Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

SnakeRansom.exe

windows7-x64

10

SnakeRansom.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    80s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/02/2024, 13:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SnakeRansom.exe

  • Size

    3.7MB

  • MD5

    d659325ea3491708820a2beffe9362b8

  • SHA1

    6e7f725401c33332beb2383a6802a7e4b2db30a9

  • SHA256

    09133f97793186542546f439e518554a5bb17117689c83bc3978cc532ae2f138

  • SHA512

    958f4a72530703131be2f25dc906ab7fc8ee174e9cbd13f9c976af7e986593b56a768e0413e6a85d06f2bdc057ac7d9617f6c25cbf8f13cc2f8348bcf441eeb5

  • SSDEEP

    24576:9ypcVmmyK+Y8J0r1dpvZlGhiUTPQOMoezwFnKS1yb0zrs7HjeAzgeJENrud9qcju:ecV8Ytr1dhrwierOjeAzAruTqQt02+

Score
8/10
persistencespywarestealer

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 53 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SnakeRansom.exe
    "C:\Users\Admin\AppData\Local\Temp\SnakeRansom.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4116
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3548
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\Decrypt-Your-Files.txt
      2⤵
        PID:3024
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2664
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3172
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5736
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4148
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4028
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5628
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2192
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3472
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6228
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4536
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2724
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3184
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:6344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\Custom.propdesc
      Filesize

      1KB

      MD5

      23131ee6d9de90ded4ed3337ac83a9ca

      SHA1

      9ecf9c26758dc1b2e70944491579b0af8d08c32d

      SHA256

      7f2843d21ccb70b424154f1c7b290d36ef5d1090227c7b077d31936fbd868374

      SHA512

      950e332fb2e4efe65f534d83bf46ed91f298b8e15c82a1f3983384aeb143c698f7406ad9c82f4776e0d9dcd361caca1200798c2047fc4ea7479401beb3508502

      Download Submit

    • C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db
      Filesize

      16KB

      MD5

      603c6c2b952a2c9af1b7afd1dcd18c4b

      SHA1

      b73f0ea0dd4a40ecc11b5a20c6e41a32c58f8376

      SHA256

      71dd7c5df71a3149b8cdc12dea36aae6fc3a0b4bd622c4560945d29e8889bdb0

      SHA512

      cd71eabce1380df4b88e613a3646534be88b3b5644f4a46052f1c4f52fc5eba4e58a73cd938135acaa07b6d0f206d24942a26506bb0cc31c02cc3ba8ce5b847f

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\BLOCKCONNECT.CSS
      Filesize

      344KB

      MD5

      16122eb4bbdcc73c91291de5f2e06f24

      SHA1

      cec53c4d39305e372f7554cb77be535ad6931e32

      SHA256

      5881a74c8115a00d83c1e71580b1bd3c374eb7880419eae01ec0b232e79c4f50

      SHA512

      2f3337337733b9a86cfbe732dc3f3752bea2c102a6950446f7fc05cb0279cccc21125fdba963937a8053449c65921746c59e489463dff9f010db1c0eb4ba995a

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\COMPARESEARCH.MHTML
      Filesize

      642KB

      MD5

      f1fcb3778cd6e0b7b76dad7950ff4ded

      SHA1

      d54d58616fdaae821826ddcf32bf7dde6edce794

      SHA256

      00baa95c4f321a29a348937f0c78959e892c59a2a432942e3511a2d5493b1008

      SHA512

      d652c6fcd35c87f505cd32d8ce976bcfa22286df9281823c35ddde1e3547aa4362614b6f92a7dfb749016e8139723e3c61f7a40e5a06231b1ca53505f36de7f6

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\CONVERTFROMSEND.CSV
      Filesize

      437KB

      MD5

      699799c69a9dc15792e42d084b1d5629

      SHA1

      906b6299d737510cc70c62b1c86a9d9a2d7f5502

      SHA256

      43157ce59eae470af666091b28feecd7ff32cfba8fdf558912c817d1459bd60a

      SHA512

      00ae26cb174005d29ed88900856488ab5308d82b859e2a1402f72d9c8371cd39a0bd0db80c2a0e63a2d227f058116d6920c26bea252bfb4a6d4802592f78b058

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\CONVERTTODISCONNECT.VSSM
      Filesize

      440KB

      MD5

      001a8bbb65d440e1c3ec2c7fcc978e34

      SHA1

      03b4cbb6b78ee76d2fa3499fabfcb5d19892daf5

      SHA256

      53fc42e7619d416998196ed79e643bbd9f61eeccc71110c468bab17826be3465

      SHA512

      525362e11fcc74a084ec090e1bd0e5df51a55787e960ee0d44a3aaa3fe07be7f8a844d21c37c7a39d50cd54638ec8e50c6dbf66bd774f6a778a83af68422cc07

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\DISMOUNTMOVE.EMF
      Filesize

      365KB

      MD5

      48bc42ed96b5948f2691afe5d94e3c35

      SHA1

      a5ef36f64c8e0b505bd5b0f462500bb3915e2a30

      SHA256

      af5d8793a5b090d80c2f204a40dc68c4bccc3f8a61440c3bc62d27b9aa2e6a6d

      SHA512

      a990b14b710c99fd21d26c0cc34a5073466a7cdbd0659b0b26e436754d75a392ad1b7dce45e4dc4564cc3a3cc3cda75f60cda78e69a969c55d7e8a506e3f7f6e

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\GRANTUNPROTECT.SVG
      Filesize

      620KB

      MD5

      9ea69d41e1cd8aa9fb51f6ec63f94e0e

      SHA1

      c1264dccc16f51f23143347dcc9ee265a7228ef0

      SHA256

      61f798835cd6f594a23e170f5d7f0f9aaae08c4544909d5cb5a061c9e969dba5

      SHA512

      d8786cb61a0a442288e9b39c5c56bee99d7a9be70240f5b5251610dcf14cfbf632f792c1e1e1b7d26e37f7fed91a6c8e22ea5966e60a8f09531e4da22a0e37ea

