Overview

overview

8

Static

static

3

ep_setup.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    283s
  • max time network
    287s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17-12-2024 21:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ep_setup.exe

  • Size

    10.6MB

  • MD5

    f164888a6fbc646b093f6af6663f4e63

  • SHA1

    3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c

  • SHA256

    8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67

  • SHA512

    f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1

  • SSDEEP

    196608:Yobw/inDWIRviYy06kRUEsyiFo2ItCC2bO+WxNtTYnepC5YbM/rN2kGBlSrnU:dw/2Bvc06kiEviXTCIKNtUnqYYA/A

Score
8/10
defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ep_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4668
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4344
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:4816
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:4408
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2104
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:2340
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Users\Admin\Desktop\ep_setup.exe
        "C:\Users\Admin\Desktop\ep_setup.exe"
        3⤵
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:484
        • C:\Windows\system32\taskkill.exe
          "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
          4⤵
          • Kills process with taskkill
          PID:4356
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
          4⤵
          • Launches sc.exe
          PID:3868
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
          4⤵
          • Launches sc.exe
          PID:4636
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1844
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:904
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Loads dropped DLL
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:956
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Roaming\ExplorerPatcher\cleanup"
            5⤵
              PID:1528
            • C:\Windows\System32\rundll32.exe
              "C:\Windows\System32\rundll32.exe" "C:\Program Files\ExplorerPatcher\ep_gui.dll",ZZGUI
              5⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:3100
              • C:\Windows\system32\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
                6⤵
                • Kills process with taskkill
                PID:4396
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                6⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Loads dropped DLL
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:3540
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1616
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3028
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
      1⤵
        PID:3640
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:1452
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1156
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:236
        • C:\Windows\system32\BackgroundTransferHost.exe
          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
          1⤵
            PID:5008
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Enumerates system info in registry
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3712
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:2496

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Active Setup

          1
          T1547.014

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Impair Defenses

          1
          T1562

          Indicator Removal

          1
          T1070

          File Deletion

          1
          T1070.004

          Modify Registry

          3
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          4
          T1082

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files\ExplorerPatcher\ExplorerPatcher.IA-32.dll
            Filesize

            153KB

            MD5

            e5bb14c2b9af4d5bf6c38e0759f454dd

            SHA1

            8ce23be643a9ac1745ee824ff91621a0b8fcdaf8

            SHA256

            a4fd75ac8f852edc8bdb88a705eeee2c93f6ec51ef9fa0739a11a690a067c66d

            SHA512

            d2e0e3176304289f0efe635d3f751a6389b48afff4e2348e478993a29aba7941624e53f076bc09bba4ba0470e171cd2582254261584d2369d7ceb9dbd45a56cb

            Download Submit

          • C:\Program Files\ExplorerPatcher\WebView2Loader.dll
            Filesize

            161KB

            MD5

            c5f0c46e91f354c58ecec864614157d7

            SHA1

            cb6f85c0b716b4fc3810deb3eb9053beb07e803c

            SHA256

            465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f

            SHA512

            287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91

            Download Submit

          • C:\Program Files\ExplorerPatcher\ep_dwm.exe
            Filesize

            115KB

            MD5

            6563c5338177ff66050eadfe3960c567

            SHA1

            20e6e7c7778861756549062c5c0715090cad0e52

            SHA256

            315af6df079b31bac26156c9dda8cc415c76408a39972346c238888aaff79921

            SHA512

            724b9823e36b99490cd9b86a9b6ef33c35c5f92761abf7d6b2d00c0398b14679dfd07189519025e89f8dcef2409b0fdfaa48edf77b07764a4ed6cf6c683b330c

            Download Submit

          • C:\Program Files\ExplorerPatcher\ep_gui.dll
            Filesize

            734KB

            MD5

            81cd6d96f81b1e54aa327a4af6bcbe85

            SHA1

            b786c4bde03d1566b1b040eb8970b82f7b80a007

            SHA256

            b23bab1f5dc85c9e10145eeb32214d6cfe02fb5abcf956a37a3c9dd7e09fee67

            SHA512

            a1360b71ba11b529bd21f8c93c6ceec01c4faa9d33ca5e5fa62acb118cebf1e9e1d38ea17d236d1f8bd0d790f6b743329d41598d5a62c794b4786c14975782be

