Malware Analysis Report

2025-01-18 20:58

Sample ID 241206-dmrxmsxlgt
Target cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118
SHA256 16ff948e12779fe3d09b502772605a037198291861ae2fca4fe0ba91b40d9d26
Tags
xorist discovery persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16ff948e12779fe3d09b502772605a037198291861ae2fca4fe0ba91b40d9d26

Threat Level: Known bad

The file cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer

Xorist family

Detected Xorist Ransomware

Renames multiple (5458) files with added filename extension

Renames multiple (4276) files with added filename extension

Drops file in Drivers directory

Manipulates Digital Signatures

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-06 03:07

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist family

xorist

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-06 03:07

Reported

2024-12-06 03:10

Platform

win7-20240729-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe"

Signatures

Renames multiple (4276) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wintrust.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ru59MZ442beTeJU.exe" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Windows\Media\Savanna\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_8.0.7600.16385_none_add5a10aa4d614d5\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_6.1.7600.16385_none_480c0d8bd31ae43f\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Scenes\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Downloaded Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Garden\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Landscape\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ehome-samplemedia_31bf3856ad364e35_6.1.7600.16385_none_b6b9b223710b3802\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-festival_31bf3856ad364e35_6.1.7600.16385_none_121f20b55f0bde68\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-systemtools_31bf3856ad364e35_6.1.7600.16385_none_da623240a154f357\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Landscapes\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FXDUII3O\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-maintenance_31bf3856ad364e35_6.1.7600.16385_none_ba8f25a3b6d81a68\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_6.1.7600.16385_none_64398328adc9c59d\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Raga\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Architecture\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-musicsamples_31bf3856ad364e35_6.1.7600.16385_none_06495209cbd8e93b\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-afternoon_31bf3856ad364e35_6.1.7600.16385_none_2a05e57d5ab3659e\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Sonata\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Nature\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_6.1.7600.16385_none_73076dd9cf3a9dce\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Delta\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Offline Web Pages\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\KBDSYR2.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\webio.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\DevicePairingHandler.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVPZ0.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\sud.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\ipsecsnp.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\EP0LVR1C.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drmmgrtn.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wship6.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnttd2.inf_amd64_neutral_9dcd97ab7a913b7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\AtBroker.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\EP7MDL0Q.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_neutral_68988e550e69a417\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netw5v64.inf_amd64_neutral_a6b778ba802632cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNBX0282.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\EP7PII02.INI C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\NlsLexicons000d.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\poqexec.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\difxapi.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\replace.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\cliconfg.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migration\MediaPlayer-DLMigPlugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\advapi32.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnin002.inf_amd64_neutral_977d40799168c216\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\DpiScaling.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\adpu320.inf_amd64_neutral_4ea3d42a9839982a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smpicfg3.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\netjoin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpc5500t.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\QUTIL.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\SxsMigPlugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\upnpcont.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\uxlibres.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\dmvdsitf.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migration\WMIMigrationPlugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\netplwiz.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\avifil32.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\inseng.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\rascfg.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\serialui.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\DeviceUxRes.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\BrSerIf.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\CNBP_279.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDYCC.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\logo.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\handler.reg C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_en.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Mail\MSOERES.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\pkeyconfig.companion.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_dot.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Design.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\msproof7.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libsubstx3g_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libtta_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Web.Entity.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\1033\MSOSVINT.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libblendbench_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\1033\TRANSMRR.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-over-select.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libcdda_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\xlsrvintl.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\LISTBOX.JPG C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\11.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..nter-shellproviders_31bf3856ad364e35_6.1.7600.16385_none_f06311f5098e0e17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_vsmraid.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7f9a18d8d701ae73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_networking-mpssvc-admin_31bf3856ad364e35_6.1.7601.17514_none_a75997dee0110f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\JA\System.Drawing.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-extrac32_31bf3856ad364e35_6.1.7600.16385_none_371e8c461d966a55\extrac32.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_moon-waxing-gibbous.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..c-mceburnengineicon_31bf3856ad364e35_6.1.7600.16385_none_0a0899f37b2bab4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..rbleplace.resources_31bf3856ad364e35_6.1.7600.16385_en-us_09bc2db811bc91be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-getmac.resources_31bf3856ad364e35_6.1.7600.16385_es-es_14cb683eb69d3792\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-photoacquire_31bf3856ad364e35_6.1.7601.17514_none_925c6a062361e055\PhotoAcq.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_7.5.7601.17514_none_0f99f84e0e6e2bc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\Globalization\MCT\MCT-ZA\Theme\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_51e5e402131afc4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_perm_res_b03f5f7f11d50a3a_6.1.7600.16385_none_d966c4065f6c437e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnca00f.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d7fab1a039b9bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\msil_servicemodelreg.resources_b03f5f7f11d50a3a_6.1.7601.17514_es-es_ed30aee2fb066a08\ServiceModelReg.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-a..olicy-snapin-native_31bf3856ad364e35_6.1.7600.16385_none_a5b522837df19ae3\AuditPolicyGPInterop.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a2175ff5e085f97e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-netpacerinf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f318701f5c84e52c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_48082d3607b4f4ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_netfx-mscortim_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_a32524c42126d7e8\mscortim.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Client.resources\3.5.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\0409\mscorsecr.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..pbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2856a514b1493d6c\axperf.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnod002.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_871dd2fab61555c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-hid-user_31bf3856ad364e35_6.1.7600.16385_none_3cf5e466d58070d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-c..tasp1.res.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_404a75aaa23b4aa7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-tpm-tbs-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83c79be1c765a37c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netmemorycache.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1b9ded448b012bcd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..httptracingbinaries_31bf3856ad364e35_6.1.7601.17514_none_8dacedf8319144f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmi-wdm-provider_31bf3856ad364e35_6.1.7601.17514_none_d858d17478af3bc1\wmiprov.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-a..orecodecs.resources_31bf3856ad364e35_6.1.7600.16385_en-us_43f2d4cd240da13e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_8c46e17f1398738b\schtasks.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_fr_31bf3856ad364e35\TaskScheduler.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ftp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6ddf1298b9c25dbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.web.resources_b03f5f7f11d50a3a_6.1.7600.16385_es-es_540bc71955b9409d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_megasr.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0d2208e5ce638932\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_moon-new_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.Wrapper.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-bits-perf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0786042ead1aa38b\bitsctrs.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-networkprojection_31bf3856ad364e35_6.1.7600.16385_none_3fbc74d90a6e33f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..ure-other.resources_31bf3856ad364e35_6.1.7600.16385_it-it_967d26877ca0e4c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.deployment.resources_b03f5f7f11d50a3a_6.1.7600.16385_es-es_d11e5e750ab9fe98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-tapi2xclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e8e4d27156d257c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-wmvdspa_31bf3856ad364e35_6.1.7600.16385_none_e6522b866608b0b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data.OracleClient\v4.0_4.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_6.1.7601.17514_none_fa8534ab236134c4\mf.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..ator-base.resources_31bf3856ad364e35_6.1.7600.16385_it-it_80ac4959a09d7b38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..cingstack.resources_31bf3856ad364e35_6.1.7600.16385_it-it_75597592789f1a85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\msil_eventviewer_31bf3856ad364e35_6.1.7601.17514_none_a7c7be940756e915\EventViewer.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ie-ratings.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_a31e12271f624cf8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\MMCEx.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5#\867cbe7462b04e2cf1ae39abb576ae2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_83f81bfd004e80b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-n..ion_service_iassvcs_31bf3856ad364e35_6.1.7600.16385_none_3e71837ad96d07fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-xmllite_31bf3856ad364e35_6.1.7600.16385_none_e5307039bcff94de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netg664.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2682446c93017f7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell\open C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "IHCSFKNFSOCVCMJ" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ru59MZ442beTeJU.exe,0" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ru59MZ442beTeJU.exe" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell\open\command C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe"

Network

N/A

Files

C:\$Recycle.Bin\S-1-5-21-2703099537-420551529-3771253338-1000\desktop.ini

MD5 ca9aa5bd7274d42da4a38eaff5805a91
SHA1 64be607cef5acf1e4607e3a386019e871591179c
SHA256 0d6191e3e025d1939b62c26fade11d1521201f9320868527a7497bf556b7e694
SHA512 a6fefffd11eac3a8114ffe4cabe16be988f239dbd252e10b38b375bf05a57bcda027ab45a945ef2ff9581d799d1f1636cd08bc4df13c710eee18c55394e07b29

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 f460d5b87d924c0e31115f3eba153e5d
SHA1 97f7b67f96b8946da3b2d01bd19fbe502bfef4bf
SHA256 aa804d8fb0ee963c022b36b10dbea6a91f1b33466b05f3e2a3768452e90efa89
SHA512 6dd98d33e049a5f380c5caa36a22da3e070f258630819625a2b6f88e21a7695016a6a558acec5e55b370ebc3ccff9f72734a55d153e686baa1ba7ba9be13562e

C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll

MD5 424dac8ec4e54f998c782afc296fe075
SHA1 e30a2ce5bf8005ac2ec7a330089949c32df53368
SHA256 f209284e300dc72118e840df057478bc8552ca5d82c84553537d20371724ad32
SHA512 0cdaa9a376b6239e7ef7dbab3979cb1d94465ba783e3c97a9a900727ffcc0d4000b654b8f33c5a6f17b4086778506f6b1254e20f546efeae95babd62b7e432f3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 1153f0a892ad7dfa545886c55a8bc82f
SHA1 c8a8085e6cd10107adef33a619d45d5f059d270a
SHA256 53cb9dd1052af65a5d422d77c3dac1454d8decda8555129686ce2ce4ded02e0a
SHA512 ca4c32955b1aa49919621ed45f70be6cea5c180b934e63151629d94be800bd7c646437003476a2c6f8ee9c8d0a99ad31038d1608586a3434eb905420045c4015

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

MD5 d0d249a4c482cb615be24c7bf8985194
SHA1 46c4ae999f3c8a07deca63a6f82e00971c508271
SHA256 d076824c64127c565fb92cd9bc80c050772898ceda6ef643cde45f2437d77c4e
SHA512 dff7ae330c8d4556d09a9f459f8b2d202ce97f7d566247da5786c5c11aec7b24b8295f1f00242d520f2c2733f893fcbbb996820b132607f8c00fcd1a25a0f3a0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 b4a6b83c727c2adf643a10533e209f28
SHA1 c74ceef0140ad8b72f3c6bf8e1a6c63c14152be6
SHA256 d62ffdd28ec63dc8c2b77726563c3d4febbacf50ea6cbd28b53e43a0075a6e66
SHA512 06c20c831862d31ab93078c0277933fa42030057acb4c3354459006337d0fea6597c3047a53c2f1e426ac053a22618923299cb7cfe118f4b4b7d84f268ba7341

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 43b6f60cada0336d8fb36f1e361a3e6a
SHA1 5f9bcb4c456df82521ebea6b04ad7cfc4319816d
SHA256 072460ddaf51bbd9bf0341949f406dc2d4d047040b1e113cea7ab8d0bbeec10d
SHA512 cbdd9d1976e9f6936d818810d64103cf763ed7f1445ea7e767e9c740bd233d1ad4d780801fea8a65f5d689acc6a710e1a4041e53c5a2ee3e42b0b1765fa9d0a2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

MD5 da4661d58cfac2c52b863790bb71c9b0
SHA1 2fe3ca12ea3b139fcf68badbe07b08bc8b1c2b7f
SHA256 1966e16b32af6eb5502e59905dc7c2e237610aebff91fb4129f6a681aee1b37b
SHA512 5510ac342eb20bad117e5a7346aa97a7a54c942d1d170d131206368644511770dddefe2b58f10307e222a1e3fb4ad4e893bac8239810dd3bab9060598bfc1558

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 0c169929f8ce6583c9d28cb9295b3d85
SHA1 a11ea6f382e335465ce445a580b598da738ba1cd
SHA256 2a9a8791f9f939236b318b66423f93cdf489d3719b35dab841e101a9ae47c1df
SHA512 5e544ab11f6a3ef8ce1807abeb6c7971051d5ff6cfe97333298d2a37829ba8429316021fba590b5a613d25ba89e140fa94a499bb5e576bbda95bc3113a6c2484

C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini

MD5 932e6f3ee61312cada5e1e83fc87e8e3
SHA1 5c461f25836c841a288dbdf1ec022908b9450c63
SHA256 da893d196bc8ecdab64e8310939f066725662f3ca00138e3ae4e160ceee61ebb
SHA512 035d70be52b2dab1d0b14fbc4f3f9fd13532c6a03a105d3ec8b4df886b86e4768e95ec4cd4439cc586caa3eb346bb4ae7d425cc43e96af9bca3c074a843f3636

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini

MD5 36498987a30b1ee7a4b2e9fcf55064c7
SHA1 876a8116c43fd7c4f2f8420f8eecc9e5da49eeb7
SHA256 b918cc98a78ca8b27c1bcce657a3f9e4868952dfa8f330573c3c001c85984723
SHA512 ca5fc345111293980097527a86ed032ded5aa761aa1916b56f6b7261d8ee52e8a440d3bb9c39cd5c04067e33ca84b144d18d35ccbb3317e8f530ef89258d6583

C:\Windows\inf\.NET CLR Networking 4.0.0.0\0006\_Networkingperfcounters.ini

MD5 3f0e0b52600d1d532d781515a65c2cd1
SHA1 e669252fa5e00d7b729e1655efd20cc07475c58f
SHA256 44de74f8d460a8ad2c411f240db9e8ced4f5bc9382ae28d06e7ec108f6ecfd4f
SHA512 3a44c06e5c4caaea64f41db62641f391f6c9e2b6ffe735e034cb0d851f501f125da734f591b7ff5d3550aeeb7698e395d3e1e5d788852d0d45a1f9c8b9b3506c

C:\Windows\inf\ASP.NET\0005\aspnet_perf2.ini

MD5 fbfa5cb36d7ff9114978aa7527f7a715
SHA1 b0a6af71310f17db94ce7399af1e63330c460233
SHA256 e37a9cec4cac9b4df692af7509e43b34c0f8581633a5c8869ebae2324052596f
SHA512 c9b424f4b429b3bbfd8d7f7e67bafe60ca913f4bd5f6a59ab66a400080613a5f8d24a159c7981d0b95ebb593a69c893f23da4d049d2777f46d499b2555108723

C:\Windows\inf\ASP.NET_4.0.30319\0005\aspnet_perf.ini

MD5 700a4cbfedc1473b100f11d244f34c48
SHA1 b0b57289609f626dfac2836b16e34de2a1cdf321
SHA256 a51fffa4ef73a4810fb0ff5965468e7251cba7eb943da70c8a1ca89cc2ff3b7c
SHA512 aa8fa2bb54b9cbf5f94f3d6cf90fa09a517996b8adca66aece7239cc2a7a2bd8543216718041a44a0fba7663c5b24a153b173eeae70a531d8abdb6146c7f5a62

C:\Windows\inf\aspnet_state\0005\aspnet_state_perf.ini

MD5 4d4937d710812530ee0720e982c12391
SHA1 3926594701e9f8e79b71a149282e655b6d0d3182
SHA256 f4f1b3122ac9db8b42cc0094aef0f0fc5f2734768b4aee7475174eb5b729549b
SHA512 c440009a9f84b7c5269eba13d843be580a66da4abc89d2c6365d3a08d9f669a9910ba3d84016d0ae260f92e198815a863512e3b1b253dcc616d8bd409593ba29

C:\Windows\inf\MSDTC Bridge 4.0.0.0\0006\_TransactionBridgePerfCounters.ini

MD5 78a87148048cb247a3040197c8d3bdea
SHA1 a4ad2fe4bf4d1569c7bf454761566ab52f810cad
SHA256 6002a047a591e2b380a3e248d4ded9e7478d1af5946d16a5985b863f2121c3f2
SHA512 97b0896d13df1be135b60604c682a7e86cac1203dbb84d75d4af45514e531051b6d88003c34d8ca48307723d2bce8305e0acc983a41030125e2439fbd901c848

C:\Windows\inf\SMSvcHost 4.0.0.0\0006\_SMSvcHostPerfCounters.ini

MD5 9e7d4a8b02f81da913683c624e4407f2
SHA1 63091e9fd9e3788a34bb83343bb6119648b4cefa
SHA256 227cfa86069c286e2ae1f0e479528373344095c01e18b2b57ccb4fe590e85436
SHA512 203a8d5304df7f44744e88e80dd3aca26ae6b36ecec4c4df664305f0a56d6d87d44f80cd536ed3963d5e678147b9176ee83bef8a8d9e88b8b6a46ce08ecf12df

C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\PerfCounters.ini

MD5 89e2c01ba9570eb63328f0c431ec4003
SHA1 e517c92b5657f5c103e228e52ff36e9a033bbaf9
SHA256 1bf8c2ef489481860aea24dc6fb24cf89310f6db8a3be4eeed627e451bb3b6ab
SHA512 6ee158eb608063a4beb17d4baaf2ec057dabeef80c5a88f624f492a2ac0ab0fd54268e1210f02876bf1e597325c183ae7664aadbebece6138860f1d52d6966f0

C:\Windows\Media\Characters\Desktop.ini

MD5 44d6a5a3be97cef623d1ef8c3880e4e2
SHA1 da98722e40c133cebebe36e163da1dd81e75f9c4
SHA256 4a25d6ff1a57365809042c26a549d60f07bd8d2cf79b78a75ca82ff1ed55d101
SHA512 d8ffb0ff33ee6c38e0eef36efd3296ff3328fd889a497c881c6a85565edb0845a32a8a24cdf9958ce4716ced72c9303f375f742fc780056c66b1be426d81718b

C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsLexicons0009.dll

MD5 611ec56f4356cacd800612f210637704
SHA1 1e39491a8ec3a26f89a2b6b596f018e02b15882c
SHA256 bbbcada158fa7a939dee0737fb0428e7dd340033492968fe14348023e415f30b
SHA512 53dc64b4a4805f175da039402018bddad8abdac72c0f98774348fafc67779dc05b5d2c4c7f856176fc580520f676e0fea2fd33c21159ef31044c812779eb6512

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Accessibility.dll

MD5 136cba747bcd797a2b4028d0da76820a
SHA1 3d9d06be4bd0829a128f6b1b2cbefd7476bede9d
SHA256 059810f396222de4dcde6d40038fc7c2c0a25f6d14ddfa95380df877a48708e0
SHA512 b29fdc5039447e101fdc6d1cbbb992f9d9951b554949196e6b18acc3ebbaa5df8dd6937ed586e23708cf10a293e2c94973c7c2eaa8fcdc8fa2a95f62e814da7e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 c10b203185d3d877fcb9faa8f419802f
SHA1 f12b6bcdb4a8065ca5e79bd4d14291d226aed41e
SHA256 e963043e9eb7b1afeb2237c6b3bfdb4d5873e83b2347f70829a3d3315986d3ac
SHA512 5961dd250ad06e4f94478ac83fad70c18c0502414b67f0a67c8af7aef0e873a32ed2901d5251106a6ba4da629091a41ee8901947fda7db51df4d1a19298ef37d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 45e2abc360782ced48eea8b62a30be3a
SHA1 657fac630576be8e8f650e87ebd2236fc2486996
SHA256 5e6bda4bc7960ece9e8fd4919660157ff378e3737e0b870391f4fcbfe22cb945
SHA512 7beafe0aab6c3222d306a2b3a3ee60dc5999ebb22e1b5bd4a040a1bccb7a707ef24603cc2b03b3af97869883a0f0110275f6d7f56de092d839c3811e78135efb

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

MD5 341f43517ca1dc51d7ba2beff90158e7
SHA1 e0656670912d4e0d99a297fbcc724c2758a1bb2f
SHA256 2529e54fa0b98f371d0d8a6b6210f083a553bf9a3799d243999c8d24ee288182
SHA512 59721c1048d0d05eee72c0c75f49ecd665920a537fb8ca240cf3b60be55f098d78058694098194feab2805da3e6604f33ee8e5dfb0f6c595b6e6409d1958c86f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 f1a36b96bd8dc02ea5eba5f3a921dac7
SHA1 fbbd7b4dd1653a5945a085aea9d19b7d47e5d170
SHA256 af4eb0838f8733b358690731d6cf6f2bb66c340412f0fea56f10701730600e41
SHA512 90552cb4e4641ef19316ef9ee22b7c4e408291fb9d7f0b8578d546b50fd16049357e66fd3996d7fc58aa9ea8edd4391df3c847338b11b28678fb88cfaa4d9260

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 77369e1766f6957643e096ee45cf62b6
SHA1 699eed19afa12e1dfdcc0c192a919432c33c98eb
SHA256 bafeb5d2d044666bd4f38651fc63beb7f18b85421035cde801b65b307a002746
SHA512 5eff613fe6be60261f63698a0f23df03b44aa3760f679f4bd5beca4141a2fcaac05c2a9962d188b445e91f0e4a5168ceee029b984c32d437cec073efbd851eb9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AspNetMMCExt.dll

MD5 0276ab6b08a1b9168a5e62ee3ca0e4e0
SHA1 26068ac445e35289d208519223d7fb8a3db25c3d
SHA256 d15dadf7e65adb11f0eae9c91077975e96544a9afae0e4e1c06e48a17ad7e4b9
SHA512 be278cc60920d6575c1699e0cbe35da3f616d1f99cf307af9d66b83f87492c960bc8fa52b33883e18938376303a017adbdab1728d61bfe32a6dff0160d779982

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Conversion.v4.0.dll

MD5 2d552a4a4380164d50c117ad37cd8afd
SHA1 66ed81c14de5e94b99d644e1b40e7e82fd5966c5
SHA256 e5ebd082c8b751ba94b343a21fc1bfd86c6d8e0b87520662eaec7ea1fab22c26
SHA512 ef1b6e1001de9c4258ae6d7251f67d7acd329a35be65d143f73931f945be554bd4298597577a16da2dd28a3c72b59872e764395b246f930fc8a8bce52c004094

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.dll

MD5 8cf4c4f595f7ff85d00327a18b5212c5
SHA1 704552e2fc0359369d4a6785f8f86768d2fb483e
SHA256 2b9de9d912c078a0b1ffda3dcdeeecc764756cbb81e7e80527cce2fb95feff15
SHA512 e218b734c5a325315e861286c7a5e77d2764cfde7db2988a701f90cd460452fc267cc58a45f85baf346d3ee50b7718c834d35491a90e158c1a792648438738af

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Engine.dll

MD5 8c2027e06f485bd9f847033c09ecf768
SHA1 11b93304c8a56908a115564f287792fc8a2ec38c
SHA256 055d94caac0410030e58043c20b80c31687f73eb6248021f1b64a8a7bb5b5e99
SHA512 7abd461cef1f53ea98ef2ccdf9aa8e54db384c0529f514037e28e76a685a0b2eb2be1d8ce5bf48e6c440834358771ab512e24efe46f772e94b499172c6b28ab9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Framework.dll

MD5 c68aacc5e47efd2e453b1824f1c3fc45
SHA1 98ad35c84666dfadb6d4f3b4f9a8e20dea95fcbe
SHA256 5a1a9d12694ff115880a204ed2fe085afa6d7315c1afded34c4b0bc9a311789d
SHA512 e98eaa6b1fe75b3309b7775d0b68bdc4c0a767be8942b50266dfd9f1b2e12a15d2c1c70656218f28715afb8242a4ccb2138622ecf36d734502e80ab1bbd13314

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Tasks.v4.0.dll

MD5 68647f20bbca08464776971dd461968e
SHA1 8b6c62516e35a5ddba3f8866e16ee138c826c356
SHA256 a76d1fe8a468d4a7563d213ebfa704a9c08c555160fbcf21f893738a4557a69d
SHA512 0fa742783f1fc09b1ad46e3fd3c493892661d121a4ebca0cfcaf7bcb99c6b06ec4b3f89f9175b530b0eba308cd6c5f236e4fad394a303ef57e5bbefe26218921

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Build.Utilities.v4.0.dll

MD5 6f88567a9bd8af65bb7799252278cfbc
SHA1 54974984774be83106790889be6e21ce03969411
SHA256 e0f778784ed21d5e441299f6d6b62c4a961e8d01c886b548351e70427805345a
SHA512 2f6a34ba957c2c8bf5d80fd9acc819558d960d69266237f702dc67aacd2d7994e23ca8f6d59affcda2764e26bd9e0ca76500f7bd8b96e039d373cbcd1eefd36c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Activities.Build.dll

MD5 d8a374d3041dd6028ff5543a3222ee3a
SHA1 333fcbcf7e8a6168833ff950ad75aaece6bf70e9
SHA256 9c93ed77284d8ca86e4944f9edb144b2acdc687aa2dc5c3fbc5065b1a96d5d08
SHA512 4b40c4dfe54bf548684b396779704da44237eb9461f073ee310c7501c5ad3bd2607344e12c7854fd9dce277a2145e851fa3058facf52368f26d87c38e3d970d2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.CSharp.dll

MD5 74892d81f834fa23daa03a44a73cb888
SHA1 0335d43ff4b2998e3f235595f8e1575b04b76f04
SHA256 c363248bcf1fd3b7a2fd60ee3aeb389bbf0ebfd4cd80e538b28443580cbcd7d9
SHA512 bbc4e92b3aba4458fc05b1e348229450e5d41a1e4eca5c7b00b66a898d6db9906feab2b52a2014625109432a06cdde40ba6f1650a2a77e7f5047327319fdeb9b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Data.Entity.Build.Tasks.dll

MD5 f54aab996a183e5633069d9b6e2a3708
SHA1 f7bf9a89ef9d60a40e8efccd91f1d724d777aac0
SHA256 32b014c4f0c915a2b08260971d64100452c577b5d8fbc0bf218be2a60c8e213e
SHA512 c448a59a69cb211905c56e109b5072679a0a73b2cecedc9b1089e77ecd85ba7847a0482141869987e91157d6870e434eba6920ea4a859ce92fe1007667b64bed

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Internal.Tasks.Dataflow.dll

MD5 b8e75bb6f6ed4cb3a4ec87ce27d3512f
SHA1 909a65fe5294af83aa73528d70c4dec8171fa6f8
SHA256 bd6e22c241fccf8c1350fcbdac9259dcd2501c0cfae00f97228defa994eec76f
SHA512 10216924b1ae4694f03aa597768fc4c184890b267742cedda6e3371575837ad96c90e8a664882701b76c83d33d1891448a2d1d3be2679dc83dc8615db76c8a0f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.dll

MD5 52885b4fdd4b4662077700f59482d313
SHA1 1dd7b86a606f00b76466d6c072e0c0b8c4c5394c
SHA256 a6a845782c09537139a47ea3de8d1e5cb7a4c14248f1b391573f10e326635818
SHA512 d3a40c392d9806422d15b83f2f1320af634dd8e762c71f079c86df5d9a048fd911057ebc73a98c5b1beef7d126911b657142de603c747638055c76f0ba363cae

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Transactions.Bridge.dll

MD5 43984350829a14badfa71c340cc6ef72
SHA1 150c080da159719c5a69e5b04e1eb3e96a130cd2
SHA256 ab575e2544fa941815cef3c550a9661d13cf7724745ed1d9ef7c3137d3f22b3a
SHA512 da12d9560043b61342e0cf3bf3c2c599d6efb86b6ceebacaec2cc87d9f3865e6d1154abf172f2dd29c75003da342eb815746bb223ca29cdfb1351c23590a4bb3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.dll

MD5 f38a70232a4400a82518fcb5168701cc
SHA1 53cf9735b7c0c6663fc6de2a987c4cdedb170cbf
SHA256 7b57be6015e9ac899bd53f99d40698cced78ecd582d83f3039689338b738fe2d
SHA512 6b19e89112f9cb85efbcb0b400dd318a6de7e1446b3c8963eaea9751d6b264ae69392d993bee26bb2577ddda71b7edb89ae31ead581abe987c1bb40accc17c48

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Win32.Primitives.dll

MD5 9d8f1570c64dc49fd9158d5e080b9f48
SHA1 0efc77376156627c37c5105ca29fe693c83a3c8e
SHA256 86212b4dd1ae29863cdabae2aa81ad5175b3714c737d28670fa7823c12259d62
SHA512 eb7610ede2ef442c9eda17ff9aef0aa65cc3341c2df5b9154f312fa14d9e33dab591adb911e49478549b3e8d7b6ea99cc0809c5275e2d4db52282cb467c4bfe9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

MD5 3392f34555198089852e84f46f0a02b0
SHA1 e8586fdc26a93b53b43b1c53f6fda989fd78daa7
SHA256 2dfe61384e96d7511ccabc593fa1a519eff0bfa3856e9fed0d1230c722b3b2e3
SHA512 407a2dd3746e4c6eb46c85de2350893fc20da22cddf73616efeec47c179e86dff3bab225a0e6cf055cece847b963595e70fa0f16084226a7e2ecc4e5b8d20419