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\LIMITMOUNT.MPEG
      Filesize

      501KB

      MD5

      a60ef7edb991f09e36b68bb8574f688a

      SHA1

      2971c3d66e174ba61a02eb532422c679bf50e1c4

      SHA256

      2e5fc9063b0d2ab428f21a94c4b0a9e5b1237aad3588cfa33b0123f633ec2a74

      SHA512

      d80d10e8ea402e4c74da0a9775485d17112b33139f53b26906606dddf572ac5873633dcc5ecd2e3a740977e818c840ca652bb7b6242634fb81b71b23d9f822bf

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\LOCKBLOCK.PPSM
      Filesize

      361KB

      MD5

      09b7d48e96dce27bfad4f454515b9a0a

      SHA1

      41e3c996a2645f39e77452742ef581eb526f22ff

      SHA256

      cbc1e5a4fd1dc073b3ad96b110fd7daee09e9dc182c4121913f3bb712c592276

      SHA512

      050bd9b409b2c593c38ea1c4c2a95022ed869feb9d4ca47ef0d409c154f24d98dd41d161594371c01bc49f3a2fcc75f000dec40473fca4458aea0ab89b4a970a

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\MEASUREOPEN.PPTM
      Filesize

      424KB

      MD5

      74faf2ccce36e3f78292d84d3438c73c

      SHA1

      a86e896429e4875511d011148f7c5a1deca571ac

      SHA256

      7480e6f4ad84e2b179f5aef7a53bc28546c840d8420718dd8b609acc1f61cc2f

      SHA512

      6453205dcd901cff19c1ae1683d9991ef54c111eb5ac956ac082695de21aaf43a3d00039eeaabed4c4f2f174453091f129caaeac8ba0f0a85f2e1142436445b3

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\MEASUREPOP.MPEG
      Filesize

      372KB

      MD5

      a2499f1b2558ac30206a1a814e86fec0

      SHA1

      69739af9b95c1640efc7dddffe8e00ccb43f106b

      SHA256

      670dfa5c773a74f9a972e3c316a22516e4d36a1c700d1b40a62b285ea531c9d4

      SHA512

      b3d04a33ea59e3a5470a8ee53cb2643c47a73734e9ee1c0e5fb3d042ce637fac2f84c48ee6d51685509d19e6404bc4100f22a6da46d6febfa8657c37f8ac33a6

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\MOVEOUT.REG
      Filesize

      340KB

      MD5

      54815609dda5bb661941eb8fae4909f8

      SHA1

      49e9a978f4bc98a14be8920e6b0f7c4361a95980

      SHA256

      12d77dbd388b0f50f97b957630ea6da35424da669ae7c1e22f306335592f3c5f

      SHA512

      77490d10201a4c2f6685ee3852de913f1ba89855c29f6af9a797b8e1392d65615e9320d526aa658432be43c215737d0b023f5ee7196dad3d65d68d52ce9784c5

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\PUSHEDIT.RMI
      Filesize

      289KB

      MD5

      6b804fe986410b78f6fb2b4505e1c6d5

      SHA1

      d70717f3102896a2e885f7b71f928280402738ac

      SHA256

      dc4237ed381b0f9d83acfa2cf84b5e972407d3dfd19484cc01f9a264f4bd7144

      SHA512

      3aaa72442d9bdb37abbb6f81709b6e2bdb758c74177b1f27c04b865e1c763e392307ab8c76f46dd492468f2319fb6090db99dbedac7210fdf3998a535081ecea

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\RECEIVEDISMOUNT.ASX
      Filesize

      428KB

      MD5

      b6407c639a549044de7eead0b647a57e

      SHA1

      1dad0cef34754c6f13407731b9b482bc82ddb47a

      SHA256

      986cdd40fd4c9967fee95725749c487c7c0af1d46e065cb38147c898e62f69e4

      SHA512

      86241d3506cf27d6177e3904e15cfecab3e4e63bd6abb0ca05ade257423a3ba3c58f5188e76140036eca4c765a1f364866f82518a3e34c8e83e612ddcda29ba5

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\REGISTERUNLOCK.WTV
      Filesize

      634KB

      MD5

      4bbdeb334435372eaa43b03c1c418728

      SHA1

      f991eca555ebc479b77e0bb556dcd0c4db40d98a

      SHA256

      7a1182556affb924501570ceef87fd4c74cf41a82f0cd61251b896f292125d43

      SHA512

      2e091dc05dab1c79c6cf1e697ae814a2278136712297078804c9f7acec50ac4c720e8ead1cbb2e8f15d154e4923885db7c0fa469b30c39f018d068a94ddc6397

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\REMOVESWITCH.CSV
      Filesize

      465KB

      MD5

      69d65179a69ec73a2505cd01b2b35ef1

      SHA1

      2b08e10aab10c9cd939eca4dd21c65d2635e48b1

      SHA256

      50e074f64546e8b45cd68fa1a7f9d7b99f513194e8b97186dd5f99c19d2cf10d

      SHA512

      b037ab1271c7178501a5c9261a1918711ef9c826d21b0105ba16ada73cca238ad7c8954f3a4740edd99886dbb8401f178fa80f87b1960ab5fd458f08adbc6d2b

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\RENAMELOCK.AIFC
      Filesize

      383KB

      MD5

      10744e51548e1f5920a8cf69b3d59a49

      SHA1

      d31a891171e99202688923553dff3a896b11f328

      SHA256

      b997d8b5dcb492970c4e5da1b9e3d30844ebf812bd1cb0258de3142e8b147a47

      SHA512

      273248b8e4063117189e434456baed381fad06f5a0255fa55339db6d6ba70cd74eada833af990701141c20f889da2edf4ba281c6bb7d4d836bae24fd92ae00f1

