Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 13:05

General

  • Target

    2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe

  • Size

    1.3MB

  • MD5

    0e55ead3b8fd305d9a54f78c7b56741a

  • SHA1

    f7b084e581a8dcea450c2652f8058d93797413c3

  • SHA256

    2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff

  • SHA512

    5c3d58d1001dce6f2d23f33861e9c7fef766b7fe0a86972e9f1eeb70bfad970b02561da6b6d193cf24bc3c1aaf2a42a950fa6e5dff36386653b8aa725c9abaaa

  • SSDEEP

    24576:LU5NX2yJOiUXmEICxu2WAP0NIzkQM+KpPRQ9StIUDpl1fpxkHVZgMCS+:L7XP7P9o5QzUtl1fpxkHVZgMC3

Malware Config

Extracted

Path

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\readme.txt

Family

dearcry

Ransom Note
Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! 638428e5021d4ae247b21acf9c0bf6f6

Signatures

  • DearCry

    DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.

  • Renames multiple (7419) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 60 IoCs
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe
    "C:\Users\Admin\AppData\Local\Temp\2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:2860
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4356
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3436
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3372
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2052
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1264
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:3308
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:548
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2088
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:60
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3372
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2568
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4776
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3996
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4332
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2500
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:732
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4400
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4216
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1984
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3156
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1360
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1264
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5072
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    PID:760
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:392
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:916
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:840
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4980
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:1316
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:4764
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3880
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:5028
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1064
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:3824
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:3920
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:636
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3336
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4344
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3780
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:3768
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:840
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:2248
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:380
                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                  1⤵
                                    PID:4840
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:2892
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:2852
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:1724
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1932
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4072
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3080
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:4828
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1264
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:2248
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3500
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:2892
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3812
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3864
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:1388
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4148
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2096
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:2716
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:5088
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4172
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:4784
                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                            1⤵
                                                                              PID:2556

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png

                                                                              Filesize

                                                                              388B

                                                                              MD5

                                                                              1dc5d31ef9205f1034b64d635d59cb32

                                                                              SHA1

                                                                              c172576576c5ac5a3c2912bdfd0c8365b5365513

                                                                              SHA256

                                                                              676d1f912a22a12ad4c80bf552355a7e0995c56e6ef7527aaa9b77e513efc065

                                                                              SHA512

                                                                              bc334638acb1416787df04cbaebde99cd15d96c5b96b6f950cbdfb54177fcd2f2ecce4dc9212a9a3f2f85269ac901aef147ec6297c31c5ee6cc39ee4cdac17c1

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\dark\rhp_world_icon_2x.png

                                                                              Filesize

                                                                              552B

                                                                              MD5

                                                                              7d00bc0d46dcb90890a4fe6b76bc5c3a

                                                                              SHA1

                                                                              7159b1e1c264a6863708a971eaeca32cff864aa1

                                                                              SHA256

                                                                              2fcd2848cbcab1a3b8154138288cc659cd2c187412cb887eec6554b6165b8c33

                                                                              SHA512

                                                                              2f113cb27028aa0fa0f028b09ddcddb4a1ede6ae0823909d99763db6e5be57b1b4ae6977537ec17808cd622bc548e1ba3122e35b58de9d856400d33042234a35

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-il\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              6e8d259daabf1168ae5136a3de48ee80

                                                                              SHA1

                                                                              b015257e3ae0810ddbda53c0b12991161a863ffb

                                                                              SHA256

                                                                              13370a65ca7e31fbf3a133156c208bf99c01a54880d55a8a4500495683e3a47f

                                                                              SHA512

                                                                              cf3c564c18c6b0965a431cda1ed8fa97cbeeb839d992e48f77c073bc8054ead03b4823df381c5179d3d398877da3473b92d70ae905a2bd0c7e5fc45505340113

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              88151ac4ebd7f5ff2d381c65e68cece7

                                                                              SHA1

                                                                              f979db4063d15ef2e32db3c38890899bb87c78e5

                                                                              SHA256

                                                                              c1ea4ada9462abd4ec352dfaf670575e9caff1e55d303db96a2f2500d50d92e8

                                                                              SHA512

                                                                              326195f5176beed6cc39849b8d6e87a5136c41a04aa76f53c30bbed1ff74391e16a6114e236f39d403c7f82fda032c00a9ee1df583412dfea224047e51f4c3bb

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              60f1a26612dc049ce3e00fe917b6475d

                                                                              SHA1

                                                                              05791d089cbcd759088adbbd9483433dc9a10206

                                                                              SHA256

                                                                              8ced84488e1ea81e8cc3ec1a25f5b849de902601bef557b6ec65f9de2982bece

                                                                              SHA512

                                                                              06f080a9df9081a2bfd557165f9c21cf2bce3ee161c0896a9f9a6e0f8a3ae545b1cfaaca9ce1d46757dbe0163ddd0421bdb51558ef092dd0a6e5c2052ead4706

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png

                                                                              Filesize

                                                                              683B

                                                                              MD5

                                                                              ea321d33cfeb1d029794bd01c5b78e85

                                                                              SHA1

                                                                              4e04b2d8f7f23f44f96f4bbf134233e1feb5e28b

                                                                              SHA256

                                                                              3add439f478220ce8001abf2543810144a0d80f8116bc0ca13947c9745983c55

                                                                              SHA512

                                                                              f574d12330a668d89402265cf5a859a76325ed548e1730e02f51dfd36e3d5dccf2c8b75a76a8c931597bfc130a42364c73eef0200523d4eefbcf4fa5ccacddea

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              a660ce180dea34b4944d83569f4789bc

                                                                              SHA1

                                                                              e3ca7b90c8bd299c49585bd29bc3fb7494c0fa4e

                                                                              SHA256

                                                                              03ab6f2f396e0531f1b1299b61485408cff93f183942910a7d0d5f0c7a666bd8

                                                                              SHA512

                                                                              9de185c0e6a8cc49852ebb454a00a7a19f5382b358327d393a6952b32099036147c1eb799cc60078bf24477e9607a1b4c88288a213a8ffcafd8d60caab0f0720

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              cdc58b2bf0a1a34f96af8fdcb62dc30b

                                                                              SHA1

                                                                              69eb0d674e9830e81cecdd610792225a2a5dc265

                                                                              SHA256

                                                                              3b5888b652cd86408bdd59e86405d3f171d23132059228544fbe693cfcb2b73c

                                                                              SHA512

                                                                              d8ef3220b8984f759347a0e83eb75939c914bf865db492d28e226f113b469a97325befa008886743aeae2e0f32c74c0a1e7ce8b60eaf5949b51058a618daa502

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png

                                                                              Filesize

                                                                              445B

                                                                              MD5

                                                                              55c2b47c9aea50661a855fe91eb8ac32

                                                                              SHA1

                                                                              13ea23a51394ea2c13420ddac1294eae6f82f846

                                                                              SHA256

                                                                              ba5a59d879c1f6543b46085d02f5c90fdb22e663487d3586b6533cd887c83b72

                                                                              SHA512

                                                                              947da2e85f5c21e7847f10d727729915973c911a47de233ef1fb97f60ae41db05f4c8c0ee655e3aa264db2067763e4134b76279f1d3ea8ad43640a64176522a3