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.dll

MD5 fbb6376b62ae94e1c71b6b5759bcb97e
SHA1 28069771ab652fc1acefd6ca3465e67621a49bde
SHA256 18a663af8e8a83abc071e0d28533bdb061fbad448d6222fb30db753d5a69892f
SHA512 49e13467421f3726fd2da23ea7fb6aa31910a535d3121a3e29d42b831dbc76c88d22b10e7051bd35d77dadfccaa35823ec8b1befc18c2957c39c14f2cb67c0be

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.STLCLR.dll

MD5 af06b0154782ad138237d63f26cd4ed2
SHA1 a321202a53c107c91937c103d41ad1bf64bcc6ed
SHA256 5536af09f5e640bc1e8c4ee72eeb5cc8dc62d55502af52b37eeabdebc7b91440
SHA512 f27700d7461f86d8883ef67b913c1ff62897518b5dbac845f78640b530e1c7460270c60f0836a4ab6441bd36f5b76125e91edbe2c185d0174c13f6f3ac5cb262

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualC.Dll

MD5 69a70beb311c9526450f9e050da8d82e
SHA1 7cd24b6b111268c34b391412cc11bcfa92557b78
SHA256 d0cec7fab855128f25d0de93768308bb373748a35fdb8433d6ee735d9e9a11d2
SHA512 92853593cfd6c83081ed8cc65f1d1a1bb7612c1df8272e3b742d74754d094fd02cfe3b54178efa02a0467455cb560db0940e0e074fd3b3f9211cdbd3e47b96af

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.dll

MD5 b8ab7dcbfd2c2aebefccfede08009b31
SHA1 84efc0d8504f557849427aab33cd93e2d683f800
SHA256 2bbadc602691d12b4693e88299217bd21fa757bfe2df3bd8fb7ee9123654bd80
SHA512 9d31cf6efef0ebaf663f597a47f37bbf2c47073cb832d63a7dc25b30989c111fbb14ff42dff03c1f82613a50f9e984897e81e66aa586874fc7b9a90998155520

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Compatibility.Data.dll

MD5 238ae585f9af016fb58e3617671f0593
SHA1 6b8006b28bf70ea0d65ee605f35a51ab0c8d2af7
SHA256 74b8a89240fa9e63cb8ec56bab226b55658b001720fdf09df193a7f51d7ae0fc
SHA512 0305833670b42c34160b9576b38b50fef07a0b569571e2ff15d7b49103b857c99354b8b21c098067aa1682dda7f77f9c8817338b407b08ce170e821a7450afbc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netmemorycache.ini

MD5 c9920ee5d61763b7c9178e7635ddedee
SHA1 9baf3b44ed016741cbba24a5052271e876727969
SHA256 6d1685098d6c38eb1211ac7f75036f0193b0cadeb43d10d8149a50728f12a9c6
SHA512 78fb427ec3cb53c86b3481b237bcbbacf9e732bc9dcf07bb04f92b2d99506b7ce32c622d6ed712cb5aa90ff75a5fef8ad1c5107e7ddb5d878a6d6d18c3566134

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netstandard.dll

MD5 4dd229acd0dd79d15bf837b098ae937d
SHA1 0cccafc55af04d942eb6336560c7b83fd783f46f
SHA256 575d4d9279863aab638d67616c47e22a8d520f21293533a0d26e6f575dc57df1
SHA512 c35e9777b5029745522746e31c173b997233b4ea11875d2cf29f60f9a28013bb1d305241b28816f101586591694b720fb0404f3d29c87c12946563e274fcaf55

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMDiagnostics.dll

MD5 b14a45dc7739b64002e6866227f8c537
SHA1 6a039458828eda53b0c076d2f21ba876bd3a15a9
SHA256 5026a4ab9f8a2839749389f16bc51f4c899a585c52417d65dc4a3a5e3622174c
SHA512 ce044d8182f54125b12f406f89e99f2dc221e61ac10b09b4cabb3f10dbe154cb4dbe215878dc0ded6b313b805fb2cfda6685c5d1b93a9d7ae27410547d28e1a4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\sysglobl.dll

MD5 722b11fc5a4a5c85934889d07a5b3a1e
SHA1 9494b308b45c05beb0c8d8762426765cd14037eb
SHA256 1c0a7ad349cff5b13ddd5d40ca2640ed0258c3175e50f82cfc8fe0fd82cc3212
SHA512 e369c070d0aca07a355d0138dfdda793cb3028e6f86d43ef9b83e8ef4e68140267a54a292542ad116c84df01533a4efa5efd738c598ebe18a91403734361bd2e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Core.Presentation.dll

MD5 63b1d61bd3aa938e21e8565c375caf81
SHA1 1247e8b413a4084f0621b495ebd3c9e7687b1997
SHA256 584ff0f1278ef5a85e85623e229d16754d98099213ce3804b20391a4b3a0d8b5
SHA512 ca81e224c4943edd5a03f4f0f051a70546910b2b010a53b5e36b5d0615dc6ddd61854a430ed0ce30a3e79521f70bef77dd5829aa07c79ed7823d3b9f403344b3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.dll

MD5 db21860d93db90ad97686d96978d3161
SHA1 fb726bd8231b36879976867ef1038fa3ece246f5
SHA256 d6eb5b83f12441b5dd8e3deb96824935824af917d17e3052e67e99e306c96907
SHA512 e6e7e659d9364659130e16057f2383335cb9a0d3794eade9fc7480b3dc141c5509add622d96173a5bd206f3f9d55a1b6ba78d75a9c8af62957db669f988cdb70

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.DurableInstancing.dll

MD5 625d6d9c3f1acf5a2d23ac99466cfe74
SHA1 9d015a3e5f9cff6ed2a015370eadc6b9be4f84f3
SHA256 0242ea8e54c0279b465429126171dc088d80f034a4d8d645211135b62e246092
SHA512 da4ce6cdc3e1812668fa1de720c60298b1fd9feb41de6482020d9dbd596a91ead2119ecfcfe33942e5c6eff27fc335374b60168c91577693573c5d01dedb01bd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AddIn.dll

MD5 855aa120a62573925ee84936adfa95f1
SHA1 a92380cecb934f6f0d1ac599ce4c4c7d0cf9713f
SHA256 fb59898de36cca63e94b3f81c20b0245b9773368b3f3f457d9bccc51168b898d
SHA512 423394ee062b9b97971bbc3bfe92f2b718ad12e53333a262bfc6626f4803bfb9019b61065a7b8372df050ae5305ebe8e4a18f0b75a36039c452ae3f858aa5f71

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AppContext.dll

MD5 32755d1bebfe487fc096658e98954448
SHA1 79601db7f63f51c1ff5d5302e553f891cdb7f1da
SHA256 54fc8d5f0cd4df6a78b0affabf4c28c852bf6e138e3b322bc9c9454e16b294d4
SHA512 1bacf0d9b31873b37b790db92e7ddaa54d1b737934eb87fd9b06752a94076f56653cb6537450836cc1c15d99884209d6681523ed00700e0a7b22d8dde4a783e7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Concurrent.dll

MD5 df01861a68d7e362ab2c1cb7d31db011
SHA1 9a67ea44246a4d3e9f0566f3f3cb0f7d9d318bf6
SHA256 0970825b7f00b3cc6e676523438db8df8a448788bb2a506044737b16425425c8
SHA512 451adb3361355c511cb239fdc77eae3ab9f97aa24d652326bfe9f288be8519f9d1a0cd66f05677fdd17b1a45898764b0be837c355ee5ae87252eef1796a0397f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.dll

MD5 fd217b8be6b2991975df578fb833c721
SHA1 0f40bd265ae616eef17a7faf1d75c16f40c665da
SHA256 75b9a873ac5b27c11a128e6821df24ffddc644905b3c46440da1d3bf4f5d6333
SHA512 720f6efcbdab6d40bf83faf4033a930cdeb71eebed020aea3ac4d26cc138c9b1925a7e78f8aeb936490129e6c996e038443ffa02a57b8178d6259894459799ee

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Composition.dll

MD5 d31bb41dd91bba175ee5d79e8b4a171d
SHA1 7421ab113f72da343cceb3d82f88224d5fd7f480
SHA256 833edfbdbecdff772a75579bc1cf1a9f95804b214e228c442d5e0ae4d897441d
SHA512 e167b89d4afa9d7937c7a3305af8883574118d50bc5079d4daed7273047486dda88ffc849fe09ce0f2c66396e338b3285357dd05e8ace40a591ae98943e6d0ff

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Annotations.dll

MD5 d0b04d783c2e45ad099bc25aab4360fe
SHA1 66e74b4bcf237436825eef4d8f11d3c04c6bf9e0
SHA256 7331c88a5d4f4e470d8f80a3d92842c24b7e32f7adb3a21150d9f4f4ab59daad
SHA512 82a127b81eb889ff2115577f819d06526413de918b27a3dc6855bf06e3daf9670f300dfb6171723db7fa4b07d3a9247027cf1d560e1bb4e1a4190249cdb15565

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.dll

MD5 17c9141999c3ad50d079e07503baab3d
SHA1 46db14bb6f7f57542e2c073b705df6ea1c8c930a
SHA256 0e39101c299b8dab836ef44eb3ee4975e4c816ce7f81dacc5e0a137ad7abf5eb
SHA512 72e7ba0aa285bf0744341e75f28dca50e55f59e315e99423e219233dfee547013a53e43d98bb53b1fbf4b20ebfc3250dbf703b5860a6dd098ce753026e77af5c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.Primitives.dll

MD5 13fac9f77ffbdad29a26a950e0234ce0
SHA1 06e99cc299304dc9db7f2be241dd2ebba9b62b82
SHA256 c60508434f688bd86871668595e70183dd5ed4d4975d0a6d3fee39e65edc3092
SHA512 1082b5d2d2911eadaea641620fffc165b653bad86c2b4f64460801cb6ebdde6aca177dd075aafe8f91660e922d2128a6542e3002fa3bada99b4420c9acfa5894

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.TypeConverter.dll

MD5 f537cf8f8c6e3c25a1338a639fe6a84a
SHA1 b7ee9df145be321284fa7d45ff965cbdc7c770e0
SHA256 0b9413f07e31b51bc7c49e2c5109c82b5b4301ca5f5585697a512f468234cbf9
SHA512 e456d16aefdcd18a6bc14df496763291b84a2a04c5e03a40c4247519ce481724c40e42bfe31630012cd1d03d0efe46e98d54ab0f5e906491b1de57d887579724

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Console.dll

MD5 e08027c7deb129bc56f76acf6f3b455c
SHA1 b768e1a68c526d96bf9f48bf6ab7ca792ff5d72e
SHA256 d162f199f6cf5e788e90609709217b650bb1a9c9db7d2a2accd186abb9602700
SHA512 aa68f84f57b600a86554d6b26f66251c585994ffb4fb4c6279bd1852853c06ef6081028455b5c7b61323758e86c9495db2dbbc0db8ebb5482ec372e8f7ce4478

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.Install.dll

MD5 9664a699020f9d847f0a9a1465161fd1
SHA1 7405282f1a686a94b6b8c45de029230ad1be83d6
SHA256 7ae5d10ca5afaabb664ed4460ccce5999a3a423440b096375229526622609acb
SHA512 938c196e78feaf8fc7131886df12e958c3a604401d1f0e1298b568b7d46d2ddee93fe6033e537cd4762e0fdbb1b3d0a047c9c945142195ec17fa3781e8fcff81

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Common.dll

MD5 9a8f0bbd51e377639b83bf4938281733
SHA1 6ecf3e17d5de9a61ead301a95cde6e0f5df4fc6b
SHA256 4a4056efc642175868c365496fb7ce9c4119ae4e46465f4aec63eb395923c3fa
SHA512 02a1c46fe977a23f87eb5ae1098f2205ac1aa8f25b8f0c36c7f74639e8fa1489a1c60d231b4d2315ad9ef8c36b745bec0aa2ba1b9db5d118742ef0f102099296

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.DataSetExtensions.dll

MD5 4226e4392d2044b12bd2f733ad6d3260
SHA1 59ff878f536f961145ca37b9a64e11a45ad0ff31
SHA256 1a55aaa79158f97bc07fc7c761ae0a20650f5a072989742e5d85b9410b2ca741
SHA512 25e47ef6f00dbbc7f6d72c0613ad2bc30790f0779dd1bf87685896a3afc4d92ab63979d1e379eefb59fde9d8c973e0c2f2e56c6d76c9c2caeca43be2866bf59d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.dll

MD5 c906b1f405661d038e20e6167f146ec8
SHA1 b2d1118fee521b2da8bcbd2941ede3864260a978
SHA256 0280f97d6f157a1fa298f2635c3b31ca35723aa3752afb493bced105f49ed64e
SHA512 c89cba67466b97c8f7b120e99048645b79ffcba95ab37f96d5d6534092c64b2ba5fec6012f77d0f3c4b38e8a87bb434e3442022557d2bc45c3d83bf0c8e02703

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Linq.dll

MD5 87a481ed6d21bc360ba4451b5ea50c39
SHA1 4a8a00bf13f362849c1ae5b9bf99e8694fff7819
SHA256 653690d616cb90a1621853fce03dd5fc3665c4f1e5a2c3396173470ee60dce90
SHA512 1afdb11c1788e90454ab6a4598eae02321b531d4fc7b530fbca83be40353f429bb678708d7f5689552bc810de67c771d19e011567b3958b21d09a94fbd59c559

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.dll

MD5 868962e98f6649ef617d1ee8bf5acdc2
SHA1 37dc3084c4a1da8c9e4f1f6db68b4021c55995f5
SHA256 ee4f0f0ee6d22310c8aba51c7bd113f9f2b3edfe5b8e38ad82a1c3c1c233d607
SHA512 1c1ac59d71c848f7d2c1abe37c4a3c4005234ea0c7bc80394e3bf76a2ed4f4fb53266710b00d4cf86ea4101fdce2a462ccc0e386690c8b0595aa5c815aab5d3b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.SqlXml.dll

MD5 14cd799ff375081e8f31a3ff2d66c7f3
SHA1 d40921a6d51e2b382f42d35f3b762fb2f38854f8
SHA256 41d10874db47c283fa3497130782097ead936ecb48930157444c33d9e0b3b7fe
SHA512 52e2a40efe32d256bdc8ec474e983125df745b198c453dd33c01fcaeae964c996216811b808c8638d10c1bb2df0b07152d133f402936ed4c967682242470d097

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Deployment.dll

MD5 1295235b4c50a8bf9d62518739feb5a9
SHA1 eb557e98dff1d5b6239d7a335ff7253de319e0fe
SHA256 5f9feb764fbc19447a0d4c3721ca6f6923a22c859c7533c7b4693e8f6a1a3203
SHA512 cae25f35fc02796fa39fa1ab5bb4c152e2468b49696c6321b14bec992f7d9666b95a5f42659f505ea0bbe179d30bd4ba4cc1ed4c051392f13ff630335d5093df

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Debug.dll

MD5 904455b74bb1e7b0c49cf84c42d7aae1
SHA1 7688f34f2d90540d399c5e989a9f1e5740302093
SHA256 2776b64e4974bce738a7e7af57f4ee8d096588c5f87a41fd3866ba2711d57655
SHA512 5a374930f5ff6370bb7879a6db6117121b314db518c0870ebe7810868275388aa7a44ac94a9c65e3f14df45618f366512bd7e4753d4b74087438de43ef864409

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TextWriterTraceListener.dll

MD5 ba48372b47726a3a3f77ae6aee55263b
SHA1 a2e28d4f8529483e071dbcb788ec67c22d3cb905
SHA256 412f5b1aacb7d48c5dfaf5ff64dcb29e7cff3c85fffefb68e14bec73985b7986
SHA512 d003dab992650047433afc28c78e20b6eb057034dc22fc41e6a4129d8e678c2dd0194b4d498da182abab14a8f85f8174f0b3a51377041e20501a4be1b2d093f5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.AccountManagement.dll

MD5 a08845c8fa3a2a7dfc34933de38213c5
SHA1 ffcdf90fb8f14770a6a99efa2cb524c18a50e2d2
SHA256 64f6d33fad152b6b3939c0972c1b3eb6416baaaa70b666d8e32c5a22098d83b3
SHA512 0f0a977cfb3157a7b2f721a3f20db9c2f3f393eace6513e1593994fe580dec369b1a6302d7a9903d4c404779ff17067e4d3fe0840fe5050d3e268517e98ce3f0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.Protocols.dll

MD5 a005fd0b9b33a8c3977311983f43f009
SHA1 11e1a015254c54a96aac6e7c531951d86bdaabfb
SHA256 27b064c517420b2dc64ff6c91578dd120086a56c476707623219ee4b2a5e6515
SHA512 b6254f1b275c0c25603d9d1058826580ba21b59da4dd16ab48ea04e7dcaac73cca012b1e8bf67aa44ede5782f3f76b4a9b0cbcc473b666ec9974df2085a42a1e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Primitives.dll

MD5 a55fa35064ee65922a24451d15b20742
SHA1 25cfe82666468d1f1f80e1f3069526a0aeccb6f3
SHA256 9a5e0a7163ade41d181ecab42426f0bcb637494cc71b0527a8b8a68713389e75
SHA512 2dccd060984346bedb6f5e8c91a1d43beff05bb383f0a38ebccb53e9f3dcad7a27f025755a0689f27dbb59b127253e96c53b3d0ffd2c67ea40b6aee64b4befb4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.dll

MD5 791c354b145957c75537e21411586ebe
SHA1 cfa5e9c09995027d5c0c37371df98fbffd90938d
SHA256 974bb57af81d6cc6b5045e2ffb2319478c97945fbb9df2bef93b0c69a3bc586a
SHA512 42046b7c005ae5a49be69e3576781b3f0a25ef683af0e1b5859ad0c4c71b51a1a0980e2765936c2503d063c96f726086af0d1edcb639ac3beff18e3859a21ea7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.ZipFile.dll

MD5 e9819bbbb695fbc14e7838237e682627
SHA1 7971938204a32c2e72fe0362d61b3650492c19be
SHA256 cb4bcf24c2d551bf589797a7836ad0741488a82db364835a2c2a53bb62be0006
SHA512 1c4047d1052bec731c9a2b7e0333fde4307d110fff08c444367a59aa08b39d755211abbf437f1afcb6aa53a0b8de448566de3c424664aa8a7379dd43cc7d0e30

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.MemoryMappedFiles.dll

MD5 ab5f0fb0ea377e2644825c3a7fe3c81d
SHA1 e0a87299722527f300b017bd62779ab7bcb93a34
SHA256 7d658dbd53057d02e324e6feecc4b125fb649658661218356f8aa149a9542513
SHA512 d3bcf1e1edb5f21f8e95410921e4f5fdd7f381f0ac9d50a284c5c30ddcbd02a038697d209050355f5be18b762477d5b46c0e6dbd669b88dbaed652cc987e2c9e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.Instrumentation.dll

MD5 4cdb6c24865c65484f541dc3f3cd1e3d
SHA1 f2e20b7db8abef88704febba1b08083c6181cff8
SHA256 52953a642463f16497d0437304ac8c1713cf7e9dcb843b3ac72c803f926a0748
SHA512 b2a3ceb504a2d846aa8139581754549f1b886e718142360816b763b9e8e35b31c8b5e0fa80eca2a79d6a0e032a5ecafe7000850be9c62329f4c34ae395d4f734

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Primitives.dll

MD5 4e3d9532f81e3540e5ce0edc52825956
SHA1 fe01f09cf8728538e569f829237282d9e28821f7
SHA256 139338f1cdf16100c0116786e2b9c6a4709bf5c73eb0db975916ac0b8b1a2eb7
SHA512 e678a91c56616419c43b887f30519967bfa67117e00cbc1e8e6c31776a0b169284ad06d35c2315868bc70fd23544591d0b5ab6fc8806e734e93566895519eecc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ObjectModel.dll

MD5 d262aa8e9a99d6579f2dc6e84c5d7cd0
SHA1 f1fc5ff6f96d3564ef6b802791600e05a8fde11b
SHA256 276693cf2134ed64d9d43b3fcd20da56484fa2a439afae7c5aa755988766eccd
SHA512 7a516e7206c86e41bd3cffa880fd70c0ae162cd0c285e1e263d4d8795ade5178eadfc26f26d4203f3f879bbbeb9797ade77d32253bf706e336f7014014f33b99

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.CompilerServices.VisualC.dll

MD5 8b5506487ef2818eeb6ed361d36ad175
SHA1 85b3d63461f4c9dc18ad3e92e7484b74f220ed9b
SHA256 cf96ac0d5b243d0807de59be4642161f44d830086e8f2b0bdf7415ecc9683ec9
SHA512 7f378e8d62e92aa9fdad25b5c6b99aaafe8dbb903b7f8f61bc5d1c64dd02da2e0ce8acbaa0fa7ea1957befed508fcfd993f24bcc070fb95453beba76a7fd0cb9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Json.dll

MD5 d727a295c7ee38a0bc74e94fac28c2b8
SHA1 5611d214c8408fee54d40c3072f455f26713ba76
SHA256 28f373155fd80984c85665fdd7355ada26706311cd4c122c3a3801a04be47b92
SHA512 17e46a7d75c3a0e92a39a2dd05a7c6c1d3dcdfc0e76b32f9235ef3314640123e779161a12537f07e6bb2cadc36c0cc9e132efda5c634ad0f2230bff3d75179f6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.SecureString.dll

MD5 210672751fd418d7c7dd0c6df707c8a2
SHA1 e16df41e466aa091d27ce2a12258a1a58c6033ae
SHA256 7a4b45a96d7ad0d762f648c1d67d29a5b1db58dda5f1b6a978d412fb42aa138f
SHA512 4b86195897d53e9c06e1f271089152c8e1536526a8c168ee34a1868f1be701376faadc60e1578c7ee8c1440e4a679644827ee2474c8edfd36ac73629ba87e26d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Security.dll

MD5 9581624009c3efe3842cadfb95870ae9
SHA1 b681412297889442c8c1f37742ecf1f11e2b5c95
SHA256 b5b2742c6c1f15b88e36674054c60c0fb529c86eb721e801248918ad7cecd4e1
SHA512 980ef36778b772440ab8762b41df82bf192203c8b3c521ecec3d93b2e581a6a4ae144aa1709cbc150c8691709b206cf7e13b253054fda1fc3c3e76afae828581

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Thread.dll

MD5 d58ce3de04fb56f7b7aa719187601a2e
SHA1 0d664b5a1ade859a06f57f527d9769be4745990d
SHA256 cb7fa31412566797acf44b2ba1530393416a19e1e8d68a0eed7bfe2bff382d75
SHA512 de199480499c244d8f8a41de553b31aa02f5a724450bbeafbb571e4644084559aaac91c69900fcbdf01c118b9f1450d0f10d8194468a2e7167d9b61e15610612

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.Design.dll

MD5 c587e59bbafab1627e2e96390175968c
SHA1 5016e2bf475315ce5708b16db2f8574ab016396b
SHA256 5ef3a6807df97fe1bae44c1f016c086f6a8cce0976403ca5d4efc6f3dd82ec0d
SHA512 ff8850d4d8ac1787716026688fbce9bb799c22d127eee43d8470dc4ed976a9e87d8c5ec1dacb635a8e844ccad6953135d63d246d30e2d80f03d49b530a92168a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.Design.dll

MD5 43969f7257d50fd8b0687bc96c8b6f74
SHA1 a7e9a792befbef63c4662a11b966f9c17e3717f0
SHA256 a01b40f4b9a97afa7cee5c446f95c285482daa17ddd4e7d67266e2153bbf69e5
SHA512 d2ae916036c8c6a30b2a412b2ad86cab19b893e5facf7ced02735bcc305008b0f75275782ceff117eb857426b7face1ae43d2a41d2e8b54792e86faf18434fb6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Runtime.dll

MD5 efef1f471a59bb1f8af495d5614cb43a
SHA1 78abc25a3f745c026da2f2370bb536dfd0c3d5cf
SHA256 04f73657b508f98ac1269366468c579f36aaa7ee5f5d0cd20a2a8ed697c305bb
SHA512 1338d54803315c247d0ef73c36a8e39b85ca86d4953e84e784347984f00a03addc55c02e36d53b2fdd23f71902fe16820461cdc3832ae9d8697021e9c6b9644e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XDocument.dll

MD5 1fc2ab077fb91c6277d557378689af0f
SHA1 4a46fcfe67aaa4db49cffe3307784798fdd4ac38
SHA256 4dab3ffa4abb3eb4c2d4f3adbcfe36e75051a838fb08ac41b4e2422e736c1bd2
SHA512 f5704d15aa216c8712626975039fba793b86950a70f3c24f1a1ce5d68fce1082f11dcdcce8fe09956968094e2511e82520e9c6802ca917248e9687f7798e7dde

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.XDocument.dll

MD5 6754bc2bf9cbb46e9662da6147e189ad
SHA1 ccceb9615456b683839debc55db4b2632e54d3a0
SHA256 349838346254e6c8090a1ecb7243181853f291ca7d00f7323a4a3a5f3d29fb22
SHA512 e49d4bb076082b0c011e10154e4e37f4eb7e3fef3a2e37b5f9b824342f8f73bc33f26052ef858d01641dc576c645587330cd89daff5767b886e26f38a256612a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XPath.dll

MD5 aed64f576de4378f6047090d94832a73
SHA1 e876b2b70c9c4f656144000322b8e7cd6ac50c37
SHA256 5f505a18c0ca2974141977af70a1f743c2967faa42629b805b1acd8d1c89d9dc
SHA512 026d239e65782d9e3e9b4201f9583a46f3079458e15be9a50052cc5f4ec1ae07f06c568fa0b830e97e2202e5ce497421f505157181c0f67d2f3975105d317ff1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXml.dll

MD5 82fb77f0d92f5a70e8eb667470415843
SHA1 9702001507c3844b23a0780ce5ddfa4375a0f4ab
SHA256 f3338479ce2948fd5f3eeb982395df0e7748b00d99ecb7fbb6bf250e8fa2d542
SHA512 ec2a76bc1cce7b9e918e7d61ed4bd5da58e0c5560bdd3f2ce4e84d007da3dcdf0a01c9043f9f5a8fe9e267621d8f00adcb9392fc8f77e60d02d9e9aeeeda2f75

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Royale.dll

MD5 263862293c055f2e46b6596b0026de2f
SHA1 d54ef95fd02a380a81905b06b68b63606b6a3755
SHA256 70dfb5f2a9d10b0908d2e7e2076a2448e0de175120b66383ad9a8bebd8ea99e6
SHA512 79b075d99f1ef97d863e34692fa30ea7d65a20d08a3de468b716e17681cebbea99ff8f1a5e43cebc9b850f86694ec5b56aac11583101f401f20c310677be2064

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WindowsFormsIntegration.dll

MD5 18a13739d28057b00f9db343f22cb2cc
SHA1 2c364280bb0edaf45e810684b172564a5073d1c7
SHA256 8b8d1a4c0714a6969725b237651d7a78783946ef5d419941b645d599afe7fe41
SHA512 f62406c63fbe139b0ee153d4dcbeb4eca4ccaf62db930705b6393edbb1e35a4a0d55cc192c2e11191cb96a88f01c47248b56376a208e70794b64bfdd3bbd9156

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XsdBuildTask.dll

MD5 0c6f9cbd182b32875dccaab8737ffea0
SHA1 70a3a5517e48873ec0827c7a63c3c6b16b36b3f2
SHA256 fd9c2afb181684e0419e5d69b08a13ea01b307831cfda116b30f40857154c1a2
SHA512 9a0eb5f00d8738f1fca54471ea47115aafb81ce3df0695ebca99dd40e82f6d6cb72a238097fd7e29a656c1529876dc656282ef19da8aee7fb40d9c708217fbe1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\XamlBuildTask.dll

MD5 30c66286a71197e5082c7e58974b3a4c
SHA1 dfd37c5e6ce429febc780cfe25a3f01c400832ba
SHA256 19e7d5cb4c3380ba03bcce1eebb14e865411f457441527aacdbf7d04ec7a4d40
SHA512 6c479b7bf6ff6629048a89433bb6021d8430e266fe143c424bda94cfe19e6657db471eee1be865d3a599be8cb7ab3ee4ee5911aadd90782b25cda970babd4fc2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WindowsBase.dll

MD5 57ac8653eb23af732b11e8c22d7db083
SHA1 82e8ee98528a30c3fbbba0a0c19eaf9365d4d9d0
SHA256 97e10e1f1c1371445e04d90c5a66d0c7482ddc25e0c471ba25289d38a4760dd4
SHA512 da8140fb2421cce684fe71821f41f837266bf7cb9de6fbc6f22d2bc7b4bc7bcd52c84f94c48ce138529a9f001fd39434557583ce689f729d1f3174b6b73664e6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationTypes.dll