      Download Submit

    • C:\USERS\ADMIN\DESKTOP\RENAMEREGISTER.RAR
      Filesize

      467KB

      MD5

      c4dad48a07551e69d1f48b96b147bdf7

      SHA1

      c0d1a2c59d529456ba663748bcb5ee571dc427a4

      SHA256

      0040bdc3a103caed76db6588e3a6faf3fe06768d1e39d0ce1622e10a58c90db3

      SHA512

      a33b859e311a453bd55479d702475113087abd03dc7cb39f132575474caa521757d8b1794c83668fa199f808030f694d84631202343d2a4ead87b24e6c4a600b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
      Filesize

      1KB

      MD5

      774856d8bbcd4cbe7cf5024089b9efa2

      SHA1

      0286c034cc3354216981bc68c455350b7fa2ca1c

      SHA256

      1670163d9b85ed6c5a174758ab62529401ef4bec6595bfa01bd9783e0d2d63af

      SHA512

      3728771e986af94966b9ec7dbfaeb3bf515d53fd72eeaa6056f62aece71c8466693a3259b5a69a8f37e933f74e4410d9879f26835301bec4047bb1bbff9916c3

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
      Filesize

      16KB

      MD5

      a1c82c9d08074c3f545e662d94bd77fb

      SHA1

      df433ef944cab16a7e752263b5ee658847167fc6

      SHA256

      16bdecc041b6aba488c36a711248238c3f6d30f15603c3d6c9e6157802cd5dc0

      SHA512

      b933efa7f4e341bf89942904464ba89b298d14d518874c17d3cc5f758c9c1a49734a7c9afc616e427725c76dee33145740f0710e1e82ae4aceb8f667d737284b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db
      Filesize

      16KB

      MD5

      7ed94c6a9ddebcc9ac3bf10d728d8718

      SHA1

      b43660b15577ac1b24c34c436341ddb20715ee19

      SHA256

      af3cf2d4162357b62f14f1f661a4aa29ffedc8220562880c8c8947150a98d042

      SHA512

      487a0a5325b159563cb74e7da8a44c709f71c390afbd054a89ca081288296a0aab85a8d5505df36982fe4d540c4df9c5470b2b9cc2c8d81b778742a104f212e8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db
      Filesize

      469B

      MD5

      19a5fa43832ebfdf885aed3fb99aa78f

      SHA1

      fa6f872d861d86bcd3f406ccc13963cf3c19611d

      SHA256

      3239b316bdb1a8d4e66ebd8c25dab343c876c5bbc2b63a4fc57349a54d09b015

      SHA512

      79a8b99ed448a87479d0c03d7647c120000e8b082f5d623a43715fb6b0d9168f81dc83c49dab88e3d15bc78d15ae48bb59699d88c2a3f302294f4bd21d13c078

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
      Filesize

      955KB

      MD5

      1b442020c315b5c559734a6b2538dc96

      SHA1

      005cb6511f15ba1f99345f8d6beca6c198731e5b

      SHA256

      52acd8d4e17ad38fb4f11572698fe6590afd938dd7a1d4d74a5d3b5582a35022

      SHA512

      a9b90dff9feac2ebf6991621d3bd0630fdaa601686039e70f4a8384c2d9705b3252a356012ce27220ac4e3246254cb6e2b2bdf891654bda8b8d6c6362fd19b76

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db
      Filesize

      469B

      MD5

      8510fb16880dd208a8dcf87b8376943b

      SHA1

      ca1be5f810642050fb71e43d0f763599b1b2eeed

      SHA256

      f2a38e987e90d827aadfe94dc8432f0f3f60c5091b0ded3b4a90c51b2e75bd34

      SHA512

      09f117ca1410b42b79561af4a6471edf1e8602ea9f50cd8d335ec5de200cf5d411a98ffab2fcbc7db17ae38055ca89106f90c03ce7b512254ab8c1592a34a71f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db
      Filesize

      789KB

      MD5

      24ee0b86c261f69cb5ac6b659983f2d4

      SHA1

      d47b6ec9ec8b0d1505f6b39ffaef8f21132ee2f5

      SHA256

      a9538aa94159c8d6961d334dc27b100e613b54a627a79f92ecc7c7ba48c61ef6

      SHA512

      46bcf6cfc775622088468f58b857326a4bf9114217193efb36289cdc52abb1fe415daf71e8367c57ad1cad092999617ab09a6930d8a3c159d39281507f31b9e1

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db
      Filesize

      469B

      MD5

      65ce20822655dcc29bbbda361b61b7e9

      SHA1

      81750ca0448a2f7da64fe777a8c528472de32ff7

      SHA256

      ea84e9a5f77c1e9eee3ff23aac90455fc0c03bf93399e5154cf9cfc4c5a331e3

      SHA512

      74f400449d21d1a5fa00620e889acedb5709b2178859e88012a327ce2d185bf976c384be4aa5bd3744a6b894e29f271934f9eb5d239f2aa8f260a42853352caf

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
      Filesize

      745KB

      MD5

      983fdfe23253134c93287eb96c153c6d

      SHA1

      416b1f4af531bf02b4425439f3e1342881231b57

      SHA256

      77b98e01054fd2a28e87424d8d79a7123997e388e5173b9b2b29501a9abfe0aa

      SHA512

      e71897b646febc3664003eb5d3dcd12387e3143488f004d7ecf614fd62c69e961e818e8daca5d0cd3f910e2225c8060e7143df8aa60eed455e0bc0a1a4944673

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
      Filesize

      747KB

      MD5

      faad0e61717eaf1be0f7e4a41939d390

      SHA1

      5efe91a1e79f949924cb45bf9a21f1ade61bfb64

      SHA256

      13b9c76d89eb2b27a5f396275d14b30d5da0d67d8225b0c3d1fdc3f1599dde15

      SHA512

      f86b68b261de1fef01f63186e5ac8a360a38e28c0fd68d5a0a2bde75b3206a6c3076c565fa5c3dc8b1db077b457087a32663e9f6e4676658409f2a1aa528b0cb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
      Filesize