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png

                                                                              Filesize

                                                                              611B

                                                                              MD5

                                                                              808e7aedbb1da793b86c92816309035e

                                                                              SHA1

                                                                              b4a2fca53290a35ae222f2cdf80f68ec7eab51e6

                                                                              SHA256

                                                                              a90f0edb8324760029a5db9f641b05694f8717c25514b2d6abde7662c827e0cb

                                                                              SHA512

                                                                              0af4e6a83661378b618c40de02c6cb7244be544dcb02f1f14c83b6abd791fa0330b6d508c86f0ba8e345608639d8505a2f26d3a6d3ae201bb01319c10c212d4a

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              5c1dc195043bdea8525930a9882c10d7

                                                                              SHA1

                                                                              17415e551255ab016f7682d7b33451cfcb91e687

                                                                              SHA256

                                                                              019bad9e72430b758828953e3310007695c55fed1d25fdd707c76fec561f2bc5

                                                                              SHA512

                                                                              e912b84e9b4856864d302154b68adf6822189aa78859265cf8f529279e77a9d7c086452b4527ebb75d9c910ad9a6a1e95e1f45498fc168628da80739acff742e

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]

                                                                              Filesize

                                                                              162B

                                                                              MD5

                                                                              8db5f9dff9d857a8827ea6d66fea4880

                                                                              SHA1

                                                                              ef5de087109543e49ee7fe70adb49efe27e15121

                                                                              SHA256

                                                                              e8c6ae3d3f05d53d58200db3f31383861d434c6abbf66f82e925321029058a10

                                                                              SHA512

                                                                              70723910b4bf8814f848e10390378d53d9fb67e8a319edb708edc41b5c858c1d2cfc0b86a2909e33f72062df8b32e70554fa5ebe7aad7ec474ad78087560069b

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              4e6de5201d795432e75c0628dd306b26

                                                                              SHA1

                                                                              80ae62145f6bc55c2a25f68ad9d6bc9fcae496db

                                                                              SHA256

                                                                              1265f683d27701f95b545e6201577fb4eadf5dcfbc1fc8cedb8dd39635515788

                                                                              SHA512

                                                                              950227253fb845bd9a4519a209d72404760492473bda8101d846ded18aef1a2f6f6ab99b1b1b2186c0eed423c151c089316e124384f214644632e6a0f4dbece3

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js

                                                                              Filesize

                                                                              856B

                                                                              MD5

                                                                              fc4cdc00064f47d2eedf58bd02068fe1

                                                                              SHA1

                                                                              cbb7157d8c560e9b2cdffac3a2b831202d76d2e6

                                                                              SHA256

                                                                              0e8fb0e6e1dd239a2a1996059914a5ec5e753782527c1a07c62d808eb77df3e0

                                                                              SHA512

                                                                              753d312596fdd24d3ad87b7916c5d108d185b42beff7c750099aecb38c7a321ff04260c19492d18cc27cf8f8843c6b3facde0934e67a46e9ce4291c3646abbe8

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              c5596fa17e59cbf92a2ea2e1ad5c6f8b

                                                                              SHA1

                                                                              4153a71b5750685afba568403ed7522e83a9894f

                                                                              SHA256

                                                                              5812ebbc6311c0ff9919a27137b22435cbca3cb9fd56959b44ddb82f93609b99

                                                                              SHA512

                                                                              762580962300f0e0501054450772ed59cdfec76d7aa6b1944f557ccd74ec2fcd171ffd67765f2b367c526d0193eabd184f0d4ac1dadb7a0d25f00f9866f670bc

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-cn\ui-strings.js

                                                                              Filesize

                                                                              850B

                                                                              MD5

                                                                              26645133c9de7799e35cee0e47b82ee0

                                                                              SHA1

                                                                              bb6be735f6814d765bbe6b3f3ce034d1767366c5

                                                                              SHA256

                                                                              1180e5728ff28a49eec43c61f15d49541419e79397ae58479db67b533d292d36

                                                                              SHA512

                                                                              c466dc886b25fea5a0e16aec28a4e784afe797f3937c7863788d0e5fa41414346bb17546d49178a48815debcca50aec3acabadc1f508fe0a3207008bc722608e

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css

                                                                              Filesize

                                                                              802B

                                                                              MD5

                                                                              89728f1ec13231dd11d2ea20afe39d67

                                                                              SHA1

                                                                              b4350cd128350483be389b2c865633bd1ae0f78b

                                                                              SHA256

                                                                              aff85e66d5b690dc0188f4c2348ca78abdc14605286128407242a4e91a684754

                                                                              SHA512

                                                                              58203e9c3898367c78c6d10fa629c0bd2356b2ae54e225afbcee83be1d5d297977a5a9633e773ffc2b8079a6e2eb2aa0afc530c27d29f512af40d8c9ae539adb

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png

                                                                              Filesize

                                                                              179B

                                                                              MD5

                                                                              a93c09c1a326a8733b4eceb713ca7457

                                                                              SHA1

                                                                              90ba7a4c24bb0d424abda46b736170ea3b43e541

                                                                              SHA256

                                                                              d03f54aaa9216f4e32053928ce87a317341232f107140c84f73b2b6490b5a81a

                                                                              SHA512

                                                                              432c3400257d00391baa255d32fd03e0b8c97231d684ef35534868a38bcbf9cb70b433eacfe154c25fd3376e69592a7000a823535700f353975572c5101a56af

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

                                                                              Filesize

                                                                              703B

                                                                              MD5

                                                                              cc62ce00dfbe76fd8affad9c89fced8c

                                                                              SHA1

                                                                              75d64cc57ff45a50c066f882bfd8e3845f8fa323

                                                                              SHA256

                                                                              e324ff224bfa2baf51d4ab75f686195a76b8c984676c450ed660eb9ca2b36f4e

                                                                              SHA512

                                                                              028056e42f0eb02646752b351bb04a6b9f87ff27a2e1060b4fe4d4867118fe90f42f555ea8c645361963405583005ec4f3802c7c57729fc8616df1af09cc94dd

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js

                                                                              Filesize

                                                                              823B

                                                                              MD5

                                                                              fa904cdf440c6743078637992d58489f

                                                                              SHA1

                                                                              6969f407be2a1b52c5a41be256433026cabf9917

                                                                              SHA256

                                                                              152f6d0325802be61521bff49a8dd07063feaffeb2447d3ae6f47adf214cbffb

                                                                              SHA512

                                                                              c6237e56225d36d26ed594406a5bc08987bc34fac8d425dac8f909512ff19e6a27e1566651c591a38c0a5476e74dca09beb53ec15d4f08b6de2843fa064cbd3f

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              573dd292166f86741bb965ee068c3793

                                                                              SHA1

                                                                              169fcf0880c7a2c5993f5bf28ff64cd9ed441dd9

                                                                              SHA256

                                                                              ab2b7de642b66db6e6b610dab8fb3c94c972465e07b7f681127c40a6629d8c2e

                                                                              SHA512

                                                                              0217d582d827a7b6faa950bc726d41c4c7644ba11b19689b9e5eb60cf54df4afaefcf4eac3649e8315dc1134988dc71abcb94bd9a640829bf9d68a6ffa17241b

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

                                                                              Filesize

                                                                              924B

                                                                              MD5

                                                                              bf70043c03230a91bb5b402e7ee67e63

                                                                              SHA1

                                                                              2ec8302c3ebe1e34abb5e0c813abceaadfc5073c

                                                                              SHA256

                                                                              a8b45a4c0a3adae007e8ef6b3a0e9966d2ad0c552320210a778109e2799f6c75

                                                                              SHA512

                                                                              ecdf54cc56de9c49dec1e9e65aefa736201904e609474b13d089f188bf35ae46b62d1ba492f4c25ad3fd7ff584a1532be18c0115598c2deaa834b22e6e52a601