MD5 c1d638371424cbf2606fe200257499ca
SHA1 86e2e791382ad2c37cdc74d40676d5e3466a532a
SHA256 6dafafb7475e9ead63a4d533820a246176774fd4f1cef53aa5ae6e7b5f722cf6
SHA512 f30793527dc6daabd609cee694b13334efd73eb0b11ca15827853af0a1ffbe05e16dd4bffaf06832e1be9a5751bc075c6954b104f337c12a588c2ef0fd740d6b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationProvider.dll

MD5 01f6a4b974568f191ba2295b5c58f994
SHA1 2a4bf77d99038c62568c7a0d73c05a60a7a040b2
SHA256 b3d452e504a8790618f699a61242ff45e7809d425eebeb3f2b1c1581d61ac84e
SHA512 f70da9dbd0810be0d49363e1b65e347120c96eb6e0648f2e021a4fe2d1602dce06df731c04f651fd1f3791db4975480e7109c62f9517ebcbb3b004d0cd9f83f1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationClientsideProviders.dll

MD5 9aa7deb308e37b4d80217dde916698cf
SHA1 58292078146e8fb331744980495f11df22af1915
SHA256 a48ea0a6d0a468bd38319a3a6fc4025ba63d06dd4325d660ddcbb4df5883dcc0
SHA512 14cc7bd7e98e64990bb428634be6cb8e310d472414f45f49243bb5635f194d9383a71fa6d8899903bb4015a74556101fa6a7060cbe28e7d10c549563282ef71b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationClient.dll

MD5 eaf1e75cd64d0cb4d686d2656a077e38
SHA1 b3435d14bce7267d021b793bf9b924ad5c576b0b
SHA256 115adc3083039755c044b76f87b2942771136f3f48029fbc3b96d652423d17fa
SHA512 3f805a44acf81ee07ad16b5a16e7f45d97611d74997c008f2924541c02e4267616215daaf976022ccc6f0f8816ca8ebec7fbb43f96ccd9406f44efe21fbe673c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Presentation.dll

MD5 d7c5b3f29265db284aebf3c00c023257
SHA1 6b4a5620bc24689291c1c2824071574e26815471
SHA256 1f5ee5fab6aa293a117ee3ffde6ab6e72629b0fc248abf8168d13646793308a7
SHA512 6f32331180f572be2e413c6bb95aac4d75a40584c3c12fa441d94007110902c20e4456072b011fdabde6e6d5f27631c7a190a423f58e8dedad0ee5ef025ffd50

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Input.Manipulations.dll

MD5 af5ff15d730839575224ead3d5260837
SHA1 3c23b8cb233023535b910048558fdc84e8a65be3
SHA256 49551326e715dff3a7686d3564c19dc41f6aacb68e34fb24a74d0d6a1f2ed7f4
SHA512 3f47a515ff3587ae4bdbda7a4d563f3bb1cc2927220ca7755f9afb902da67dcca197c61d6ed000fa4a9e6accab251b8f73d2d2cc5c5fef966299cafe133a5b49

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Windows.Controls.Ribbon.dll

MD5 41ee2f0f5291e22f01a49d198d52758a
SHA1 dcea86a0d6f58fe9de62b854668ff75b07988cf9
SHA256 ba0d437f399a68e62350d1a3aa59c1e01bfacc1e4384d9f06d2c47e288ad2908
SHA512 7b82d260c6c82917f183edf30e2fe9ce33ffeeb46e23a4e6c729d3f1a29ee04402d0209a2b8a1836e3ef00a3b9efe159a152532774914132b32759ba860cf187

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\System.Speech.dll

MD5 6b5b79280e7b94f3278412a444fed6c1
SHA1 29b5d973dbb0c06a33ff48daef83cb615970aabf
SHA256 a32cdb5488e737f081b9748f6948d929623016ab6eaa57e1e5ce372458afbbca
SHA512 4bb7020eb5824dee897e64f55fad2b607d4d9bdf07f2218dfa34feffe64d874b14041e7c3481289625d8cbb52963256a9d650fc4d059ec9b6dc70bdbbacc2e89

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ReachFramework.dll

MD5 83f68f12a0e1bcb396a0904e32329036
SHA1 fb26ee1db7d14d032aab71e83605a4939f0b297c
SHA256 7eb4c5a1c075b926ec1425ae727c83978cfe26ddc9f24f1ac10c394405364576
SHA512 d4db19ddcd9e2af9ef9dd2b7d78c49f2936a8061db1dd2920883aa54444c99b07fe201d357335837e6e03d93325c3fb12a1ad7b88beb0a976aadcc38510721c1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationUI.dll

MD5 2ee941eab9f9dc3271c1ecd38b2fd484
SHA1 a82a4dd367ffe987c213132234fb1d8c860d06e2
SHA256 db69fcddaf57465a6cded3e7527d15d58d27ce6a97ce4c6bb3bf8f269d97571b
SHA512 40e55f3e3cad8ac09ba3ca656ed8acca8bd933046a07a8d92cc2a611c658ecc2c982c97b141e656913352b586ce78d1f7a1cabfd131fcb19062d3cadc3fa43c8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Luna.dll

MD5 0bd0f59f5fd6218e8b02f94dac941671
SHA1 b58298ba7303882d397727567d0ee76058fa5358
SHA256 ab31a2b131544438a94b405f25f19cf82d42070477a2f4ab804740449c3c7946
SHA512 36e34e609bd3f50ccc41152778316c1e20774f73fd563baf1e4a28355c1f914345c0c0c938e3d6fe1cc84d1f9a13e9601e7a44d19e4102892ed0d72d78f19f1d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.dll

MD5 ca9ae108e1c76b3a330e6b0d96a9a7e5
SHA1 ab8d94184018186d035dd83481575de31ebcfdf3
SHA256 235d87d4406f4cffc50ce0b8d8c23a61122bb58586bee6eb8a2f10b46ef99957
SHA512 bb1a952d8f931c44cbc02c3cc798169bad8b1a131d37694e6ec143c60534dfccd4be176dbcd59761f7e61e1331e7287bf513dcc482d8cc1a51cc417a7f33cf9b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Classic.dll

MD5 6e9575b695eaa610be66a2ff045b93bf
SHA1 419050e5d1dc6848c98e345c3dde50e8f0bb9771
SHA256 2228de3473a05ca1d30eedb472fb9c65b95ea86cc4e206a8b85cdaf05030f50f
SHA512 f3b735cb2e63eb2b397bc8856d4287c724d06413598014a0fc1434069c997a4c1c224ec302a3d725084b6a6ef7d565ed3fd159866faad0c668c95a85a16fc16a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.AeroLite.dll

MD5 e4a1e84c6477f3d62a1fc1761dbb90d1
SHA1 00bb26373c935ab89aea9b2b64050681440409d7
SHA256 3cc0ba2d5a44a0dbb403438f1af413948190a01db3029fc320a9e8ea4d9431b8
SHA512 97d78a64e54cc14788c739442ac242e6bf4ef0f063375f398be1d1369f7923f78a4c5b2b491f2151dbbf017e8e608743d869e5fa3ecc79c557736ec3cef8474a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.Aero.dll

MD5 7bb63390e0a211e3a5470c4e0a6f0014
SHA1 9b3a4ef8e16188b6af0ca33da6dee009d2f44ad6
SHA256 5088ebd8bd88ec1efb1abfb9f41443b3fbc6b9ba7a44917fbd16b327395559bd
SHA512 07d9d9cbcf8c9e6c9979e39fca9c9d679b35f1e21bb9dec4fbf838980feb030c9576b8cdfbf652ac3da821017dab1574a5cc63d612de2fa29432e8354fe99740

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemXmlLinq.dll

MD5 abe467c647060192886b4ddd154f835f
SHA1 3db9e9694518fcbe2e11ab7a98f697c788570d17
SHA256 4873de7a2427e14d2d96bfa76175560da4f0f2f7cb2f41b8ca606223cdab3130
SHA512 0fc1c95e3c79707397ed07d1e2c730be2566266e97917b165d5444a1749023dc78193ec63ac1940b3fb76a29c5a657474b426e3bb4bb4d5711d32e24f9d554ef

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemDrawing.dll

MD5 301687cbf1234c3bc9297637e3abbca8
SHA1 4672f8bcded0e3818e698f41debe2c17a77cc41e
SHA256 928facaa8f0212bfbc7f5f77bf762bd560ff92ce112dbe69caaef9bfa78eada9
SHA512 d2404285cf9a8ee7e8f47b92176c96a14c60a025a60c9a998b9ff789fd1b5bfad57e074cd495b6c1909c0e5ec7ffeac8f9aff645c53a89f59e6c9100d5dd6834

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemData.dll

MD5 b98a7297d9c804ff153338930e95379d
SHA1 613d47741baa9c65694235fbd8320f45352df867
SHA256 23eeb655512804e7f3b5c088763e89bf74a4a541ec4bdd8fdee175103af50638
SHA512 cbfc9649e5dfa36cd380fab52d7c4757723c5e463d021153ff62b0216eb24f8749d182b2e4344dcfc0661af3af44c5694042faf8b8bb5a715be3f6833a1c9563

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework-SystemCore.dll

MD5 34e3050ff94be37507ddd76f27319321
SHA1 c7ca955c449f7dd07c71b3dc379c9ecae00715fe
SHA256 d8a9ed8503d9da90d03c420d226b89837d1ce47d6e86524bed871586cae2ed65
SHA512 2e585152422a55d942b77b537aaab2f86814d94659c972eac05ddc6bfb6c8cef9b9a7137d0191fb4cd417d9560a13ee43e427b13eb0dcbb3565151f355e2d67c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationBuildTasks.dll

MD5 f041b991cec615c397e3dc0244c98844
SHA1 14fbf65a17e34910737d2f3c430cb21dac499e19
SHA256 7c6ab215bd05dd7c764408708efca73bdb1b4fbd91ee8831350fd2ade59691f6
SHA512 cb12da0be02ba647938b8bd40da5491f7e67ec71dfca684b23c2e817b511805ca77006cf614ccc71a72da8f0f3dbbbf9f6e3dd12c7099d8f4214652d07c22148

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\NlsLexicons0009.dll

MD5 c3f056a92903a7d89a0adc33c16aa38f
SHA1 1da0720e78b7798c5939d60683bbf25086f301a8
SHA256 f6454b91eeaf28e858035d8bf597c84080a01b5c1c44991a0ee5a2aa7bf0067f
SHA512 7e9fe20a709fa4a886ae3fc8d90a8a0460fed915b81373cc4a36996a6675b3b67dca3c47369302aa208698a349d75dae99f9589d97e9632bc030870a90c201bf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlSerializer.dll

MD5 9bb4da8d570043ef91711ebd57811434
SHA1 80cc27390846672b8ee42695fb1795e8f6f0d0e3
SHA256 db29923c9a76f13f51fb08cee718f4b1732fe9d5fc929b8a4b0d72a7a0dd0fe3
SHA512 8ed3c597442cb941199d335927bf3a3c587af0268368e9677b4c30e77c5974b5c2517fa2c563b72c273b437208b2b36afd663782c41e49d27e673634456a6641

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.XmlDocument.dll

MD5 0ad108d98b70b73f123382ed4a4e2eaa
SHA1 4182eca7a5baa3e789c90aa3588bf3b88d46f4a0
SHA256 ca5f21f9aa8e6bd92b14ea04cd7cc011f6e665479c142cd6a64202dc3abc5317
SHA512 0eed7d6b567eecf068cd606c068e094aeaa203ec53464dabe6111d25e8d913153bd80849d78b244cebfd1d8fcc51b2585e1e5b67144c6978ad72bdc99ec45e29

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Serialization.dll

MD5 636e95428dca890184f35f6c7c692455
SHA1 46c8824a7956ab0faa7d8d34f85de329fc1968bf
SHA256 dd0f37329846d287e67ead9efa5e95f629f2c6388deca146ef7c6cacc7997a24
SHA512 d5edaea2b2536354346b3322ea94b70ebcdcc12273a9fa0b65d997ab4573f6a72afd5b133a581ceeaa70d2b93985596419e6e3b60e91cd5e55c81386df068396

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.ReaderWriter.dll

MD5 d4530d93c421ea7b3c0874a14a8d5e5e
SHA1 d82dd61598aefa752cac9a646ff71ca5d3dd8ad9
SHA256 8efd1ad91a4380ab6669151c8e3122ab9152720af4bec6e45b46f65810cdd9e2
SHA512 2bd11554e25ad18d1e9b2b779b4f02c1b4f45efabbb49f6a91a746ea28e1ea0b494dc4ba34a6bbecb6c54a7281f36ae72621c4703eea40d685b5283da2207ca7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xml.Linq.dll

MD5 435bef82e9e267d2f4c876e580db5132
SHA1 387b75f51e6b0539e99f7b4d6cde3a560da2b768
SHA256 25fd03780548916d8735c9160dbba0a87438ac564bf0f6f519211be60bd980b2
SHA512 16cb30cc8333609d2265bd46897e1c874fc9753b0257872e98d99b118832f93e13b0ad688673efe1d3cce65247be6bbf0c2faba40ac40aa0ce81753a0f073772

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.XML.dll

MD5 58efa9b1088237b3a86c0461fec272f4
SHA1 74ce0e660fdea499cd505f4bfba3291dd8abcdd6
SHA256 d8d7385a92afe929289ec7059d2ad861ad075460b136104b7944f68240c565af
SHA512 dd8154e6d5f8ebb7b91378013bfe154033d2f60759b1b56cd1c20b7c3d055b8e918841f06a51e112380e880ea2e1fcc139a47aefc1abfbd50fc023e8017c406a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.Hosting.dll

MD5 7c161f1389ee705529494aeee28798eb
SHA1 9a12bbd3d8f5fcd8b0218a3b4dd3028de4d496f4
SHA256 e374070f747609cae77eb5fecca8454fc9b23ae6c59835c10da28d098882faff
SHA512 5b88f16163e69717334f11426143290335328b3873d8bd5228b3284fca4cb0fd212a2e102a3f64560a33a5a91d9384a886ac6072d579af8be1f1f32fa3641a0e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Xaml.dll

MD5 03d67f85e5d6315a6e13a843c9289204
SHA1 ece716fd32d02d473edcd3c14338b7886cc4e9de
SHA256 ca25a90cdec5c9ac5bf2706ba87ce0242a862701b6fc27d67564d0cad7563bfa
SHA512 51ab32daa68ecb584860f2c20f18e86e71ef6efde9d1dbfa2f3780356e240a7efdb957324b7a267187b084636c0757f2e75ec1c2cd944925055c5f784c7b544e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.WorkflowServices.dll

MD5 21e29032e7360ce10c7e99e838e22738
SHA1 a3b1f5e9a1dd7900ddef00d2c0e30da2415f0558
SHA256 dd4058b825abcb4ffda3407003af3a4117fc6b7096b809b623e6471898207a34
SHA512 329bd1b3e044cf222daddd293007ee470d842cc6d13dfe322b0117650115cde8f89a8225dbdf3f6830c2ec90d9c4289682ea4f36ed454f9e3c277fb9f2669c8e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.ComponentModel.dll

MD5 3e138d6f1a01a84db24beab6283ae512
SHA1 6a74e33b10610000060b771b410549b5439da10a
SHA256 ddeb999d7066a3ad116fe185138b7d85d0a7979a74dbc89addc6b3bd126104a2
SHA512 bce99eca1d4a4881f70b8c6f4e5aea4e3fcdf2c76f60c78d9acb8a1112465e5ffabf85b55e517906a1be6a3449ad88e5b5f9d98ab582a1483de5d51555723db3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Workflow.Activities.dll

MD5 2118fb009727c97540e46ad31f58353f
SHA1 7763e0828d08e09c7e6a7e8646ac3833a38ac33f
SHA256 3f30ab0f118c6c588769940d9bb430d2052fbf91a48603b9c1201798adbaa055
SHA512 cd83f13e0ad8256615a0c873c0c8388daf31b9fe8c6cbd1b53bf9b937dbb8059e132873a90bf7504a66efe31a091fbf510e8f6034e3e5475484ddf4ddb142c57

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.dll

MD5 f180603019569cce656c0c0145cfcce8
SHA1 70dcb0fee63eebc045c1f13ca01abecfd205e466
SHA256 dcfd58c1aec0a13221cfd3c84148633070dba83031396c3d57adae0b42b71f82
SHA512 364c361d26ceed2d5137cdb418a40272f9e88a09856d2b8895cf32120f8fbbf0220a9e75a513cbc4779abb5d61551d386ceb30850a891bdab72b8d950e2dc703

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.DataVisualization.dll

MD5 568f927e031e43f997955526bb4e9512
SHA1 12fe9217a79f141552b5f6c3cddeb4ab5ab626e7
SHA256 d3cdf58ead242bb5ecb3258017ccb41f82e49c2f5d7c698532f2534e1f5a258a
SHA512 db8eba642b05539c51ba051bea6455be8a835c9c2d18ddf231f9c5628835dee5be55daa6795470bdf9943bda7c0ffcf36efe7f3c2cb7f21be07fffda76db896b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.dll

MD5 f92b7a8111460382bd6c9fb36c709279
SHA1 ce154aed91d36c13ec2467577593c27a7def83ce
SHA256 8c7b70cf2ba6fe8b64db280cd09a7c6ce76c636e5f32fa949a76a1f683b25137
SHA512 0a33b67e20361f2ad72fc1822e019832b44172b5eff6b7cc773ccc8e232dd27bf6e88d4e9d54427d9fc0553684c3b8e14592ce66a266b80ceccdd8e1d2dddc94

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Services.dll

MD5 67b12b01fd45b98cf36a31dbcddc0af2
SHA1 09913977a12f9151f814846ed216b5417ba0014c
SHA256 099353e5f57df19c8c9263df9a6d363791167dad8049fdf99655d93d9a9a455a
SHA512 cab0f2af45e7b4cfdd54df0b58064395fb21a44f017ded9403311efa0a02f063468ec242dc975fbf9f6768874becce5313ac93ff3982e2bc3a5a790277cbf0a1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Routing.dll

MD5 666c1df2ae929a52365c37e4a9bc261b
SHA1 707d6fe1ee828c779544d4db91a824fa68c6ab64
SHA256 6a21313353fc7a6191f20712c4c6f7979d3aed176c78a96b2936c8cce870ece3
SHA512 8ee8d92bd954cd5bd4b9b6b620762b97b1549030da5c6a2f27297d4c082f5eebc3bff312a343ac4c162562a2c08b5f8bcd332a1a04063a2939e06321713ac3d0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.RegularExpressions.dll

MD5 922ec98829d087cddd66d345af03d36e
SHA1 f7074d20d635a6bc334dcb3c70d73d23a00d4d5e
SHA256 354261cae2d02f626e05206b710cee4c9570857a16df88159602b0d860a394da
SHA512 d300dce53e070842d80b8e57a6fb065c12d535e31f1d3f5b164e4bf28fe0a4a3ce5778d1f18dd605114d3b3b662cadee6f15d42f437cd1958c1b6f2431cd46cf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Mobile.dll

MD5 ba6137556ae7936154aeb2e6e599fa9e
SHA1 65e2548545912ed466dea5cb7d43d13182b8ef48
SHA256 6ca733aa9b9dfe0a08f8c2189d9a4bece5e92cf6b4c2c9c1b372671f99f3a72a
SHA512 5892f439468cc9f14860896b479f1b9310863e1f562b54525f39ee64526285cddf6c99bffe21c9d7cf2009bc788d3d4f1c1f2fd28dc2742e66859441f05f24d2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.dll

MD5 2d296262ed4ea25b4694156e12dbcd8b
SHA1 c6b8c4c558d0abc6e1dd15bea18529cd62911424
SHA256 3e2e5a908224f9d97a53913db6620ba2b0181be5d6cf39b03087afc079f6ab57
SHA512 7920256dcabf2e0b5da7699868a45903d424dd3c1ac06e10f5b0fe8ae9d5063b712cb1e00af5444c783354eb0dae496d78edbc22163d37b6c7552bbd61484aa5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Extensions.Design.dll

MD5 534185deba8b1c629c43e541872689b1
SHA1 72b1f3d9539faf006bff369126e2ae30c48831cc
SHA256 85b971bad2fd1e24163b4e5fb3c5aaa08ecf4a982b65758e9cc083b5861a08cc
SHA512 b77d7b63f467b93060342ecc05bb0f0d0e38ffae57ae5b7845c50d3f94f803e66c5b2ca61168188372440e2b8f3ccc557d13ad6494ce1e8c5a3371281563bd2b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.dll

MD5 d4ea463fc18e4811ec020ac320d856e1
SHA1 3c40a360ba6b590578ac1aeaa6ffe0bf437bb40a
SHA256 1f21f057e08bf701c5dea0dd597061e415695ad111d527d1639f6c8c92baa985
SHA512 e20b1b70e76486fee4c523dd5e4fbbaaba7fbe8058bc519bdc741ed90aca0a3d45ce30e40d4905fa694e1c898222a2d1abec703462bf6319c84ee648dbf6b752

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.Design.dll

MD5 b707882f19ba40defef33ff544b20b6b
SHA1 a7164b15bbc466354655c7356172832374bc98fb
SHA256 7720bf3cda9950d0af64e7f4d5db6f5b86788586a4ef7595d5baf352a2ed0f2f
SHA512 53c3d9f606955fc7768b0b9903a7d10200a8603bee34f775f4d55006e7f764b95d17a6d32d7fb941c5b0becbf7bfdc63ad9bef763f77c2b2249175f580982a2e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DynamicData.dll

MD5 0d3ae633b973321df04d79e261c9c81d
SHA1 afa1f3bf777927c053c30d0dd72794f33468feb8
SHA256 2e5bf656f57f57ec7d6e586e67f8ee508080046de853d064007a03c8d8dc5b6a
SHA512 aeda61710af35dd8b8f68a59b489c1ee175b0de2e7bc2b7c4b8c1369da899eaf2f99b0994f169d69f721f337946093de517b0cc894055f2488667949e0b64765

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.dll

MD5 465a1966c0d95fe200221b377aec3f80
SHA1 80ff38ea792f6d682aa1adcacc80012b89e6e33b
SHA256 1c2937b5c0c277adb961b9519c0263e340a08748969c9d5e8064fa6de5e23989
SHA512 74ceeb2a07105924ec277717ba9d7a55286b771a45747d585692aba483de0b8e980c62eaf171730e4d374b06a02426d4e339df97edf91c09186a6212badc04b3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.DataVisualization.Design.dll

MD5 1c1a4cba8a2ee5273a0c329dcdeb70a0
SHA1 c2c59092a7631258641fd6180b0e4793afb7e089
SHA256 8ca5aa7f183ddfc9ceadb27036cda81d5c64e43251e5974dac31b7da946d928b
SHA512 a77646cb6e1ec21b85a9ce7bee11e59c30f17379f29ad0df638f72c32fa0beab338178fd561392cf46db059cd28d34e46d101692af139908147dc156ab722675

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.ApplicationServices.dll

MD5 b4ba4f9e4a849199e5bf2117e7d6483b
SHA1 44aedc6cf3baf0100de7e4c5a9a8111349ce810a
SHA256 78388d3590dfe5efbfae941f98263300c9e3aa690318282ae990ea5107f2f1a7
SHA512 cca9b8e1098e4600d946fc61d529b278392330fdcc4cb8bebad09949a1e710ba2ba09169b0adb93701df0f5caa66ab9a936e1a5880cf382c6b64c0d887740193

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Abstractions.dll

MD5 4e19bb76af94eeb1cafe7fbf6e6dcabc
SHA1 5d494d8e3f0bcfd24f1542812d29cb46ecfec44c
SHA256 8c4891313b83bd58230f9d2c2dc63b2cdc0f868f89282a92052a7067f9665854
SHA512 4f95d7aa55e6f8abbbb4c031ab168de04d658e96f33dce64b086ce71c7dda0d8674adf1398020ed8e409e45deccd7dcd3c6e18c9e2ae17f45900d78057ca0aa1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ValueTuple.dll

MD5 e8f9ec862c8d9e63815af207067fd745
SHA1 08e8f6372dc2a14b9a6ea2fd5593f9d7219934fd
SHA256 e23e5a3e97f141bbd682f3a28cdfe1e5e1fc2f5fecdb48585053366808191579
SHA512 1f7a1c57c42356db5b003bab8e2a19997bbc6bcc708422a685424bb90f279fad7c7bc4a452c7c146ef8fcc3ac7e49b26cb82565b225b1da8430e4db03efc17a5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Timer.dll

MD5 962a19a042658035e51f623485d51ff6
SHA1 38c56474c9c845acc3d966c3877272aa4b1de82a
SHA256 b52817d085fd0c27c49f731cf067ec843d86ec83f23379fb805f9a59cc66dcfc
SHA512 59ebdfea3a44ce9e9ef2aa54287038fbe44ba2d2acb542a79e3079589aa6d7c860d65f5e47285a4e03788c6864cd7d0f966f9633eee6a97a2cef38b6aea55295

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.ThreadPool.dll

MD5 29b71f1f3dc37a69fa69e873039c3313
SHA1 021f0ee877580c6f46c7df2804a9f7e966ff46ea
SHA256 b46ab250fe65248b2966aa18640d082dc07cb720c5602cdb18b7ed1fa3ddafb6
SHA512 932a2e5e10b63015ff6cf0b8da6a738e9fa523ceb65d2b9890d9fbc833b62ed7811ad7459713c3542e0808f3702db718460a4d6d501d0a1a929e908909f0f234

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.Parallel.dll

MD5 3a978eebac7221705628a3b545f21fff
SHA1 7ccf1a5277e7ef03e302c93e855b929fa01d8fd3
SHA256 952b55b1825bf18c770e14aa4a7f9a3e939f03ef76727bb2c5c13fa08cbd23e7
SHA512 c8c5f2cac4ed941531cdb756a29037ff381a6a147f8410caae309f58cba6d7e47349cb1990eec037b6c63de74c9f01b3d14e43c2104d7dc711c7801425ff2b63

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Tasks.dll

MD5 8088641468fcc43de4d972de392308bf
SHA1 84e6f90e6d1ac820c5477d640013aa2b0e98be24
SHA256 110482ca75f3633c2f590652783757ffae390b25263ac6f765239add03d6d6dc
SHA512 e043312e456c8536d078c0e6fa76f0e5e2210dd583b8e47285eb8ea9a382262e9891702feac0ae7529af0b44c67a91c446c30e9638aa3813f9d3474a03f80fed

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Overlapped.dll

MD5 44cd3d87839441378237b6743a1dfad8
SHA1 0554ed1b88e608736fd4511efdf07d4372339de0
SHA256 ad9c8f06224fa3dfac7f245ba845e9e52042f4a55486b253ca89f048c93312ae
SHA512 8222ab8d8a0f726dda813ee3754b557b7b2b6166c1c54ae82b42c3924f93913ca0f17abd5c5e900ce827428c69d0aacc45ce3c6932105a4e1074de5460cceb4f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.dll

MD5 92cd1f93f2384125d85ac192c3627454
SHA1 65cf7763cebde3e92938a762e12c29e24fa984e3
SHA256 f1526218e02c6342053d09b72590c77e220e88035d0e32f24acf860955f61898
SHA512 e33fa9fa1fbd46f73eee6e6567ffb3e2df98931f1d5f6151c274a7a57722f00afe3b6a3f3d5eaf43e5753f4d3e13fe8fdfb719d26777cedec372f2b1eed148d7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.RegularExpressions.dll

MD5 19a09fbb2fbfb710f8e1aeab4fcc353a
SHA1 2d8dcf61dc629af3b56a5e421e99e68ccd48997a
SHA256 7b0bcf1db9a74902065a9e8816ea711190a9a4d8338d51938602984ec95a16b7
SHA512 d6102e4c94408a8bd2950f67bfdf2603b587dd60627b6487994f5296372b8981c9477f8b9b61619a7885883f18f45eca8a5ced1682bdd6feccfc789b7e73b5fb

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.Extensions.dll

MD5 7ac9b9a04fcea3babcd5be82ab00f0ee
SHA1 9c6ebc416815815d5bb1ccb76a5d7abe5fa1e9d4
SHA256 451f9ee786b69131191b73b7929eba224b0469d3a55818421355adae16cd7788
SHA512 67423ef5cbaa71f28a5811e11184e27285672c0087ad5da336132c58888fdbd008f0778bc143c35fe4f544f85cff9bf03839f8436eafd2a92d964f057ac6715f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Text.Encoding.dll

MD5 be4565c86dbaa95ed0be27911171c942
SHA1 9d32196e7788e7615fd6110cd458ab02489daae0
SHA256 837fca9ecf3c198cbf7cf9233b14ae0fd7ae012b53d5b8e6a140c1730ae39677
SHA512 4dbfc4f3da3e46115002b12d7deac9000cd74cc619cc57c23235f5eca9905551a9b9f6e1be35d59083332dd514df60feb746b3d3c89e8383e91ac8f55002ebde

