubleoffset

MD5 ba6787a74fd6bba5fc5cfcec5d5fe3e7
SHA1 55418bed2452e5b3458ed860a0041be04593ed73
SHA256 8b3a8d9e3f3d696f8de6b3e5654f5be89503200de1afcd84e605052470bf750d
SHA512 ccd1a45727d24d891f7cb2dab75f5324e55478aa6ef9e313d466fd4456dac4d46e2da2f3f6431119310ca5083002b739fff1b55b263885941f657689bfe7c9e8

C:\ProgramData\Microsoft\OFFICE\UICaptions\3082\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-ENVELOPR.DLL.trx_dll.doubleoffset

MD5 d7c62965c75978bf02672a2315f5ab93
SHA1 ce9cbe1c8c679dd352db7c0d5a8a53959a19593b
SHA256 be1aac1849c63c126c82bce1ad0103132c9485e373bd19fcbfc7637a797faa26
SHA512 70323f907897386fd580bf07641b5dd7a7ae07525c39b8be47d99a8b5d948a09e76571a74954645950e0686e2487ee33a94905dc9d8a72da0a2bb45fb7290a69

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-XLINTL32.REST.trx_dll.doubleoffset

MD5 3b882d03e4eed9e6e09fd3e43089d9a3
SHA1 111bd5d5c3109816183bb9d9330d13359983ab52
SHA256 ee5d0a3e4ca487ce7d3847bc9b84f4aaf160a71c9d41d8d849feb7d22e406547
SHA512 9ce36dde713f724e3af1a8e3e35a7be0380b42032a79d576339559d6187d5b209ac44fc046cd49e3cbea984888f35e11e83f66cbbcd0209a190595d55c428d25

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-XLINTL32.DLL.trx_dll.doubleoffset

MD5 9159c3291ab67d0c1f4037555845e34a
SHA1 020435fd0c2e37b178c6ae407a6bd277668ce0d4
SHA256 e4c9512c6553dbfd50da96edcedd39426903f6206600799a50ae8846409ee99b
SHA512 f5f33e891ff3ae36570c2edecd67c621e7a68b29529a0cc33bebafba9fec957cc1d9833e3bfd3968766454a0b4ae63d9494934721320edca2a2d9198384071fa

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-WWINTL.REST.trx_dll.doubleoffset

MD5 33eab94e5ae65fada5aa66778e0f7ab7
SHA1 a473926b90abdf298b0ca043214f9428a656447f
SHA256 29bf4a26a68ed5d2a627db835ac7b6b14fa3f7dfabc0bcc00b2f076aad3e06a2
SHA512 c9f21ff775aa304ac60721bd74e2271049f5c7f12a4731f0603e005fda026d053128e4e4b431c92cd139d7c488d3f00e5d50bea9b5aef4e86b5fd93c5b15c9ed

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-WWINTL.DLL.trx_dll.doubleoffset

MD5 d40dd276a6b7c4b3b90ca61372109428
SHA1 9f9808c5988b2390440469c52e080fd84aca88c0
SHA256 fd8b08c3c0c0e5ecca99b45159a817704f11b607c9cf066de864bba32a61c00f
SHA512 575891d998ce17a478b586e0fee3beb1a448d07e92b531a1d7cb86fed38864ef878ba3c3bae96b82034eb57b463114267312b1c8b8b5a889e6060ef20b5f0520

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-VISINTL.DLL.trx_dll.doubleoffset

MD5 9874b17e4a7fbc2ca84deccea0e72cd7
SHA1 a5bab826b1e09697be949c29dbd38fe5ae60b0be
SHA256 e5d99188a83205162c9924064028833569cac47d471d163c69e010fb00351433
SHA512 581bf57a85ee2b71a0f6a3d9673f31317788af560abcbbad47e02676b0f5ccda61c7f56e44ecf1997f4872c75abe52bd09bcdaad6baa3ec96acae7f820663c7e

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-VISBRRES.DLL.trx_dll.doubleoffset

MD5 b13da5bdad6a8276d1c90059374355e2
SHA1 aaf974763c3ae362c704eedea8cd7785bd86df60
SHA256 0ecbf24fd7a61ddd3cf23d41d93b33dd83f2dc930811ec97331dcb7add66416b
SHA512 a7635215b31db2c0017d91befc50e42c8c6b1874d41a0494506b100d121a9673f8b01061d66ca9d7de2bde5137f40c4a27cd363704cc79c10deeec84574494d4