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js

                                                                              Filesize

                                                                              931B

                                                                              MD5

                                                                              7adbce4bec815b574ab3fc6d85eb1937

                                                                              SHA1

                                                                              7d14e52fc6aa5796996988e9feab97c31eab1e0b

                                                                              SHA256

                                                                              efec14a7f219aff9e96c136933c0316abbabfa082b5755a86b2745c0a8423a79

                                                                              SHA512

                                                                              4218fc7991ef7ab93b1fab696432fc0130f07c534b2da244ce3370e6092213db657505af8380e7a07576b16b19d7c1b58f6a5498122d73061a362162b31f5b18

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fi-fi\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              478f0065e127108d705114b29fb9170a

                                                                              SHA1

                                                                              3d954983b0594275bdbe444336baad9517129b79

                                                                              SHA256

                                                                              1beae6b25a652882189f27e3b52232bc3451a54eeedf3e5cb0eb827fe15032f9

                                                                              SHA512

                                                                              4affd4e7c23c555d99a5a1a4ff929228af723961c6cc1c320358998fbba2528e2d84d5c64a5c28fd6420ba3132fad056f2388538086d061510d80e244f7b3990

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ui-strings.js

                                                                              Filesize

                                                                              851B

                                                                              MD5

                                                                              661fea8b99a08e2422d8b5b9bcfd9921

                                                                              SHA1

                                                                              54a78f38a3599aed6d27c6fc711d7af7a205c524

                                                                              SHA256

                                                                              60624904ad10defbfcafa3acd5dac4c7c5040edde23bff489b6b32ea5a1403ad

                                                                              SHA512

                                                                              69b58c6c99f494ca1b6f2788cd17b63cc9f583b0abca870f666aedb9c504f660b03df699b69828c8ecc43a747297042eeca7e197de96dd43defb7871e2289b9c

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

                                                                              Filesize

                                                                              855B

                                                                              MD5

                                                                              3dd77972f6558af4969a57eb4f19f2d0

                                                                              SHA1

                                                                              d56f6ebeaf408c667bb9491845a33ddc19d18947

                                                                              SHA256

                                                                              cde2dda4b1709d6591356e21717833ecf9802dc119d719e9dbbc97b090158644

                                                                              SHA512

                                                                              68f15867e6b29cce5415ce31203cc3f1790869f85d1b1ba8b2912e9b1b570f61485e5e9aac96d9bcc069e81d298b56d8941cd94a1df72d07c7508c7fdcc7ef1b

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hr-hr\ui-strings.js

                                                                              Filesize

                                                                              849B

                                                                              MD5

                                                                              95e6ecbe44dc4ab34323c697c6568b56

                                                                              SHA1

                                                                              0ca5debc2a7b53245ae6b7d6594ba93b3152bdee

                                                                              SHA256

                                                                              d3bdbdce059d04ec6e336179e6262bc694def0fcc5fe4b006953dbf178dbb30c

                                                                              SHA512

                                                                              af6262bf0a2b16fbd1dff7051eb0373336781c105b63631080ed2b6d38f54adbdbd16d794917fb9ad08c9ee238e0d4df732b7ef3e4c6d521a6b347eb8c2e9804

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ru-ru\ui-strings.js

                                                                              Filesize

                                                                              852B

                                                                              MD5

                                                                              4fcc8af63d8fea1581c1e96e9436e913

                                                                              SHA1

                                                                              5c09be5c84dba1172a2503a3406223baed06f8bc

                                                                              SHA256

                                                                              bbce03b612d22d42e40207a0ac4b6492ab0ad8c2cf4690377929f4cad738954d

                                                                              SHA512

                                                                              4bb1df7206f7fee79df361d678cd250399efff9d13d3435448170efd515abb425fcbf3b6ad9d0c6da1b4a7860d33dfd15daaa199e96dcdd701afb3b80234f2d6

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              21a5d65fbcf76ed1b8e9489d3bb051f7

                                                                              SHA1

                                                                              dcfde89bb81642e0b1bcb2b4d8c0fe574e912950

                                                                              SHA256

                                                                              f054ff5e3f41e79c647bd03dc9ad1bad42f8292c7e7b839088faeb8abc182ff4

                                                                              SHA512

                                                                              566bc1f2c5f4b2b9888c8e414552c25609d2562e10a8abddf6f036a6cbe2bc7644cbe850311224c25db96380c0e11fb07800f965305f41e068968bee530c320a

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              0e038344281f0aa0a74103dd77048888

                                                                              SHA1

                                                                              163a5a2d3888eb23ecc17b53865742f3eb7aa3c1

                                                                              SHA256

                                                                              f3a76de64a79cd7afa5438bb0a4f4330a97497246fe00f7b29fb690e2ffe32cd

                                                                              SHA512

                                                                              5988b04142669c005728510cc0a0c7507a9b8561b9d3178e3ef06b77a725e5e3ab7c13faf2998522c601285e823d3f72edbe7b93ba6b14a9c5afefbacb974560

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              c4b091c93a4910ecfc619efdf3c56111

                                                                              SHA1

                                                                              4147f571dfd1d77b6a6943c57784820bd0cba24c

                                                                              SHA256

                                                                              d30e4139d68728b1c0b7c0fdccf649fc98c269f0d57c08e1d2033c13f162c29a

                                                                              SHA512

                                                                              b276ec16ba3a0737c8958a7373c3b5b53d384432535e65ee5651dce90da0eaf7dad1a02479243efb0b5ea78234c0f423ebc10c82b6e28db557106b8a21db1964

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png

                                                                              Filesize

                                                                              289B

                                                                              MD5

                                                                              65afdbfd57a964a5525ef68ca68cb5f4

                                                                              SHA1

                                                                              986fd9886e54eaa35b90561c94b00f85eb758711

                                                                              SHA256

                                                                              322fa7539ee1552758dbb051fe1199a7b4b247ec8335fb35cabf043d8947466d

                                                                              SHA512

                                                                              88b2d9c205d6fa4fb7823fa118fb95c651977cbaf1b54445ced380d34541e5367a218de4335a341b3994839386b487fcc33718b749ab2e05678ae87e0da1dbd7

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              2870d12e27e8a50bf66493145c06939a

                                                                              SHA1

                                                                              f4319fc28ae1f99e359b5cfbd4c8c69af67dc03e

                                                                              SHA256

                                                                              dd6fda1bd17d115065254a8af134a7906d8e15e2725b01223582c3add3240272

                                                                              SHA512

                                                                              39b2281464998cd9f3d87659cdf7f3f2690a82bb8093ac64d5141d837dd4f951514cf0fcbfc02a0102f3d8ce780805886a361c649d6df2347db60b383442e5d0

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\dark\adc_logo.png

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              d1dfee6d7b14e63f64c349b2cae8ad27

                                                                              SHA1

                                                                              fd382215ff99c0993d8924f18ff7912b4835f4ad

                                                                              SHA256

                                                                              b63bba00ed3b7a86b6ed36ab7d6eede57656454e0a583b875d34ee19466714e4

                                                                              SHA512

                                                                              220e189bc67b20bef3f92da6dd063b12fd53436c6fa9e728553669e4d42dbe595c52801e68a929797c48dc56fa4ff47919aa3d065363ce881e207abc83f7de77

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              598b166da1d843121d50f9593073a15e