            Download Submit

          • C:\Program Files\ExplorerPatcher\ep_setup.exe
            Filesize

            10.6MB

            MD5

            f164888a6fbc646b093f6af6663f4e63

            SHA1

            3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c

            SHA256

            8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67

            SHA512

            f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1

            Download Submit

          • C:\Program Files\ExplorerPatcher\ep_weather_host.dll
            Filesize

            238KB

            MD5

            aac2857727cff3cd7b291f9500196f73

            SHA1

            c86eedff45b672df58885f12e7a7aee3398c618b

            SHA256

            78ed3e3676d97c337fef071b522805f4cf742587a40f96af4aa4d74fee0af88a

            SHA512

            a4c54b4221b1745fe1de6d53fcd7a528b4bacda6b2c66e02d55bd5867d118e042a35490e45b64c2d24398a9ac06e356bf10a2822f83663d52c1a28e10f0a52e5

            Download Submit

          • C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
            Filesize

            109KB

            MD5

            e477912c435db101603781dcc44289e1

            SHA1

            7b2eda1b6055e8874f37fb9b48bcc933bf69c1c3

            SHA256

            0930d2e71353a411d96dc4dfdd473dace98d1b7b9546ac4c185f8984f8b9c18b

            SHA512

            9f8089742099a789387381980ec5b493deec46bd73f39cf8fa9919be4dd772b20c70246e5e90d625011f052d5c3b2000b42c50843956d74fb85ff1b1d18eace9

            Download Submit

          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
            Filesize

            1KB

            MD5

            1fa0e272989c67f8c8559acad4fda9ad

            SHA1

            6f47296be6b5115e029c9e440a28c85cdcfd17bd

            SHA256

            e95a54df298956b35d0628d84fd59677b90cc464e8bd3dc453a13f445de72480

            SHA512

            abb1bf7d5f0580e71aa74a3901839fd53c5a4bee4a70f56e308cf0c73b6f30b3b8f21d7dc585c2caf9ebcce2f1f23b386c1d0f056a54415b522834c265a8d28d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5C
            Filesize

            282B

            MD5

            eb74f9931e91d1551431f1f2b593c13c

            SHA1

            480111cd648c59df029252adf753a6e9a81e0ddd

            SHA256

            31f8846ce53e5f149375790c9238806b837c42ddaf7d9b82254a0b5b3e1e48e0

            SHA512

            c9b0da203096d5d22208041596693ea2cfd38d2d46e4a85cb97d311972d5698e4816a86c21709d4f5638bb1871de6ded709511ad51e132cf04ad3017381ef58a

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
            Filesize

            1KB

            MD5

            db9f328db6df24090c0a3688275e4b15

            SHA1

            4edf9d3df6fd343ae873c3fc3c190e266e4bd56b

            SHA256

            79c578361ce907d3b4df828e60630446401189e6e5c096d65f4b34730aa0440c

            SHA512

            a42de16eab0406d984491bf21a7d75bb0b42fe0c047087ec1760b936e214008f0321415e333340483b838d0cb280b363d217a5531b741989d3c47f3f8177039d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
            Filesize

            979B

            MD5

            113d49d307b7985d972d6d5cead5a39d

            SHA1

            374541fd2aa973d1a23a1b2fe98152fcad5da08a

            SHA256

            363af5d2d071674fd2a288ec9c415d4915173a48d5d92c6d691ef78fc06e8fcd

            SHA512

            25a37dd14fa20758f119d6351678717cb848c0a4a5fa0c22a42fdc444e83be0af6cf9625b74cb7efcb754e086824398b6c596cb432989ca45f5699625196f527

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
            Filesize

            471B

            MD5

            dba676640ad2cb835c28382b38570588

            SHA1

            b4ccae5a298e65b1de1a3e4b1024bd63480ce987

            SHA256

            41fc2338afa65bfd37d4a505754080a3af530e8594b22e9248658be765f724a8

            SHA512

            c607235cb6df49ace72e9013adb66c8702f59c89b2aee4a9aaf69501661647f16fa87222bd71297f34545e39f16c01bcbe9f339534c6df4cf217ddb57ffc7701

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
            Filesize

            471B

            MD5

            baa5f0705e79c1f4ba5cb23610f58754

            SHA1

            bafa06d222e32741a51265d0e29e6105b59896b0

            SHA256

            c563430f17a85ba1dfa8884b165f3c11faf2175c0af0bb1014f5997d8f0620b6

            SHA512

            1b21d67afd4e6d21b0f1993aa6efa088272ffcd7954202751ea0671c78be8150645fe547281e49958be9ad68dac2564f460898c2a1916aa045802c3a1484bf4b

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5C
            Filesize

            480B

            MD5

            d97a66f62916f03865763e275f5e37ae

            SHA1

            84e25024a367813e71902c5bb21a62755e35f42e

            SHA256

            09ec0d0e0b4155c73c74746f2dfe7903ae79d55e49b511b6547b11b790ca5b3d

            SHA512

            3c5629165e0494889414f8d38ae3dda578cd96c502912f6f3f0243340a6fc4590725fa2e9bf9e98b6f009363f3729f4a94a2d2ae2e09f740cfd43517bd596aca