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-STINTL.DLL.trx_dll.doubleoffset

MD5 0ed4be324ac8e1ee69c50b3ca5098d58
SHA1 4debb9ab8551473210cfb7b037c8761934237c18
SHA256 6ec92cd4e4473320cc648c9f4315de588a88306b46e9ac8ada954dbf992ee599
SHA512 55ac7e79f98088a4e435ea6cdbbc7edb789c712f7938a3c41ee9a56e80a7901cf23c36f8d694a93d8c78dd108fe4f7e7e3052c3a32ff0a2d5f22116f0462ab27

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-SGRES.DLL.trx_dll.doubleoffset

MD5 8daedd9ca288ccfe7e062032290f1dbf
SHA1 1fcae0d34f00630db33e1dc60f60a9936b7317e2
SHA256 89e0d6beabf4edf76dac2bc3d6ebb7c23f105ab5165d4bf3206178253889ef41
SHA512 b7e282bfa8198eda0b790a3d20aee9d83cab3ee89248b26a5b9a0bbfb043f96cc59b855ddc0c97bdb50b591018b2d980e4c264103038bb2f54caaa7fa5680bbb

C:\ProgramData\Microsoft\OFFICE\UICaptions\1036\[email protected] 1.5.1.0.id-1033291474-786373795617175494114665.fname-PUBWZINT.REST.trx_dll.doubleoffset

MD5 8f22d6a564f59a41cf76c343e5bc1638
SHA1 f9060d5182b9928692fe295c3e548bb8d147b503
SHA256 c0a053c3b7a4b0f53cb89dd5eea1a4bfbeb3dfe639f6953aa987a3e56892ead8
SHA512 9f6936ea0abede90ca3c858a2ffd3bac855cbfc94d96816beb719a17de712761df5dd6466367fe0174bf0900365cc9d0ce04010169c434b2d8341298b5b9fcce

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

359s

Max time network

360s

Command Line

"C:\Users\Admin\AppData\Local\Temp\карточка предприятия.scr" /S

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\карточка предприятия.scr N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\карточка предприятия.scr N/A

Processes

C:\Users\Admin\AppData\Local\Temp\карточка предприятия.scr

"C:\Users\Admin\AppData\Local\Temp\карточка предприятия.scr" /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 100

Network

N/A

Files

memory/1036-0-0x0000000000D40000-0x0000000000DF4000-memory.dmp

memory/1036-1-0x0000000000D40000-0x0000000000DF4000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

357s

Max time network

358s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe" C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_job_details.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_CommonParameters.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Assignment_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Ultimate\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7600t.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_wildcards.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Parsing.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO6300T.XML C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1RC3L.XML C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_trap.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd4200t.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Arithmetic_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC3052F.XML C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC3055F.XML C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc350u.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Line_Editing.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_environment_variables.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\Amd64\RICFG7.XML C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_methods.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5100t.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\tsmxuPipelineConfig.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Ultimate\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_cmdletbindingattribute.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterN\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\Microsoft.PowerShell.Commands.Utility.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4680t.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pipelines.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_cmdletbindingattribute.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\hpmcpcp6.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\koc353X.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Assignment_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_pssession_details.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_properties.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp6000nt.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc5100t.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_operators.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-tabcontrol.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files (x86)\IYCPMLTHZT.XZW C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\GrantWrite.wps C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File created C:\Program Files (x86)\IYCPMLTHZT.XZW C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\io.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-cli.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sq.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\skins\winamp2.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\co.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tk.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\ExitRequest.doc C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\da.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Return.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\3082\eula.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..eraccount.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8a76a5c0503cd275\OOBE_HELP_What_is_User_Account.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..statement.resources_31bf3856ad364e35_6.1.7601.17514_es-es_8e22d46614494e37\vofflps.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_68bfa622c568dbc2\Rules.System.Finale.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_117bd8ffb46dd92c\Report.System.Common.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_wiaca00b.inf_31bf3856ad364e35_6.1.7600.16385_none_9a3fc1497fbc9081\CNC172DD.TBL C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\ipcfg.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_534cc7b6b042b425\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a5cdacd238902a08\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_61da96604705f464\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-netfx3-core_31bf3856ad364e35_6.1.7601.17514_none_c5c6d478f0c06fa1\FrameworkList.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_try_catch_finally.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Comparison_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_6.1.7600.16385_none_6b16fa9f975e1109\pppcfg.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipscat.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_en-us_39b468a7491888f2\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_c2cef3909acee84d\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_064ef2a4b72f72b1\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7601.17514_none_a5926b147a413e6a\ZA-wp3.jpg C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9e5b45457e71d50c\Report.System.Memory.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6dc5297496bde7ae\resource.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img14.jpg C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPF4BK3L.XML C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c1287167d3ec9a72\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\PLA\Reports\it-IT\Report.System.Disk.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7b0e256ab1668dc1\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_6.1.7600.16385_it-it_57ed1fbb6defcd2c\resource.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_WMI_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_remote_FAQ.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Session_Configurations.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d1240af48795ef12\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c0f3ce4bd4138c17\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-t..riventextservice-yi_31bf3856ad364e35_6.1.7600.16385_none_4153c9e11ffae30c\TableTextServiceYi.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_it-it_76a2639ab9cf435f\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Summary.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_16b2136334d4d376\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_289b855890d86e62\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d34b7c772c3fe85c\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_906b5430848de670\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f704a3d4d39c1ac9\Microsoft.IIS.Powershell.Provider.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Command_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_functions_cmdletbindingattribute.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Reserved_Words.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_59f90b40a942117e\erofflps.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..gadgetxml.resources_31bf3856ad364e35_6.1.7600.16385_en-us_904fd67a29ac3806\gadget.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_fd30fb074d73753b\lpeula.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\img20.jpg C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_properties.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_format.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_1cbdcfd93365b0f0\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0d913a91dca5379a\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\ehome\MediaRenderer\MediaCenter.DigitalMediaRenderer.RenderingControl.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.NetDiagFramework.xml C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_d9a2e129b5039123\license.rtf C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_requirements.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_wiaca00i.inf_31bf3856ad364e35_6.1.7600.16385_none_9dff40bd2f903760\CNC1731D.TBL C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_remote_requirements.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_do.help.txt C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe

"C:\Users\Admin\AppData\Local\Temp\0442cfabb3212644c4b894a7e4a7e84c00fd23489cc4f96490f9988e6074b6ab.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\NBTML.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 shopping-na-divane.ru udp
US 8.8.8.8:53 shoptorgvlg.ru udp

Files

memory/2512-195-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2512-1195-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2512-1548-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2512-1816-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2512-1829-0x0000000000400000-0x0000000000464000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NBTML.bat

MD5 af5810cdaa2aa3d2d6e392bd4989718d
SHA1 3f3d39a57782f786860aedac255827860fe01e5c
SHA256 ec12ba52e03103ffbde5275a02a21822188721f0fc7cc7ad12c586cfd3c8b5f9
SHA512 e35f059cac62fc77daa7f9283aed4bee5240ccd308fe335bea5bad914f73215078852b3d9d86262f0f03a20744610ae8adff3c42379b47846b171ec23499663c

memory/2512-1844-0x0000000000400000-0x0000000000464000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

357s

Max time network

359s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe" C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_troubleshooting.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa610t.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpsd730t.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpd7500t.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpc309at.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Signing.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumN\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_join.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky307.inf_amd64_ja-jp_e40bd14f18e8ff7d\Amd64\KYW7QUR6.XML C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\Microsoft.PowerShell.Security.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.ConsoleHost.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_CommonParameters.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scripts.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp8500gt.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\EnterpriseN\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\hpmcpbp6.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Parsing.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Path_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_job_details.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_operators.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_script_internationalization.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_methods.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJ3330.TBL C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc770u.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\locationnotificationsview.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_data_sections.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO3100T.XML C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smx620u.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJ3320.TBL C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\CNC172DD.TBL C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_requirements.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\about_BITS_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1QI3L.XML C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_requires.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd7100t.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_transactions.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPP8100T.XML C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_do.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_command_precedence.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_methods.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fy.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pl.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\et.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ga.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\README.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-windows.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-ui.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\kk.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sv.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ms.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\va.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_it-it_4203a96875a097b0\privacy.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..eraccount.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8a4202a45063c41a\OOBE_HELP_What_is_User_Account.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\Microsoft.PowerShell.ConsoleHost.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ae782db97dad8098\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_512fa3b8707f96fa\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\Vss\Writers\System\0bada1de-01a9-4625-8278-69e735f39dd2.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-gb-component_31bf3856ad364e35_6.1.7601.17514_none_92d51a492ae12096\GB-wp1.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\Report.System.Diagnostics.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPC3050F.XML C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Break.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_eventlogs.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPO7200T.XML C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp004.inf_31bf3856ad364e35_6.1.7600.16385_none_306093dc85bc087c\Amd64\hpD5400t.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Network.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_wildcards.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Comment_Based_Help.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipssrb.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Tanspecks.