                                                                              SHA1

                                                                              e41c87d8fa9aa263dfe783bdd692556fb8e24f43

                                                                              SHA256

                                                                              c46d21ff4c32097f172b4e99b5794374ed4a1cb025040d157f611f43929e98d5

                                                                              SHA512

                                                                              107ceb56129c1baade5930cea77fdc9c53264ff06b92936a5823c483235ffce8ab4ca3efef5001c5cc16eb3351b663877e1e4184749ba33d785b4927fe2f2db1

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              48a2c150eaa7d9fe84e7e31163e67495

                                                                              SHA1

                                                                              cfd5375b61328af47b784d2e1229c95c9355ce06

                                                                              SHA256

                                                                              ff1d90818c6ec24ad8dc4334bed7e72b3ceb9460cdfe3b25ec24d2b31b4c9288

                                                                              SHA512

                                                                              e6abeeb5ed043270c9148b58fa359d8536e0a9606aaed86446f3cc3ef14a855b711a86869d02fe27f50ef79b91895c77bc970c6ccf962caeb8311984c4778410

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png

                                                                              Filesize

                                                                              385B

                                                                              MD5

                                                                              34300ee4cd847a5329747c2294699c1f

                                                                              SHA1

                                                                              5e1086c8ebeaf9205517c82d8ae1711931ec48e1

                                                                              SHA256

                                                                              122650bd6eea6dc3c3cde5c472c78fe200967b33c6e3f3d2f394d8fb66c3acfe

                                                                              SHA512

                                                                              ecea239cb49cc1b9018e9d5bc34fa0d501cd9dc6bd7a8c01b8a2bfe9cb8d9baf805081d3705f0f986903a93a35a3ddcb852463bc2698606b556999cd0608ad6e

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png

                                                                              Filesize

                                                                              1003B

                                                                              MD5

                                                                              d82b1439dcd0ea62ce3edcf6d36eac1e

                                                                              SHA1

                                                                              f5216b9a0c6b294584b24a5fd50b43e79d46310e

                                                                              SHA256

                                                                              44f25bfcbff16b8e7c81ac93d6dcbc312035c81ba6d62e61d4177e23ef62dbff

                                                                              SHA512

                                                                              bc789786f1261ce50116190f56ce7da3063fb944af6e5da17fd0a61e51d3d25b11fc09a83d2fd1805e16f33c2c469bd28d05366b8fff7faa85d3dd498e5e3d1a

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              7d1b0ec51595563c9214ddfdec36f303

                                                                              SHA1

                                                                              bbb988973a8281943b5bfacb8ab03d97c0f0f398

                                                                              SHA256

                                                                              c915635ac032617e1acf87810abd8e8d9825c7e40a74245bc9efcf31d6da9da9

                                                                              SHA512

                                                                              709deed649d6062cf8c1ada7207b9c871d51a69a4bc7dc3c1408bd6a38d211ff53ce19a091cc4bb68a62eb00aa512afd07a33d314393812716391f04faea93d3

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

                                                                              Filesize

                                                                              840B

                                                                              MD5

                                                                              ac24e253ff384d8523af43f5a93688f7

                                                                              SHA1

                                                                              beb4ffa972185300803e9a1f6a16ec062cec1015

                                                                              SHA256

                                                                              f49327d72a4888fee8721962d13a94571e349ba666a0e1354c4f49331e858cff

                                                                              SHA512

                                                                              9c559a1bdaae9172fbe9e6a9b907390041fd16d0382a202423e0d9d19bb0f2c06a7228d6bc17df943d4e927c0420f302982e0463755bfd5c0d6e4ecb65504a61

                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              cb05ff26ffcb30838de16f659f8d93c9

                                                                              SHA1

                                                                              f9e977e1f60be49be8a17cf75d31f4a7620827ab

                                                                              SHA256

                                                                              ef97178fce43f78773e1c57cebaadd55904a1e5d810f8f75219b23e92c00687d

                                                                              SHA512

                                                                              26fc3838e5ef5b638d974be02b6d8f76f7f4778b1b612ea9031c5a5b1cf4a421e48c7a667a1f8db55270c1c86c4e1ec469c8078dd0edaeec2df02fddff27a999

                                                                            • C:\Program Files\7-Zip\7zFM.exe

                                                                              Filesize

                                                                              930KB

                                                                              MD5

                                                                              45d3d62890fa98b808e4379a0a399baf

                                                                              SHA1

                                                                              5b5459717f961d20f002e3c5d3268906a71e7f73

                                                                              SHA256

                                                                              de96183d3d1e3c5a790c8fb31df0c6879d3bf1ca64b10be23452b58ee8e2b69e

                                                                              SHA512

                                                                              748cdde074183fe2780a236a9cf3e8141c5a79f492cad5656e44f706a74a58575015181d32d39bc177a4b68a045f7f0b836ba9d66e73fefe9877efb5744d6f2f

                                                                            • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

                                                                              Filesize

                                                                              190B

                                                                              MD5

                                                                              f0be99f92d8b8ad3d79c9aa580fc2f08

                                                                              SHA1

                                                                              a9ab5160208575c2c19277491406d5c95690a5f0

                                                                              SHA256

                                                                              e290cb91a6aaf54bb397c8f72d0bf5e8a70935ca00abde862e3d13fdf75fdbb0

                                                                              SHA512

                                                                              c9c2002d0f14f1d92924f80105c4b092bcb8de5bcb838179f2129b125fbcdf83f78ee80f44b0e26bab451c6fa5d6a29547a4933a92858e310dfbbdcee32f8cae

                                                                            • C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              950ac8e007b49ed7acf1646758393817

                                                                              SHA1

                                                                              3a795f27aac36ba92f33165a6550cc7f201b3254

                                                                              SHA256

                                                                              4ab0585ac1cc953813901847e774a0a6e2542bedd0e5964cacf31e421455223e

                                                                              SHA512

                                                                              6bf7c6bdc1f802cdc8cea1d5a22de2e2cdf307411504499351fa5e9bdb7d1826c1968c4cc8bbb2fc17ea69850d69e0e2d77b76d29ad991813b598fc18ea0982e

                                                                            • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml

                                                                              Filesize

                                                                              744B

                                                                              MD5

                                                                              c181d62d13f055127f354bb60cdfa03b

                                                                              SHA1

                                                                              6cbfcbcdb417807d7ce1ffeeaa2eaaf9b548885a

                                                                              SHA256

                                                                              d8dc1b9aa2aefd658fae2d9b6bf36318bdda72fcecba0538a1f121592b44e3b6

                                                                              SHA512

                                                                              62dd4c375f5e3299843c78dc86026da551a8a66c2c4cfac4003b8e4774ddd1cc36c130611c15182b61a472169305b75c845f17ec899e53250461867cc82abd36

                                                                            • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\readme.txt

                                                                              Filesize

                                                                              223B

                                                                              MD5

                                                                              dbac9649c4bd702f55fbd1afafe87c44

                                                                              SHA1

                                                                              0d914f4a809cfe400ca111ebfbd0ad552d500785

                                                                              SHA256

                                                                              b9dfa3b30224bd5eef298531c945d5f2f6bb978b7ef42e5ef09715a535172127

                                                                              SHA512

                                                                              86d7786b400303b1fb722689aba7e8ef6a01ad7e2776194c5d545a7d7357dd91e7079296790587210683db7f4385f98f281272fd3d1ad6770dabf401709a6415

                                                                            • C:\ProgramData\Microsoft\Windows\Caches\{2A1372A8-EA6B-4184-A711-26CB9CE6046D}.2.ver0x0000000000000001.db

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              8b836d8d3ea988668ddae3311f514a57