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceProcess.dll

MD5 d8a2f419145983d532d9181c1e99695f
SHA1 e01ea069ae0457a991bd2531d83267178d95dccd
SHA256 dfa501c0efa735f43f4e899b5d594f083765dd38008bbd71e80cc92a532dacf6
SHA512 847da8541853044d1cafc1a1c2c3d92d431e7669095d094f38084836be60041ba2c6429bcf7cfe76f68739509ccd5c69ed55a40b442752b43e7e8a93a3bd3b61

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Web.dll

MD5 1c0f18c2fb5d9394e65861dc35653f27
SHA1 6a50782dbbac09537911c5639ffda44341a2cdcd
SHA256 594a14caa2c2889406599e8e9d81e0368edf8880458353eae3b2e6a74ecf22c4
SHA512 bd522f7097807aab72126989b2c436baf78282f573607993ade91a3369e43a91130064ef554db8e9afdc5a9dc409443613f7323646dac19da5768661a43c9667

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.WasHosting.dll

MD5 9903a39a8dc276e558a92de263236b76
SHA1 58e2c6780cb65c97ec172383504932a5a610e6fb
SHA256 daafe8a6926a3f306a216a6e5030141f45fe723f1925c46f336001022886d7ee
SHA512 94b512df66995916c8f1eafbfe5d91babf2d84dd26a815de1f067d8a3149830972b8307b3b340acca86190f5e2a6e2f60d0413349dfb364edafd0a5dadce7eeb

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.ServiceMoniker40.dll

MD5 e27a7610f63c29ad29d58c885d8422a5
SHA1 ebee1a3ac8aad19913d50e0e71b8a124a99bbcf9
SHA256 592f9196ed692c9c0896471bbf884a8979c558c747db3be180481854aff7caf7
SHA512 ae813f71384cd9631d366842d06d508c620ba2b3cbf661308febd2e569e99499b42957c5332c61f6d28a01729db97df4cf6bbb6d1661db3e0548f1d2c85daf4f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Routing.dll

MD5 9fae0da4ab77e30ebdc1267dbd00f5c9
SHA1 b4d1b4e22994afdb7b44f136d1575dab8e19e532
SHA256 10a00a656a4c62664b4d09ff11a96fa793d3508b8b5b79751f297c2942326a47
SHA512 54ee53409533e5a7cdc2bd8765049fdcb38b1a516d2ffe6c1f8ee40f96e0f0fd0898a292583d5062a9f1ca4cf49847ed8822597a17a9e090fd5fd3da5af17f7a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Primitives.dll

MD5 61d78477f72316f942e0036772c9d562
SHA1 8b8caed1d33c0df477931193e985099b58715d46
SHA256 f11442b75dbf9a5b6857799070d3095a977058fa104384be89bdfc39c1bbb040
SHA512 f99db342e7a5da5dab4c4c5d3f0d00cf78f72cfb0a75dcf49b90c0ecddba81609a1ea9b321aa32c9ce80bcb344fc3c7fdbfeda404669013403b0dbedd2e40dba

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.NetTcp.dll

MD5 1bb6ab17dae13bd7644551a7ba7750d1
SHA1 7bd2864bec59c0ee04dfc081fcfff23282eee0a5
SHA256 8d543cefaeccb170e2e62fad1165a1cae06fb8dc55f39d57adeff09ba4d532e6
SHA512 e4d84d32b2086b8b3a436785e2494201efd77231b4129ca3a4dfe1af59a865d05ca89186396ba63655ff25591fc237c12c71eb182bb3c09b6110e5eb3bb303da

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Internals.dll

MD5 da368838dea53b30166a188c365ffa9c
SHA1 a4f10e1b4fc97a550984429762faeea23f360d11
SHA256 cf3125323c868a0e32920ca32512ece357200a23f1d6e8b819b1c091fb50f474
SHA512 6361e9236366c01547e3ebe265b99f50ad62efb611499c043d877f6e617853d49352ef4f4f41427ef76dc1dc969db88fe9ee70dab5a4499ff69b780840e2850d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Http.dll

MD5 c7d3cc492d8e22d3e932734c966316d3
SHA1 9beab5911349ec7f1c2f30ca9bfb0a44692b633c
SHA256 d9a5396ce12f427cfd5d25949295ea2167d774758a0745d27558a4a3a66f2044
SHA512 b8013fd0a38d3cada4ffacdf9726e665d7aedc1540ab655eca7dbbe39b0212bc7a96fa51404d35bde953ac8546e3e4a286520ab7aa1d234b130c85ed9e3c7893

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Duplex.dll

MD5 50a6d2789b7d7aa2e36d8ed864b3e945
SHA1 c8f195d7e90fac150f505524762f3bb5c47d95e7
SHA256 a89516966aecf5153f55c14afac795cac8630050dae7367d923633727a1faf5e
SHA512 201d87b732c0ce6d3c6572e8c3244e6c4750dde132a9defd2121384648d12faa9f38c03ae6c1499679177c73f4d461bebd0cdba3a512745d8b3980fda14ec0d1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.dll

MD5 2ccbd7882a7a4022151de212a4ebc05c
SHA1 95359d1e04f87b86ecd97ede371cbf1b17b07a62
SHA256 96e40d1d2dea8f021274d65eb92727f7c05e23b8bbe54a87df3acdc0ece6c6b0
SHA512 0505739bcf881f9f05b31c7c4e8ca5ac98dbdee120da47ddc44e1d0801293491711cecb72fe12c6d63da197d3b6ead1a27f302124051764f315a65c640d9a329

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Discovery.dll

MD5 e2ff78eedd5bfda1a0eb5f085291c918
SHA1 c7a9701c5b6fa7b430284d96cecc70b67dfda8c6
SHA256 b12f1f0ee4ff3977972f1420dae36b28a9db57a4fb337666df13cc2ef897bcf9
SHA512 7fd71ce4ca9704ac70b0e03026c0fb469453d32e33c203003d69f23ad478edf4b8efdc672850413795cb01b82ff7a027fad5d2385dbfa732d093394bc85085df

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Channels.dll

MD5 4a45cb43a1ccf3e846afb9d44cae0751
SHA1 7c98a7aa1d16fbbca39cf24d4c4fcc585b2d04b5
SHA256 8066cec0681336ee80dbdea92c4a583f294aab277334872d6d4e3416405ea43f
SHA512 5b0fb070aa4f7f915d68e4a658f11630b96357e6f444e7d993506aac5a3814a102c0b745a48d65b54b184ad1c8c6ade2a620d8b45089ae38373852c9860bec90

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activities.dll

MD5 3a002c0486cfba7327f49959f307f6d8
SHA1 69e8094692a3a706f2be454ffe9a4d7337b9c7b8
SHA256 f6e8d64c20e4bd3981e914e258cc8d696ac3ba2348fff7eca3efff9e0ec62902
SHA512 8aa623cd26e230d2260dda5ff9f7cecabd5821df33446ccc4cf4bbe4189b030fd4f73973a09d915e77f8040791651270bcfd32f08977ccfa3a8842ef63d3eb6f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceModel.Activation.dll

MD5 d324c42598d5b8cd8e9260be4ad907ea
SHA1 40794db36476235c6d0f95776bb341090dd258e2
SHA256 0e14e73887a827f0cd7a2e441262c40202284bc086426bee508f6d318246a3ef
SHA512 14b2c656d8a30a2861d4e13a91ecafca0548fcb22f0e144756fd1025429e5c4b9b21369a22b4abec1d7edec1a23a7abb630f8092d76942ca0a066d81e442c19c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Principal.dll

MD5 511ed8a57682b6873aa1e3d37db3483d
SHA1 0db0ffa83abad169b40efccb5fc75ca40f76235d
SHA256 28c38bac4365e188db53c4d68d9cec64c892c345f94d57d379f27acab046021f
SHA512 1dc493fd5347b46b5703044f8b078ef84aa5805a88d5e6a844981b668fe6f31f3fc06319d106fbe8e235372da9dfe9f151a709cb69f4e3c33ef957de5f48b876

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.dll

MD5 504c39bbff1dade8b95550f6ef9af4e0
SHA1 7bc939ed1694b411478a9f276360308b829b4a34
SHA256 52a67d620fd46fb920c536a8651bc9755d6bd560544836c0887f6ee5af1a5b1f
SHA512 4af64487c5f5ad0893539371e9d12ed5aa78d9fb9fd76bd9eeb7c3fa95a91b349f22d2b3692dccee30de4b84599036334a9579a75acc592e5d3547994f00ed1b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.X509Certificates.dll

MD5 4ca1d24d1ea90b1bdf77441e2513d6e6
SHA1 bdd4627d65a145f6457ffa0b2e42cf34b13f5a56
SHA256 7e19481f6d0ea0e8f581324fbbf60f6866ef1ffe013bec8113bc4ea971f82c05
SHA512 2b49308c43068cf7c684a50b6e66341318841248b51ae958f0654b2fce6936b496f44204f5513fef2ce5c47f407d9b71015f7d3b8e7a0e171ce57de135e7db7c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Primitives.dll

MD5 87d2ed7f0e223be9a97c9fd740aa4edc
SHA1 3629041ee175c8b8ec9df87a9aad21af06b6202b
SHA256 9fb07115f697d77f87b001253b6682f39fcba1bffd5f1cc7fffd20b8b0930c05
SHA512 85b133cf4cf6d45559cdb62e54f7fef5ac21fbbe1912a9b0b41577f7048ae0e7c16a87ff0d30fc6251cc31e79ac9fa5d84d82b835119ac8d03991890c6a65cff

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Encoding.dll

MD5 213832e025eaac6bef4e87f2554bef57
SHA1 25cdd11d2f15c90a6ff7e9054f3c3bc61265c2e4
SHA256 3930c9968100c6cea00848161e084ea9b37364c60654d0ed33dbd94d34dbf55d
SHA512 d05e40eb74bcea443794944985244c835c5464ddd04917d3923c928dae9e075f94a9e08b0137afa7b611b510862beedc356c99efb06fe7678a6a3d44db739002

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Csp.dll

MD5 9c8754c8eaa5ee00739ff2e268de2fbe
SHA1 27305ff383499bdb15333c81ea4c82b072ac763a
SHA256 b5c01749120fe1113757837021631129ae23dba4c360954bf920409cc2aea18d
SHA512 820c06d6ee230ac73af06d223b7f62a62de6c6b111a0c0d4c7e9230416c607c9052d8cf63f21d24f134dc0fadd84789ae89520b305b064072938a23b22804a62

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Cryptography.Algorithms.dll

MD5 e2b2a8875968ba7e62316930bbe0cc2c
SHA1 c0c4e983c385a880598fa7e4decbd085dabd4d60
SHA256 fb85139a680f197d29dd155bd850d72bdba9306ac8cb9bf57decb75a9ea3b153
SHA512 91a466b75c0283e35b64c81e84d6bde905899681363b1fd2ba5fbb8c3ab904d9c552c22cd603cca62d273730272aeb9855ed7e4a9e3a43c61f76d6e665744896

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Security.Claims.dll

MD5 e4f88076bb3e831dc5814ccd93a34d95
SHA1 2dce8124b6e038ee70f7d37e15778cbfb2cc53f0
SHA256 1e5ebac5235fe4120327de2805d2cd5a6cdd7b3b7e67ffede8c16877fbddb01e
SHA512 cea94a7a8321a6eeb4b47a245998b9bc19b103a17aae539db5c78f638047763c4a2990d1e7fbb4cdc9628b7b5afd7ffc311fed166f5209402a7d61fce8c64284

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Xml.dll

MD5 83b72d7d7c2023b4aebd7c7dc450e238
SHA1 0b0dfd805e240249503664e90e1bd40e3337d66f
SHA256 a257d3f6005f1ed6c0c3f66d5a0d658e6572bbefaa5181c0aa9e008ed91714c1
SHA512 603c936ddf743994f791624a1876dcd5a1c261acdef387033c07d3c7ed086db5aa8417a1b630a608654ab2f85d4bf112181ca08d6d6fd11c38d474324abbe2ce

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Primitives.dll

MD5 d5e2b8da2740d8505472ed775f83dbc1
SHA1 cdc1b47a2b05addec9ea3fd4c8131ff2da9c098f
SHA256 b354f8fb1fde3ba77d7591fc38725f465e202a80742dfd071c0e7e444469a572
SHA512 67a971b76e782d7a52080bdaef69d8898d0413fd5435a7af1127fe9d37e21bfaab2bc81d60f50a05e1a519f1198512deff006400893c249a7bfeca3def226660

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll

MD5 29454b69e82c782e69ce1e9c4615f95d
SHA1 931927fa6ba73d6f0dc38bfa4f742acec697581f
SHA256 84f9eb0be1623fd6a0cfb9a8a20d476a03094655db347981d8d19d51f2d633a0
SHA512 9bb274cd684385c09b49ab7116cd1032ebdb8e57334924550f0c28eb06413e6da4db294aa3dd74fc976935692b7ad6f88e72ed74ed2725428432b66b30aa8821

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.Formatters.dll

MD5 11e902b5a457e1cacebfd054b8a27316
SHA1 18f3f70cda9fcfb2b716cef9599723113c8355b3
SHA256 76157507714371c31adcab04de337b36114038962be1b12fac3e4c159363f9f1
SHA512 66e621ec5c0885e9fc6b3014331ad9590fefa506e0737ed5732f8f0cd5a240ee1f3301b525d27deae7b8e8e1a669bc0680ff55127ec91ef0d52ba9cc9b670db3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Serialization.dll

MD5 fa5a643a57c9bb5ae9b4526b150d121e
SHA1 9a7b47c31fad3194f807b9b2e4e054516fc0c375
SHA256 c9b5935a4d167655e07b6b7ccf4b802cb0912de3e432df658daef33448e2b5c1
SHA512 f998265084daada467fc2c5714fc27360a8fc5499a7564a21987aba05f105a4b991feac53de718538093e1daa301f7db1cf064d2231035f072801f3f2f14696f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Remoting.dll

MD5 f5e9a650713f4e23d9e968fbd0ffb3a8
SHA1 4bcf994aa3653b3af5a190dd3422555e51721c34
SHA256 210600071dc0e8a3774969da9411bf6765dc169afb00e9e800571e366514e29a
SHA512 1aff901727360ed4c5b7f4c1acdbcae8fffd40a6905bafd63c53e45c9e9ae8a1fed53a51744970e2156c107f28d6733d3d1bcfc0728338f8a57d903d0fec26f3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Numerics.dll

MD5 280c83605081baa6679bb6e7b026c804
SHA1 ac59cb90964e4a2ddf70d77c91f08e69b3bd8130
SHA256 c0314ac9e1a3366f5aafd3cc5428a6c0c3035b3059a7b0f09ee1e7e551d26d53
SHA512 599518707bd430cc10ecd1e5b74968f64ab3e3dc3949e27368259b2e13fa79cf1baeb691058664aa12b82b1f6099f41819b1512a985ded9ddfa711a2e553329b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.WindowsRuntime.dll

MD5 a8c3cee1535b5d568ff837a5206b48a9
SHA1 7bb615e18b801d89f218d8869ee38669ab90133a
SHA256 2842bad771388a685204f70fabc110916de350ac411f63fe20967a320e85298e
SHA512 4f2d0fdbc1d3f209ce1a463313c2c391b1b3e9f7865ba8e41bb23d6b3d754e938eb820ccd94c94c561f26929fdf7e1be971672b4a897ca8e890b621115a0972b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.RuntimeInformation.dll

MD5 73ef89314086a0a4b0651baf9139292c
SHA1 78143803cb120399dd25a829d60f2276882cc5fb
SHA256 193126ea7de1afd549d6ac6e0548ba31e197936d35970c950110291bbd4d44a9
SHA512 6d5a37284f716f3d2313060d7ed36011344612fca803b241ed6966d635b659dc41b4bb48f6b8a79f2a14b433a92dc056df5077ca8dacb69bb85c46e04aa48f40

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.InteropServices.dll

MD5 144a02fa813e18c67e94a36bd0998ff0
SHA1 a157304a84598f2ab7b5a14f60b31a040c2f0301
SHA256 013f8cfcbc1dfbe1654d9a7e65a1e04220f771d6ac1b293922edd127a58d4db9
SHA512 6de5eeea68ff30541326e2cdb11a1b06786fa982f361e90c928012fb7a1c45f8633f2edebc0cf2143081d45bb67fc041db946b75ac9db912bc7a52de38210829

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Handles.dll

MD5 87442fa9b971d670829b0df92a4a31b0
SHA1 b6eb809ed05feb30538fb853aa85c42d7ac9252c
SHA256 6f432376567393e4e3699a7094b7a914d293f3ae64b45a8706bb98a420b52bc9
SHA512 8277ef60cbba7f6837e4158070c777a3524aeedf966c6775f9aa0ad8ab8a54ff78b8a3ed9f70dc49439a132f3a595c3c62c04abb369ca0aaceabb1ee9d884362

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Extensions.dll

MD5 b2b590f2f20c343ea41c9c1283bd9bbe
SHA1 5ce607b715b4e982cd917536b581dcb3f4fba8c3
SHA256 465d73046928100036514cce8bf919a65316c373ed9afee14aadab3c9cb66110
SHA512 69bddb74220527c6fb96eda8ad77c64925ebad8c5b36a1bdecac080ece8d7c7685d801dcbc20043ead18d2251faa9fe5a3725ce52c2f70a032d886016cb2e44e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.DurableInstancing.dll

MD5 8b7820c8d5771a4782007638b0036bbe
SHA1 167b6c688380ceadb86a64cb0e3abf477d6a592b
SHA256 842038ec94affb258bba1fd9ee9eceff676d088a58eaf78de5e9cb5498e98d24
SHA512 d2c5f6dc5e4bf6bbb02a43740d98298f6b808f700bea0ec52ab0645a25579950d65f7f1389c9abc4dfe96ead28e346e35eeeeadfd6bceef745e94cb6b8bae82f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.dll

MD5 6af16d2646e07c2890cd80fdd374ae2b
SHA1 986280abccf9b5b69563600addef3b9cca4be142
SHA256 e79b5a854c3ad4b7e88287386a9a341f1618ea4717c439db76d6abe5af8df098
SHA512 2766aab91c09ec328eba68701cdd3c180af278af261fccdf08b617396ed9ddc706957435b761aba4d61c7b568d0c5b70d0bdcb80b989601cbf72c01e4f8f147d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Runtime.Caching.dll

MD5 da60c8a29a24e7a15517948dfb42ff59
SHA1 727550106d74d85fd090e7f370c5c7762dd1734f
SHA256 714c38b780f08d30fb4adb0e76d109024b296b8b5c87d551e54a489c17895991
SHA512 3445fba1eefa3caf2e14c0b635938b660569a428ab3709e36d110c3d2d90a3312a36568c52a2d49358b150bbd9ef8d7099265a794353ce6dbb7d5ed15fcf91d4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Writer.dll

MD5 b5bb9304f883c43d995453fa863de5f7
SHA1 a16dc2e973ac745dc58f4ced05930e66dd3ac86b
SHA256 37a86d427acd2bf9786b940d4b554706cfddc6d2a21f719bc26dd2f8ec4b8fdc
SHA512 dcb8fae610fb6c359ed4d0e42ca7ee307cd7be81092c12b62a7132db21652804b881e9abde40a2d2268ecedb3c6dfccb1604f3abf51a6b4d87eb0f221f7e6e28

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.ResourceManager.dll

MD5 540597698f25141bf54de10afc7866a2
SHA1 e56b246b91b2a1d611d1dbc5ea4f0e649171d859
SHA256 1282dd0008c7a6684aeb3430c4560aad6df54cd1ac7794722ec188cc8b790186
SHA512 867028ec3864c9d5628f632ca35706e5198444e817080e99de7cba8f00c1f300343f7b34d4786ca61d17c36e9f1beec404999a7a369fa57de9cf437c8e41566b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Resources.Reader.dll

MD5 daad3b5a5322c63b3e9243b987d745cf
SHA1 8cd4cb494a926decf7022b16a4d5898d99a23b06
SHA256 8b8118cfea2a9ce78df2c1add62df03af4b974a84d750ec568f2319ea4570dd5
SHA512 7739c3aea7d814fa978297fb5ced6055de40df912a1a0f77d75f2e3de941f917aa62a31dbf3d1b202500c03d2bf057b4edd011729f107b3d48391d0266fd9657

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Primitives.dll

MD5 07adfa041dd08849cdb2de54d26124da
SHA1 469d84dfac7c81a771f65d137eda4eff17ad71e9
SHA256 b6749628ad26dfcc4b406ebc7124eb0fb5c819af21a85d3133153b58788aa840
SHA512 5f872886ed83b6ed2d4ce261d702866d2e16bd6f434b08a62cce1de7a19160cc64226adc69e4ecedf53c98f2304fd20d05d541ee783173b722cf488c222b9e01

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Extensions.dll

MD5 a5799f5e7b0653c38d910c4c01b46d5a
SHA1 22842f24c751a70bc4dabaa25e81b5697526248d
SHA256 eae8ccb6c07d972bdc83d63ce06261564dc911304033e748799c0a066c86e11f
SHA512 b8cc9ab708eb34a0a6952be2b90fd39c317d4b9cd442847b1b9746035fff35f70f3888c893fff18de27ef72dbbc0cbb630bf09be79ca6ec0a6fd023f4729a96b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.Lightweight.dll

MD5 33d34992246d48ab3c7acc7d0549c20e
SHA1 4d35f2d6b812c9edf795f8f0369710df29d0fad1
SHA256 1c64ea3e39d26038560a23f53a4493e229938d0d37734a0416606e1eb269f921
SHA512 286c5ba5a57b016e47a57f122d76b8239f5300cc0e87f3cb3bfbafa24168daa9172457b81245b8ed8a6b0c6741a2ff6b7d5792d83ab9a88ceb94f81a4faebbfb

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.ILGeneration.dll

MD5 a93256a31b82994ad7cce5389fb503cf
SHA1 632e3f1902aa3efbf68863ba5b0cfad9743f97f9
SHA256 179963f3326eecf85d7377f7547abb9877e340a8f58714b9fa4e699a2446507e
SHA512 c13ef894779eb3e93ff0f18f40d61aa3a38e36789da72c1b8a4bfac674056badd57fea9bac94901b606c07d38350e1bdf9d583060a114587ae1a09687d951bb6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.Emit.dll

MD5 2109347e9026d0b39c6eb3df4ef02b27
SHA1 6d6d03c3167addba9de6cd9ff9651923f6d9a8df
SHA256 1b971e14695307bc1e15a63093ea2098ca6e317776132c656e5ee542c5066b36
SHA512 e1301c09cc0b1af577e1713382f23887076fc2108a0d43c943d8ca4499b544bdd20ea33656627d2445b7270b4b5f955d68eb918702003f421f8a19322d8767c7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.dll

MD5 dd845ea3f2f6f4f410deeb5d34a263d1
SHA1 4e195479ab633d85614ad18bdcf69dddef06b5d6
SHA256 6680854cc60fa1f0c234d67f7eab7d0745320cc97a3302e4c78bed442915ffa8
SHA512 a0292014e22bce93a703744daf9c46d264f827772749452b8ce7220b72445218b475d4399ff88e57b695ca8c4ea411f80129780687802f7247db0aab8de041d0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Reflection.context.dll

MD5 8ae7ba843a78821335f3b1f1fd09e6e7
SHA1 f207d66924e98f34c654f3b81395e4f53a49f141
SHA256 27d55414d0e79ae730b0a1e397c40659ef07b6bb903c9d8c1d29ac315884f13b
SHA512 033d4ba396508b819db9a748d610c373e8b994258b002c2ead3a9aafeb55b1247e89747c7e2d94839b05c401288c32c74f758e2e580f8fdf87a4c0ab2712d0a1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.Vectors.dll

MD5 3b496ef7d99053935b9e8c5a36920a2c
SHA1 401136956c52f36d84e2097b61e6a5f1217d2e30
SHA256 726ab6d50eacec8f6dea3db86bdac58501613fcfb3d7541df7538d916e1d8c75
SHA512 63d396d1801f75fbffafa67dac0ac1622341649bd87ff6c6d6815d97bd80adb4e58172a4847f0604d0e62985e525728565edf16e68e925f4b077dd21903e451e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.dll

MD5 eae405fe9f2ef0e1bb0bbf8ff31605c3
SHA1 0029c03ee7bc2757955598b35d09116233078a68
SHA256 9c437ced622ff9aa2b1c712c204e46fb63082823abf2ae34dfd2d85784eec147
SHA512 acd9431b5e93a80801648fb1d96c29cc8ef44457928cb5e5350bc3e23c131ea85cd1eaf5f7a05717b0a2e0407cbaaa6d6408b2f5f48a9bbe22e1f6633234d41a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.dll

MD5 8a6f679851b9e867b90fac295f8f3338
SHA1 609f5606065178400efa4a869c1cf7c14321aa5b
SHA256 88323091435606806f50ecb0d78b0731c3383cb5b76e1ee82c255de81dcd08c7
SHA512 fde4872798907f05dc21bccb6d43a13e96bdf319a8c984e9c11e6a74c94ed0a4bf9b6b32434c970e0a902f03d2e9c149319c75f5581411a2f25f1cb47cc8385f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebSockets.Client.dll

MD5 8e664484b5bacad14fbb503bf6f7cb37
SHA1 700c36abf999e48675d92907525d429e17e1f149
SHA256 c7c3d7d493720f6181c3931f4334df845343140d14d39c597adf743b329df6c9
SHA512 44677c08c6bfc622dcf7faaddc0f8655cfe779b97c6545cece5ab4cadb63d3564d632994b21a810b2c4af5c28423d1a7ededd1b35661e061b6b710ad7d64f67e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.WebHeaderCollection.dll

MD5 91c84a7f4d6eae641ef58f87103bfc4d
SHA1 c75614018f2138a2a9e744fd97da81257989751f
SHA256 6732a602e2944f053ecdfddf2cb7e56f360d627302bd9760fe9846502570cfa8
SHA512 1e79739054fc86da2f0cbbf5f169cbda030d2f88f806112e2536cdaf64cd5f50ee10079eef16d15bba830cacbc8e9f05ef6e05779693a779b19d5b84d064b819

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Sockets.dll

MD5 382b893964a84b19a622a1d45512baca
SHA1 298c246e1b0a352a6a9dff2189782fd264433790
SHA256 cad04ea39838d625e32fd0dd4d0d8a745a4dd0c311a50d5e3ee385ca99cf1e26
SHA512 0c8f950808fd08a37c9aa58c5c56efd53c894992d3b4d533c6985d4b817b494c4943f0406c9137d66a1fc27170dc792068b22e2d8a8e0a84cdec6e7ac4706585

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Security.dll

MD5 3a2f73ac855eed5621cb67de2b022070
SHA1 a6d7113d3934a2a94290e16d06db9a05b46a282b
SHA256 e3457666a314b127ba36bc4aa936f0d73a48d637113ebb236f7ab0ca20cb0280
SHA512 2bacd2060d5e6c66174eba264ad1ef71ff0cb19d4bbd29b2379d3c437234f04b72255830d50711c7f8822c9f139f7fad790dd90c1fd39376fd5a54fb4c647078

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Requests.dll

MD5 4c21ba6eab207669db05b16ff6dfc541
SHA1 a5f3652973f774a96d30923e3ec2a85b9446c41a
SHA256 596bc50977e67e840d09757db7a416941edf42384b11d92f9a7ebc0847f76239
SHA512 1320fbd495f04c4090d1adb7430968631d045f1b242804449a5c181ec4d7b418490f2491f008910f96473ac33a021f4fe23b8296046f2562a2c1e3920ab38f8f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Ping.dll

MD5 adafc4b45587e6671a944fc5df9dfaf3
SHA1 d9537f1b40a2b33b112bfde8f7404dc529e83944
SHA256 37f6cebaf250d0a90ee5bd8d86f583b39554518bf64387d1c6886312667fddb7
SHA512 d79570d4bb4586e6157bbe3f2ee6157a3d0c6af4fead66ae2297e67cffeed36185876d22a35d0137d3618182ebee99dd17526b0aa359c0a0dd449cbb196e66e3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NetworkInformation.dll

MD5 da7b81705b3fc3a4742da9991959f676
SHA1 b4aea6f72683935c887417eb558ff977badc8358
SHA256 25c113e072278abddc8ad53ec56539d5cc4afd161cac91af6003dd94afef0899
SHA512 2dd95a85640658a01e68313bd21d32d03ab9e16aa58aad903f68185498956f429ee706089a201c7cd6730a3480c688a1a2514b9ca6355e2a0099cc196818a84f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.NameResolution.dll

MD5 24bf21a2fd9d2e7af6a591afb95b6a31
SHA1 94141a217829f6f31e61c5ac33939a25daed7e7b
SHA256 bd1535a52ddaf5243abd93a41dc4c74824a172f593a0b522663f4f43b500a0ea
SHA512 f3cb955133c6dbe619f689a97aea27499cdaa5ca4c3ed6d312ac64df0b98fb034f31339db8e277404ce6b4b5297e51951d8e318e3978326e749e57aecf25a4f4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.WebRequest.dll