      756KB

      MD5

      a48c2a15d8b98bd32d905d5bc12a5dbb

      SHA1

      644cedb98f3e44d2afe7de756fe4860317952897

      SHA256

      8e50aca410df7b1ae19e29bb78a6c7ad1a71441217db8a1fc7bc9f7d9459d8a4

      SHA512

      4aba0ae902948d91b4a3d3aa77cd2a634ed99c7d46d99a96d8d34d5dd2d56e36c7f8acfd4c256f9cfdabb0b9643240610fb15b809bf55b77d78e1a9dc05cf536

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db
      Filesize

      468B

      MD5

      3f1af69ee684c74ca0de792c54b38b80

      SHA1

      13849451863020ab226473d002994e5ac86e9093

      SHA256

      9780e3bbc5d96152ae1eb7e75bb9eaef05c1b652cb6752b841a1240e74eca7a5

      SHA512

      e22e5480748c6dbf52ad4874555c65c07e4e2e2015f61c98fe84b901e23337b83359a7ab17d3f72f76c58f8ce9b51c8545756fe6774084735a9eee01fb958679

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db
      Filesize

      467B

      MD5

      54e70ee909dbfb793c9c9b0a3df06e88

      SHA1

      db7260ec8d957ce1c53e684a9f98c6793f7ace8e

      SHA256

      35e8633dce97d4095033493472fcabedf394ba5006a9f5f62a4738dd8ecc9468

      SHA512

      c52ee44cceae04cb3e5e0a331e4e9719fe25e9245d9be14166e2010b2b4df33e49b2330b118f66f8be5098acf1db07d60a84013d8c26c70a0c180352291aeaa7

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db
      Filesize

      478B

      MD5

      2fe56eeb4a937534c1d7b0f9c7b66c40

      SHA1

      9abafcd35124bde9faf0fb9c3c4ce2833ce791c4

      SHA256

      571e4b137ffa53d2c9b3bfc59cfdf741cfa2180e33532181758f4db2de1cb636

      SHA512

      f91b9257892c6de9b78fa2454c3791703f5293bb9bd443c37b26dc929cf2e107a2e0d0cd56ec5ddecc3771a8327b61d8f5ff295f7a64ffaeccf0bcf46e92e077

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db
      Filesize

      469B

      MD5

      8457dd214d2a04dda03b8a6b96670c07

      SHA1

      a8ef4a429e3b16610a22d9ea315106043bf94cce

      SHA256

      669107a03967828d3854e7f8c5eaf787c29d4d1ebced4d7806f60e2dfaffc69b

      SHA512

      2e33df14a280fdf11f782491f27db818cae347c86a31b5174a4f5d607965f024fcc9f679728fa89372d80db7ec39dc5df4fa1e5f0f60e99f5a76d69159fae91f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
      Filesize

      28KB

      MD5

      fa78169085f9947fd906ec0037694602

      SHA1

      7ea508721fd172fa4936ba7927ebed4a6cb4ee9d

      SHA256

      78d321a4c82ab3342c36f47b38d1aea7a70c03edbeb0e9a156b828326253e464

      SHA512

      603370079f16a294d74b10466b44a8895ee9fb5ed7860e3e623d0ffd74950a2ed1df05706312988bd7e6c95655a39e5cdefe2d786dda3e1194d1b159d27d085c

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
      Filesize

      7KB

      MD5

      e342f339c251a79743ed175f3cb21856

      SHA1

      f6a07d6b153a80787f4c554012ae7cf9226bdb29

      SHA256

      ce54b9c530ea7c3baebbc23880879425c0337f59c7c2e9964659c52013b8c629

      SHA512

      1ff48a5734ff18fe64ea2e3f0496694f5c08cd13b9291e60f4edf8ef1dfca3513f6d8cec9ebe3f2c71831f3aab9881ab4c05761dc5b353951899fca6f41260ad

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db
      Filesize

      467B

      MD5

      42ac1ffc8cae1c06e66a38fc80d78bc6

      SHA1

      ae084cece5acf477152140d50e61f5f39348f659

      SHA256

      7afa2026da53564cf6b1f9a00198e7a9a5ea98b7886e6404467fb2bd8ad9c7e4

      SHA512

      07946bc412aa02aac965e58f506e55b4475c963c23c77d620ab038b3ab2d4d58a479a1bafb1e27a39ce65289f6cc708a78cb5719ec00dff15eac070d5bc670ac

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db
      Filesize

      469B

      MD5

      dc2e971c9ef01f478a79caa8a27ffdc9

      SHA1

      5f5f607cb4c0ad81421b2897756d029a24617177

      SHA256

      9cfbf1d74bc496d98e3a4c5cc5da5eb778d5724f358c1181833a5cab33d1311e

      SHA512

      5d016ac9b4e0581f2af0586c9568e758200d6855129d7bad82902d810a7fb2629ef39daecb0b204001f58bb3ba771121d10eb8f98aa5aa43269f49cd30343d5f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db
      Filesize

      479B

      MD5

      2f9fff0d10d7e9c92ce73c13f5257870

      SHA1

      aa96c8ff605b091c71ac27be173c7d7cd7da364c

      SHA256

      ba3ff284f03d8bb2be649c3f111519ba8788c8c4d71e1e0b7e636c13eda9ece5

      SHA512

      23cb3c671b4b30a4e0d31b7421165d9f34dca1c99b7bb5b5fcd6587e2fd9a71f4c6eb1f94fa1f1bebc18e266cb8b98b0c1d79955adf14a7a2c1206eb7c20d1ab