                                                                              SHA1

                                                                              af3199496b831b74bde630f871615ce5848f9857

                                                                              SHA256

                                                                              ac944397bb7351bf439ea8b7e6cf5863fed078383f3da0b7c92b53408fe680d5

                                                                              SHA512

                                                                              f205183db25237a58c6a33b9c83af86df3210fc7cc411d4638af9c856fb39a2795c99d612601bdf183101402ed6455b7949a9deabfb2b2262afe47dff0c17cc2

                                                                            • C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84.xml

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              29eb0301f92bda0d67f79582acadf847

                                                                              SHA1

                                                                              2c2ac90238793f699322833c2f8bd043cc29ddec

                                                                              SHA256

                                                                              221ce3a8c269f4dff433a9a8a9807f65d8fa7b302e640b245f7293a0998363d6

                                                                              SHA512

                                                                              61f47426e5dff09a432a7848f3d07cfb5f85cab6b327fb416c31223e6a5ecaaf3a3f065a6c4bf0a352fb4fd3c7199ae481c929c43da3d596000f87d7f6bd52c1

                                                                            • C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bb26a0e5-d235-0ee6-0c36-6d5e185fa5b1.xml

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              31434364acba2fa351fc9715db743df4

                                                                              SHA1

                                                                              1c2e77b236cfdd14960e90c9a48e59532d1a255b

                                                                              SHA256

                                                                              a94fc52f4840aa6390d47765d3fce16ab6d1c1978441156ef607a4b6f63fc317

                                                                              SHA512

                                                                              b069a65226c5aea8d50da2a179a351051a6680cf42a117d5d5b98e97bdcdd12e412f698b89039bd3464550e5794d3b95d97c6ee6931dc72e1bb060daa08e40b4

                                                                            • C:\USERS\ADMIN\DESKTOP\CLOSEFORMAT.SQL.CRYPT

                                                                              Filesize

                                                                              483KB

                                                                              MD5

                                                                              7a09461cb5dddc094174483a596f7d8a

                                                                              SHA1

                                                                              02bd5ef4863808ef6052370dc71c6708916694aa

                                                                              SHA256

                                                                              bd06b834bd26e94e1997426f2643ef7d143f209dc8b23ecee50a5ac864de0e6c

                                                                              SHA512

                                                                              c6626dcd171e4ba546f2f1d36bbd07438a02090a84f684e8bb191d8fec218c22db1df7fafa5a028d3a1a8370ea475c143263ad0be83f426fa4bc538d62161dbb

                                                                            • C:\USERS\ADMIN\DESKTOP\CONFIRMRESIZE.TIF.CRYPT

                                                                              Filesize

                                                                              300KB

                                                                              MD5

                                                                              60e91cdbca602e6b95fab7f54d381b3d

                                                                              SHA1

                                                                              5d1a0d3e515755714d811da857a0dabbace18471

                                                                              SHA256

                                                                              82e1d5776719932f7148a86d505b4512b4019387efb3b0037bdcc113611858eb

                                                                              SHA512

                                                                              458e6978df56c3ee55463ca8bbd6d2bbbc5336b4a739edebd12907045bccd9c44e248276cd109657ddf9f1d075cac1546798792ad53e06357e7a1637a771be27

                                                                            • C:\USERS\ADMIN\DESKTOP\CONVERTDISMOUNT.INI.CRYPT

                                                                              Filesize

                                                                              250KB

                                                                              MD5

                                                                              d0f333d8c73afd1d97e86eed41889af5

                                                                              SHA1

                                                                              8b678b89f44f0f4cce681ecde7d5548ce6d98efd

                                                                              SHA256

                                                                              3f9a3bf5b8a6608767d99b94b504ef69775d9b8918a2b7862dd66e45c57c9ab3

                                                                              SHA512

                                                                              bede9ac1b8ecde2291cf8d77ba4737a43044739cf8692b09466ea923cbe1139b56df7e533444382454fbbc56997930200dafa805db9379bc2bc2309a4cb5818c

                                                                            • C:\USERS\ADMIN\DESKTOP\DESKTOP.INI.CRYPT

                                                                              Filesize

                                                                              568B

                                                                              MD5

                                                                              3ff3e6106baed083abcd33848bb65d88

                                                                              SHA1

                                                                              6c58a439a782c3785536b99e7e7962dae62efeb8

                                                                              SHA256

                                                                              cc158ea36be7748d90349d12a1f988d48418f0c974c30aed9069e7c79efba8b9

                                                                              SHA512

                                                                              2bd4b88b8ff354a8ffdc34ba8155a401a005bcad8ad05e6c2bcb266c03d3941dbd6be65af291782f9fd9fa03593437b38065fb37d088d0df7821ce961ba7866b

                                                                            • C:\USERS\ADMIN\DESKTOP\EDITREMOVE.PHP.CRYPT

                                                                              Filesize

                                                                              366KB

                                                                              MD5

                                                                              2dfd37a7126f6a3b68aae81b171f2a21

                                                                              SHA1

                                                                              b2c2521631504759652979df4c1620c3f2140e9c

                                                                              SHA256

                                                                              4928849d4d729c3b30011c14624e401f37333eef634b320f6281f7c8ca37733e

                                                                              SHA512

                                                                              588f9feb8c960a2b50f84e1f754e426caf3e8dc92b4216ef778127e0e27ac3878c83d8848a104353645b50f5fd073303454e549ed2cce306562b2481321fa859

                                                                            • C:\USERS\ADMIN\DESKTOP\PINGOPEN.HTM.CRYPT

                                                                              Filesize

                                                                              583KB

                                                                              MD5

                                                                              6fadf606bbb4eeb47244e4ff1552ab28

                                                                              SHA1

                                                                              596e563ff5dfaaf554debbb8e2a9bea94efff984

                                                                              SHA256

                                                                              a8bc94662db51954f1b0bceb17be1ba987605dc9698eb87c071dc16386bd201c

                                                                              SHA512

                                                                              aeac640948d8fa7625a626e2996a91e1dcafefd6cba1a1b701db666aef3a4c550e34a49643d416bcb58f1849e08ed3b9ca24b4fddc7f218089612b0aa118acb5

                                                                            • C:\USERS\ADMIN\DESKTOP\RECEIVEJOIN.TIF.CRYPT

                                                                              Filesize

                                                                              533KB

                                                                              MD5

                                                                              17161f5b7284138f0512c5445de1edcc

                                                                              SHA1

                                                                              5fd66873768aa77ffdb503cbdf605458dcd7281c

                                                                              SHA256

                                                                              29ad7c94eb240576d4618604a0c8196f794fe229d7624293f290431641adf65e

                                                                              SHA512

                                                                              99421d6e681c8911b586da8dee2bd3ed522151aee9208bb83dafb7719eb3c2521775652a033d436e4363baa4dc83546c78e8104d7854276517921ce7e6bc784c

                                                                            • C:\USERS\ADMIN\DESKTOP\RESTARTWATCH.BMP.CRYPT

                                                                              Filesize

                                                                              516KB

                                                                              MD5

                                                                              6ef4c9418096aec1550eaade0d27e7aa

                                                                              SHA1

                                                                              70f426b3ca791cb1a0a36f5d3f7407160350ba70

                                                                              SHA256

                                                                              ada455a2160fbe9f6451559f22fdb7c33e108d462ea671fe090de88ba7f9d97d

                                                                              SHA512

                                                                              7437dddb0e325939c9c234c4012b9721f8397be19be7bbe1bc0eb58c973f46193a31d34a3323e0117158783ab54d53333a83d2c09a2de89861348c6b2727dab2