MD5 c157cb5a9e20e6b16af14e4003de1d3e
SHA1 e0bd36112dc52c387f3168a40903a3b9d08c0b3d
SHA256 c193a1f9d69f44ec344d2e46e53fb5806622519c73e1e6bf8bf1cf287b791515
SHA512 0784c3d1e43c8a7b5fa96e6f078b2c85830375b2165aaf7564e6da8e553a8b1cf5979a122df4ba5fd4554a7118ed53c4694f9c441d8891a71bfd2b68dcbe52db

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.Rtc.dll

MD5 258a37b3add2f82889b8fdc6fd557c31
SHA1 d5adeaaed447093b9341c5e449d0a1490e8f3550
SHA256 3f6d788f4e530ad79a3fed4f5eb69c54b63a5589c550a109d087ddff295bcc1e
SHA512 db2e45bfbe6ff0b0ae084c77627259b54f9aa69867e44a492f77c91384b9c53e28fa283a0f184c04055f976804403d4dac513f4d614f5ea88094ba88c37d9b27

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Http.dll

MD5 cb64dda22d3a94d5e5933e61e78b26c6
SHA1 e6726003ba4e649f346769896fe22482b09f986e
SHA256 fda9df9598663c8e9405dbe4ab7fb8d8ab3496aae1889921649619954e6c9cb7
SHA512 64011705d60a7a7f35f7956b766b99d5e6b3661b813456328e4b25af3d78ebc0c2ea50b8598f6899c749e7135ebd9faa2b769634b3121d292f3598d5a13450bf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.dll

MD5 ff618d59f708c14950e291edf87c3449
SHA1 c1c77adf710c882eaa8ed75464bec81642316d3b
SHA256 4dcbb4a87bc1ffaa23ac12884590a6e24102338cd047340975187e4f9be761c9
SHA512 ca6cfbb23e0e3efbf71609bf59eddf0b7d69dad118774f97a511d2c4ea801b9f5ce5529def03da6b9ae1b4c6d5678e5d76b4e31f961b61fd67f930d3539e9630

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Messaging.dll

MD5 4c24ab3499491fb31c65604c295e7f1d
SHA1 903b1de231141d27f8581bd860ebd59450aac267
SHA256 93633adc60aab7e4ca28f7550881742b31922d98adfdc4f677b7baaa34042a13
SHA512 38a8236a17fac7a185355546c9c25bde3e0a4bf6d102b19ed420462d64fd3ad786916c2c64c7072ceaa0841cca1fe9c132b02a7966212962bb9e488d8b1221ed

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Management.dll

MD5 4229765ad585cf30d2a31f3f4477b009
SHA1 97fb30b02ce730d52c60cfb5699bdb98a6078c17
SHA256 461a59d2d394e83395d97a436ef8ea4a1875ead980c5ac2680baffa4895efdce
SHA512 9ad5a4c5169a12ab68679ad7ab8307f20846849d7d670b6f3c5e79487bfff5651bf51876686dbf47977f911a515f7db2f47e5093be5a8edcb5b1e358afbd9b0b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Queryable.dll

MD5 41eedb2731b6aa6c5331db9280f8b514
SHA1 f1cb3570331f3d4f9853f745e8657544b86ab954
SHA256 7675cdeff0d1a6c08c5e7f3b5d365ecab257d7d7b66237381b990827edd4d82e
SHA512 83f12314a91054fc374e8bf7faa0c6b769bbc67dae4a87d6200eb94ac8f05096ba306b3c0dcd90ee3c430a9f7d53ba0935a646ecc277b0c20cde48f6dea395b0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Parallel.dll

MD5 350624d1febcb4d8cbfd64eae6306326
SHA1 db629acd0f005b2459f8f4bba307af3f91882635
SHA256 471100c9a1c75f2487bc6700c7cb729d2adde6afd3b557e1fcd8a54a3b496cb4
SHA512 78324c99facf949cde1c34e690c4871a5c998fb5cd1b100593f806b0f1f67bb6f050cf6bb9e151059416922bc9d90c88845073cdf219eafbec4d6b70af5a85c7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.Expressions.dll

MD5 8c88060cb4bc4dd03e8465b11407faaa
SHA1 f4738510f4e9af45b53457af01cb4c3cc4d63d2d
SHA256 0ab6ce7196e1926e5c201c8f509a4777ce8ad7e6c10fd19a45d16722860cab90
SHA512 2ddfbe6815aa3bea128e2af78980620f47c3986e174d9822b317bcbb0de89541c966f8aa06c83fa3567d1d0769e6c8e5d40cad5360cab804c4087417bb3463d3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Linq.dll

MD5 95b740014b21cd4b8cc3c829817ae671
SHA1 83801855e7f47667a2420a591363aba323afc502
SHA256 977d54efd52a89c92379c33ebf6cc9933d79b71cfc89b1d748c5b08b2ae214c7
SHA512 b18323eecbaf7c7ff858e4fab581ff9819b32b9366911f015d9188f3b2a731637f86b53c4328b67c2e8d65acc7128fc05c6a03e8484e30417dd706da7dfa9287

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.UnmanagedMemoryStream.dll

MD5 4418bd89762a5a411d7bb78727d79853
SHA1 dc2d2c6267075555856520be8da351e099d43469
SHA256 15775ac7d6c6a9ca977584c8959ab485316903503edc26e8c736fba0c744d1e4
SHA512 9b6d5f2eb420138ad58922a11d6530d4e257c6350057536d057947f96389aa4da6e3c3068766dbcb499b2affc4826f837921af213b19e1cc4a2ff5bfdc983def

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Pipes.dll

MD5 a9eabf83317d5dac41964530ebbcb279
SHA1 7c84303ef8c463713463b9a02182ca144bfba220
SHA256 249f61455012f0dca72dd1fda865aae2d5c61c401a60c05ec1de9ac018356005
SHA512 04276db651fae0dd51783f2cb06d72a68da631a5a69b5ec00fb78908e7d9154415f6e56f14e0efb25c6309b8fdf2ec1527781fc55e6b7006246963c265cec3bb

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Log.dll

MD5 041f52232daed7cc0e0430410b28a125
SHA1 eb50d78aae730d7200f6380fed1f1cf384941d39
SHA256 886ac7a9e37aa801a9c67e4bd7ac48ec804ee6d2dc302d87bd6b70efbbc10be2
SHA512 dccc8db4e5ae5c013772c244cade14f2a3d2e6b4816c475d8d6353ccd25ce40687b8584e0191b32abf684f08ccfc3f3e600f183ac8c771bf291074f8607a7b5e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.IsolatedStorage.dll

MD5 226f91f0fab85140d6d702785132e144
SHA1 711f930d28b27ba027bb94de1a9347dc8a6dca05
SHA256 477138b1beb22c7bf98cc04c235a94f526ecf6880915b831e64f6365ef639c11
SHA512 eeae289eb49ca401bd2e992354532c6915de59cb57d823f93f828a6c1d0ca42d0c0e1b2dee09bf810e894f333c9b1cd45c684040d9329cde23c5eaab392bba82

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Watcher.dll

MD5 5c13b48763cd28e23baf30946302eadc
SHA1 c6bf2ebe79520b4f2bd31a099e0dcfdb1741c6e8
SHA256 f9b64842bdf5c944031b647cc12f1a100a0d16434cfe625dd8d1b3d8d825e8fd
SHA512 15ebd80e74db62b38af1d9fc9c1992ff9be5cc72a94a3392962c024f3eaa1cfdb5529cfcf85343b2ca19c3ea5a9921c868d4d85d46287e8fb44ad3397d18c610

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.Primitives.dll

MD5 3e55e9d686850d8f4f85bcc0287ebf2f
SHA1 cc9c6b04cc030356253b63ffd8995ea962379399
SHA256 7e718400192951fd3933f0826a01dd6447e270c12b0e55c490b13368ec6043e4
SHA512 d5a9df25d47b9d6255c1ef436317a8d0ae94c0d1d7547e45157e6c0791113e8a0ae495d9a0b544afd8f7729f018d7ff7cdd4b67be89963ae4065204b18911279

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.DriveInfo.dll

MD5 606db4a3eadb4ab22b5f4582fcaee82f
SHA1 2cdd1b51c3e9e2cf7ef644aa2c127c69b402bdec
SHA256 04fad6fe81403c5c2fefe41cdd0b5a93d17b7245c2e008ecb65ff367d0ec6e94
SHA512 f0fd33e0888e577689f03c3142b8945bf80521f57c3a1e354a27716074f4533255abbebbbe6c37fc0f6fcfe3954373716a28aaac0aad0190daac1dc5182e0a01

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.FileSystem.dll

MD5 96cc371d3b448a923ad2ebf188796e9c
SHA1 282243e82a6f7ab74b0f469ef2129a6f47a8023d
SHA256 0d34335b59c682eac71344820ccca35798e057692675f3d5772599e49aa8a18f
SHA512 3377362079e3c4c0941da3fb70c3eb409e5f489809afa102fb60e9504d56e033d69e7099594de245ac4f6e6ab9af4962237f6d1ac2f14516c8742f4f803893c4

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.dll

MD5 13ad81e91d3c57a263033910aee18cf5
SHA1 21d8d625c557a4d7e594c746b9a3a9f10ed46ff1
SHA256 db86199fcc30dd3d3b96a215fd5f5f844fc6503cf221b738086780fa73e725b6
SHA512 bb7c7f4026150edb9fe96542ab1fa6749cd2792cae951d3384d1a143b69123aa4f44590ec196e8e3b2e80884eb90ab0baa22d20159d2ae02d30ddcb254dec8e5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.FileSystem.dll

MD5 3226cf55d5d0f161ff9268f4fde32db7
SHA1 4e4ce5edbffeee5ddedd0a1e98425b0a1b9fb099
SHA256 de331ce2ce9412188773d693b909cab5afc366ea541e72916dad455e377bfd63
SHA512 4c0f2bf72925ef5ed1e004af79758d8f316edc93fef34770ecf17110c6505efe0b3e0861a344b442ade359997eb748084f96482a2881556a72f7d2c41ea8ee8f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IO.Compression.dll

MD5 009d14c7db335a9a3fc1085eb553e4c1
SHA1 741217d77ec25ebfb2ed09e84cd4cf003d40a1d7
SHA256 265c72896d373426bf9b8cea1f6452e360749aff9f6727418cf3de1cb89c4341
SHA512 badd33281b3a36709154096ff4327cdb59ab4df13190d4169f47340f525724611fed3132d9ba7206db74ee5753ee268647e05a1a16185b96a70c4bfbb948be95

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Services.dll

MD5 4df1980dd66ccb622b19848f06f6d31b
SHA1 dfb61b3536d447e8def83ee3ce17bf3efcc0e35a
SHA256 d3bdf55fbad4d88b55a311a3b878b2bb5cb6c0803aac715b7bc784c31cff719d
SHA512 6b661f8d3bc17201068a5b8f454bb19798db23c2a4072f140cd5f7ab2ec847b09669df8fcff8337c0ee87bec01e4c4f507bee1fda311eb98282e16573cb42f2f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.Selectors.dll

MD5 c613b9810b8270bffbb751559ae84375
SHA1 3beb7234b8f212aaebb7bd9c95dee62f0e452834
SHA256 78cfe59579fc736ec7290206bed523ccfae20405021bd226cde72fce83adfc9d
SHA512 4f543d0f399abcbcaec7959d600d65094c1dcb21d21e655de1180f9840053da4d60efa97b6e1750d483ca748987873785b91159ff1a4a9ce486f0bf8781b8ce7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.IdentityModel.dll

MD5 f5f331343ece8e737bb69f2eb5087016
SHA1 564d760a021a636d1cef98297916776b735f8478
SHA256 362cacb2470bc29cf1d22b2947d0a195058cee2c2edc9f32c1b45541b80c49bd
SHA512 a103bd856a788f3c1d7f37935844a402cec01c48b60b9678cf1cd492fbe0aa9d42e1a481fe0a17792a0f95c9a7fcdaca5770d94b83ee11a06abc5d0e2164b2c2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Extensions.dll

MD5 2e5af3086288ac0a3073647e8588274b
SHA1 2b112e18db264600ea4789bb04f8c374c5071692
SHA256 130bb8091312d8a322f619957df55db32ace3c79e100c88711be619e518804fe
SHA512 d039b9154be3c6a1818029a87f114cd0fc42c7127fa9eb655c61a6898c207e89d27e1e5a7e17a9b461034edb437a3a13519e106bde8d28a7c173f18899bd8e4a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Calendars.dll

MD5 3477c49d5abcf5cd008882adea6964f3
SHA1 a97e8f9294f90fcfdcd0dfc268bd6811263a4872
SHA256 e1d11055bb900d6e26501b9a15a52db48695066ff4462fe6de115803d34aa3dd
SHA512 379dfa848a96b03152a61d98818f9eee0d55f5ab75d80e20cbcda6d07f5139c96405f4302e082754529df418ab1d8dc3a564f86006cdebfac7ad054c0cbd44ae

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.Runtime.dll

MD5 3039d2dac4c8b6bf779415497bce9182
SHA1 f1260438e9a6748ab89f273b9b6c8bbeacf4d060
SHA256 2f2a12c209c99e1734f63d93c7949787e0f1431e640eb7290ed8bc64c34b5c71
SHA512 54af749cff05c850b67269be92f62c0881792981ede05d167de5db07c5d6ccd9e603fdd4858eaa5d94f8b3aa5df59440d9ff5a9214990e1a9507329ebc1d612e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Dynamic.dll

MD5 7db3f334ece74cf2af8fc9a7adf3ad95
SHA1 b01ee65af349f53708cb008ec5bd3b8dc1272fbc
SHA256 6ecf9eeb606f567573f117d02c3cb0ea3ca76d55ed7b5cb1c4a3a4893a2e1b92
SHA512 1af9317edc13597e4eb52364a45d45a7ef26376a70c8d1e0e5211e9ff14a73b5e1c5d01076de1de2d785183764614c20595851094ca729e90cf63a598509ffa9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.dll

MD5 35faf6d13558709992dc15e30f9dc45b
SHA1 a7f9bca20a681808e3c85ed1e71b21e5565d2c88
SHA256 53daa4f0056d3d1ef9b1e6ed70bfb493c1925f35866f3865052a2cb7bfdca314
SHA512 c790534b816afe4af8597cd4adc02ddee86757912df69a6e9bdba03e56aa981e57d59533ec7ab1629a29033f59fdf402a5cf2c9a5ccc6768b320ea28a0b5a221

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Design.dll

MD5 34fa41ab6dcec0ef3ca9527994d88a74
SHA1 baa38aca57ef0ce8d0cab96ce88bb7e7a19cad47
SHA256 fff87eb59027f579cefe4e20f2421f3dd5ede2522f81d6da20413a3fa7899ac2
SHA512 63c194d84fc4f08457b79b5e28de09c7185fe9d4046244ccd2ade1e2248e38a4813051604a9f660dfb953b41d0f913c5db6d0fd873c414b6cfff70731d2ae8dd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.dll

MD5 ca704c2acd1d71aba8842067b92323c6
SHA1 1f75119f97de83a2b06c2dd6687048a293534137
SHA256 ba92bdd7d2547f06fe19301ddebb74796471ff818b0d60317dbb1db59151eeb2
SHA512 9a87c7bbec666129d16dc90cd288b34ce1f00e12cd4c6c2d6ed6287b02b019e47185b0c330e999b3793e0833a595da24e17e59251754e3a941ac451d8c864968

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.dll

MD5 18fe362f098208ecadbe9fbf1fbd971d
SHA1 c27d54507c88e4403b2f7e56642f9ab77a1aff0f
SHA256 f80f154f1d29a3ba113f45f40162830b4e073cb04a57cd7ec0a996056765cb9e
SHA512 ad7834cb1c08a46e85788fcfaba5a54240e8c4a14823e2145800cb1e07491baefb55b44ce071b884833f60eca63691de8b9d47e6a8d7ed75c84763212a207296

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tracing.dll

MD5 2578916723d910c66b4e11a0cd5c89ab
SHA1 3c296d24ff5ec2c15eaba418375fa6fef9103fa3
SHA256 f90f7bad625e238b1ea28756e7d18983653791acd43322a720114eaf7fdf701c
SHA512 2f9f8a76eacd0875e5e9366ab5fe47e7ec98f3c2da2e51ce5c612e04ddc661998730223e3a51e1a5cccedc75fa113b8c049bfcdb236350e123ac8a30eb1e6af6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.TraceSource.dll

MD5 18e3b7369426b375f67796be7b29852f
SHA1 1c658274457f1f35f8bf948b28bce153600bf2bb
SHA256 cc3e6140c951857d7bb0fab0b0ba394a232a3cb01d7d08cc1e204ba85dc253f6
SHA512 3d1dbdf8468a9566bf1d3deafff192d08b933c98439fa3f2af7bffd9434eea244ee20676272a3120cda21d63694260dd24d7207709d667dc80c063258fb50299

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Tools.dll

MD5 e7e1e33d92369af532ddac6894b6bb24
SHA1 923e9895542a914004b230a7f234516ca15ef4e2
SHA256 8404e6b130b3cf3970973f26cbc6440fd9587918cc556b02116ccfbdbdcd950f
SHA512 ec63d4b096cfafc3cedf25ad401f4bbb27e659705f834ce38a347e84c06cae4dd7a543904ab1c13edfe5e643c9cea752caae20cbf5b8d487320d858c0e0636d5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.StackTrace.dll

MD5 c85accd289a8e64124c93d41cc909c9e
SHA1 0ec417d88851a14e857ba6b2308b7ac55e06dd16
SHA256 e115db6bd785dae03ef0833b30622621b30e8ceb49c26f85778b7b9aa0729b05
SHA512 ea8427112c68ec76900db1184cc28d2cf21f054e53790af362e06026f461f75f4a54eba0e262d1d480b0cc5b81f017745d446c01df86fd4aba0f61c280278c81

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Process.dll

MD5 6e2df79e4a4f59f22e9d516e56a1ef71
SHA1 0c5661ab4644fa62bd558d18390a23be6d6fa662
SHA256 f4ea00ea5027ab13a4e8255642753da90c8eabe50f7ee6b43dbc671bd0e02497
SHA512 f1c1cca7ce17e21e2d2def3702a16856cd5f9e7adc2f5ed3640f01f3c6f12167052e0f52d11ebccc1cbbdff24dca9388e9f3083d70d753a41b79b7c1a966f4c1

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.FileVersionInfo.dll

MD5 a770aa3f250c02d225fefcdddab1ec4f
SHA1 f01c7d0a371936381139a49f44b69fbfc7ab325c
SHA256 18f80e51fda81b84748c7caff100a884b7d4bc8f20dd9d5b88a395f9b13c35b7
SHA512 debc6eee8fd2e4a850b450bc6f8f268c9f9943251dfc7f1256aa07f1c6beed17b2f965909f8d60c58381d1b742865acd297d3e8b44729d9278c2d3b55ebee566

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Diagnostics.Contracts.dll

MD5 e4aefa6403a530a0bc8922856b9627bd
SHA1 c242531078bc457c90ffc6059f58ae0b596d5c30
SHA256 298d99acb473e21cd5209033862831a6bcdfe596e83ff98475cf89b1980c1011
SHA512 bc17ecef565dd683390cc073e03c98bc95c82f04d8a69be17bcdf3433119413f7930925b4e0ca4c96707fe5c8760850c326a7287e75dd73a52e5beb5199baf7e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Device.dll

MD5 9e86d2d764642b155761647af298cc4d
SHA1 4e02ce908f7ab3929cbd9c4050ac2e14b2096806
SHA256 5027d61dafbdfe066ae83efb90fd2a3089026d89c1646cbda5a842cf73a2beeb
SHA512 f566d30ddb89cc64729f65f38f70f1f3999782bbbbadd3eca79cb7233cdcb6913b9c5608bde8171a09b32999ef727e27900e55b7c8386c71025f2008e0fed973

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Design.dll

MD5 8dcd98077ff31c83668dd1b4fc7edaa6
SHA1 64103daf4b37103d50c1c28ade0aff0a8fa6b016
SHA256 b97f35da49e2c4ac1eb491b17369cce98cf0fc76e4fc09a4be62f3de045f228f
SHA512 38b832596809816940406e34b171ae323bb8ca49daa9b0261ae7cda2a0dd6c6497ec9a1f3389d05e9c8fa814dcf624f97e080db978bbea6c31cb461d86de11b7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Design.dll

MD5 906e67ad83aaa7a1fcf6c9a47d4e7aa6
SHA1 5ea7073c53954242d5056a768c1bb9641102f455
SHA256 e534e885c4bbac0cea82e5c505499a1d3a2c0d4465e373e644fb7a4a7a9a67e4
SHA512 0da479d99e565ef67fc5263fd4777ba632be9dae8fb33346cd9c9ac56552d2e6e15eee6a2f506526156e01c41fd4bc18da428c5c2a0f695b2c63d614d54ec421

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Services.Client.dll

MD5 7935d25819b45d60132af76704c54fb1
SHA1 5d2cfc0264fd3644b325a017fb6ecb6cd60b412e
SHA256 4ff991063d3c09ccadb2c46c6bb749bafea86fa82e07a5ffd13b43d900583462
SHA512 aa2d70202516b22826a9e66cf37cfae1ed88eb1f5b8036f9881e7379d60074c800b55de99c57572101cbd915b185d1b06d9227f84f835d74b82cbdad096189f7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Entity.Design.dll

MD5 4cf3acb3567eb0667cbbfd4177807a07
SHA1 8e7c1b467f36a92c9e0936ea87712183becc2a86
SHA256 d89d8752ec65c87c0648dcff85507b51062d896e01e082d35cec50f0fc97b4ef
SHA512 8cb1f0ee73e2c32f0fdf9e6aa67c56ad27a278590355458383a5ce3b6ede37c7f5d38da9cc26ab39d8d6b1a47d988a19d3c1512db3005b5e25df719724c6fbd9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Core.dll

MD5 485bc14f7496f81c93c34b6b0b08f56a
SHA1 4ef278266d37e23d549d807bdbb3cad39980ffff
SHA256 a916d33563e312176308806a2a3326e26fe7e3d09035acd4660e19b711a38ea5
SHA512 7ca85e0476618ed706fa365e747321e81e3666fa5a2da22bb0b06b02a86dab3d27cdfdbd181ac9f4076f2d72ee833c6fe5ae631cb8f5faa5c6b2945eb46b8b5f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Configuration.dll

MD5 9b806d9d04a1a0e44e22ed65dd676ded
SHA1 9d48dd0b3a5631c19d17dfa02874a444328cfa75
SHA256 720ac8f1c19e8777aa13cd841ddd6b797c061b29bc5560306ef2e636688baf19
SHA512 2a2c55cee7aa2583bb20a1debcc75f240f7c59cafc488280d0b172a13cda48442816feffff32e0395919318430916a08a108754bf6bf480c702149bbf01756de

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.EventBasedAsync.dll

MD5 f6cec282af4ffbf0272fe0a629470cde
SHA1 04eab1fbb0c964db4dc85c7a2b7a4b3e901cbd81
SHA256 81239079491df79b482c7ea854717c555f086d833e91bb46fcc2362c07e342b6
SHA512 9ca00bc3f8c3b74b677bea0d89b73438d1a20f7533c67234a7fb47e53c9729fb49a2a05ed07b35ab4bf3bee33cf1cfbdceea193f7aca0e6d2b5dfa92ff5ca4c9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ComponentModel.DataAnnotations.dll

MD5 b1bf58d199012bf24c4ff2b0fe3813f4
SHA1 d4671a9c2f9408f3564fe5ac09052d5267fd3be6
SHA256 5d39abe6989b221b982ae60b0cb2bcb54e1645edf6caf642fd4b0ffb8d0683a5
SHA512 068ad75f40dbcd8804f0445b9c06232fa06781fd23cb0305575a6b0efdbee4e5cf4a00889360963d454134440e081f174dcbc2a34c15bd45850ef27bdcf17f7f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.Specialized.dll

MD5 7c21ce2c139034b3f4d7195416451e12
SHA1 315be7349ef4857178c2c307372d4ce9fba2f519
SHA256 3474986d7abdf091795c8da9434d6d77616d013a2d99937d942fd3e27425ba6a
SHA512 2d2a4c56864dafebac21257b51f4b924da33a2cfec19e2a8a43e0566d3dd6e5c72ed8b545b7dc2acd306e7c69b39d49b693b6378a466412095f1c7363a78d3f9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Collections.NonGeneric.dll

MD5 3847069536650838d001c0846a8236c6
SHA1 ad3c8688ae9565b38deeff3dc17157c664e93af8
SHA256 a0dd1ba060a08a8cf586d8788415ab784dbaeb190906840b74a46c97b8f1adab
SHA512 8030e9a438c4b950fbeba0ef47130167a0bf76022260a2edea1817d251fc1de7455292e695edbc5d21c90c0fa082d961589ae7b4ab211250055d9ee6b162ae35

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.AddIn.Contract.dll

MD5 db4e4c283844f8a2bbb6e02feeaef9cb
SHA1 ef8a8a0399de1dab6b11881187f7c9563c88d7bc
SHA256 f911d09fbf2e921c843770e4c2dca00e22e8a0107710fcd2997d8de9b59e968f
SHA512 528cc171f1e9a6ebbc816143611dac079b35c31e0aeb9329d1387fdf2fc9d3b8f9188fa4e9a4ae35269ea10ba5e42cc310938756e5f32db0c6c231f90867064e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Activities.Presentation.dll

MD5 6fbb116c844d61494e6b3854d8b4cf93
SHA1 d2c0aaf7dcb1607143ade4987eb12a3df7aaf45e
SHA256 2843d13947cafdf83c8c88339b53617c828d79582329848a563fcf9ba3d1368b
SHA512 6295abe89dbca993930171b13509689c6a8bf3a15e0553165371043555dfb595d1ace565fd1f7702ee4b74d02ac9aaf9553e3ec1658a900be91049a074496137

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini

MD5 06b88037d08b99aba34a61a950f8a038
SHA1 ddd531abac7d5ed5be7e10beb065bc0605d8044b
SHA256 6bbc77f47ac1cdef1daefcd6c3f9ea69b894db524770cc783738d44b4ce101c8
SHA512 b4fd57d472a822692ee09e3aa0a238df4c45c3e86c514bdb4291d54b276daa37f946e99a122c7d3ee98572207296e16b3680d204cfb96ab55b2623753d580d33

C:\Windows\SysWOW64\msvcr110_clr0400.dll

MD5 f6eec510d98463d17aecd98ec98f4961
SHA1 aaa04352d8a432f258fe9e94187383a7389a93a2
SHA256 badcc3de97dd90c3d3952b87e9cec77461770f0d7fa022165bf245e9e5d798cc
SHA512 d76c4f9bba72c19b14cb0bd355cad87487f7db755a54daa84b5c33198772b03932b61f1c30c0eae5c8037c02564ab5d57321a248d1bdd04445d253fe8b59a68b

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-06 03:07

Reported

2024-12-06 03:10

Platform

win10v2004-20241007-en

Max time kernel

106s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe"