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_functions_cmdletbindingattribute.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1030\eula.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\servicing\Sessions\Sessions.back.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_pssession_details.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_scopes.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_pssession_details.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\hpmcpbp6.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Memory.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..ctivation.resources_31bf3856ad364e35_6.1.7600.16385_en-us_581f4464e637a2c6\HELP_What_is_Activation.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Arithmetic_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Arithmetic_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_6.1.7601.17514_none_1202940e4711971e\Rules.System.Diagnostics.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnca00d.inf_31bf3856ad364e35_6.1.7600.16385_none_de510ba10fac7008\Amd64\CNBJ3120.TBL C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_en-us_524aef45cc8b8229\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_preference_variables.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Windows_PowerShell_2.0.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipscsy.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnkm003.inf_31bf3856ad364e35_6.1.7600.16385_none_50766fcc42797a9b\Amd64\koc451X.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp3.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Common.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\PLA\Rules\Rules.System.Finale.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_it-it_f7c88fd818ef8148\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_While.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_properties.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnkm003.inf_31bf3856ad364e35_6.1.7600.16385_none_50766fcc42797a9b\Amd64\koc650X.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4359cbccfec4bd1\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-t..ional-chinese-array_31bf3856ad364e35_6.1.7600.16385_none_64b02463c341f83d\TableTextServiceArray.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Comparison_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp003.inf_31bf3856ad364e35_6.1.7600.16385_none_2fd781a76c9dcc13\Amd64\hpn5150t.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\msil_microsoft.security...t.cmdlets.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cbde052b5e31472c\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_If.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_7fb35d7f8269823b\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_ecb9818d9a15db2c\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hpc309at.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Common.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fe0d287286606a77\license.rtf C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\HandPrints.jpg C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4080c452718ce6e7\Rules.System.Summary.xml C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Reserved_Words.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_pipelines.help.txt C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe

"C:\Users\Admin\AppData\Local\Temp\c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\TKEUP.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 shopping-na-divane.ru udp
US 8.8.8.8:53 shoptorgvlg.ru udp

Files

memory/2408-642-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2408-1450-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2408-1761-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2408-1780-0x0000000000400000-0x0000000000464000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TKEUP.bat

MD5 f4d067797a4aa5c771882c1b22b37e55
SHA1 46cbe41e05ebc57f5ee957dcf77036d97d2c9e0e
SHA256 18e731a59d5119d1e671f9a4a4d0b8245408591b2d6fc251bf3487ad361b0521
SHA512 c46d37df5d7e4770b1dc95dd5b418f6b25854439e80d9a5a51d12acbc4f65035d79bd66065d77ab627c09eb0ce17347b82f4c84ba5cc2dcaebf23553860173c1

memory/2408-1795-0x0000000000400000-0x0000000000464000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

361s

Max time network

363s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ПРЕТЕНЗИЯ.scr" /S

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ПРЕТЕНЗИЯ.scr N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ПРЕТЕНЗИЯ.scr N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ПРЕТЕНЗИЯ.scr

"C:\Users\Admin\AppData\Local\Temp\ПРЕТЕНЗИЯ.scr" /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 100

Network

N/A

Files

memory/2540-0-0x0000000000400000-0x0000000000473000-memory.dmp

memory/2540-2-0x0000000000400000-0x0000000000473000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240708-en

Max time kernel

357s

Max time network

358s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Счет на оплату от 26-08.scr" /S

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Счет на оплату от 26-08.scr N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Счет на оплату от 26-08.scr

"C:\Users\Admin\AppData\Local\Temp\Счет на оплату от 26-08.scr" /S

Network

N/A

Files

memory/1680-0-0x0000000000400000-0x0000000000434000-memory.dmp

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20241010-en

Max time kernel

362s

Max time network

368s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Накладная для 1736 от 26.08.2015.scr" /S

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Накладная для 1736 от 26.08.2015.scr N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Накладная для 1736 от 26.08.2015.scr

"C:\Users\Admin\AppData\Local\Temp\Накладная для 1736 от 26.08.2015.scr" /S

Network

N/A

Files

memory/2332-0-0x0000000000400000-0x0000000000434000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