                                                                            • C:\USERS\ADMIN\DESKTOP\SEARCHCOMPRESS.BAT.CRYPT

                                                                              Filesize

                                                                              416KB

                                                                              MD5

                                                                              a670958784829007e7945f0b09a948ec

                                                                              SHA1

                                                                              a4c50f35e6ca813d8f1d37e40b40fbeb1a409c3e

                                                                              SHA256

                                                                              3d3295331328d6f2bec72d264547a798f2e042ec65ca86da9efde5ffe3aaf944

                                                                              SHA512

                                                                              215ec48b7755cc7836cd5a02284b1ca9f2d648b6d748c5c875064725e735363b4137d9e21d81b7de08e2de09d2aaacd6328a227c96362a48779ea52de341d5e6

                                                                            • C:\USERS\ADMIN\DESKTOP\SPLITNEW.BMP.CRYPT

                                                                              Filesize

                                                                              450KB

                                                                              MD5

                                                                              bad97e751a9590e59214735b2f923d3f

                                                                              SHA1

                                                                              38f316930b5e509f6907c833a48e6c022e343fc4

                                                                              SHA256

                                                                              aeac50659e4df5d08b411b6dc8b4147f32c290dc1a1f987771284ed87348b5da

                                                                              SHA512

                                                                              1f5806709ed4185bb726cbc7de28bddc688f681ee924ced94119198e6aa2e998340fd28cc6e047b02beb7862981c387e42ebba45e12d41d90a86e2a644523c71

                                                                            • C:\USERS\PUBLIC\DESKTOP\DESKTOP.INI.CRYPT

                                                                              Filesize

                                                                              456B

                                                                              MD5

                                                                              e00ca8a0244bb21dfefdf6208e0dea36

                                                                              SHA1

                                                                              a801ba38e784349a3c226eb01248bf961977e639

                                                                              SHA256

                                                                              6f75fa57bc6e797e76907ee271ec4ba8e61147a4002af138318f8c2651f2af3b

                                                                              SHA512

                                                                              7ffac7fc1809e4b64aa482f73ad2c596da5459fa6964c2e4bad1841b898ee008ada26c17e8162a4ee0cf815b9032fa86c686a36e44bd7ca228ef825119556db4

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin

                                                                              Filesize

                                                                              413KB

                                                                              MD5

                                                                              2350b47261040b1ee32f7df427ab30fc

                                                                              SHA1

                                                                              e656cced405e01b6a60b7444b2c9e1b31ed7c63a

                                                                              SHA256

                                                                              612881f476b4820221970c20f44ee5d9cd9c64a2cd3c9ec82e6757209c0184db

                                                                              SHA512

                                                                              a9e5838e63c2f786d57fd3e808ed54c6af0f7fc60dcc9cc1d606309d976c1b8954ef6271838db3e20325a6d66889362e3f28825a6fdba5075b860efc43d1d941

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini

                                                                              Filesize

                                                                              174B

                                                                              MD5

                                                                              ace3165e852adb8aedbeda2aa3be570b

                                                                              SHA1

                                                                              4577ff7e92850e2723008f6c269129bd06d017ea

                                                                              SHA256

                                                                              237f73d46d3501de63eae1f85fdf37e65ddced70f013b7f178d1ee52b08f051f

                                                                              SHA512

                                                                              cf77563b9295b191ce2f309e03618d1ab4d317f65b87dbecc4904ee2d058db06d23c20c199571b0fafb67ae5ec5166b76af0b7d8bfe3996b0dde9751e28f8c03

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini

                                                                              Filesize

                                                                              174B

                                                                              MD5

                                                                              e0fd7e6b4853592ac9ac73df9d83783f

                                                                              SHA1

                                                                              2834e77dfa1269ddad948b87d88887e84179594a

                                                                              SHA256

                                                                              feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

                                                                              SHA512

                                                                              289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

                                                                              Filesize

                                                                              16KB

                                                                              MD5

                                                                              4534f12102d235344cf8dda748f0cabf

                                                                              SHA1

                                                                              7db67baceeecb3a420bf37a7beca4a45185f8f3c

                                                                              SHA256

                                                                              1bd4db450abc8914c2fac721cace2704ff4c16028e6d07293154dad289835694

                                                                              SHA512

                                                                              7b4dacdbc6a2fccdd3818eb41b7fa23eeec51f333af0e842d9185c7ae45eba1623369b1caa27b824cba10c4cd6a2cdbf7f127ab2c6f7656eedce5fe25a0b84a2

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.CRYPT

                                                                              Filesize

                                                                              414KB

                                                                              MD5

                                                                              e55418698a10527e8760b0bb1bd5937e

                                                                              SHA1

                                                                              282544c700a62440236cb678bf3c68c631a64da0

                                                                              SHA256

                                                                              0bbae84ab12bbc503943c28a5464fa908062ea9f82cd9010a2bc721fd7a0f60c

                                                                              SHA512

                                                                              78d394d0724835fedfcc7f0fce946e6d1645e6141aa4392ed69b06f1394167fefbd7e9e01acb3ecd382c58ba4c43163631ec5c8fc32c574054e965dfec4396ba

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db

                                                                              Filesize

                                                                              1024KB

                                                                              MD5

                                                                              6fd0dc8eef89238de623e3e2f5d6487b

                                                                              SHA1

                                                                              3ec98dd8f055bf78e8c72718c051d310bfb9f904

                                                                              SHA256

                                                                              ca0d34bfbe594d186c81118c16da35eea071d8a97192b030100a163b7e735211

                                                                              SHA512

                                                                              5d821ecbda69de6ed61a7454283228ea10fcb1ef3e1c92ae19f5356520fbc793bdb0b4053c13c2625e78d2fc277c31d949e155c8d92fb7f861e214f1b48bcac7

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db

                                                                              Filesize

                                                                              1024KB

                                                                              MD5

                                                                              b093fe1566d0aaa497c79771928e7cd1

                                                                              SHA1

                                                                              acdcb70da714fc64e0a13c98d64a81fd0d933ddb

                                                                              SHA256

                                                                              f0d5b17d51c6afee790b071504a2bb5488a2dba0c211290241dead29dd07f17a

                                                                              SHA512

                                                                              eaff2b13bb0a4e5e29525a164ca6d1b4ad3aeb93a039f02c48331f95e7e1975d11e929757c9b3802da1eef0f0969eb14f57b1183b801fbb1c722837218588668

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

                                                                              Filesize

                                                                              1024KB

                                                                              MD5

                                                                              f5fef41e3d9b7053177844b3f94d8b61

                                                                              SHA1

                                                                              c0c6384f2e0b56c6ac0b999d8584a2bc9509d20e

                                                                              SHA256

                                                                              68431ab4b4a76a1a635df107e402a68d272c88729c157e5de0fbdf84523b879e

                                                                              SHA512

                                                                              7039fbe40f264b4a79df4219fbee8952ad0d05a2501cf9ca5cfd28adc86558dc6df1a2568e486d06b6f50566f1ce74b7b9d0796891b5d1dbabcf077fa7dbd885

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db

                                                                              Filesize

                                                                              1024KB

                                                                              MD5

                                                                              084dabf9d59c01f6ac7f5a59c33d76bb

                                                                              SHA1

                                                                              207bbc6e8ee0f8210937bf0d3229fc000137a2d7

                                                                              SHA256

                                                                              8304b2fb1627ebb080726ed73c39387204637dc15787dae29f7311437f1ceca9

                                                                              SHA512

                                                                              2d219a3aac5b6883e2f1cea72089d4357748ab7131c3e0778b6180f20a7a95c178c8f8c81b1ccc638cae9ba166ca1c7b5d2e8dd23b68d8d5f4c27d70122047e4