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
            Filesize

            482B

            MD5

            69561fed4270dbb2c8ee5b05c7c7b88b

            SHA1

            8106325bb7850ffbbfe81c05240094bf2cff80b2

            SHA256

            da75f2c6eb3dd9ca10f4a3ea0b4c619798264773a43821bd9804fddb82e8c2da

            SHA512

            c2ce94d79fa7849bb74c6afcdd298c122c1126fca550cdee0d79e679fb6fe93ef56427b091d0c059b80ce0371f70299ba17d557f98cd3ff332dfd7062db47e18

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
            Filesize

            480B

            MD5

            2256863bd068c2bd29565bb480d7cc9a

            SHA1

            6512cf90b445845a0a455e4ce5d7771fa50b99ca

            SHA256

            6247b8a1d62530b03c3b9be60d7971362a328d49f0809b56e2cc58f5962910b2

            SHA512

            6d8acdcb575af588f33b98369ca24269c711ba0ebf03e28f7bf143be58f72637a5f8e789597395642f364c08e1a726e8348e1a9197d4aa06a00ad4ca12e89e20

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
            Filesize

            412B

            MD5

            b311de1909e2bab0b5dcbc244bf58be3

            SHA1

            cf188d9b0d45ed82d7003421dc38d141a5375118

            SHA256

            d546cc59b2580e4d5db8943fef8f9bd402630c7f44b2b6747e27d285decec540

            SHA512

            056a585bb0759463046a96585d23e5e1c4a6a66e7ad8b8f62518a68ae53a4008913c2a094eb542a8480a197573ad774185653acc9b5d75f6a144e3abaa55eaf3

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
            Filesize

            412B

            MD5

            ae7e4f8c6f3b0ec763773514afe709dd

            SHA1

            1a9cf094433a62fd9d1c5a6dda906b8a151d897a

            SHA256

            cdda30afb8d159eabf5a7bf8d00b446e85e9a30ed067b16c37e92942e53cbb31

            SHA512

            dda77aedd01c3aae6061a686628549587e151e59d30d9b75207a5ae6ad25eceae34990833a83bd0d818b931f09cbf9d893edc1007c07cda2efbc5cac230c6f73

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
            Filesize

            14KB

            MD5

            95c7213da704e16253bb487b2e63a2e5

            SHA1

            90f7d3226123fd3a9be4bd081fa5654428cc33bd

            SHA256

            b7f6c5b394a79c5dd11b1666347663756ce1a7218cd44bef24f952ba680d57b7

            SHA512

            ec0905360e460b041fad76239b7890aa67229d4ee26c60ad64b91f94d158fe3e00e984312ea7caaecc90c97e14135f74ebd3193119378c209a3c7d71116f04d0

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
            Filesize

            14KB

            MD5

            542b7372dda4dae1c132d5515418bdab

            SHA1

            c4e6459a5d6e47b31ef8fef214975769765d2bc4

            SHA256

            8cd0e9b969ba7a1766d76856a16c3cc479d55abbf19ef9268542832f556f960c

            SHA512

            5d823ebc17afeb5e0397943238e197a7a7597b71155e7daf09d876ba14a32bd0028921cfbcad3d51dd91471900fc2ff1362066c70fc407b71266d38fb308d0b4

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
            Filesize

            14KB

            MD5

            944bd07e4129445015fb0814a7462ab5

            SHA1

            cd68f97b4df1f8270a8d14d50f954dcfb831bc17

            SHA256

            d4751e6875eea7049ad39f62bc5b75d0bc6500901165707d32e485f4b7d71063

            SHA512

            5a1ad9b3c65ad36c8e4cd53fa9556609489efbdd74bd8b66bcaefb35f31a90719d0f9442fb7b3a1cc8357cfa0972473c632b4831158a300752d0c7463ed39df9

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start.bin
            Filesize

            3KB

            MD5

            2f1bfb2165f70c93a18ae0648298a8ef

            SHA1

            7e19836ba490673becf07a9dca41613deb68ff47

            SHA256

            3ee6618278c324eb0db98ed57b42a6cc14798855a28bc2bc3e974d9bbd82e754

            SHA512

            c8ae4685f7a6db42a07845bb766a45087afefa4cbb60f1591267ea04f09020ff77d06eeb41ca42384951fd26741ed22d3de0aae6151393cded19065431856b04

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\f357ccc8-c64e-43d9-9c7e-4663770bc41b.down_data
            Filesize