360s

Max time network

361s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cry1.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\cry1.exe" C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_aliases.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpd2600t.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_For.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scripts.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Arithmetic_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO1600T.XML C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\lpeula.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Path_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa430t.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_logical_operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_join.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_join.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_wildcards.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF6940T.XML C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smx624u.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Session_Configurations.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2500t.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky005.inf_amd64_neutral_8836be987024e6a9\Amd64\KYW7QUR3.XML C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\CNBJ3250.TBL C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_job_details.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW0460T.XML C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_PSSnapins.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVF00.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpah470t.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf583u.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\es-ES\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBJ2820.TBL C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1200T.XML C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd7400t.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\StarterN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Return.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_regular_expressions.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hphp915t.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp6500nt.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\cs.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-sampler.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-progress-ui.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-heapdump.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-impl.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-heapwalker.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\fi.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nl.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-attach.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-queries.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-charts.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lt.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\eula.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multitabs.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_PSSnapins.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Comparison_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\servicing\Editions\ProfessionalEdition.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c4a3b307f7533c7e\playReady_eula_oem.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_es-es_9a81109b0c695e16\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Reserved_Words.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Comparison_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_For.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1036\LocalizedData.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_join.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\Microsoft.PowerShell.Commands.Utility.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_pssession_details.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_split.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_32fd74c7101b30c7\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipscat.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\auxbase.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-editions-client_31bf3856ad364e35_6.1.7600.16385_none_bc037fbe81d7b074\HomePremiumEdition.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_7f87dfcebdd0c352\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_de-de_f1c4ddbe1d6460ac\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp6.jpg C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_environment_variables.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Windows_PowerShell_2.0.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eb3c5b6953d3caeb\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\Microsoft.PowerShell.Security.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.NetDiagFramework.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Wired.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_35ef874ad0caec6d\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_environment_variables.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa\Amd64\HPO7200T.XML C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnsa002.inf_31bf3856ad364e35_6.1.7600.16385_none_02a32ac8d56280f6\Amd64\smc770u.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_117bd8ffb46dd92c\Report.System.Common.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_join.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1029\eula.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\LocalizedData.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.NetDiagFramework.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..ctivation.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_86ef8c9ba37da226\HELP_What_is_Activation.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_de-de_a3713776eb43c7df\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cd9932e5aaee1f78\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnca00b.inf_31bf3856ad364e35_6.1.7600.16385_none_dd3ee736dd6ff736\Amd64\CNBJ3320.TBL C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_preference_variables.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1042\eula.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_dbd1f9033ac6f371\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_CommonParameters.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_types.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\Microsoft.PowerShell.Security.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_es-es_eb87d0be79581f9b\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_es-es_3e627517540bece0\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_08d5d719d58c88f2\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1038\eula.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_prompts.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_functions_advanced_methods.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Command_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9c4da920e2047ffc\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7d6d7fc69e556242\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_f6dd3a0b7213f522\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_f4cdc228bf848a30\license.rtf C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Line_Editing.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_objects.help.txt C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cry1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1236 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\cry1.exe C:\Windows\SysWOW64\cmd.exe
PID 1236 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\cry1.exe C:\Windows\SysWOW64\cmd.exe
PID 1236 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\cry1.exe C:\Windows\SysWOW64\cmd.exe
PID 1236 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\cry1.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2720 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2720 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2720 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com

Processes

C:\Users\Admin\AppData\Local\Temp\cry1.exe

"C:\Users\Admin\AppData\Local\Temp\cry1.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\TGKWX.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 shopping-na-divane.ru udp
US 8.8.8.8:53 shoptorgvlg.ru udp

Files

memory/1236-87-0x0000000000400000-0x0000000000464000-memory.dmp

memory/1236-1354-0x0000000000400000-0x0000000000464000-memory.dmp

memory/1236-1659-0x0000000000400000-0x0000000000464000-memory.dmp

memory/1236-1783-0x0000000000400000-0x0000000000464000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TGKWX.bat

MD5 7ecc1e6ef44282aebd5637877a33455b
SHA1 32aedd7889d7a25ced15a84ea67764e6949abfc2
SHA256 fec32040bd14256a9ad81601e39cc543f332c5653987ebb86abfeb4d5eeac165
SHA512 bc00167011cb049a22fb32230cb108c9dd8b2e5232f52aed2adacb25d97b4836d3b42c53227568f7678ae633c3ab4ca9ac29b5a99f5875e067c75fc74e45559a

memory/1236-1798-0x0000000000400000-0x0000000000464000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:13