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

                                                                              Filesize

                                                                              24B

                                                                              MD5

                                                                              c7c6abfa9cb508f7fc178d4045313a94

                                                                              SHA1

                                                                              4f130f23896bd6d0e95f2a42b2cb83d17ac8f1a2

                                                                              SHA256

                                                                              1bda9f0aed80857d43c9329457f28b1ca29f736a0c539901e1ba16a909eb07b4

                                                                              SHA512

                                                                              9f1c1e438b8cceda02663a61a64c1c5fc6fb6238aa92d30e6d8d1a7b0cb29a8a6f26b63b9964ad876617f71ee7dc3c05205158c4ed4be327149652b1c6900825

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              e342f339c251a79743ed175f3cb21856

                                                                              SHA1

                                                                              f6a07d6b153a80787f4c554012ae7cf9226bdb29

                                                                              SHA256

                                                                              ce54b9c530ea7c3baebbc23880879425c0337f59c7c2e9964659c52013b8c629

                                                                              SHA512

                                                                              1ff48a5734ff18fe64ea2e3f0496694f5c08cd13b9291e60f4edf8ef1dfca3513f6d8cec9ebe3f2c71831f3aab9881ab4c05761dc5b353951899fca6f41260ad

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              0af62facd0d640cb85dfe3f7f714c0f3

                                                                              SHA1

                                                                              a582791f41c8c9d58b3ecac044707d2933e98775

                                                                              SHA256

                                                                              4e5ae6255576f1c39b850a4c767340a1095fc22af8f5bb8264f3ee0d882a26e8

                                                                              SHA512

                                                                              8227e6d3ce41395782949b2ee43e765a27363f0fd258053ee6e047154e7b8d4eb6034be3d4d451760acab6d39e70b2bb1b281a9aea087963990b5b3f4b7ff423

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db

                                                                              Filesize

                                                                              1024KB

                                                                              MD5

                                                                              42167b3b32b4aac54db9645d7952c9af

                                                                              SHA1

                                                                              65e91f11537cf5b632fce5b8800fc5f7b09705fc

                                                                              SHA256

                                                                              045fd5555026ec4a40dd1b19ed8c4833058a1931f56e62a0e54ceae43f1265db

                                                                              SHA512

                                                                              321226750eb500cda0422d690e78eebebc563c868298ca2780f9cbc1ef506fe12a99e336ba3a7d26b547badf70c77ad61343a635aab6c8de2a6f0f66c01a8536

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db

                                                                              Filesize

                                                                              1024KB

                                                                              MD5

                                                                              350ef4d9f43c52d0d64f9658eda2b42f

                                                                              SHA1

                                                                              0e4ffbf70e059a0af5e31d05c5bd813e217c9af3

                                                                              SHA256

                                                                              095a2ef23bb8b2031345271f705fbb734111812e73271f32b0d5c3e9fe658daa

                                                                              SHA512

                                                                              8413ee9a8ee6e4c31e9f2a9c5677a09706919f12191f7f3be3f3756717819503a27f120fa351b9b8ecb076c9725047e2cc7455c71b6bc279808eb982da288ed7

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db

                                                                              Filesize

                                                                              24B

                                                                              MD5

                                                                              ae6fbded57f9f7d048b95468ddee47ca

                                                                              SHA1

                                                                              c4473ea845be2fb5d28a61efd72f19d74d5fc82e

                                                                              SHA256

                                                                              d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

                                                                              SHA512

                                                                              f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              357b91ae77d6d665c91a5ae64d3dc886

                                                                              SHA1

                                                                              a40c20dc65c6e03ae05bab72a8b1c4ea44f3ada9

                                                                              SHA256

                                                                              c4093a55217a06050923fce5dd5b3611f5cf76f9d3a03f163a48f9ff2c749c12

                                                                              SHA512

                                                                              291a015eb5a078aecf2b5293fa25d38422d0746b7f02621694200317c2977655001bd57ddc1df229a0718190f19688c53d543368d32ef198f3960fd84941a35f

                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              fdcdac74b430396cdd5d8766adb8720c

                                                                              SHA1

                                                                              3215139cb878afe3e0feb3ab272b2a4253372dca

                                                                              SHA256

                                                                              d53a8168bb261f2759638cfdea8db9fb970f110cf21d19409b816630a2343d42

                                                                              SHA512

                                                                              1f774dc762eadf7db64e954ae71ba2a1f35b3888380f3e04511dfa59c32f8d45fae0f9c8ba15a32e513530db47e04015ad25092bf973db419fa0726e8f8ca61f

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\202914\imprbeacons.dat

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              8a64f6875f2ebe77e8c204bd25010d5c

                                                                              SHA1

                                                                              da2e2a84756eb74b1b987476773b304ed06e2dcb

                                                                              SHA256

                                                                              914dfdf6304cc4a5f0b6b05b2298addebc75822b706a0f87fef227e116b6aac3

                                                                              SHA512

                                                                              86c31ff65b0b13f7fcfe50561f20014cc87ce2d02f7fff96bc889e6878b67ef4af7893e07d53f4e5ab637a51567155b6be01c4670a4855615fab35336653dcb4

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\R0724TAX\microsoft.windows[1].xml

                                                                              Filesize

                                                                              97B

                                                                              MD5

                                                                              18ff4d7aba5f22f379a6f7f39a91b10c

                                                                              SHA1

                                                                              61f406067ed85c8190d6e4139cd65c331a851126

                                                                              SHA256

                                                                              c85d405f789147c3e8a5eb84bd68b496faf4bd251526f362c74893e9a3796612

                                                                              SHA512

                                                                              c9e3af6169f1ae7b0083f2fe347f07166d1fb1e42048b72afc8a2bfe542b0268f6b74681045d73cf1d09365613f12905a3530a49e3bb4a78a0617aef1f5e5258

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              abdb0ade65bf236fa680be98cdf5a80d

                                                                              SHA1

                                                                              64dfd59f794f340f81e8e49c36839ee88c05a26f

                                                                              SHA256

                                                                              9a26b064ac7d8070a44908ffc4fd76ef829a4c87fd6b7e3f161e0540c1832e79

                                                                              SHA512

                                                                              739e7e5107d9e81606f2e4cdbd24186cfd3d5342965c534514dfdb952693169d16075784ebe741cb8ca9e05f4741d588da03b72e277a585b20da86389da3cf4c

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{d643562a-c341-45f3-bbed-afb41f072ff4}\0.1.filtertrie.intermediate.txt

                                                                              Filesize

                                                                              5B

                                                                              MD5

                                                                              f6a6263167c92de8644ac998b3c4e4d1

                                                                              SHA1

                                                                              c1fe3a7b487f66a6ac8c7e4794bc55c31b0ef403

                                                                              SHA256

                                                                              11770b3ea657fe68cba19675143e4715c8de9d763d3c21a85af6b7513d43997d

                                                                              SHA512

                                                                              232d43e52834558e9457b0901ee65c86196bf8777c8ff4fc61fdd5e69fd1d24f964fed1bf481b6ef52a69d17372554fecb098fb07f839e64916bdd0d2abf018a

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133640535669500212.txt

                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              ecaea544af9da1114077b951d8cb520d