Signatures

Renames multiple (5458) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\wintrust.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ru59MZ442beTeJU.exe" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.19041.1_none_f6eee8789c1c6fdd\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.19041.1_none_04c252e5678f305a\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-theme1_31bf3856ad364e35_10.0.19041.1_none_8ccb1090444b78d3\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonprograms_31bf3856ad364e35_10.0.19041.1_none_047fa97bc9873117\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\Wallpaper\Theme2\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.19041.1_none_39d6d106c6f70bec\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.19041.1_none_be359f0533764571\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-commonvideos_31bf3856ad364e35_10.0.19041.1_none_923716ddadd939c8\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Fonts\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.19041.1_none_0b090bb5ae01dd1a\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-publiclibraries_31bf3856ad364e35_10.0.19041.1_none_cbd9ad4986c925d5\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-commonmusic_31bf3856ad364e35_10.0.19041.1_none_2f07a4cad3dec315\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.19041.1_none_0cf1a65e91dfb2be\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\netcfgx.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tpm.inf_amd64_154e6da862a6dc30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.System.Profile.HardwareId.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\asferror.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\BthTelemetry.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-errorhandling-l1-1-1.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmntt1.inf_amd64_263b3076d78209be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_ports.inf_amd64_181d494584779290\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc1bda6cf47380c\mxdwdui.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_a7a5b507fa22251e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WinSCard.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Windows.Devices.Custom.ps.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\tsgenericusbdriver.inf_amd64_bcfa5f586783921d\TsUsbGDCoInstaller.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\iyuv_32.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\packager.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Startupscan.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\remoteposdrv.inf_amd64_0f0da968c1cfce06\RemotePosDrv.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\RemoveDeviceContextHandler.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\TextInputFramework.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\inseng.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\provmigrate.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\acledit.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_8416dd97e1ecb6dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tdibth.inf_amd64_e1022e6b4f7ab56d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\FWPUCLNT.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\framedyn.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\PrintPlatformConfig.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\PickerHost.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\SecurityCenterBrokerPS.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\srumapi.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\rdvvmtransport.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WerEnc.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\BTAGService.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEFILES.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDLT1.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\pla.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\KBDFI.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\MicrosoftAccountWAMExtension.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\MSMPEG2ENC.DLL C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\wiaaut.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_multiportserial.inf_amd64_e92b6921fca885d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Dism\OfflineSetupProvider.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbaudio2.inf_amd64_8d164ac6f7088f97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\Print.Workflow.Source.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\iscsicpl.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\PerceptionDevice.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ro-RO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\at.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\CertEnroll.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdof.inf_amd64_3ff016f4df6d2b8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WofUtil.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmarn.inf_amd64_947cdd3822225c16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\networkhelper.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\SystemPropertiesPerformance.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\tapi32.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\iscsiwmi.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-36.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Numerics.Vectors.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\Microsoft.Build.Engine.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Presentation.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_output\libwinhibit_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Forms.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-string-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_24x24x32.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTabControl.v11.1.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\OrientationControlMiddleCircleHover.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-400.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-125.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AttachmentPlaceholder-Dark.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\TinyTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\System.Web.Mvc.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_targetsize-32.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\msquic.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-utility-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-400.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\6.jpg C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationTypes.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-125.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\GetHelpOffline2.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-environment-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_filter\libskiptags_plugin.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework.Luna.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..uetooth-dafprovider_31bf3856ad364e35_10.0.19041.746_none_fdc3acdd83fbafd5\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudstore_31bf3856ad364e35_10.0.19041.153_none_9a7584eea3d02b53\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\wer.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-powercpl.resources_31bf3856ad364e35_10.0.19041.1_en-us_404e106154453a0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..component.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_663caceb164a694f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-network-security_31bf3856ad364e35_10.0.19041.1_none_8d6a27befe49207f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..olsclient.appxsetup_31bf3856ad364e35_10.0.19041.1_none_3fb2edd2476a33e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\UserOOBEBroker.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..wscollect.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_62286351359bf512\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_netfx4clientcorecomp.resources_31bf3856ad364e35_10.0.15805.0_fr-fr_23685c9c791653a6\Microsoft.VisualBasic.Activities.CompilerUI.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_0e9691ac6feedc0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\INF\TermService\0000\tslabels.ini C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\System.Messaging.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_hyperv-vpcivdev_31bf3856ad364e35_10.0.19041.928_none_8a9d24318ecb0806\r\vpcievdev.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..-nlsbuild.resources_31bf3856ad364e35_10.0.19041.1_it-it_b92ae16af783030d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1_none_d69d2c25bd407a87\SystemSettingsThresholdAdminFlowUI.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\ScreenClipping\ScreenClipping\Assets\Square150x150Logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_universalvolumecontrol-model_31bf3856ad364e35_10.0.19041.746_none_1f112a4fb5d16d58\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-container_31bf3856ad364e35_10.0.19041.1_none_dc8438e1679872b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_presentationframework.royale_31bf3856ad364e35_4.0.15805.0_none_1d1d7c19edb20fe1\PresentationFramework.Royale.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_system.directoryservices.resources_b03f5f7f11d50a3a_4.0.15805.0_de-de_6782eaa1a066ce09\System.DirectoryServices.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\msil_microsoft.windows.d...commands.resources_31bf3856ad364e35_10.0.19041.1_de-de_07dcbbc41cf88473\Microsoft.Windows.DeveloperLicense.Commands.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rasmontr_31bf3856ad364e35_10.0.19041.1266_none_01aaeb834d2b9d4e\r\rasmontr.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-security-ntmarta_31bf3856ad364e35_10.0.19041.546_none_63d472fa22d1aac4\ntmarta.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appcontract-bmpolicy_31bf3856ad364e35_10.0.19041.1_none_bab0858e9282d2e4\ACPBackgroundManagerPolicy.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\AxInstUI.exe C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-f..istory-ui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ecc8f01666b12299\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\badgeRunning.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..m-library.resources_31bf3856ad364e35_10.0.19041.1_it-it_35b543fa13574693\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-devices-lowlevel-winrt_31bf3856ad364e35_10.0.19041.746_none_12bf0a27d0e73927\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\Ignore.scale-200.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ointofservice-winrt_31bf3856ad364e35_10.0.19041.264_none_462202d4c044712d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\msil_microsoft.virtualiz..client.6.2.settings_31bf3856ad364e35_10.0.19041.1_none_ada5c8757a0d2f2a\Microsoft.Virtualization.Client.6.2.Settings.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_ko-kr_7b2bff232d678514\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.19041.1_en-us_bbe394a112ff516f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSplashScreen.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-msasn1_31bf3856ad364e35_10.0.19041.546_none_a5535ccb0430ada2\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_360a4694041d294b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\Icon_MMXresume.contrast-black_scale-150.png C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_system.drawing.design_b03f5f7f11d50a3a_4.0.15805.0_none_770dae309b92adaa\System.Drawing.Design.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-s..on-onlineid-runtime_31bf3856ad364e35_10.0.19041.746_none_30d6e6284f82709b\f\Windows.Security.Authentication.OnlineId.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\assembly\GAC_MSIL\System.Speech.Resources\3.0.0.0_fr_31bf3856ad364e35\System.Speech.resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-pdm-configuration_31bf3856ad364e35_11.0.19041.1_none_3a3176fb20a387fb\pdmproxy100.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printing-platform_31bf3856ad364e35_10.0.19041.1_none_5ea144b16134be06\PrintPlatformConfig.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_27faaee495997877\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_windows-id-connecte..nt-provider-wlidfdp_31bf3856ad364e35_10.0.19041.746_none_8200bd0d163e4474\wlidfdp.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ai-machinelearning_31bf3856ad364e35_10.0.19041.1_none_ba5d622ef928b19d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cloudstore_31bf3856ad364e35_10.0.19041.153_none_9a7584eea3d02b53\f\Windows.CloudStore.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mskeyprotect-dll_31bf3856ad364e35_10.0.19041.1202_none_51695309b91402dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-p..cemanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_61c9bb37fa88f7ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_c991318e4b11e4cf\secproc_ssp.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.Resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..e-protocolproviders_31bf3856ad364e35_10.0.19041.746_none_d14e7c9238ed667e\f\BarcodeScannerProtocolProvider.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..tenanceui.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_ad93bc9653ddea58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\msil_microsoft.powershel..sreadline.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_178c05b8f743a84b\Microsoft.PowerShell.PSReadline.Resources.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.1_none_4a03fd12cb3f16c2\ImeBrokerps.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_windows-id-connecte..t-provider-wlidprov_31bf3856ad364e35_10.0.19041.264_none_27b83f4616081fe3\f\wlidprov.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Microsoft.Build.Engine.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.19041.1_es-es_6e3c2686dd2d1656\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-msmq-runtime_31bf3856ad364e35_10.0.19041.746_none_7edb1f4894ffbbf6\f\mqoa.dll C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ru59MZ442beTeJU.exe" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\DefaultIcon C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ru59MZ442beTeJU.exe,0" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "IHCSFKNFSOCVCMJ" C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell\open\command C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IHCSFKNFSOCVCMJ\shell\open C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\cabf8f39ef3d24be4adf8a096bae27ff_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini

MD5 ca9aa5bd7274d42da4a38eaff5805a91
SHA1 64be607cef5acf1e4607e3a386019e871591179c
SHA256 0d6191e3e025d1939b62c26fade11d1521201f9320868527a7497bf556b7e694
SHA512 a6fefffd11eac3a8114ffe4cabe16be988f239dbd252e10b38b375bf05a57bcda027ab45a945ef2ff9581d799d1f1636cd08bc4df13c710eee18c55394e07b29

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 f460d5b87d924c0e31115f3eba153e5d
SHA1 97f7b67f96b8946da3b2d01bd19fbe502bfef4bf
SHA256 aa804d8fb0ee963c022b36b10dbea6a91f1b33466b05f3e2a3768452e90efa89
SHA512 6dd98d33e049a5f380c5caa36a22da3e070f258630819625a2b6f88e21a7695016a6a558acec5e55b370ebc3ccff9f72734a55d153e686baa1ba7ba9be13562e

C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

MD5 d1c2582c5b670a9a92889c4ee11e9261
SHA1 f0571fe5d4b7ea171e9834b11cbd7f897fa0f5ed
SHA256 c50e2923a29cfaae3d2289d148adf2b02dfbc60a095c116026bec82149f4736e
SHA512 ffe623798fe12a087fd7697907824ad1ac4826e2cb333de99f157176d722581ddcfbdc7d0c712f5db8f9f9196a73377ef3092dcb067b589eae68141bb94a590e

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

MD5 fcf9fbe6a2e354f96989b2c9d9638103
SHA1 ad5ce46dde2baf8f7f8447948daaafcd0b0c6a81
SHA256 c16172733195f6fb05c4ed5dd6d92095f577603ee5151b1ef6d1b14c0d7008cb
SHA512 683240110f6e9156cd62fcabdf1c4d945ae25d7d1cb901b114b91063b1b616b73691d7c6590ddc348d1cfb84241c1cf863287633f518781270e50cc03628856d

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

MD5 9a2015825367a8993aec62a4d9001389
SHA1 d13743ce2c6aa63b80c6c064188dcdfd4cec2ad9
SHA256 0c6f8cff7992a38c3ec97360364a8881d8cf1e973489eadeafc53f2b7646ed62
SHA512 65bdcb718586cd6580093701ca9d0fb95bfb36e6b35fec38cd8b916ce4d7c8c9910305d6dd13818173fd2b8f36a6d3d9dc9b1e7c45fa0f943a76c83fcd38a121

C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

MD5 4ccf980b0312492ee9c013d7c5c6b558
SHA1 b9488492c319f700ae8d88b64f9193fb752c38f0
SHA256 d2eb0d0a7e1ae825764e53f07d27a152f0667ebcae628485014fa26d49df2fcf
SHA512 9972713857da90e3635a0b2b3be572a9a91ccf0bf187078045c7d3d2d2c82d3288552fbf09b7d7bf902d5e59347ee82376df5e87b42bf2c762139d097b1c74a1

C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll

MD5 257e1d0894aadd68c684211e9206fe51
SHA1 0f83448ddcb6670991b71122ce50fe89dcf4576f
SHA256 a5996389099c80c4538daa3c6185782e7bb658d17ba6095a8bd99a909f6ab07e
SHA512 744d2073cc72046b7edb798da3e9acc4e6ea78dfe6295d6b241eb9ec326b1d352414e3de0bf3b7244eee6897c17d5b9cf2e7354bd7ca9b8027ea903b35ef84a9

C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll

MD5 18239acb195b5ddcbdf9a4989d526b4b
SHA1 4fa203d7cfa6add9e9fe6edd37decfa8419c423b
SHA256 8a07f9e1e2a099e2df557e05c850efa5922c7e51bc0621756996d0a4d525184f
SHA512 74782dc1f48b77fb1349e5a297d98469278584b8b068707ba4733d5d9c441f7c81705989ee905b06cbe452afed7a9487602de70d716bc3bc61a1f0e18e403aa6

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

MD5 a94cf026bc02d70266ba82d2e2b79dff
SHA1 0871f993404bf286519f1737be58c5e3af95db9d
SHA256 c712b2e73b5371ca3ea759a6ac15b342525c8a9505fd2e4c2b9c7bf34ec30c04
SHA512 352ee310a06981d06c94753594caca876cae75f0b32487fa09bbb28f9ba8fd344ea986cc3da649328259d181cc87c9510d91d450b818f3088539a11a7839a8ea

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

MD5 056837a1435b1ef6ea1379e519070e82
SHA1 42076662b73cdbfa0e3940a9aaa32fdd874a797d
SHA256 ff7e94660c9a12f46c66692a62ac7b31710f5d4f111cc64436e082f2d658986c
SHA512 6304f76d3b4ce035eb87f808708396df7d842f664607008741c0e8029b5c4512d561774679e5ecb67ff3b792efbb72dc991c6f782971601b97cd8749ca332223

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

MD5 919e33c71497e4b2b51ff5b85ee95b27
SHA1 547eb598001c144cbbb14a45af205bc531d1b359
SHA256 946b5eaa1524365aeb3a6677eace33f3d5d82b69827056b5e43f90247d363f0e
SHA512 c751dd9acfeef47442f3fb3b789e2173ea7b1481eca0b84d0c1aadfb620a9fab2a330e1f52fc1159d4f648db22b88ca737ad497b26b628b688304458589d73f1

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

MD5 c4d7a631b5fefd64151e3ddb771ee290
SHA1 80effe86f1de59acd5f1f1283c1b67345a5fb02b
SHA256 6ebf2a9f8d7757b5a4f896076eb3a307e53aff636ed5766a84560302ff8067a9
SHA512 cc6d0524699a35b0e5211aad34dae95d916ebe09b50a6cbec775c8ab7b8faffd1d22d6b3eda8498a9be70dcc3d685db3b90378eddd14c2d1b34ca665ff2842f0

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 b45f2f9db1435c62bfa36ad79e7d8c30
SHA1 abdf5a9b9a5200cd9e6de24135cef4e4390d07d4
SHA256 51b74d37684e22d95f8c469f6d4a0facff341a607c642df40a29e198c244d3a8
SHA512 c64d90272b294848c51c7d7bf9fd78c6e75aaa59f78d1091bb78aa7920b9efe61f466f48ede9c78e4241ac9d780c2d06d6075e29d56c7450f6f5bb8a1135912c

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

MD5 3a20cdd485975c6d8bca1178269735d5
SHA1 f666b1b520bbe784ca4c30ad2a0126d79bbdbf19
SHA256 25a67ceccc7516a4dbbf1b6d9bafe2adad751c4ce7726a12232d04c93f4ba4b9
SHA512 910557ad38f80892646cbf6aa5a98b27ce118feac898d0578c59509b75195dd46c72d99e785fcd5a9fd8d932f4eafddcb8d8b2978b428855b4bf712918ca4dfe

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

MD5 e5f0a4072a937fb5979237f44c56b893
SHA1 a2a9f5afeec6b2c13b35fbe9e82c6952aa8bd8e6
SHA256 ff9709305f3dfbb8954bfb6bf664fa90b6c5b2fb4f77f00c46e3b5dcd9010857
SHA512 7a27ee00e46c37e9431d461bf16cb0426c14b7ca1fc25065e404983b6f4e3ad8f1fd757a997b310404cb6e30f376cc3d54e6f82190996c3370d9f18caeb4bef9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

MD5 ccf066851814d41eff0b0b9c78aec085
SHA1 e576e8e30332f28f12ec78dd0dde45da74bc189b
SHA256 428f74a4927ef29ee89ce38b8798aaff84c5bd20d9d42bd86c42a5644867e687
SHA512 058ba302319e8eeb1cfdf2c7094fb6ba893ef634da39e297b9956a16f3dccf65e212f6ccc075abb1cef0d3f3b72f5e08093b7ffb9f011188b1070c3d51daeb9b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

MD5 2034931de129a88f66c662985bda8cd6
SHA1 3d5c472f2ec8b195f8c6827513c50b370d615553
SHA256 64a838f1a6ec5780dd3328d0d1862405eacb52740aa57e578297b3b334a06df9
SHA512 c52a4a65bd1046c330962d344565b3e24224fe0c67f919901ec0e7fdc2eed20f94fdedd52f70586d50d6364ee768315ba7db4b42a4633a4c1961f61bb4ac1f3d

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

MD5 77118f1e1ad7845e7f76d5ae3222998a
SHA1 51796e031f32a6497cecb2e54b1f1ef911c239cd
SHA256 8d1a42603e5c13a6dc51d14b39bcc1925ca2a0db2548dec2b0c454f11b4f34eb
SHA512 1eb7da5894e3ff14ce4d1debd08f125b5a0f59db94a4ecb3fd7903e5dd46e8199cbc9fa39098aded00bc2cb5956c981ac6ed282458ac54d7bf793a957b1d66a5

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

MD5 e67694a2cb99024c1083e51b41168ddf
SHA1 2ca494d2ed185724a5e12b63a95418c0835dfe34
SHA256 93aba363e231d595d673138d56b32943f2304d104d0c04b0c9325b799fb3448d
SHA512 a4ccd2f3dcedaf63766bccd0c83697df9d84fd67a5d67fe69d9d31c4ada3b0bd91258ce781315f14b2a2350d142539fb86e5fa50c5e8125c42e20fa125b16f36

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

MD5 f19bf58b30f175260c51351f891000ea
SHA1 833ff1c6a4b8f90cfc03cb57b21b9f7d7554c7e5
SHA256 935e01a9c4e2ad94a8ef577c022773986e1c23342552f8e73c8a29f8913a8a49
SHA512 f8d8ac70f122152145d1f6ede3a4cac7f76723893a2a0ac72830cbab51881675fb7baa1ad5aab80ae092348158e77372f3ad31d8c2ea0776021bc0efa4695ed2

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

MD5 f80e4bea0558b5a878a6900022ae1f21
SHA1 2f9612e47adfc4d5d3caecff1cdfc92b4de8d028
SHA256 34e21a3620731cc2e31a0165562569f395936354a7f75dc366cb8997cccdebef
SHA512 76b8558b755870152eda9f0bb9c5065ce04172c224646738a4862b97be2a728ce50b914271563bf8c674b94495768d92ad1674981fb0dfcfbf03ccacbbe66823

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

MD5 b4e9162a0c54d0ecd9f9cafcd7a5cc19
SHA1 09ec9d9b31d53b1baabbba49dd2d8d89230e6ed6
SHA256 78af84de57171dc26f04a3cc4fcb5e6a6105b2b6a456beefff1383b41a5ccab3
SHA512 f8a98a10fae220ee900d0817acba5904307043424298e52e1f3ffb95759771528579466f9e0cecdf3ec3e84af89284d0efc7e0c07f23ec7bd6cf15c617ab49d9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

MD5 fb39164ad1a0b578526c79a3fdecc27d
SHA1 3be8cefb97342bd4b56706283d2f4cafad54a43d
SHA256 265631b0f8269988f8dfa26d1d0d2aabaade3ea354e75a4bc2c641e1712a3d2d
SHA512 afc40b390bf410d4ec28977d14a08f66897549068fc73d93efeee497c6b703c5cf6eca303751db7196d388cfb47117367a95f41edbb2a372f1bd3ea75c021bf4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

MD5 7068167a29109bd5633ca152a81c7991
SHA1 34a19cf2c3caeb174ab4d7fa69777e8bfd0bd46b
SHA256 fc71a7badbc2a570c567366406a5c34bb90083b69b8a4e02d722b39a9f2aba37
SHA512 338e59039aa2852760eba72500383a7a18fbaaa30aa3efc52d7dbe9d00a6e5b3333a8ebe369c22d88a82fbe11d565b8d2bc897baba564ea8ee77af28884833a7

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

MD5 a67b97e5bfda9139a3b3ea99ede85c03
SHA1 3a81cb305719eb292db3a1e4e6fa8483a6e5f8e3
SHA256 e869712ba9478a5122ada11b7dfdb1e30a8c1f82da34c753d60d991cfc7f4106
SHA512 7cd153f017605e5000932a7f2bd4208afca4ce81eabbfec0e033c78224416c1b2365155cd9b4c6defdfce20b2bca194ec009694455e4d395aef6137f7976cc3b

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

MD5 cf8254c3264c2b8ef6b85b1bda10b9c2
SHA1 bffd12f8d216d37ce93b18f3a4f1d6d45197f814
SHA256 acd464859b099088ace03ba8742ca7acd3d93f85f404d797bd366477b7b29b1d
SHA512 5bae7a2d980726456d64fc4b1498be8aff44297bf247460f5ae54d5a3a9e66ac5f4074fd0e405f8385cf082190dd1a87053d98d9621316dbfb61de362ac4f206

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

MD5 ce7d23654f53aa78c9e4a005cdc0805c
SHA1 b1118e038e5ab356385d36c91572165c5e15cf3a
SHA256 3e4dc2cdf9ae64749b1f1d8aedc635db6ce6a8053981287718cac46a6943c761
SHA512 33e8e484979b45a78401e67f0d27d5147963ae3692c16816154677ea89235bd32ef192e85132f867ab3326909d2f5e1d7f91273852effbcb490313d0c3bdafcd

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

MD5 897b551e5b6a503f3d8a5e0c4e15bbd4
SHA1 39407941cc1fbde9b16e7bed264f097bed319e57
SHA256 e141df55e731c388d19cc7e9cfc1e1af11843699d56c457cc0ebedf61ce34e3a
SHA512 6aa4ea00dacf98209d09cc0b47ece245950b94fb0002db31ea6c312ac62671be7bc13644a11c72d0ce75ac0b9a71749c07935e3f449ebc77d0a07dc63cc7a9d8

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

MD5 168cc20cc3358262b4aa912ce1a66b89
SHA1 9a3b0900256c4315a7a368b63420402c03e752cc
SHA256 eadc5f60686231c27f4c575883489d46f64af479552100369ed31f4d9afd42d4
SHA512 800b28b4bce3d535ba044fee4d42c483193b49dd9fba741fbd55e1b373dd3750d9d2833e61c3ae14881b3fb69e8181bd4618389410309bf48ba852a3562f1289

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

MD5 3de91b59b6fabc073bb6e13c263d52cc
SHA1 ee6b62ded49eb5e4bf4df71853124998bd24558f
SHA256 fadeea7d55daf4c174992b204febe815ceb6ab7004498800aa2f9fc3d70ff2e4
SHA512 f368860085e2191f5ff45dcc197cdb329701d07e493eb0616d67a049634d2324901cf8e6554f361cad447e6a9b6d9be726b03f6c82cc7c623bf39c7696280f05

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

MD5 e6fdb15cc6f3e886c99a3c6178bf3c82
SHA1 141ee1aa4d23ca94aa78f4802de7800b1f01cb6b
SHA256 bab4ee9c0ba25ec5403399da1507b8755490a3e9290670e76dd3882475066465
SHA512 ff59340cd160308ed60c270fa5efc8809cdbadfadb843908a9653716143b477e10575e2a71fea89183a1224cdd664e897a5d693674acf133d28ec67984563847

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

MD5 f5f445515c73efbb3f67b6aa9b8bc8b1
SHA1 7b1db41257ee569cc77632eb03ad50060101cb02
SHA256 5276ea80ad81a115a8f68b83b348e33b1af1cddbe01e823e446a06c77b33dbaf
SHA512 b8f6b4e277885ff2ec54d1f79ec441fcdad8a35c70d1735c8813453b7e444679f260fa1767558e4344905b25abd1f85221d4ab9f3878de664aa023030a658210

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

MD5 7b446e8d42f156bedfdd6118a49ede97
SHA1 70cc806885806d5ddf83b40ae93d0b065ee333b0
SHA256 0be630c5b2c8a6b85ad7bb94f0aea332b3e0de1165b71de029f1caac406a2d08
SHA512 1cf9ea115cf6189ffb4f67150c242227bcd78e5d38a8cc9c4474386954482ddc8ade17e66a66a44e9a7f629586d9a1d6f716cda80030afc22ddfe340886c2e97

C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

MD5 766324a5b6fab1cbb7bfed082e78a781
SHA1 431edaa545303aa0ce5068566f1f1e5649bedb2e
SHA256 d2818f8578b3f6cabf9ccaee202dbf1745f31a1a1e3f8234cad517107704152c
SHA512 189e5c3e50402976533b99d1c348fd02bff6031ffa7175b2442f68ce57bc10b02ed2fcd9d21ddc5e0db220ecccdc3596cdcada8c759d3f51867746d869bf4339

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

MD5 c6b6ba7a9e17be8fb2b73ff6882db0e1
SHA1 2fc84943c243a6a11a2fb9e37371e97c6c9ceea0
SHA256 6a4a5d79d0df63dcdc3be19660a5c539b846f6e7bf31a354a451ebfcf00a1207
SHA512 adcab5a65c7a7c7acaa1572ab5df89903cab6ed99bdfe29aa45faad1f779007f185641dfb6ea4409f77f3b766ac47a116895aaa3da9d74b55295624e0b4ccb65

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

MD5 11b69dbbc6a0960b29f862c7fc96e840
SHA1 4c7552bd6d47618502967778d37ce36fd3a6197b
SHA256 6250b65379c05ef77c510b69be95651e978a1188c634768d5625b0a432829e15
SHA512 d8de6c5abd1facf01ec9d3abf8f3721b3128f070a0ddfa4e930dc25801c818427a9e5300725c5fba1a09934197cbfb489a635adee5c2b4b103fd91ff191dbf6f

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

MD5 73b504506a3ea22b4ac5430d590c979a
SHA1 da36688cb41e1c831b27ceccadbeab9610f3985e
SHA256 94c1f056dfd38be15083782bf80b2848de3daf0d6f71e2469462391ab2c1f9da
SHA512 12225277ba8a0ce0b7fe98fe8f360dd051e0bf4ac8db36c4b77c96706c776a37acfaf0d4f94649e60e6de6b9bf49683db863a8e9777f0a200f96dbfe24bddb06

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

MD5 25d949392f8fed0f81ae336d109131af
SHA1 d58f2fa1ffc08bf1534349b7997f9cb74f0cdc4a
SHA256 b4fb4b1d533fd2a73a62e2969142f00123b545a9ec8164c7855ed95e3ac176f0
SHA512 9b59e1cb910f63e05416cab7b18664eff474c4d0310f0637ea090ac8a994b73877d97e47dca4fcdb84614ac53052bd19abe90c9273da1b117321e1b03eb5b976

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

MD5 055264b727c7476a9a9fd633474d537f
SHA1 6109e250651c6560cd64c04622f71a32b879d45c
SHA256 6eb48ec0ca64cca0c7cad7aafcd761f1bf93acd9a7635a01095daaf2e4684a6f
SHA512 26e670586535ca88d1a5f3d3d6ac1171ab80e525bc71d0ae052e5db0019866e2e6a5b98a57304f1f0b4d7739fb96dd0956b924872268197a9dca67a47d0f769a

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

MD5 7ab8db9aeb2b1af5fa81a767d1057a59
SHA1 3ba759deff383f941cc580a400187f33e15858f3
SHA256 9de22069641b368bffd96a1397400b58ea2d75813f93f6d516c867076a19f149
SHA512 cd3cf17f1096a26fba47d1040adb069b1844fba0817884b1267a9d4235841ad26a42e3ec77a02253a2380b7357cbe2139b8a566bd8f3cd884de182c2adf320c6

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

MD5 c1e7e598637872138e5598261f589407
SHA1 1727b822cb8b47009b0f31465a784c4f7a7299b7
SHA256 3a220ab4f3c6b87c6ab81044fb278bc119314c9a8054da626f7eaedc28e3c6f9
SHA512 812b8e9b8fe08a14c8b41c64686b4e9000568af9cb9933e97d37516675cb1a195dbe85512b92b5d4307e62f539de1b10fd6d47c2c927c97b963da1d6ec5a1de9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

MD5 dab85581ecf47f9592ffc47485e54d51
SHA1 e19e02b51c6c039ec3ef789c35a778f10a4aa67c
SHA256 f5e33a2190df73c8bc209217757a88ff5d2f9291814ced1fab9b72b476d1b71e
SHA512 e54b65344ea4075966ddc3b89392d62c854b8a053bbe72a7a73aebe62523bd2b922e4790dfd70547c5cb0c0dbe187cd9bec9530b9bd63d44ff202aaf17b22ec0

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

MD5 f6480177f5a00b91999201ecc593fefa
SHA1 ff11b6dd951655c6a8918aa3c2931a50c7c0b560
SHA256 718275b2ed6474030556d0c0832dc4dca69cc649d504614a98af6787b4bea6cb
SHA512 7b37a7ddfea1f214956a959e18a1358859c53e2e514de9e94f2ab4d1c30a8bb0ac6c950b2f5b382e4633fc8e29c10f646ec80bb5e2e8283ba2925024f1e99316

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

MD5 c11dde12917b2c516e431a17e2eb03bd
SHA1 73b915025b66ee3c790abcb81429e1ebe7568689
SHA256 40de414641120ca2a5a8d6cc2939fed766cd40c24eb72f6e8b39e85ea878631f
SHA512 f0b12d55e6610c35179407c05fb2813c77377ecbeba5ae35d7dca37c46a45db04ed4b24c8cda4d3d338c03eda9007e62f3544cac140c279f88338eadc9889ba4

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 66a74cbc1c8355353e9f08be79964473
SHA1 6aba8224cba5b7256b3e513ffefcb92e150f9fc0
SHA256 05c2c1df1fe51fd0d67634e79ba0310ad2e4deb5476738230154f688d10e8231
SHA512 f9a7357f87cc41ff5f7272636004704f91186c7f318b43eab19b61bbdcde8fabcf888610bc3b0b16aabfaac4050f237e285c7fe9c0c6a80007285a1988890049