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cry2.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\cry2.exe" C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\Microsoft.Wsman.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF4BK3L.XML C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\data\HardwareVendors.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Redirection.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPW1RC3L.XML C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\System.Management.Automation.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasicN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_debuggers.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x4u.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Security.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd2360t.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4660t.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc610u.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Break.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJ3310.TBL C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\CNBJ3340.TBL C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_scripts.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_command_precedence.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\es-ES\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.Commands.Utility.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj3600t.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_logical_operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO5H83L.XML C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa320t.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_FAQ.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WCN\es-ES\Add_a_device_or_computer_to_a_network_usb.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Ultimate\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\RacRules.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_do.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WCN\de-DE\Add_a_device_or_computer_to_a_network_usb.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Assignment_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5300t.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-appui.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\ResetPing.csv C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ps.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-utilities.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ka.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sa.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ug.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ro.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File created C:\Program Files (x86)\LYYPWDJWKA.XLG C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sampler.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-output2.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-text.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\es-ES\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\br.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-print.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-templates.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\be.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_38563db42d064525\playready_eula.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_48d81d1152734c62\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_16b2136334d4d376\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Configuration.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\default.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_de-de_37f6db1e3094fd2b\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_6.1.7600.16385_none_9ba1049ce0053bef\ipsdan.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..indetails.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5a6758686ecd5550\OOBE_HELP_Opt_in_Details.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_a462b98a69d9fae6\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_it-it_b12748a9bd27a24a\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc_31bf3856ad364e35_6.1.7601.17514_none_c99214378a23d63b\Rules.System.NetDiagFramework.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Reserved_Words.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3fc6a921cb2e7ab2\Add_a_device_or_computer_to_a_network_usb.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hp6000at.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_Line_Editing.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Throw.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b7c696a7f6d113c3\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\NetFx40_IIS_schema_update.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_40de2380e46761c3\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_05906ea4445b6301\Report.System.Wired.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91dde3f80ea85a5a\Report.System.NetDiagFramework.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_es-es_85e40f599e065800\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_types.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_remote_requirements.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sonic-symphonyntsc_31bf3856ad364e35_6.1.7600.16385_none_d75d6085d60aa50d\Symphony.psd C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9e5b45457e71d50c\Report.System.Diagnostics.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Signing.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Comment_Based_Help.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Common.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-editions-client_31bf3856ad364e35_6.1.7600.16385_none_bc037fbe81d7b074\HomePremiumEdition.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1a7b58bf239bbd92\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Windows_PowerShell_2.0.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_methods.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Pretty_Peacock.jpg C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\ko-kr.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..svc-extra.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fdbed0629f061767\Report.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ebb345e71aa87bfe\erofflps.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_de-de_90c392ae5a3a7d2d\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..ctivation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_af2e6e6bf7599701\HELP_What_is_Activation.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_08a7cc7c72229ede\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_modules.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1053\eula.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\Microsoft.Wsman.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\amd64_wiaca00i.inf_31bf3856ad364e35_6.1.7600.16385_none_9dff40bd2f903760\CNC1730D.TBL C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_remote_requirements.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_remote_troubleshooting.help.txt C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1eef89e6f9091c8b\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_en-us_f7ef33e70a2e2b7e\license.rtf C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cry2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cry2.exe

"C:\Users\Admin\AppData\Local\Temp\cry2.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\UUKAX.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 shopping-na-divane.ru udp
US 8.8.8.8:53 shoptorgvlg.ru udp

Files

memory/2736-228-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2736-1366-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2736-1653-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2736-1795-0x0000000000400000-0x0000000000464000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UUKAX.bat

MD5 d26ca83ebbdf25ca3687a88b327db23e
SHA1 95ba3c3293751c937d8e1fdc12bcb6091620281c
SHA256 bfc2cc5f86714dbc55910d3a5a99c7ddc9d1c48b8027d33d9cffac959f209e6a
SHA512 0a55144333234dfc16c66e65be60ecc999019b143ccddc7824e87b07a74bf05790bcf4a8e32149900b91d422e423575a482fcf16071469adcef5032417a1e802

memory/2736-1810-0x0000000000400000-0x0000000000464000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