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db
      Filesize

      470B

      MD5

      2655f9a050b5e3fc8aab916ee905f0f6

      SHA1

      ffce04edd030069002cd527c71b42eb72a27a046

      SHA256

      4953167f8e88c9e041e59ec55b5215f041b51ba55d3c184012f55a37e75e7f0f

      SHA512

      fd6f58dd21ca9dfb7a0108d1fcabc97ab251e4f8a88491d4beac127718407fc26605cbb3c17da928af2e4af43d737d717ed7a8d69d5f225f2d92a6886e9bf240

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
      Filesize

      1.0MB

      MD5

      6e224fd0eedba13e257e2f8e4adf5dc4

      SHA1

      500533e0a1f9737efcc7bc1606ffd7925fa86273

      SHA256

      d570fb294c656abee21e265d9ca0d4a322b365117baf684fc9ebdd3de9d107f3

      SHA512

      ad5979321663b6e0069597f78a977f979db91382785462b2e938daa79d3ba402c7b0668f76861eefc6c19fb87657fcf65d81cc2a5534cb249dce1c568dc07ceb

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
      Filesize

      1024KB

      MD5

      44254d1a00d08518a338cf9d9ef407b3

      SHA1

      5936113e9ff7fd95107b6ef957f390aa838c7e3a

      SHA256

      6b7d49c89ebc3f480dab87b3ce0fd9592da5f031e4f0e14b0d567ee85ebc56e0

      SHA512

      44a06c8d3fdf426368b92118be08c6a5c809e64d4342e89c8aa490e852f3e50c84f515a1f77f1bc8fdaf2d373d5547c1981ba909b6be809bd06c65435b74d73b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db
      Filesize

      470B

      MD5

      630e5fae2940b04bb733a69f25f643e6

      SHA1

      847fe110f93f3ad449ab10ad65a330b634d6f52a

      SHA256

      c9dbcfefc4655553008e55528fd6753d715d7d6e42c5d6021e48d5709769424d

      SHA512

      1c8d6f2bc88a4ba3f8d89bd7a98adc6bbc3e3d341690ee6edb6e2fa6ae044c06ebcc9ccdc990dbc304df088b8b7c2fe1e1d1790fb02c14e0d79c5724adc75f86

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
      Filesize

      1.0MB

      MD5

      fceabfcac9c73a33e2127027b9cf0b91

      SHA1

      3b9554bc14f9aec01556f20495f0d42f4219ed3d

      SHA256

      358b4cc9e5505912bdfec89967cc3568130b2e79beeadff7539338a5df142d02

      SHA512

      f124042632d1d4db2192681daf87dbf6f69a887c9939b89bad5ffb3e7c31fb5c986d38471b2f5518de62550d94324b99252b399c5d68ce4d0e4f9f725866715b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db
      Filesize

      470B

      MD5

      6e9759c198af42d53997aecfe1a7a7dc

      SHA1

      62a90030e393f934c05249202daabeebc82ad11e

      SHA256

      35641d0b9c5c9e801fac567d803bb0d75915d27e91418f582f070db6553bf771

      SHA512

      fa8dd252ce999d0438719f9f24f4e4d7e56cad4c229b87bafc1ab80e5ec579c472585bb9847bd523de546bc83453cab4098f61114b2386311d433ac2f69b9e46

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
      Filesize

      1.0MB

      MD5

      515bdc2cfccfaeece019c8c195624fc9

      SHA1

      06e3a4729647b87ada67929300c5b8c17aa8bc8c

      SHA256

      4ebed4828af15ee74511a532ba1568677a30af32c31a8d30d8801aa1a643d8e9

      SHA512

      45cad899286d57396fac537983cb245002500a78ed01f63412d3349e91109fda02156897ad077be475dd42e2efa0e6ed814b7337622dcd6ee3bd4dfb5c3bdb95

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
      Filesize

      468B

      MD5

      cdbc470df3e85000b38296df6058cbc7

      SHA1

      3c8d918406d3efd91132648cbd2f98aa66799991

      SHA256

      79efaf7aea0df841d634d71acff28572b6f1ff71104284ee3fc3e6085c5781fa

      SHA512

      26ad20cf1f10fc3751a524f2ac1eade159d557e69160bc0156fc703af91ea857d76aafc67745a71d11fa7cbe056b4627e8535de62f6416607547ee6176fee0f0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
      Filesize

      24B

      MD5

      ae6fbded57f9f7d048b95468ddee47ca

      SHA1

      c4473ea845be2fb5d28a61efd72f19d74d5fc82e

      SHA256

      d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

      SHA512

      f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db
      Filesize

      469B

      MD5

      827cafbcbf23655b21053e34d01e6d2d

      SHA1

      a2012f92dfd3c9961d73b6a2ed9f0756e8eda774

      SHA256

      b6d99336488f957adff49ce890755f687ec27716e46b2821b8d2414ce99b9baf

      SHA512

      a8b020699e05e0451d5078e897ffe60f54f5b18f7292b82265711a418fa56f1386fdcfa5527f32f887330b5bf91fa095984de40cc644f3164a2c2c4bc4cb029b

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db
      Filesize

      1.8MB

      MD5

      cc18d55787834acb8a30646a5f7bfbb8

      SHA1

      5e9f4318089084ce2b211e904a9fe26a00b51d47

      SHA256

      88a75f9e1da6441810008a86a2dea6fd6f26f77706cb602df91b1ef4b91d0843

      SHA512

      506ba66f418c068ba6333a3b462d7427e04884976a80e89f93854824dfaf6dde3d88019fd661dfea210a7be40ee5f690e6835a9fd8e36c73c4bbdec52982ef76

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
      Filesize

      479B

      MD5

      57d0066ab586aa5731728575d53a4913

      SHA1

      236e046ab99b921162fb4e3e526228523930f40b

      SHA256

      40941b8b67920cb7b929d3abee8b1deaa308627f9a88aec5f20437fe631747e7

      SHA512

      b4b9578bc035c6fd2fb8ffae5a02c9b1ab2683ba22c882e1ce939f49e37d69abbbdfcc4ddd94264bc60aad7d9ba52466c8500aa7a0abae7e6fb826e7894cdffa

