# SHA-256 of every file discussed in the article, taken 2026-09-03 on Windows 11 Home 25H2 build 26200.9168.
# machine=0x8664 means x64. Note SysWOW64\sudo.exe is byte-identical to System32\sudo.exe (same hash, x64), not a 32-bit build.
C:\Windows\System32\win32kbase_rs.sys | 43E0C65177BC701DCB4EB8B69320AAF9AF5386087F1DE57FAA7929140333CF4A | 155648 bytes | x64
C:\Windows\System32\sudo.exe | 91739478BE752086CD1A0C3C88CA3D84397E4DECAD1338F1B72E200F0E44614D | 970272 bytes | x64
C:\Windows\SysWOW64\sudo.exe | 91739478BE752086CD1A0C3C88CA3D84397E4DECAD1338F1B72E200F0E44614D | 970272 bytes | x64 (identical copy)
C:\Windows\System32\CloudRecoveryDownloadTool.dll | B7A787ACB6E20FCB2019FD82FABEE9599A342AB27F7959F02FDEEC8BE4BD2112 | 2792864 bytes | x64
C:\Windows\System32\UdiApiClient.dll | 490ECD8E48F12F3D1FEFE3F956305C8232828D689628D7FE17D72CFCE04E4205 | 2310048 bytes | x64
C:\Windows\System32\NarratorMCAT\NarratorMCAT.dll | EDD0987181C5AD5F2DE63105B461EFDC7E57E215F3C4170CC1617C8910DE4B84 | 3768656 bytes | x64
C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DWriteCore.dll | 99B2DF1A3E18118F56E29F4E06AE3CCA2E18C32A0CA4ED6827FF9092EC24E5DE | 3019776 bytes | x64 | App SDK 1.6.1.2406
C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS.2_8wekyb3d8bbwe\DWriteCore.dll | 9AC0AFCDAE3AE847D179640B605F7EE88C6BE15E30798684F230B5D3787EE3C5 | 3242496 bytes | x64 | App SDK 2.1.1.2605
C:\Windows\System32\DWrite.dll | 0E030FA0BCDD4DB7F20435E8288547646A1D838937D4F82BBD16D4CD453CE6FC | 2486272 bytes | x64 | own version block 10.0.26100.8972; en-US MUI file reports 10.0.26100.1
C:\Windows\System32\nvidia-pcc.exe | 0237E15F7FB32B5A64B684E0CAC05C15F69C79F9E0B6BD0FD74834635DD99262 | 28094184 bytes | x64
C:\Windows\System32\Microsoft-Edge-WebView\msedge.dll | 3C5B6E37DE1CF3A5A1BDD4FB03EFC8905CC9E0C33A60008475AA48894ED75F00 | 331654472 bytes | x64