361s

Max time network

362s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cry5.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pr = "C:\\Program Files (x86)\\cry5.exe" C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpah470t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_providers.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpf2100t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Comment_Based_Help.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\Microsoft.PowerShell.ConsoleHost.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5300t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced_methods.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO0410T.XML C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa430t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Ultimate\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_debuggers.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\hpmcpbp6.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\lcphrase.tbl C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_wildcards.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7600t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_troubleshooting.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\Microsoft.PowerShell.Commands.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Assignment_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPO6300T.XML C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\es-ES\Licenses\OEM\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc8100t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\_Default\EnterpriseE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_WS-Management_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasic\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\OEM\StarterE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pipelines.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4660t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa620t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\it-IT\lpeula.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Enterprise\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc350u.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\icsxml\cmnicfg.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_trap.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\Microsoft.PowerShell.ConsoleHost.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterE\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7300t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_providers.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\desk.bmp" C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-applemenu.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-views.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\ConfirmGroup.odp C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-uihandler.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mn.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring-fallback.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sw.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\da.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring-fallback.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-search.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ext.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\THIRDPARTYLICENSEREADME.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-keyring.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ko.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ta.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-explorer.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\eula.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_debuggers.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\Microsoft.PowerShell.Commands.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_9a7206c9fd273385\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-n..diagnostics-package_31bf3856ad364e35_6.1.7601.17514_none_1bde017f5d8d7006\NetworkDiagnostics_4_NetworkAdapter.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_655452efe0fb810b\GlobalInstallOrder.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_02b53e1d98470ee8\erofflps.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_565b1bc9c3075dac\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_it-it_1e4d6c8ff7baeac6\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-h..putername.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f7fc29722da787f\OOBE_HELP_Change_Computer_Name.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_en-us_d5fe5d00fb97ccd1\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_4f8483af7079fc18\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\Microsoft.PowerShell.Commands.Management.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Continue.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_WS-Management_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_20ddd8fbf0c66814\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_afb6b99ecfc04975\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c99bfc6ddd1bf1d2\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f86c44a49a61f132\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_6a8fc4b7a7c6fdc9\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_es-es_85e40f599e065800\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Session_Configurations.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\oskpred.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hpd2600t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-dot3svc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91dde3f80ea85a5a\Rules.System.NetDiagFramework.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9893e83c110fe46\gadget.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11b07c1bb446e787\Rules.System.Configuration.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..svc-extra.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_71715b0ed4b9200e\Report.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_functions_cmdletbindingattribute.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_2d5fd4d75f62fb5e\lpeula.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_f72e2c32f7e542ef\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0d913a91dca5379a\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_Windows_PowerShell_2.0.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..bilityanalysisrules_31bf3856ad364e35_6.1.7601.17514_none_85194071b6440c78\RacRules.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_6.1.7601.17514_none_2fd7b56967fc5c76\base_kor.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Windows_PowerShell_ISE.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_operators.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_7fb35d7f8269823b\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..eady_eula.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_38563db42d064525\playready_eula.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_en-us_29b70e81faa66c43\epgtos.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\Microsoft.PowerShell.Security.dll-Help.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_try_catch_finally.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_de-de_424b857064f5bf26\about_BITS_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Wireless.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Diagnostics.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp003.inf_31bf3856ad364e35_6.1.7600.16385_none_2fd781a76c9dcc13\Amd64\hpb8300t.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_prnhp005.inf_31bf3856ad364e35_6.1.7600.16385_none_30e9a6119eda44e5\Amd64\hpc309at.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_trap.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_es-es_a122fae633f5ab58\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Summary.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_pssessions.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img14.jpg C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_properties.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_eee4e052cd1adbab\license.rtf C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Language_Keywords.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_escape_characters.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Break.help.txt C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\2052\LocalizedData.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\Panther\diagerr.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
File opened for modification C:\Windows\PLA\Rules\Rules.System.NetTrace.xml C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\chcp.com N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\ C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\TileWallpaper = "0" C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cry5.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cry5.exe

"C:\Users\Admin\AppData\Local\Temp\cry5.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\SQNLI.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 1251

Network

Country Destination Domain Proto
US 8.8.8.8:53 shopping-na-divane.ru udp
US 8.8.8.8:53 shoptorgvlg.ru udp

Files

memory/276-3-0x0000000000400000-0x000000000045A000-memory.dmp

memory/276-1117-0x0000000000400000-0x000000000045A000-memory.dmp

memory/276-1536-0x0000000000400000-0x000000000045A000-memory.dmp

memory/276-1831-0x0000000000400000-0x000000000045A000-memory.dmp

memory/276-1850-0x0000000000400000-0x000000000045A000-memory.dmp

memory/276-1851-0x0000000000400000-0x000000000045A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SQNLI.bat