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
      Filesize

      470B

      MD5

      e096e8b90cdd4c812924374e3b65b00f

      SHA1

      d7987b0fcae63fdcfbb48ce1813f5d7b1c84e10b

      SHA256

      bba92d43160144a0672d63b5b2a883701178dec31acf1fcb06d74c84379cd0ad

      SHA512

      9360159c68c09c13bf730d8abb3d09f3b0fd9d7bca0e491bf0b78463932fd3d3b797172faf722e2377d17d6b81caee7777e186af8cdc83e36f3fa9a969b1a151

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
      Filesize

      14KB

      MD5

      ba0c3c5d09b2ec95f4918423b71477f2

      SHA1

      916224ea720a0ff5c246bee8f9b1220340ff9273

      SHA256

      1e040fc42db7df5e6dea1eeb4dbb36336a116bd9aac52de3181b77aac8f2adba

      SHA512

      6e25a6fd4038cc137de75368810162889e30589983bf21f6d674321b2bce32314477936c8c56dfa6841fca554d0f6be6caa53167b184226bba58e801cc72c21f

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
      Filesize

      7KB

      MD5

      3a3849747cf4934853919c9efe035b6e

      SHA1

      c57aec35679f8a39c6b9a9a7b8265e6fed15a7b7

      SHA256

      c21dfe1f94ae0a2cabaa497154b010c314c2b7f7bf0b659cc8bda2711b9eaea7

      SHA512

      566a57e8f103e439ef9084abcc36d4c115d400daf70cb8d2f2caf5e2183e1545976d5e86c88af6246d76ab844726a5ff59c1e0200efa33e5205a8f223f6cd817

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
      Filesize

      468B

      MD5

      ab1f3b4355578c5f8e5579e8e7cae528

      SHA1

      0a309f90e64769d921b82a77f5a7e226aa0f8a92

      SHA256

      e40544ef51f31a0bd6cf4397d854371d447a90a7fa429f3fd854b98d1d48f51c

      SHA512

      0cfe1f28a34fb0b7679c2c096a51d7005c059d2a66871078d7ac99d4a4d36f3679aa11abeeebe8563f891f8395e3f3f7404de93dd44fd489853117969bf358c0

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
      Filesize

      470B

      MD5

      e47e3e080afa8a0550e802142688ca5b

      SHA1

      6feed26f2575155938cf06ee0e96701f55e3a942

      SHA256

      835db5e5bd301469a2aaf577a8c6fc2e4ae7ec33ada2b63ab7b3543a23720293

      SHA512

      8647f13cae206036ef1043f7f27290b198331a5c690c5a6ed3de9fd070572aab1bc4d55432d6400998b881ee6bf83b4fa29bf415674adb32770dc016907cc3c8

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
      Filesize

      480B

      MD5

      78c948a6f56eba04f367ebec978cc67c

      SHA1

      fc4b6601482cce58903dc4c5acd4629cfa1c6b55

      SHA256

      10ed726e279ce987264d3048c841c113e65d1ba9df11c1db4fd77267487af344

      SHA512

      50edb51f1fe4f736894c973eac87183147cc10ec7c6e61a20ec14e105eb0a2b5ef35d91b4adfb4730f5d982d8177a95dd004293384bc0c0a734507c290f04335

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\BJW3VN18\microsoft.windows[1].xml
      Filesize

      97B

      MD5

      c8c02895d42e00f03a98186dfc9a8122

      SHA1

      a94f75d05a2a811f61043a336390cbeeb47c1f8d

      SHA256

      f8944e0f9ff357e2ee9f8f7a6cd36a3a2fbf70f1c6bb0ef002ccb2e4a74fe7e8

      SHA512

      cbfb33da52918505bb3b56d22b89f9daf4a9428144a14dbac84a5044f6628b3c5a1cd6fa9bd274b9ef205b01cbeb4e5b1efe52cfdde85035f3f3eb9585431568

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QDDM1QX5\microsoft.windows[1].xml
      Filesize

      97B

      MD5

      11fe6d3e9db9853f1cea9f11190707ea

      SHA1

      6bfb94a1ad354b22bc24d7b8ed46902b18bda5dc

      SHA256

      e36532171175f48c36d1ef3e7e3bc9d5d4788d1979396dc4bf886677322fa31b

      SHA512

      6a7d214585693ccda328b4cd0e1317af9e1044177a4460e6cfed46c54064225d6a1c0613681dee192d114a1b5d177c7157cc085cce77600c4735147b7885b39d

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}
      Filesize

      36KB

      MD5

      8aaad0f4eb7d3c65f81c6e6b496ba889

      SHA1

      231237a501b9433c292991e4ec200b25c1589050

      SHA256

      813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

      SHA512

      1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
      Filesize

      36KB

      MD5

      ab0262f72142aab53d5402e6d0cb5d24

      SHA1

      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

      SHA256

      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

      SHA512

      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133528242608692536.txt
      Filesize

      70KB

      MD5

      2f75605b215f68b09cfd95ad2234616d

      SHA1

      34c443aff189fe0b717caa7b199e3ab02a08360a

      SHA256

      ed5eef08e811c4e98821330bdd844d91a555ecb00e03a06f9549307101dbd3ae

      SHA512

      c2c3942c2d949d89621d95202a574b5855d4c3fccf6dee3f569437b80a8cd2ab31ba744366bf6e4fa9478d8c406c1ac02f89ad55f1ed8750607a5f96be0cc955

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
      Filesize

      202KB

      MD5

      20ea4f885678adf292904074d3efd92f

      SHA1

      e6bfbe04d8fec663a5b60ac019e450242da2b27b

      SHA256

      4ae97f530ff8243e695f17acf299baf9f1f72cfc61d5ad5d696b3c4a7a3c0e97

      SHA512

      d49bd5fe3fe02264c35938d1cd8644339cf07203f74bc1f06aeba7e8ed663be22664d82c2ca3c0a8438d2aded46c6a8d08a49a1a241978999a150dbce0b5b3b5