                                                                              SHA1

                                                                              5820b2d71e7b2543cf1804eb91716c4e9f732fde

                                                                              SHA256

                                                                              9117b26ab2c8fdbb8223fe1f2d1770c50a6cf0d9849a5849d6aebcbe90435be6

                                                                              SHA512

                                                                              dc7bedbc581818011aa2d313429f234b12e5e9cf320b02b8d7ceeaf9cdc1c921ffc51af7f4080b02740f2d2146fbb006ccbf37cdcba3e3a10009142daffdb919

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              c270b533a85110c88da26dcb97d7ac31

                                                                              SHA1

                                                                              4a7b275c9cbf0eec7e67d48ffc6ed51a55c1325e

                                                                              SHA256

                                                                              93e2622ce5336d64f02ecc7cdf728b1e5820737f949ac41f2af1bc53d04238b2

                                                                              SHA512

                                                                              b5beb8f19bf4ac8606330610a95b2b4865e3e28450804f7d8cd365cb479c6b53c0f94106b4c4159b2514ad446a7f26049483931aab733db70356781937c1d6fe

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat

                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              44a57c3e63b021759a97ce319f4ca71f

                                                                              SHA1

                                                                              0c5442c7e8eba48bf8cc7abde6886e6bd6e2a3a3

                                                                              SHA256

                                                                              97792469bd0f80c0722a870cb25ae0a500f4b03ecad0c56bc69640311d2a8801

                                                                              SHA512

                                                                              d9a52b3f2c619acc48ea09e17dfc5a3bbfd431186e187f320c631259d93afd956d3487dfa150c172e14929f866cc389fa659da78a8821dc8bba88e806f7a243b

                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\TileCache_100_0_Header.bin

                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              e9848396594f3ae87b3a5bbd91ff6dcc

                                                                              SHA1

                                                                              9b955257af7e91d3dcedafc26c688f52d6cc6869

                                                                              SHA256

                                                                              0f11d63773e7a0415eae2094a4afea4b292a96a093877efd18e70af6ae8b4299

                                                                              SHA512

                                                                              0ec60824cc306383c86137510285a3badf3b2e5977fa59ba8e47d29d5c3dfe1ce60117c7f1829c39c65dfb5fd916832a905c0f2902abdedca590c77dcb887e78

                                                                            • C:\Users\Admin\AppData\Local\Temp\{B15EFD49-7867-453B-ACBD-9FA680AB01F7}.png

                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              00e5fcfd833151f7cbde607e2f7afeb4

                                                                              SHA1

                                                                              55839875c0947aafebff53d22ccc5dad29fe3563

                                                                              SHA256

                                                                              b80192aaabe007baecd0603e3ce183e9d554b8a6b0411d20716acfa086ae3035

                                                                              SHA512

                                                                              f056777a1987c3becdc217bdc2d82e6aa41086d38fddaa45c42f1726b6f7b7616a10918081650e825a724464ef148b669bc258d38a62e0de8642e2607a0b0de7

                                                                            • F:\$RECYCLE.BIN\S-1-5-21-2080292272-204036150-2159171770-1000\desktop.ini

                                                                              Filesize

                                                                              129B

                                                                              MD5

                                                                              a526b9e7c716b3489d8cc062fbce4005

                                                                              SHA1

                                                                              2df502a944ff721241be20a9e449d2acd07e0312

                                                                              SHA256

                                                                              e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                              SHA512

                                                                              d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                            • memory/60-22731-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/636-24033-0x0000000002260000-0x0000000002261000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/760-23465-0x0000000004620000-0x0000000004621000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/840-23616-0x00000000040A0000-0x00000000040A1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/916-23472-0x0000024033E20000-0x0000024033E40000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/916-23468-0x0000024032E00000-0x0000024032F00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/916-23467-0x0000024032E00000-0x0000024032F00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/916-23484-0x0000024033DE0000-0x0000024033E00000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/916-23504-0x00000240341F0000-0x0000024034210000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/916-23469-0x0000024032E00000-0x0000024032F00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/1064-23890-0x0000000004900000-0x0000000004901000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/1264-22435-0x00000209E7260000-0x00000209E7280000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/1264-22434-0x00000209E6ED0000-0x00000209E6EF0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/1264-22400-0x00000209E6F10000-0x00000209E6F30000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/1316-23634-0x0000019EEDCB0000-0x0000019EEDCD0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/1316-23624-0x0000019EED8E0000-0x0000019EED900000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/1316-23626-0x0000019EED8A0000-0x0000019EED8C0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/1360-23312-0x0000000004540000-0x0000000004541000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/2088-22618-0x00000232C5760000-0x00000232C5780000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/2088-22592-0x00000232C5150000-0x00000232C5170000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/2088-22585-0x00000232C5190000-0x00000232C51B0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/2088-22578-0x00000232C4370000-0x00000232C4470000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/2088-22579-0x00000232C4370000-0x00000232C4470000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/2500-23022-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/2568-22766-0x000001F240A60000-0x000001F240A80000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/2568-22754-0x000001F240650000-0x000001F240670000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/2568-22740-0x000001F240690000-0x000001F2406B0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/3156-23169-0x0000022216400000-0x0000022216500000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/3156-23201-0x00000222177C0000-0x00000222177E0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/3156-23196-0x00000222171B0000-0x00000222171D0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/3156-23174-0x00000222171F0000-0x0000022217210000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/3156-23171-0x0000022216400000-0x0000022216500000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/3156-23170-0x0000022216400000-0x0000022216500000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/3308-22577-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/3372-22390-0x0000000003E10000-0x0000000003E11000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/3920-23924-0x00000267D4900000-0x00000267D4920000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/3920-23912-0x00000267D44F0000-0x00000267D4510000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/3920-23895-0x00000267D3520000-0x00000267D3620000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/3920-23898-0x00000267D4530000-0x00000267D4550000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4216-23168-0x0000000002A50000-0x0000000002A51000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/4332-22877-0x000001FCC0400000-0x000001FCC0500000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/4332-22881-0x000001FCC11B0000-0x000001FCC11D0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4332-22876-0x000001FCC0400000-0x000001FCC0500000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/4332-22903-0x000001FCC1780000-0x000001FCC17A0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4332-22878-0x000001FCC0400000-0x000001FCC0500000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/4332-22893-0x000001FCC1170000-0x000001FCC1190000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4344-24036-0x00000253C7B00000-0x00000253C7C00000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/4400-23051-0x000001B0D23E0000-0x000001B0D2400000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4400-23029-0x000001B0D2010000-0x000001B0D2030000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4400-23024-0x000001B0D1000000-0x000001B0D1100000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/4400-23040-0x000001B0D1FD0000-0x000001B0D1FF0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/4764-23756-0x0000000004610000-0x0000000004611000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/4776-22874-0x0000000002680000-0x0000000002681000-memory.dmp

                                                                              Filesize

                                                                              4KB

                                                                            • memory/5028-23772-0x00000213A2070000-0x00000213A2090000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/5028-23782-0x00000213A2480000-0x00000213A24A0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/5028-23763-0x00000213A20B0000-0x00000213A20D0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/5028-23760-0x00000213A1100000-0x00000213A1200000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/5028-23759-0x00000213A1100000-0x00000213A1200000-memory.dmp

                                                                              Filesize

                                                                              1024KB

                                                                            • memory/5072-23336-0x00000130EC5C0000-0x00000130EC5E0000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/5072-23351-0x00000130ECBE0000-0x00000130ECC00000-memory.dmp

                                                                              Filesize

                                                                              128KB

                                                                            • memory/5072-23320-0x00000130EC600000-0x00000130EC620000-memory.dmp

                                                                              Filesize

                                                                              128KB