MD5 b708814ebbda5252a78fc5c81e3c3a2c
SHA1 e84a1cfdd22b4133343619e2f1f90fe7cb6f692f
SHA256 7c6335dc825aac3889dd521c6e54f8f2eeb3d60ca9251f0885fa64e8983efa31
SHA512 ff2c28552a1ac7a70689e5eecb977b9c5766853fe03ca755913c54d90b42648b93965cea42593f5c1a734a7ef6f01729898b0d869d29f8513bf0f382a3cf6793

memory/276-1866-0x0000000000400000-0x000000000045A000-memory.dmp

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-05 11:10

Reported

2024-11-05 11:20

Platform

win7-20240903-en

Max time kernel

600s

Max time network

597s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Gozi family

gozi

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\desksenh = "C:\\Users\\Admin\\AppData\\Roaming\\difxuser\\cewmnect.exe" C:\Users\Admin\AppData\Local\Temp\cry4.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry4.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cry4.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2204 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Users\Admin\AppData\Local\Temp\cry4.exe
PID 2176 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\cry4.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2744 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2668 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2668 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2668 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2668 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2704 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2712 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe C:\Windows\system32\svchost.exe
PID 2016 wrote to memory of 1132 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 2016 wrote to memory of 1132 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE
PID 2016 wrote to memory of 1132 N/A C:\Windows\system32\svchost.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cry4.exe

"C:\Users\Admin\AppData\Local\Temp\cry4.exe"

C:\Users\Admin\AppData\Local\Temp\cry4.exe

"C:\Users\Admin\AppData\Local\Temp\cry4.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\6336\319B.bat" "C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe" "C:\Users\Admin\AppData\Local\Temp\cry4.exe""

C:\Windows\SysWOW64\cmd.exe

cmd /C ""C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe" "C:\Users\Admin\AppData\Local\Temp\cry4.exe""

C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe

"C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe" "C:\Users\Admin\AppData\Local\Temp\cry4.exe"

C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe

"C:\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe

Network

Country Destination Domain Proto
US 148.163.112.203:31780 udp
US 8.8.8.8:53 megastraster.ru udp
N/A 224.0.0.1:39249 udp
N/A 224.0.0.1:39249 udp
US 8.8.8.8:53 robinson98.com udp
US 8.8.8.8:53 monpasevashumamin.cm udp

Files

memory/2176-8-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-0-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-4-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-2-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-6-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-16-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-17-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-14-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2176-10-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2176-29-0x0000000000400000-0x0000000000466000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6336\319B.bat

MD5 bc01f616c09d69a6dd36f7bc58286817
SHA1 b83283444714ab1e312a7b221dc709f8806c5ff4
SHA256 d19793bcf4f5441e08c64d40b4d4d31164efc59944f2d3ecc0a963ba55565e85
SHA512 f6764745c4c5ea014a349156299c2a0aab725fc0edbce095cff28cb1a37d4612db6c2d64bce0339bcb12c074d7aa9b7c226cd7f873c0c9e564de44c328e12b13

\Users\Admin\AppData\Roaming\difxuser\cewmnect.exe

MD5 6e352a6e96db293f487d1c1996f7ca60
SHA1 887a357a96b9dbb428b6b776a3ec8ca8de746f18
SHA256 49b84085b7cc731d39fda5a6c15d8bedf3051f3e3f8792f4a50220ebdbf1a4c6
SHA512 bad3b109707b7ba714ccfd41109d6defe9aa2c651cd7dd8c91f536622fa52394071e858a81a2844421a56219527737d395580ea73e250f6cb44c4c1c4959351d

memory/2712-53-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2016-54-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp

memory/2712-61-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2016-57-0x0000000000450000-0x0000000000554000-memory.dmp

memory/2016-62-0x0000000000450000-0x0000000000554000-memory.dmp

memory/1132-63-0x0000000006480000-0x0000000006584000-memory.dmp

memory/1132-71-0x0000000006480000-0x0000000006584000-memory.dmp

memory/1132-74-0x0000000006480000-0x0000000006584000-memory.dmp

memory/1132-72-0x0000000006480000-0x0000000006584000-memory.dmp

memory/1132-73-0x0000000006480000-0x0000000006584000-memory.dmp

memory/1132-75-0x0000000006480000-0x0000000006584000-memory.dmp