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
      Filesize

      9KB

      MD5

      cd81e40389b7df450a02d7e120fb817e

      SHA1

      6c52947364282f5366ac6d59dbc2be9b25327a3a

      SHA256

      48750516307230b7132bb57a996a347e21edc9f69336791cfa161bbd7185de35

      SHA512

      f2f1f404fe4dbb33616472884be7baa1d805384020a9af8f4b345477317b09ff3a42e76fbfbdd97ffec6a15c61b9aecd4601df9ea82840f3715d31c4d972bf0e

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
      Filesize

      5KB

      MD5

      6f89d34e91a59b6ae0f2647a0da3a495

      SHA1

      c0aaa01791d82b1ea87ff5b20d51cd943f6c777f

      SHA256

      2ef337ef78f66f182135a8fd3a89a4b0dd15594847b85bce3c627979541cf786

      SHA512

      663d98bf62a3a049a99bc57690accad9efccdf6ba04de2840de7676da9b6ae4cd1d3da942b724b46eb1f80286218e2b8ff1445e58f9392cb348a1b89ddabab7b

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
      Filesize

      5KB

      MD5

      8511fbc06970ed37fffc6cbe7ed33e77

      SHA1

      b22931291a65618e8f842362753759ff7601523c

      SHA256

      0fc27e255f280d1360b037d7e82800c10ab15111a5637d6578095818868ac5fd

      SHA512

      d0687a6b4fb973e25f6e4b1c733c1a13b12ac04192cc421babadee6570597f3299050caa82f53cb4695c536a03abf09251a9807d63ceb52226710b384fd608ad

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
      Filesize

      8KB

      MD5

      2e78827d409c176e824702fa59f58525

      SHA1

      ff0131d18b1140d8fd5064da90011bb0c64f85e8

      SHA256

      8c82d7f3d3e5fb67b91e0677b44ec0b683f555a2c57e0d4c105cb88237170c11

      SHA512

      8e591022f26704f1bba9ba0070af64b992d39a2c8a7c48d014348a4291af34e30f6230544332875a8862cf7634ea41062aa01593a154d5a2ef8b48e1da8b2e59

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
      Filesize

      7KB

      MD5

      36ca97153b0c7efed459e9ad0c05d13a

      SHA1

      884bd0349c21a2549c7f8804a01841a440aaab3b

      SHA256

      23542c4afa08ff7b2f469defb5a35e23008a409ceef0fe3c96a81af93686d826

      SHA512

      1ba30e1cc9ec1c1e11125045ba66a8271a7d5721eb2d0376a316025d95f7c8f996bae31abd6784e6b29edd8fbf9bbf4346bb5f85f556b18cfc8069e3d77119a1

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
      Filesize

      14KB

      MD5

      2257fa8cef64a74c33655bd5f74ef5e5

      SHA1

      b9f8baf96166f99cb1983563e632e6e69984ad5c

      SHA256

      ead48b70e048de6ccca219a229ca90b49a9d1b9c14bf3a7c5eaad544294fcfd3

      SHA512

      7792be9b935a46a923e97bb76b76957070e116dcc4cb6fcd8b883c2d6f142285ebc9fd26cdf29bd19c8bdff412487f586abaa1724332b613e71afa45d7f3e4f9

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
      Filesize

      52KB

      MD5

      76c4a8300a9aed324acc91154e2ce361

      SHA1

      65070d19574bab9457a3533307029fa5b077fdaf

      SHA256

      06550772599025cdafb5ed0d1119a85239ee9e7e206c5d94b4ec6ed6ea8fe8ef

      SHA512

      1099a0f522d7f061a947100695bd3470a2c23f5a8e1636ef8f3cce5986850bd20ded84f89a079597f9b9fd440f53be9fd27190a08786f2c5a593c4d67b23bd55

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
      Filesize

      71KB

      MD5

      dce8d282be52b74a3a2580946b832fe2

      SHA1

      bc5e8aeae30ed7296f3a47b82c33152e6747f44c

      SHA256

      49433223b9fdfb61468d1832b40de59ad583dfcbced3e2a17bda39198ccdb00f

      SHA512

      8f84e0ac0cee2ba3e98c3b34abc2483db1d4929b7ab7c719cca6058971a9fdf37f0972c75e11a01ef1a0f19dd89bf19abf62826f422ea8270900f6e35b1287c5

      Download Submit

    • C:\Users\Admin\Links\Desktop.lnk
      Filesize

      905B

      MD5

      d940f84e515a7975bd78626529dbd213

      SHA1

      21abc937cac085f48b7433ec93feaf0d50c9a1bf

      SHA256

      a5d213e22915388894841423e9bb14dc91f3ecab2aa7f362071e882969454396

      SHA512

      5dcbfb77eb98b22a22f02bd6c2642b941adaecb09eeaaac3cdde668aa216af0a2be196038e92f2fc6a524914af656a69f8089dabb5af9e893ce342ed873e43b6

      Download Submit

    • C:\Users\Admin\Links\Downloads.lnk
      Filesize

      1KB

      MD5

      4129811cd3139cb50f24609c8be6bfd2

      SHA1

      68430db3d1c5c0a59c1be4b5a647c35174c928c9

      SHA256

      5f187ee0abd73fb7127453986120ba5ab1bc9db5ff5348847c4a21a257f77c89

      SHA512

      9960c5e46ce77be949e8b258fd963e25c17dd8224e4227554639fefdbd19e2e546f5b8ac593370e4f3cb05e948ac1279fbf36eeacd3ceec9abfb63a8c43ca24b