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

MD5 f30e91dfa0fe76f8dbf71fac420c52e4
SHA1 f16f1db9eeee6e0b017e2d35c014625542c8bd5e
SHA256 6691256ea034c2363ebede4ce55e5d725b471e81f5bb86fb60195c8fdab7c9fc
SHA512 56d2d4a330eec3db90f32532a09ae59016545d4ea75918b2488c2d9751332dc37196fa82dbe07ab581a35c4b11e0b5ac0e0e3ccc6e02b1f85a44b4f4b2b33ac9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

MD5 a0fab336358b2b7c971149b77517b202
SHA1 b23453d508a1ef425b7d62a70d2aabc592738b6f
SHA256 0614f49cc24866762a6432107c4a0e4adbba3eacdca42ab9d80a1ad2fd37641d
SHA512 365d241ae6f2fed16e4f28226807b39605b1dacb41a5b56e280f46022dc4d317d7213452293f7cac1f82ce9040a425d997b6986023d8d8a5b6d8273de6dc6428

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

MD5 e1e106ebece9a3bb87ef455ca7d791fb
SHA1 5410b7a7a2bff1d51592ed0372bf56e279b931be
SHA256 34d63396c179edc8cce2dc3669ca87f56a5ed418740d9a9803fa871aa90a7e84
SHA512 e3a1557348ac744ad7c750c819041ee40a6eeff6cccb126a5ea1783da96a286f9807a2377036a01f5805352dc3a771741b43f9e9efa03dd9ab196620bfa822f9

C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 1231c572aacac7855a79b491c94edaa1
SHA1 f5ee8442573c002f04473a2c8f22835b208ace3f
SHA256 c2672eb665e97d87a027b8de5d2a211539aa5b6f54c3d7b468c891071189b28e
SHA512 738ca7f6f542df85aaab04e24248bfc47ddd4fdd7429dc2f0d2f16f8d4a89925a9a7fe1efae09b872e6fc9350a2f4c3cf021221b3b94fae2a9d63fa7a6a596b4

C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

MD5 ff9f78b068c7a6e4c9dfd4e3c553db28
SHA1 56dc34d82cd192cc2eb89e5c54746d0603a7d22d
SHA256 8f35c557d90d574e765d754c8f6dc025144c96e863b75cf00059fd99ca0e1660
SHA512 116768b9005c9cce739a218531c48d6b597be6b6b526a5e096fc53e8a1ed2b5630dfb4024b6a8ad1ff5dcf211f8efaa5864d590376b67ceecbedc4895cbe28b1

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 102f0ec98a68283e1533a866e21860ba
SHA1 79a25c8c45a2abc72fb7c816002d8f6c9789726e
SHA256 415a2e66d3fb77ebf025655f20dad40c71cb1747c39737948c7335b46086adab
SHA512 48a538560fa2eb1003c4112f8486663132a2bc5519021a1ccb0108adaee27f4f7853a05f6d199e945ca28b9208a386f499d1f3ff0c95606e9390d2c871a0e2f1

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 f22bd832226626c87c4e506776b7a9ad
SHA1 2b69dd0ece3131f2620e5cf5b921a6bb1619a47b
SHA256 c0ed1131538d3de2cef305b81adf3b4810d0edf1ffe6d56f84d6163c9fad405e
SHA512 b38c2f81add4748c2738b5b8e5e4f306f610f46e57c2d4552cca6ce7e2bddbd19a82a991d8069521b0b134e5150fe72adf60c041387a0b541b0048216c93f837

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 bc4022d764d63e8616b5382fa7411336
SHA1 fd8d6186224f30e01fedc4a1c4482638e49fa7c5
SHA256 f3cd535c6336d47dd8d89b95ad2f1a61b286ec4b0c4e05bc31df9d6b202ac453
SHA512 ac62642532a3c2f42d49502269e077b7baabd744726228ef1ebbea0592ba6970888eaa1ece8fe210053be375c4d3ec8b514316620df0f403211cf8180470a56a

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 5ce05e212d07775f3cefa7e4442a9c87
SHA1 6f40a4bc3cd637e752a47b07240a5edba4c34d39
SHA256 149392f0019b63798957100a77ddb672a40d2877312e5c59320f294c2162f336
SHA512 f1d561071ca93d1782a3908214f7b2bf1462970b63069440ab4f7a78eb3c95c5b35a08d4f6228a1a8778dbaebd6218fdc2b4bbe5277149e06f9c40e16a5732b7

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 ba391c6e18efe7489dd5dcaeb7d3b2be
SHA1 19bc33ad5cc312314cc14169cf05f85297d3afca
SHA256 e156a08ffef9b33b6f166291d8f6f4a41b9ed1cb1a79d12caac85f355ec58a0e
SHA512 f68d9e288d06745daf4e549fc78ed0dabbb8cc30e8c51d3ee27822a0311a9fad35414f25c0f8cc5d7e232263ab366eadd4282e3b4c3016c9cde5921d42a47176

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 269bbac5b2a55fc1c3475b05b00b1c36
SHA1 c4e15113258128e2003fb7a0fb2a147f585ebaae
SHA256 b179f5067d017a74ca7b76245883507baf417f50fb42f85c1f795bedd055158e
SHA512 02c7b9835d2445bd3157785c11f62f4d98051d188988f08992234974e16929cc7bf77e464974a2e841b2d1749264b62eb269e3a85674aa629d4e70cc085530c7

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 0eb6d6fb5e35a9b5ad225702fa6cc86b
SHA1 aacfd786ef2e9717e2e388c7d603c336027aca9a
SHA256 ebba56c109dbe3cb24f3b000f7e631ef201eafd9d4b64fe4cefd3d193e476ceb
SHA512 faa465c68287f7e7690f31dac9b6ced306f001dcc2ac22b5bebc018fd2cffe96d4c357a61d093328e730a6fb0b2d26c032258717baa92f7b6ea59545b9e899f6

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 f4c7a6e0b998dc7efae2df2c1c6fe7ee
SHA1 4c8eedad0e7e22035a978a202b89b6bdb5a5b087
SHA256 8f9fca62bd9d440145cf10dc33d865beba5d2ab9fbd42300c0b0c7cf22c76180
SHA512 e3fcea61005af750963609933a9b9293434711ee240ec6164fcd8a4080e5d818076b44663ba71b9d8f76936b20a2d88709318aa9fa7aa691a63626c4332107d0

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 da4656104dcf880d6b25b85e544e0fc1
SHA1 c462fbc05eeffc77e2de15ba99bf75728ce3a762
SHA256 c304ca64a87b305d5b86e0579dad29b72babddd5ca8e1aa5853657158e22544f
SHA512 aeef44a1769db757d682a51edd27216942276ac05c76dc567a271712b40db4ebd61f7ae45663163230d991cb8a84a1ca3081a21567a98625576fdbf258aba20d

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 e084208819611b8c3755701c078000d8
SHA1 6a139d65d9cdc45395718094af503d872b06a283
SHA256 a832b7d0448512472001585343138e583ef1ea5f03832089846f0dfb820c0ab8
SHA512 0bfefec6f06b9d8f657ab900f77f4d3f000f2ea9f5c1bf6510acdc2aab905e6ce98c11defccdc332e6641773e3fb77b14ff701874117763179761c4a46f3ddfe

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 11c8c08bfb2fee3154a7ef69b1668806
SHA1 822c7492b74cfef141f7baf150c4a9c8cc0b5af0
SHA256 361966773e3f5f96e45959c9eaf52a40c8e70de136c3580a574bc29b4109778b
SHA512 03eb5d097553abaaff4df1c9260b5dc2b4cf7e5424e3bccf438f5c719fa4b3e6855c3d2f86323df57c0facbddbcd5e0b056d8cec020bc8082f949c22d76bfeab

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 b356fa48df30c1258ac5fae3ddbc90ef
SHA1 2a68e20908e5ae234d2643dc9220623c89dde341
SHA256 eed3b097e38b2ed02d5b8560bd9924bd914998a529325a82ff0a387ec918d576
SHA512 93ede0f5d74fce61ea2b1379bbec5400ed0dc261b29d009e6320ea340c66442700a84bea0ddf041c2a64a81b2dcbd74bc8571ff2bf7a623bd67cc8bc6dc4a287

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 f7dbb80259f0381c46a2ea87e2c42683
SHA1 64b3db9a8beeab67e43c7134baf9566229bcfeb5
SHA256 525cc065541d42b5c73f767ecf42b9211b55e24d47660c3395333b7bad267ed4
SHA512 435f2087475c4b75fa55a351ed7b146b0ebff0967227beed373e308a84d5aec83172e70004746238c73fdd5ffae034716886ff4297d7dca7865d2a7ac3305fce

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 bf88a4e07b792eea9a84584c90c85d75
SHA1 53a75d040e92616f6759e272a5b497e8be379a77
SHA256 398d1756729239b5e6203a9f82215000e82f7ea73ddb4400547b421af79ef50f
SHA512 7c895b4db5a1dfe2a33be818ba5ef0e95f0e69a4e65d0856f17216b6376a14d449d560843c8388de2a8cd979b9004790349b6d9484c587e489eba050b567d965

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 cc3d2fa991463395944e50541efffd61
SHA1 8f0fd8c0a3287c215a42f94a4a0a7a728c8d92f1
SHA256 b7834488780eee564c25c49f70f991aa2670bff754559a1edc02726f0d62047a
SHA512 15203411300d1f0119d4024de1a4a6f1915625cb2d6c33d04ec97c335389cbfc9079e0ec89027fe7db553ca891c1e6e9e7eeb420412ae62938b04f3fc6745b61

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 6c691aa591641668410b0b03ef4b1479
SHA1 d4080eb49acae165762fd218a97925af926a4aa1
SHA256 593b6c93e4c5d4602a1a5877719ea57b7e9d1ecbe8b56c41ca6c9ca7f5ef0e56
SHA512 583ee616045ebebf447953d6f85fda5bc894ab43169f8c06b55ce477fd705dab0005624533e9c6d145eda4bda52cda439f5fd9b4dddb8d44d19918cba34d096e

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 6a8610741b85d325b62c50245f0ecd2d
SHA1 db8c8f5c4c01a1412246b7431fc7351c82e69e80
SHA256 00fd67f10e29211f0037ad1a95f16a7acc7302a071142c95bbbbfbce316f50ac
SHA512 abb5b7e8c6474579f048345919e6c10a7d0e96732c5abcd8bfea4afae1847951bb029f9f47dc862dfc58f3a25d5faea1b19c1e381461b4e6252c0472a4369637

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 52526fd0eb0d94666c85dbf3296453cd
SHA1 6d23f0fb543adca598ed217a1395d3c7fb0f9070
SHA256 c42333b50cb455040eda82253fc94fbe5fee6ffedbb5bcd55c53ce67ab4077d1
SHA512 cb9ae944b74c54308852b51349a71a5f37ee17cac3b3838f1a1f69b525685dd273cdc590b9cbdf9fd7f554a182cd77010bc18ebd5b59589f044af1c2b7a4a948

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 5d1ad0a1e0a9400405b5da7b44b837fd
SHA1 3125a1522f06d74a567d80155d1825353116f2e3
SHA256 603be0537352171487737e06eef316e2b22f7287e20232caf7db05743bbc01f1
SHA512 6fa0056fc40e4a3061cf5c139766403e4adbcd015339e63e028aad2e620f51d1a336fb96e226ec2429aeff711778be40451b4beb23037a0cd570f770f6cff902

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 4b873849c5b21fd6599e4c4b1d8cd547
SHA1 315d38bf568596f095fdd68529812c255c7cda51
SHA256 abee8cd89111fb67ddb7629d104bf1b3cf3eba7c70a6462aa9b968b669ec958d
SHA512 196c47e3ae74930c762e95199cd2eb1e5b638a65fa2ff5ff17813441d435125b2838e677534c3e0362df25d194f6b3b1064710d3fe6605c9489dc709050576be

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

MD5 e3fb3fd9e1600ededefe59792b24fba1
SHA1 de72cfee0621140d7c396807e65cf1c2ed805973
SHA256 86ff45a3bb1cb40837c4d3cfac2f68dc75712b71894cbdde60b8e8532d154b57
SHA512 0de769c2be9a91ded45e9e46ae785115b81ec54d98bb7828349f367e561df4bd54d557e256c61222bcd242eeae181636cd610a32808a565e830314831e9e5c69

C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 656860deda66657ab9c82470ccf05cbc
SHA1 c284ab9e59637515f2a9b00d66e73890d09d0205
SHA256 7e97bab9dde0b25a8a4b079070e57d0f8076507dd9524a272018b600f371f565
SHA512 5fe314580dd7c7d73939aa715a6961f4dd26164e7fc5c85dc50dc8bd147931aa4da765b5adfb194dd1754172361a442414d9718fa9508434352388929e2d6ee7

C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

MD5 457a9ad31611994f58fca57cacc40be0
SHA1 a95f6f7caaac7e0ad66a27527a74d02b9dd1763c
SHA256 1ac15d3edce01460d5dce2719385a7485b46b33aa9b24add339a35a982082c90
SHA512 f5c8fc6947f8143dbb659532f549cc9ffd84ae80ff2e3658d0f33c309b9a832c704db6aba2ad1d6e8e9f624f34a0dda6b92694057169fa35085c6f2e1fab56f2

C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll

MD5 4ca41044b3165d2bdc2d2e002408211c
SHA1 4300c9d513443f6f5f5d8836f193a0f811f5e719
SHA256 e0e5e022771280b30e958d91eb869d9fb4e58849bb4637286adb83bcdb296fd9
SHA512 6a00d783584b675aed60d8f2b88628231e06d9aa0f63edf9cb1faa6b9e66102221a14b9ffa29a07ca98ef79681ce73dc058d67aba1dd21d81049382481837bb4

C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

MD5 26be55e9ef6a0d8827cb77e0f66456c3
SHA1 a34e18dada977f0b7b2736d1edafcdc9a7195c37
SHA256 c93a90c69752fa897a5740598afeaf0899bd5fedc63afd60666068df1394f2ee
SHA512 522d33af43dfa38c0be37a4c1a098a97ba93ad81626f45dac000a0e5f05afb4c6089e9c9c2481f4f1ced15a92a3627ec98028e4c03917b25c2d7b11792119e41

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

MD5 15c1530f7ea9fa140d8ff2360640916c
SHA1 32e0b028ef68981d54c085d74857351527929a90
SHA256 507774b9ba401993be14336141983c2b0c62f454d9a4c56d7d194db593e02ad7
SHA512 3b97dfff910474ac15c99c0a95b356ac21de18bdb2199f3ed3461a57dae26a8bdae56f04f22feaa522ff378b5a529bbdfc4015e7d34959d608c2c9276b9e1d49

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll

MD5 c7e6de889fe78a851ed7c1aaf21f844f
SHA1 282db0ca74d12c74c8d519e1899e902eba7f3f85
SHA256 99d8c06f0701cc6c104400dfb694b7bbc7b855ad1eb43cf2809cc5d83665d8c3
SHA512 e7e0adf567c98f881ddf0292a74bb5fa01404c45bb6304d441723a2edacc82146ecca6023b24c3b8d23d475696445b16cf11da12ab7717f4caccbc9d2aa49e33

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

MD5 a9a8fac8a8c39cde4584cc86346530ae
SHA1 b8836b89f92fa7c1b886eda0014bc1b76992d02d
SHA256 5b17c15afd86205019c725ec26d54e4df8507130c57ee72f0e4b8af44b5661d0
SHA512 51b203aca531572dbcf2b64816a30dcd872ba22b98091723c406765cee5450189927479ad7e7bce914cc06aa9e842416d07e34f2a6a15995930ab9ed8bf35577

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll

MD5 3877e5f4075c7267e62f66bb1a3d5dbf
SHA1 9a340658f7a814bb3dc521f571ba8a9973bb69ea
SHA256 3afb8244d048ce5b955aa9c006ac63a260763f76e123d5427dba79053f160552
SHA512 c90bde1e972953d6ed27ad000af92e4182376c201c6be3ea6be4a35275e3fb0082455dba3da5be69a727373deb2c1e8c343a01fa2dcb7b4d45717f2e34afc931

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\vcruntime140.dll

MD5 4e3c56a200ad43f49b249002ded279dc
SHA1 5a9f44de62b8928c07b3e86712e70f8cd769ea46
SHA256 074dd70576b5769e3ab9aeb3f76ee416dcb2b14ef23a5bdccbe676c85e5e4b40
SHA512 bc54dc0e12867485e401746618a2147050e550aa922bab7036762db1cfd4ba830a3593c02f629a51396ca6e468053578059dfc725daec207ee4deaf5629507ba

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll

MD5 9ab44d70d614b2aab590fd595528e762
SHA1 61efd440b2e7895f9ce565b0ea3b85e94f5cf5f8
SHA256 0d1cbd468278eeff024984c4a504765f8ad63dc853c5fe2f6f99fb1653d534c8
SHA512 0304e0763a78d3ca44c48db316bb61aba82c8b06d784f588aab0b8fe727840daf72985e69484dd9f2dee55d36005464bc77f7d11e1d12b95cbaf66ef0b280dec

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll

MD5 23977e902ed17860454b2c5d0cbfdf09
SHA1 5637480418f1c3bf24a39d81948e024d0c16e763
SHA256 17b029e919f024efee93c9dfbe817f7801e60777ace958e83ab097eb4b229581
SHA512 068b52289d92fcfa0baf0a59be3a5f7336ac14b2531cb6608b8f40a227a62fa7da53d20a88ae73850709283e22d331c353d92d6b8d2d44a87006f3bf03465ea3

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll

MD5 c598b6b5028f71279d46b8fb3b6afc7e
SHA1 280740876d47b7f6c9e5b8197d8bd450b14803d1
SHA256 607e36ed0cbc422407abac427a64f7dae4f4a46f266d9ca01b9b15bc6f01aee0
SHA512 8e95b53ca56ec2780fbb80de75500356bbbe2d925bd7e9b6c48d4ac506d1ef1a9cb846c9d842b0bf2c070f7bc0673c3cefbf209a06cdcc35030bae67c8709393

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll

MD5 8d316bce9334f6b98a94a202c3ef2e79
SHA1 d4764c7ca55246b57e5ee090b42cd96b7dd4486d
SHA256 9da5125a95584d1dab7494932f9130799976891216b45b0338938ff981449b6a
SHA512 2950a3777c484e3bcd72a0748a569c8f4c7d2e98c95a9f4f7fb01d7a6d506e9dd8d62a4f215838f07121048d659d505eeb9fe7d92d2adb07b986773e823a49e3

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll

MD5 b8e60a7a781326361375fb13387e7304
SHA1 8e026d51541bc90def9a59d79aab3b9c22ae7683
SHA256 76e9171fbdc481c2450a51715b1562439d10c603126b37f494ec7cbb70b646e6
SHA512 9dd70567c30b4070d26c8a0ba4b97d6602d7fc4194d173b82e32a4094a84ac5d73a3b3f6069d9f6027465d108ea1e2be24440d67b42e4d81e58cc4df00fb3490

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll

MD5 5b24239d44a1a386efb67c3ee2c30f84
SHA1 ec4fc93bced889b72cba7733fa8076bbb2802cbd
SHA256 6c4edccde0d76fdc607019866bebd6240aab7eb45e84d413678acdb5a031a2ea
SHA512 a51e2202f4a2dc955ab974f2f775fe71a1af5968b180c7d89ec7a8804c05889519403a653244f546d57846f45421fb85324d4305bd544c881b3da790dace12c1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll

MD5 36ad902b76e020bd91b6cd4cb40a4b52
SHA1 d918541e4c7d6ae7093af4d16c6162f49a95fb90
SHA256 8ec6d3490d2620eb2a97658e4defd08b4d641028f96c52fbde4839496129fbf7
SHA512 a1d1bba88910ddfabf2020546a26f4b3b52090826cafa6a16e37a86257d34d4fb06cd7732ebf040a64421b49c166a2f2512781ebf7d8855a02025f6f6d3fa857

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll

MD5 d65314d4c8c40c155efd6a661cdb0f86
SHA1 d88c54fd057163e8d16ba913a7b6fb8062dd12e8
SHA256 27d550c50ec06dbaa9957b2065745066cacfd555616f8cc44b8a0d59b6cb0192
SHA512 b445afcd81322615c1930aa2e18fc4093e15e24dbd3e0c3d4cfeb76b22a9d0e4581259961b5614af654cd2c01732a1148cc4765c2f3756aa2d7acfadf96e595f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll

MD5 847e2a7b39bede907041b6a12346605f
SHA1 d1f4152bdc889f35d154023dc079f9f22b90c8b2
SHA256 de2d9200ff6d6d6d5fb55491764f6806a3232f91735efa02efad639b382a495e
SHA512 daaa2b80ffe1c470aad9b94aad262d5cc493be63737f333cc42dbf6d93238a4527a32e9d4feef09d32a5152550ed927deb6d6c15c9f03767765ef9095c5d3a9b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll

MD5 e999bd60bd59552e22c0911e452df75d
SHA1 32d31668eefc53aa874475fc9b1a22e8b42bbc3e
SHA256 f5360e734c077dbd291b57ab7221b96100376fb9f86b7b9278ae1de8ba704444
SHA512 1f1d8ee5396efa1177c2526366f66a17f07b5693b294959792451fdb674ad883f57d9826ebb89509e0bd4783b9109905d5919069cb5f52434e363c4ebba74b7f

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

MD5 be6167c55926f8677bd3d534747daf59
SHA1 4d5badc373b2ae93454362c626a4cc603fced712
SHA256 4383510e07878111d043201d52098148359ceed1d77aad16e63e9fed058940bb
SHA512 540f82bab87e60e1fd40e7b0f10bca0f360733152923a0579ef327dc751ce12ab43c3d3b40d4c28b5942b8b1a4b006a9274faf351a2b59d589506fd5a7b8e5d1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll

MD5 a73360f1ff11e75bb8b48717bf1e7a78
SHA1 470e9ad76d6f6d7c9070d7b297adf51764e9b8e2
SHA256 a75d1e1863fe9b8eacd934578e0c8955dc08acfa6ba6c6635b5797a1dbacf9e2
SHA512 b27158f125609fa3c72e492ceb88dabbbabd6fdfc62c160f19c4626a00640ab39f860930517c9e501d9a68a5c4ebf23212a0134a2592d039e9ad3248aacd55bc

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll

MD5 a057271935a93fd069a006745ebe5efa
SHA1 a782040315604ca780042d6647ceb9793df7e12d
SHA256 f4392482e0321711823fb7d5ea238cc442f26143471fcdce883acce929a1e714
SHA512 7b0e2c24edb5be7cc7bbd8ca543d995a2fa9ca417485619491a138aed484ccf82bf042f0c772192a6fbaa47bcbddbee9c23485fa9a592d43fc4409bd37973692

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll

MD5 c024fd69f3fa7da289f8aff106d75317
SHA1 39a5aea3cb90965bf8de9a82891ddde811133add
SHA256 a0cef1cbfadbe9224ab55657ef554186167869176add7ac654b895808e014751
SHA512 3186820590e0d6e115bff5ba4528500d21a85e03c3ae29177d9a3d21d486b32e6bc06c13d90ead7976b381b5e2f68bc75fa1e24163d424f2d1e21ac2ef361f3b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll

MD5 f4126f24553d01113c391ec785efa2d1
SHA1 efb4e0f086f5aeb492093dee4a4a8ee99af7f823
SHA256 d3193ea6d06d9d19400729d8cd3c6676ac8f247c7f44a78b1e888f71e1195ab7
SHA512 c8c1ee87351b533b6e036bd8b70eb069854d1bad25e62845467ba2943ca83cc85cea6cb9c160a51c0e3f8b7c0fbfe0b3da6e35742537dcd6f7a6f989e804bf29

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll

MD5 13cde24d0274daa5b3bfa2cc70c49924
SHA1 70afedf33e8f89fd6effd8bacd0c51868c99e34a
SHA256 e4ac8cd7955e6b9cb3357876772c0ad2d2d0ec377685c17f1c7aeb3c95ab8f44
SHA512 42fa682a227a445e1c41fb6ae72300d80b0ba4b095d8ae93751304c5614ec4f11aca4b943f222e99ab1149c058329cc1e1e49513bf59309ee2781881fc2a39be

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll

MD5 7d5d6cc97472514af66d4c85498927c5
SHA1 6619e1b0f3f4048f639b3cb882b87d595fec7125
SHA256 b7744d71d5628a1c04e96e288ac77844c3d60845c3ad4d3742b85953d2c7fe83
SHA512 63f592c3b8944665d8b7034007d3a01e174f87e4bf8e38e82aa6b5ea18b9ae6156c98c47275f15830ca7c4f7422bd2fb937e41146725be50a8c7cc99d7dd4d09

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

MD5 72e1f3455ffb0b6122206db015c5cccc
SHA1 0f986f1dcd7b3b86fcec561b6acbaf70dc8719bc
SHA256 e50c10794325a02939bc4e51c9064af31ec1fe2ec3f4582955bbbd002e08c6b4
SHA512 f29b96a241f71fb7a9851878cc960dc2184030d0cfb9de77a2f8055c68ef9d82f682bff2fd059bbe1d80042acb4ecfa0e827d634482f4d34854f5c1c3f779eb6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll

MD5 8cb2241ebce3eb0df4020d49bdb0686b
SHA1 ee91bc78053ff3920138f07589154d240ab6dc15
SHA256 1dfb021b8b9a5ed71f9e9499864aefd8ee7e933d74764e2fc8a07e3e4f34b341
SHA512 b7794560ef5cf1c5eca0fbe97a2991dca6a1c47d82f3a7407c23d81d8cfe4b09f7493f9a989e3a23d80990336e37182e7938cc151a1f322c1b7d6adde3d98b15

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll

MD5 fee1c4a3111539541847a1321d0e1f32
SHA1 395d94f2841e0c58760431721d9dabc525dee2ae
SHA256 f018314d3558348c16e70f49ac539297364fa8dc9d9ff7867b8327f896694657
SHA512 6d334a57d92bf854bd78894aa6f2b51ea81ac5a6e62de2261aeb2ca9eab97c5389d5319055f29bb557ef806cf3fe629394c3d15f33411beebe3a5d32e27c709a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll.EnCiPhErEd

MD5 bdeb05bed38dc48141c2330ca68c6f42
SHA1 7c6ff762d060c4b53ddd9789cec0915e3ec2ec50
SHA256 90b70b7ea7efd9861cfe0bc29483d35185c215961f3215dcc381d07599c7b1d6
SHA512 3208c1130639c979fc365d759695c8b9c7d3ef87a6be41df19103d906a0fc2595c8df574f49b4105437a6304e98115375d80104389edae89a6331ec444258fa3

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll

MD5 06e66c78ea3dc46a0bc4a2cbc4fa6b0e
SHA1 f018deab5e994ed1dea335060bce297553959f28
SHA256 ff5167613fe6d1664be1b3a88c09e285293fec805810bd5bc57fd9738a518ce7
SHA512 551a02e8e3f1aeff147c9861a5404656cd7cf2b47149d1098465010c0b66574aa8c72fb323dd9412a1ec9498dbd93ea1fea74af328d97b58a0aab57ed8c4b5c1

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll

MD5 4a0c0ed6f2cea7d57835d176f86c99c3
SHA1 f5adf5b2b568e47ac44067aa4b4591282de67423
SHA256 41ab4fa55350245dd95f8045dc343f43c6ccba266bfcac7f8057657991e8d53e
SHA512 e739d4768e57d1de1c7fc761d3dcc6dbaf0495d37105036ffb7f0493d177beadee31dd9b9b4dba9fa0d0ca50548525859ad21aba9fe9db19ebe482a6f3d6127b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll

MD5 e2216cae49a9b36cbbf5cf17c369ad35
SHA1 5fd21653ba4e5cd8fece0de3ffe0f12312e0c5ec
SHA256 bd39a247cc7efb1ae6997f2096abe52bf9ce64c67599ac27b75ff93c99d780a0
SHA512 720e29dc7f62518874a34f4b50276ca2e858d3af4249eae54eca9993a352326cbd1501b3c2056777f0f870a637e71fe3b6f72fae21e50525df3434820659cbd4

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll

MD5 61c039c13d547928d5791fa71b5e7317
SHA1 272aef9cfe52853871c326a937d44d649c027d33
SHA256 4c318f9bfaba2ea87717b384f30f5e10117ea1be8ddc9bff508d8c54d699759f
SHA512 6279ab2cf86caac074fc9b0b580a57fc667f34082997cdc24db1eee525ebbe526953f5bb8c7f970093ea456550119735bef18df5eaa291a8638606c19ea6e338

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll

MD5 b5f81a6b2f0f92e92258a77f227faf2a
SHA1 e28b76c50c7d21cbd7789c26a6bf012058cb77d2
SHA256 f29e18efe9a976af3bf7fa9940f0641392279fd9e268986b17e452bea2f06ca7
SHA512 6593308235f6d66f6691993125a215d150f5eaa05d817512fa78811ea83110733022439d6aa42763e7b8e31d123f7bdcaf795a691f72b827e3457a254457c2ff