      Download Submit

    • C:\Users\Public\Desktop\Acrobat Reader DC.lnk
      Filesize

      2KB

      MD5

      600a93c264ab483890e93686cd85ad30

      SHA1

      d05f20c8af24243dca6a1ed07b1be36d264bdac7

      SHA256

      784c0c01f8d5a45938c28b71981d6b402b5386cf2a1048bf4af0530ad47e3389

      SHA512

      03bc4168f7101f958f9ec008e7dee4a04c35e395da3fbdc2dcd3a41b69900e41abe349d4c1318ba9cbe94d095645bc0a5201d9648713c885e9db69765ac39382

      Download Submit

    • C:\Users\Public\Desktop\Firefox.lnk
      Filesize

      1KB

      MD5

      4d9bd8b75560f868e5810dade26fb24e

      SHA1

      eff3f7d15501e2699ed95b83a75dca73c619ea31

      SHA256

      ebfce369793740c1309274b48a6097c86a530d58427345e2021213b4a6f1e295

      SHA512

      91093232bef407ef1b7a9bdff23546cf30a098758a8729d8db05e4aa90557dde7dc87f17749df77eea3b6a7dd204a53a954b4d38af9cf94d250b5e68739cbc2c

      Download Submit

    • C:\Users\Public\Desktop\Google Chrome.lnk
      Filesize

      2KB

      MD5

      8cbd7439961e8f4b1e473aa1776a1e8d

      SHA1

      cb24bf0804a32c4444e87212ae231c2a56a42a6f

      SHA256

      c6ad617e98d12084d66a39746baceb088adf4505886e18ae5a3cfac7e21da936

      SHA512

      898253c09f47843518554e3e546732affa744f75b914752b5c144f793d0f585bdfdffdc490119b0defb62a78f574c265dee4bf23a92570ddacbc7dfe7d38de4d

      Download Submit

    • C:\Users\Public\Desktop\Microsoft Edge.lnk
      Filesize

      2KB

      MD5

      7d59ce21f0afe5a97e7941b0b6ab21d0

      SHA1

      bbf181e1d93abfbfdf753ccf260934c69917f205

      SHA256

      2a96eadb9055716d90eb74aaf3a1c2228561ed0ff8208bcd1de9d576c0754a4e

      SHA512

      a9b92e5058e875477a1b7b250546a048d7fffd19f8a3c52307b4cea9e9938e79a8e0dde0a3db0fe8b40c859175f6ab04901b58b014ef2ee2d8ae7d3be8fac6a7

      Download Submit

    • C:\Users\Public\Desktop\VLC media player.lnk
      Filesize

      1KB

      MD5

      10fe69fac88416d54568eae10f9f1556

      SHA1

      17192b977b8b91b6c429ed66da4a83e179232777

      SHA256

      764aa1058c99a0932070db2e1a9c9a06ff88ef60cd6724d19e09d2dbe8644f36

      SHA512

      4393433fd6204080b037b1225bcb07b6ad2be4f732567f6061dfaa5346116c5d5eccbd3ee0a02f39c31c32a1c5a37937b22ece4f492f8d8e0b3836cf984536ad

      Download Submit

    • memory/1272-8269-0x0000000004470000-0x0000000004471000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2192-8406-0x0000028AE53F0000-0x0000028AE5410000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2192-8404-0x0000028AE4FE0000-0x0000028AE5000000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2192-8402-0x0000028AE5020000-0x0000028AE5040000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2724-16528-0x0000020E41540000-0x0000020E41560000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2724-16530-0x0000020E41500000-0x0000020E41520000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2724-16532-0x0000020E41910000-0x0000020E41930000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3172-8286-0x00000211927D0000-0x00000211927F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3172-8288-0x0000021192B60000-0x0000021192B80000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3172-8282-0x0000021192810000-0x0000021192830000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3184-16555-0x00000180E6820000-0x00000180E6840000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3184-16550-0x00000180E6460000-0x00000180E6480000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3184-16552-0x00000180E6420000-0x00000180E6440000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3472-16461-0x000001FC663B0000-0x000001FC663D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3472-16465-0x000001FC66370000-0x000001FC66390000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3472-16467-0x000001FC66700000-0x000001FC66720000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4028-8362-0x000001F0F8E90000-0x000001F0F8EB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4028-8358-0x000001F0F8AC0000-0x000001F0F8AE0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4028-8360-0x000001F0F8A80000-0x000001F0F8AA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4148-8341-0x000001C76EBF0000-0x000001C76EC10000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4148-8343-0x000001C76EBB0000-0x000001C76EBD0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4148-8345-0x000001C76F1C0000-0x000001C76F1E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4536-16508-0x00000183B98B0000-0x00000183B98D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4536-16513-0x00000183B9C80000-0x00000183B9CA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4536-16510-0x00000183B9870000-0x00000183B9890000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5628-8387-0x0000022764CA0000-0x0000022764CC0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5628-8389-0x00000227650B0000-0x00000227650D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5628-8385-0x0000022764CE0000-0x0000022764D00000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5736-8326-0x000001E53BED0000-0x000001E53BEF0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5736-8324-0x000001E53B7C0000-0x000001E53B7E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/5736-8321-0x000001E53BB00000-0x000001E53BB20000-memory.dmp

      Filesize

      128KB

      Download

    • memory/6228-16491-0x00000234DFFE0000-0x00000234E0000000-memory.dmp

      Filesize

      128KB

      Download

    • memory/6228-16489-0x00000234DF9D0000-0x00000234DF9F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/6228-16486-0x00000234DFC20000-0x00000234DFC40000-memory.dmp

      Filesize

      128KB

      Download

    • memory/6344-16576-0x000001CBFB740000-0x000001CBFB760000-memory.dmp

      Filesize

      128KB

      Download

    • memory/6344-16580-0x000001CBFBB10000-0x000001CBFBB30000-memory.dmp

      Filesize

      128KB

      Download

    • memory/6344-16578-0x000001CBFB700000-0x000001CBFB720000-memory.dmp

      Filesize

      128KB

      Download