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll

MD5 ada04de42aab88cd6596f64a00ead455
SHA1 4952f003d5364bc864af800e6f56c3444c4a4e52
SHA256 1c5f5731367aa685020cfe33d25064d85356236fd5a1cb78d40aa829714d0250
SHA512 ef78a0e7e1378e852d51eaf9f3bc90eb1cd6e2fb0ca552447562bdef3c55a8e36502326912360ae862f39588fc14465cc00c8550e97749aeee91d779a9fa3231

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll

MD5 a94f71c8490d3f33d323c9f75374022a
SHA1 e382cf79d2321fe064bbd1f864ed2705dae3a903
SHA256 ab748eb8f2ff7ccf7a2f658de00c6fec88ee154154a66dfcbcff7f5d3d6f5355
SHA512 eeaf2ad26002541ef0a09f84a3fb14555f6ad07390e34c159bfef32ff80b1b634c4e05d02b0034e9ada5131282223ea18ed76136711d63d8a1d41ce70ccd80c0

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll

MD5 38aed41352d6164d620941bac96507ea
SHA1 0b9bd332e6e9a4503a63353cf3e1816a2834b671
SHA256 e6a4643998883d0008b6b5efa3d42545aed9f36ec57604071e747b51dcd21a08
SHA512 e70cabcde3882ff0f2a944562dd92438d39ba39a64ee6f04c66b673740e5a7c1052c5ca2f2c619d5842e9f92f6d2b8189476fefa5ca68a0cf93b20d754d5f6b5

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll

MD5 07c00c8c880ef55df0765af0048029c6
SHA1 8277b62f651fdee2a9620ee9cd0ebffe00ce029b
SHA256 09068be191d0237ac2a5f0cdb6a7aeecb86e0850b0f5135de32152bab319d2fc
SHA512 4751862caddc0837f1660d49074859c8baf57f2ecc6f5490f0b658d018c16cdb1657adad6f44b853ecce4cef40dea5739a985f3b5fe1718dfa5b4e7aaaf0216f

C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

MD5 a2798bd8ab784d4fb77900ecca9324cb
SHA1 ba71774cc294afa71bdafa4a10b925d354b89865
SHA256 f3312f1288077dcfe2636911f7760f0f12de30561b8ab054958ecb37ae3ceb9e
SHA512 3623037413c2bbaf44819582be9db69da2e69103d801712083ea5bb07181f38a01858a94bc50f0b3bb03aa829b8742a4edf91cdce83236b138c95d4b66177f2a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 e2fab79e9fe5991d05d594f82f1c5912
SHA1 72886d8cdc115fe86ba2359ed9664d1b4de80887
SHA256 4fd6adffb5f0b789719ff7934dd95d2f49603b6d68bf4283de5fcef5d8c25bec
SHA512 78fb27c1b06c0360cece8a2fc9ce7806c660c3ea4d768e3cdc8237460d750e81bb558e0626f259f339188beede386d0e18a463dfc9d2e834c92f6a092863ecba

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 a6c22229b8e478506aca305893ac32c1
SHA1 0649054d7a2165d57bdbe8ee36503b986f1b8cd3
SHA256 f5ee32afe12510b2baf841a13891640161bc84c6bac7106e6e64cc8da7d477f6
SHA512 eec5bc1a254ff86c2b52641498ea0a1b5f16ceecc3b5e2e5ac249d8b6c7a488c3b652d029ed8f1f6aa457ae2c546192f245992c3819476626f046a5006a9253a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 bdbccdcde6e5104eb73a60b5d654e232
SHA1 d5a5fb9127a1ab79841e41ae05d6f806544d2f34
SHA256 44f4a3906e5774d11cf8251b47059ee888f56d897526cc87d1d293370281e111
SHA512 3965c0124015e8f7436f24149738b12be08a6e0434c74ac13559f85613dc0d3ddd033442639d6ee16b4223d53a9004b18c3753a0c2eb931789ece26873350a77

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 69d092abbb6bbf9b89caa3ea010e25bf
SHA1 ca03f9e7125bd76bbc8390bf44516b5c1f0d5b58
SHA256 17f99440b0d84f438e22482ddb4c40fb985b2e079c1e1a906c3e4a520b4a14a7
SHA512 d74182da6de469b9ff893f2cd95df3883ccb762448122103a15f0381db36865ddc0e2486482455690241d20a2a72333dc0fd6686c1763f0645050c122102d9ff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 33988ffcd9c051d703d56c7d16af9ff2
SHA1 853c2059c39f63ab8b270bb5a80b4eb12ef6c69a
SHA256 ea9dc08686a789e0ddb61cca492f32e1905e52d57d7ba14495cac03f28094829
SHA512 43ce044bd5b13085bad56da78d3bdd0c0f1acacb09d5932c08df93b405d291a25ba5b39d176609e094e27f57ac0eaa780f931c3e7a95002885722473d695f460

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 e3b0bd8de572c485dcc8d1f5c629a39c
SHA1 d5f1171a2f4bea612f1318b305d95b8192ed72df
SHA256 295aee56cd99d797648b5afba6a74aa9d6136f8e6c89058038c8887d08ef568f
SHA512 f236d9ea0a02d2aa86949d052ca62f002d662550006d5b6a629e3b345f5522ba005a0a361ee85e7e6d7b538273fd9a09e8a800cd191689f83c289204dfd71add

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 ab59e6510e2873808e97af37931d547a
SHA1 bdb2c5861371b3ee75603b408a988760e335188e
SHA256 69fdde95d19e5fedb5201302d08d8578b1113acb5ba9ae6b3f3d7c02778bbcda
SHA512 c381661e20da4b45d6c0f5be76a7148301d55ed47dbc4b02b3a6e315ac84c6ffb337eac818f065796956de31f8f6d5a6231437a7fe6679572c857ec50fea456d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 e6245922b65ff154299ea16d46cf81b8
SHA1 279764a61901e5c837cf05a2a05282d57bec68c4
SHA256 ebb1dbbb40013ac48200cbd3fcd81cc202a3db02abb9c72e9868dd75def4c6c2
SHA512 267db2c4573f3902d529d188d20f40b2a2fe1d1e897c70c7b37c072021c6ded52a3ceca3e09e58200f37ba6bd5739093a90cd321b8f3ab3f6f930a270d39a4d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 b04c8bd547737643f4a510dd45f17e2d
SHA1 8dbe113b48a338707094e778dc54a4eb646a2817
SHA256 73b615603c1560b5433fedbdd42674dd6d3b66cfe76ff2ecf8a81554eb8da765
SHA512 72fe5059c1089eb1beb9c11f093cbddd49ec5bacdc3cbf5af1a53468e677611d76b1239d87f346a4513ad68633105d8c0ba73f227eeab328e42b58518e4c27d9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 e1da6112181cd5bdaf3409919b53e921
SHA1 3bbc3426b65435d3a5de7e5c6e5d665284a7dda4
SHA256 688be7cacc9404e55e32fffba3c1775d1578fe3b26d15b95d59d36af2166e092
SHA512 d0e9b7ec67c032b83b6d0d71bb2517ddd67c7761a7c07e66b5c72bebbc3ebd7bf3c206a28b28b66447692091a5cbfc2bb383d358ef8f556c9bd36af2a125e2c3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 d2a15f6bccdec0ece5bfac30ddc749c7
SHA1 6a4c8fa98244c6f3e235610fca479c29dd377cd7
SHA256 93ebd3139b5a70049dd5c02912741727ee572fe6ac7c3bcd19fe06178d866266
SHA512 656c3a623b157d39da50f7eec13afda3e4a7cef329de10dee7f32ebcc3a64e14a5d27dcb608a6ee199c5980fbc6753e11f8132239946ab58adb5934f4f30d65f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 6e59e1a98b0aa525526b2191557449d7
SHA1 0c79e94a577b4538c080f27532b535cc5c192cb5
SHA256 c52207172b7dbd6345701a061329b301dbece897e1a8bbfb280a3f6972404342
SHA512 fec10b3818bed2d7fce91e5e807e644f827c66d3c3f532bd556c5e93d98a51199078ebe5f0297a7aa1e91dcd710731e4562a6b532df3a475eb19940accf43da7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 dd66fd50eada29820231c65deae54ad6
SHA1 523236670d36dfccd5005de722255dc0593c1589
SHA256 57a64fe440e5519b397491336c81ec022f1ec7f8c029392ab9d6bd27756662d6
SHA512 c1e4a9672da1ed1c82f046f254b8e88e52539cf7ed3ea921e73b8a4d77248fb062c7054dfd2ff29fd1913c471b0cf276efed97b1c698c0ea7e48e525b3882e5d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 d59e0f4abe046b07d630846135526d71
SHA1 c5476854b10da7752e89d02b53cb17495150ae87
SHA256 d5f40abb0cf0fcf7fa2d8c6586d0ccbff347a14fa46ebf4f19c943328dd38df4
SHA512 ab98dfda48840613abcc53a5bc9b9ea1dce9d0139bebd700c7a8c987e17e7279efa6c43161814ec7e3a29dd5ea6355d2b2d02b7e8a7eef5d636809d8a440fb14

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 62a1201acc353eb6a97d7160f53b3be0
SHA1 23a87959b76a3095d133db962fb8e87226766757
SHA256 af4002aa1a90d31bad21dcb5801e84895ce3e4535dd82dbef7c5e7f1b78debf9
SHA512 19b5d1e8d5b196424560cbfcc547bb1d79f965b355043ba54536ac0c4713ec1fb40bc381288509c3b6dec0169e78ad15ac1ae5ba2f0330c197163fd70afe2a7a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 b95eeae5601968266941f762b576e7f9
SHA1 71893e847b89f5b6a1ee06fb868ad2553d1807b9
SHA256 29e6fdda2d62bf356debe6a59689ef25c183b767fdf65d06663655cb953b784a
SHA512 f3cb3bd4b3e20ffe51cc38ffd0a5052f5db075ef7a62d5651eee655d8adce0722451a40dd1bb29698ac99c946b554b5d077855e7e1a86706a221414cc355a07a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 4d9d99ed2446083eb9198ade592ddff1
SHA1 f2eeba96a975a9f3c8f01f1960f1e6adfb899b5c
SHA256 862024240ac9a67f79dc42480b8b15177705f3dd8f1d4b5e0a4a4a9d99d54ba0
SHA512 5af638d145daa49aa5dde1f8eb5022d928475a384671fb5249b945d73405127c64662c0cea460e57bdde874ea58bbdcc5c0e3bb724472425c1ca30ab6351d7d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 4a8d30d0cf75ccf44e4589b484306e42
SHA1 9032783e883c55949a96ccb2ce76f988740021bf
SHA256 ce57f11b4f8fa8dfba2c3ee6eac627324cb433ab9a54b3e7bc951613c4800e25
SHA512 c18ca7321b69459a6c5b1660a95fdc1104bb42891749e37375b12c25eb6e5883a1719c91a37dad4f16654fa3b02a83034bdcbcd1289e375dac7c30c067d69334

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 e262033a2c985b86b24e0b4d74ef26c8
SHA1 8c0d75472feb2cf41ae738dd517b054b97909472
SHA256 b07d00aa11aa9c676a78d226d6ccfdd06c309b3d2ad2327e95e067581fed7214
SHA512 e758e80a57671d60ca949955e6f1812ebec963d01eeddbae51de5d258672858905172ab18fda8e9cd1ed638df789782ef395f41cba287b1a3afc09255e94e995

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 c3b86a50c91369b252d76bf4aedb63d6
SHA1 771fcdfd84a91e8c13d78d177f5b9a1e7a2b7d2c
SHA256 6254d973cf53b4399ff4ae772f93538bf793f62829de02c0da012e321e32d1e9
SHA512 b98306e5e1f3a56df6abb8fc7e1ae8ca34a9c62efcb103f96f76340d4444a10aa6757116d2c30a9ef0b80ab491fb5d95165de1f4bc1863486ccabcae8281ba68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 9dbba1849d53fd91128ae42f4569559b
SHA1 617b79ba72a98582bb45b1aaeaf999cbf390d178
SHA256 240cbd8d705230b03c79d5e06196e6cbc8f5d1418e24c7003044b1aff65b3ab2
SHA512 b78e2cff70655cee41d29407d1c42b9ef87e28939315c8344fc1dabfea242f1e9f6dfef18be2b6ae519650fe4d37f0a2aa634f7475beb57695ffc0c97009f43a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 715e45556ac7e8af6befa257e6a78331
SHA1 9993a97734952086cc86df7b8e47ce8fd2c024f0
SHA256 b6142b7897560becaf8001d6fc66ff07feefb3b2f19fbdd9bad0c0ae92b88a9a
SHA512 ecb1d2a32a34cceb37e491de11facd404231884cf483839fa35b7cb00171808e9a3bf6ce367ea627c47b7e1f4f49d2036957823106db04f17a66e0952178153c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 67f55c073c5cdc81cd085fa20dc96cca
SHA1 0c3cd73ff2122ff626780dfa6f97406040b0e21d
SHA256 47b8ba48922c1b657894dfdd427692eab54c0d41979493920bcbf4f98efe7131
SHA512 e113c1fd71d4853a6b3f8a3884456f0e86c6430ffb799012ac40681dbbacf41ee5fccd78ed761e08609bb0ebe44a75414e24320e467fb7b791e41789ca1f81bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 c7efadcf983fff58ab8e55e96f5eb3d1
SHA1 e58aa8571001c1ea0db5852406ac1fba46fec618
SHA256 4733e301dc93af7daf9cb557aa26b0b87a6570c3722cc132ce4404b921796931
SHA512 f425f501bdc0d73ef1c58448872244cd6d572e6ffa67ad95b66ec2e6afeeb71aa6ff1ad13d52dddd59439c207385595efa6ea477fab93ad4a1e6462b9525a8dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 b06b59ce5cf0fb06056924ae3edb8e7f
SHA1 76f1b7db958652855f605d3abd7338172f71dd8d
SHA256 04aba1d47c5a5977d59f988e7b7c16c6f2de90cfc47803ed9134e918ce57cc81
SHA512 75f3613dbf0fe5c1139114771b9a848efcf028a10e8682cb45c9b1f833e914a4a7936444195eb6fb7ee9d4a9ee4115a6c85a90798427892a399fcafd5b871001

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 3d5b30660a5097d2f6ed68b33b9c8c09
SHA1 91ae2d5da91cb1a726cafd9a05a867d552b1db2e
SHA256 0dd58c32584dc5f3ff71c5116b33ef30ba2d9d6c83ab4d888ae9313604c4745a
SHA512 e165acef48f17db15b04fae6ecc4935a90afb5aafe4d22bc974872a86558683064827d3450c37a4c37167738e83113a0cfe10cc6ea1c05a923e729d5e9e17982

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 eaa3aff181b742af290051e11ce49ec4
SHA1 4aab4b2e09c6226fc1b1cfa42dbee81f06d7b03a
SHA256 c1cf2303ed79a83b15418ccd023711960360135ee89aa4eed142c9126dfba34a
SHA512 0e0615a67847fc063e711f1b4ef97a08112f92226680a1c02d77f7f934a01af892df7467e442a9185b8c6f0c20990587c1417d41d4ccf1f439b0c2c9bc494ce2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 1bc74635fc973fc2317b559b097335ba
SHA1 746cb17d3e3a140aa786b15743eb8cbed207bd6e
SHA256 151a442e736a243a69c027f6f90745c921f69d7aabf6f9c017d658a44d785e92
SHA512 8743acee19c2f2d07a33149f55e58e442d7a30cbfff40c7ad5b6d4d055e13c057341007d81454bb6182dec68db19dab86d74efca90e3195ea5bf8745dcbf5d0d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 74cccbdf828fa3383a7a75998bd4850f
SHA1 1c02cf22b60668412a9ce18293cf05ec73130ac1
SHA256 bc9dc1b5a432005ceba686df66c38ec8fc0697d413ea4e639f1f83d65c80e1d4
SHA512 8440a5498fbb743cdb5f564205f7b20ee96792bfa48a57703687c7762166e976b76d4a10626160a0e095da16d4a89cbac19c5109fdc33fdf0a3cc0f0d56bd320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 f57118848db4e0b134f9a662ea78680d
SHA1 75957ff914869fc7318c1a769cfeeb8ec8e395dc
SHA256 91805f9a4282b14adea7b45fd18e477824e2f8a96a0734a86c238377d306a096
SHA512 ac00a0ff8fd7154aaccbfadbe03235ced2d903aa4c7db5d57df0191e71c1053a654c46796a01f5e6d8c449088d1042f9f9cb54eb4b955e2d9c0c499d52e190c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 a1fe39f21a01de1b0e865677ecb3e2da
SHA1 fc76f26a64a738c6c2b8fea171267d58378a5834
SHA256 a6706464329a8ddac1a06604bd9b7227a8c6780d69a5cd2ce8295b6532e2da0e
SHA512 008fbdda719ec3debcb13270f6944684814c4b1a7e224b9fcdf31aafb33ebe3738a6511884e469150e4e29f7777f8d00663b347e1bf3372d07c11bdf0fde2a41

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 8bc1db02e59c91541866c8a28d858031
SHA1 4da7d0c319645dcaef8bf7d1a5a369dd05ea722e
SHA256 a757226439415f68493692e11aa9d3cbc46452bb708a8a1a739283ab60e4ff91
SHA512 48e7beb7b1406cdc7fea7d692d8a1954a42ae96bfa333ea2941207f7eebfb90b51fbeae45b34f7e8b32727b6e53b3c46219d7567f2750adcc1109cf294e07e11

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 3e5b2d21fd6ace69b10b2870484cebe6
SHA1 a9601fc0a1561567e53ec4c9e2f5e801fe60c24a
SHA256 c83a02107f0be740dc1bd9328d7f43e0658bc542871c4d1d1c84f2d1278e101f
SHA512 8ec2968ade2479a178ed05620a5cc93974cec71ce69fb343353c305783c08651a65d8667be95e480a0ce7132a405e9be61ce700f8c5d379b5bbc786a3ba1b757

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 e598c26229f240252538941605984ef1
SHA1 f4043f402b0cbca01d9d4eea7134739d218aff44
SHA256 01d7276254a8bbd138df416dad79a723d7e815cfa33757bed1bce17030d9cea6
SHA512 65ed06b849d252ac77587ce8ebcbb1004cbe655d39a65835c45d33577bc6eef49461585173358ef34994469516b199478d84910fd95c6cffe0c9ed2595da9a72

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 db0a78f7d044d90aa83e19b219ed9595
SHA1 40b0a5db1d26b72e83f8a53f41dfea761e6c7e72
SHA256 19e249ea24914d99fdcfca4f3e653ee9ba00fbb02e3126135e5739a77a461ad6
SHA512 8cbd78914932b0ef9820af3a31ea632aa7695287b1acbd63d322ffcb8ae1537756e8a018a49c0ae672d956e3149d8ccd964ff87343ca1eb49ca0f3ff01bb5fd1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini

MD5 308d9b6313f861c6c352e1e43599de16
SHA1 f5572312346b9b7355f42a86cde3615165a30fff
SHA256 1ede0d9cbcb771a2a14817652bf92c5c4ecc6a4829745c377640a741057fac24
SHA512 e8a86c337533b131f94b6a69daad8d11f1756542dd2ecbeb3ae4ac383b8ee031cfc589c6ba042193174154373e42641282d8b0a2423b37044695ab731faa871b

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

MD5 5c2ce56c9a019c5fb19d1983d441b685
SHA1 e02ea08e3a1e33e4feb768b1d2b11e41f9029a5a
SHA256 6faf0d139612d218aa0c7f6bf373f5454d813601307ff0c63cf38c9d41053355
SHA512 22d79ea3277410537f4ef1e3a59fb0eccf0eead83199e6dcbe1845a225c61dc8f9bf8414f978d6e67a03edb9d227c0199178e72d0cd51a9b39cbe24e1f81e858

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 45e2abc360782ced48eea8b62a30be3a
SHA1 657fac630576be8e8f650e87ebd2236fc2486996
SHA256 5e6bda4bc7960ece9e8fd4919660157ff378e3737e0b870391f4fcbfe22cb945
SHA512 7beafe0aab6c3222d306a2b3a3ee60dc5999ebb22e1b5bd4a040a1bccb7a707ef24603cc2b03b3af97869883a0f0110275f6d7f56de092d839c3811e78135efb

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 c10b203185d3d877fcb9faa8f419802f
SHA1 f12b6bcdb4a8065ca5e79bd4d14291d226aed41e
SHA256 e963043e9eb7b1afeb2237c6b3bfdb4d5873e83b2347f70829a3d3315986d3ac
SHA512 5961dd250ad06e4f94478ac83fad70c18c0502414b67f0a67c8af7aef0e873a32ed2901d5251106a6ba4da629091a41ee8901947fda7db51df4d1a19298ef37d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 f1a36b96bd8dc02ea5eba5f3a921dac7
SHA1 fbbd7b4dd1653a5945a085aea9d19b7d47e5d170
SHA256 af4eb0838f8733b358690731d6cf6f2bb66c340412f0fea56f10701730600e41
SHA512 90552cb4e4641ef19316ef9ee22b7c4e408291fb9d7f0b8578d546b50fd16049357e66fd3996d7fc58aa9ea8edd4391df3c847338b11b28678fb88cfaa4d9260

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

MD5 341f43517ca1dc51d7ba2beff90158e7
SHA1 e0656670912d4e0d99a297fbcc724c2758a1bb2f
SHA256 2529e54fa0b98f371d0d8a6b6210f083a553bf9a3799d243999c8d24ee288182
SHA512 59721c1048d0d05eee72c0c75f49ecd665920a537fb8ca240cf3b60be55f098d78058694098194feab2805da3e6604f33ee8e5dfb0f6c595b6e6409d1958c86f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 77369e1766f6957643e096ee45cf62b6
SHA1 699eed19afa12e1dfdcc0c192a919432c33c98eb
SHA256 bafeb5d2d044666bd4f38651fc63beb7f18b85421035cde801b65b307a002746
SHA512 5eff613fe6be60261f63698a0f23df03b44aa3760f679f4bd5beca4141a2fcaac05c2a9962d188b445e91f0e4a5168ceee029b984c32d437cec073efbd851eb9

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini

MD5 73bcefed1c400fa5a27116b8a4275fc2
SHA1 ab68e2cbb1b5740961b4d663f8bce4370eb5d3e1
SHA256 d3e8b290bbbaf02b2f293f847009a65ca8f552c3bde4be533cee424e206d96fe
SHA512 8eca3fcb22131c6c58d93678e026dc00dcdc53766da56d9eb8bcc3713b0c460054fb6f7c022c694f16fadc82ac411559ebb99c8d167d90b20f723b2f700cfe08

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini

MD5 b3f09ab18937eac75b6416994baaa311
SHA1 e0135501f6f995cfcfc0e7431d1105ff36a452ff
SHA256 230882480b18ba59c6601c1d9b65f638564efb82e36191df41db537762f6ce7a
SHA512 b26baa1611c94d6fa202e15b0e81a8460650100a4ac792aa2441de9a08d41f7bff71d782f4e655ba868e7d10c81813ac4bff4276c5988816935ac526eab3be72

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini

MD5 6ee575eb9a1d485b2b5b3a7843528d85
SHA1 d085222645ce8bf98baa6c655eaf03b386911ef6
SHA256 9a7f81eace5c0df79ed302821f8ab0ffae836521618f9904da3f818d3c9b586d
SHA512 becd6984dede2ee731d5caf9147927b35fe42d533b3b9a09806ec8ab6011a321b09609419bd435dba0d37ad867dfcd6c6216a99db6ae1eec9ce4728b78771fc2

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows Sidebar\settings.ini

MD5 2539a44974a9c63acd1850e02d28c502
SHA1 2393e05e619abaec5535b9e03c09b4f887de7f5b
SHA256 222e75b5486d3fe0297b8c08b25f2ba4666c6a4e7baee2c15dd1626d2cfa88bf
SHA512 5a87f2ec642659a064fef41a739fb4fbf0d374fb85a66261f089a33e2e1b1d0bb197c7e838ec7b4154e89d39895459ce6f04bdc6ac819eb01d32b9e57cecaca0

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

MD5 fc8784160fad84aca8c91b72e021f8a9
SHA1 ece0374000880bc115be7064ea0cac9871556185
SHA256 937b5f936ed63f131786bffa59cabb60b1b13ff3052a5eec8940c91a385b72d9
SHA512 01766886a24886e8faf9241059408d3c4de41e80610c70113a2639f155346b617cc03ddb27724aa3a9738916c68f71dc8a1af60a9f8d8d67e7136cd9282a295f

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini

MD5 0a2bbc8b8e6451c78b636243878febe6
SHA1 188282a85c946e4f3ec2cd62c4599752083ac1d9
SHA256 922e14c3b036fb40170809c9e5bed8a59555679f0023d32b6b35c631881e1ffa
SHA512 ea4d6175d671b19a41f2d440fcae66e0a75b261ab18276e09f2c911cef13de6751c2f216eaaab399b8e32e4cd1f695410cf8433d0cf861a9e754d504c23ef026

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini

MD5 beaa65fcd6715c1d4c9cba32f81bb60b
SHA1 1e0f59ed08378db0142ee98bb7c62a64ee80c667
SHA256 8afa83a4bd89a94bd4e83e516539e880e177fdae52c0bf0b6324a52fed87ad7d
SHA512 e7b9b717c9764a96c26700b4d976fcde4b558b68f290a6bed3c12f9bb03bb0ee18a6d391720581cacfc0e639893d8479a7883caa7837b95ec728b30507d9410d

C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini

MD5 1c7a13d98b83bf6b1b80c79a3d614ce3
SHA1 01972681324b10109389e4b4432436a3f312188a
SHA256 52a755409ac7c107037d6b6afb3795ed010631278250524559b5f3686a40bec1
SHA512 88c2122dbb6519fe809d41f6f829a52be69b7b76b678b00317ee4068800db208761b0c6c230be93e4454da86e78e2ac7d13a9d9098e244e435541162695959b6

C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini

MD5 1dfd06efb4f81614b85c4d18d41a7b2c
SHA1 613957d86f9b828adaf2d4a58cdd14d724a2ea1a
SHA256 1079d0832b79f8d307988be6e575e8a5f069da769e4d5cd32bc2c2356b396d9d
SHA512 962f7cfc40511f7bcc8af161bf6f9f1cab6677b2d7742f962d7f6084e731ad7b9b0367d679b80f216ad78015230d7c436e816e01aa535fa7cdbfc009a3fcf4d2

C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini

MD5 c31d3d5dd316d6eea4650cca2fbdb4e9
SHA1 e474665ac790ab1806b05559ac89796cd4e73b72
SHA256 11a1640f2c27d1e87f6c3dde858bb021ab9cd1e413c877a6cbd6585142295074
SHA512 441cd0bd66468876f4cacc200dbe29ad512438d9dfd528d7f5924cda85296d6dbed7295b7ea32562e79f20b9c9f300fac0161159511ddc8e332bf50f670cdae4

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 89c77d48b86f80cd65f5e133cd615b69
SHA1 0a51b428b8edc6ff6bd316dd05d198da20555790
SHA256 3bd1464c7eb4916fc852c9890dfd09397b26430065292d584f610bdbffcbb8dd
SHA512 8138cc423ef8c97285d531b9b773c1b3f19d7e4a010b57cfcc0e80543377f97b2ab07100a9a9105ac887b8f898534fb027193422aaa1decea617ca55d03736f4

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 dfdd90ca6103f4e7cd54959e94ea4509
SHA1 0ce1d3294573fedee2f44fb028f27b6d10a8b50d
SHA256 1e7694ba2b9aa4faf3d035874ca4b8653f3c5e5de2d5d45f08ba9e62a34fd932
SHA512 f2280a23763054340f205aff9ab970e5c48f1752c7cd73d2a5b90701e7efadf70727a621f04b07eebd2166241a7bdf315c5a2ad8b84a8dd8b353f647756fd677

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 c4437a010ee313b39d94edf0c84da0e5
SHA1 6de8999fcfde838f9c91f329adb43e15f00f80ba
SHA256 2d93017b2f2f37f0bf81793efa713ff16f858543fc6fe7ca8b8b2b2c64ef1678
SHA512 55665fbe63b161503366cb93cb4f3e8d7e97d76054668761ed2f7d0450950e4deec65c69e72b295a69fea7adcad0f94823f437313e56e3ca8257edac05d27f6a

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 562b634a5cf97b8b21a1e11b94da6c82
SHA1 8215291be7f60dee11d46a70cce074febfab6dbf
SHA256 b309af849ec98f26dd0a7dda86c645b0d0b5bec44aec487a7ac7561b6f9f978f
SHA512 84bc59d983de4eefc8017e544b0f3f8f1d0cfff7a7d0ea7223fb7ac8907950ec93dfd51ad58621604a66237b6d8b27994bd19b08d408d51f4db8557626411e94