            555KB

            MD5

            5683c0028832cae4ef93ca39c8ac5029

            SHA1

            248755e4e1db552e0b6f8651b04ca6d1b31a86fb

            SHA256

            855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

            SHA512

            aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            3KB

            MD5

            81ea26bfc6eaf787068a1430df0977c9

            SHA1

            937fe23ab2d822f999c82a2c2fc79458dcf72182

            SHA256

            048b1b4d54c438164fdc1395fef094ea85f089354a5148b1c1afd2f4027eed0c

            SHA512

            c60a09034686c3d1827be722b0909996429dff2df947682c78cb53b32f396974e8a8e756a3dbca493f5f52e7754ef9f4537fd6514c6087b12de59d6d1f436949

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            17KB

            MD5

            f811cfc36edba8bd8d8ad4e9723a542b

            SHA1

            506a0653c3d79b2cb32aff781e0d5603a33afda4

            SHA256

            d2d1558d6bef13a564eac7b16704cfc31964d6673758b6a4959e526bd0f887b9

            SHA512

            0bba4ef5af69f399c18d8a66d405d58074b6cc6013b6bfcdb1fa7bbe889b94a3f0494d9c2b5efa9e0cd69548dda5c2daa06a5caed9aaca863a413ddcff4a732f

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            17KB

            MD5

            8f383b5635ad548e34ab09fd73dc99ca

            SHA1

            874d2239beb3a58eb2442a53ee6a1c22421b0102

            SHA256

            e0f61fcd5752a577cf56ce48ea7636b3d0ea9311ad405e54685b4a577fe77459

            SHA512

            da851e96659ca44b0ea66c01e8f2e95b7e073af2e723e1e977cbdd02d3c0d492a41b5aaf2796cc33018e6f01bd4fc999fb8e58c3817af60bc60e5270ad2e0817

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            15KB

            MD5

            d10e4839a4fe98e031d1dd88fccf4038

            SHA1

            b1d3bd62a833602881a6e03be7c07bddd852a969

            SHA256

            b2038fecacfa52f59592669ac5456b796fcb8e09c38caa5493255e3828e5c785

            SHA512

            ce2daf666a6290dd7b54d594b6e151b9555fceec5dc347e555ba16aa2b826fe5535434d3d767212a16ba204afe250cd8f262b207eb901c5dda8511ef336a8469

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            1KB

            MD5

            03de444f06561360f6cf04b246203e73

            SHA1

            cc809c8bc790730ae55c3732905a710194fec141

            SHA256

            5bedb9a295b894ce35ddd57af0c2fb76916072a46527dd0f4266e5a6ff2e15c5

            SHA512

            1bddeaaa8183f82b911828a0b34d9361d97db1c2c1121af4d02f451531b8cf5d5c76e2656b90d6e9c9f615ce377e5a621ccbc287d23f82219586778a7261f03c

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            6KB

            MD5

            0947bdb64a7479c1e70f543551fcd0ff

            SHA1

            e4f80f111315952366c5d14fe6f83f2e6a2cf9aa

            SHA256

            2b3f25d1e619eb6d02895dd7e7357270c833fb81d56c09b3d7a897f7ac35e452

            SHA512

            8fcaf0ca49bbeb899a67157861949548947075df4d18aa520a95b52af91d1cf1218c9ace7ca73b0a449cd57fcfb5ae3d8103117c32c6d319650658895cd4b282

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3421A30E-DA49-40B0-A145-E779726B4A85\Zrtu2hQ08VU_1.bytecode
            Filesize

            66KB

            MD5

            1297d7425002606f0b01091f62e33248

            SHA1

            323fcf033ee7ace9d227e7ffed66c4b906b34ff0

            SHA256

            38959038e38f8c74332749e157e4233e40a73f53e8114241f97c355dc315619d

            SHA512

            5b2a2e4c749f8a4e1c84e4c6d2f520d01aedafc324a1613ef53e5e750ceb7de0afd3bfa946b6bed49308542f5084d15776eb3b35efb74e19aedb1c2770192f1d

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3421A30E-DA49-40B0-A145-E779726B4A85\Zrtu2hQ08VU_1.metadata
            Filesize

            192B

            MD5

            77bc53a4786047dc32bbac4172dac10b

            SHA1

            610e6fe91fc9e6265e172dfabd43c20c22e6eb5e

            SHA256

            92e2ca2810fe05cb9239f14abdcf4cd2f98f1b346fbaede63c53f3939dd7d474

            SHA512

            6712204881c82772bf23730c9a5826dce51481bf92c8aabd10431f9861fd960155c079241fb1469164922a2dbbee5775c54668cb63d0f7d8f8ec25e25b7a1f40

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4be1622c-5eee-4ac0-8d86-e3ec933fdfdb}\Apps.ft
            Filesize

            26KB

            MD5

            a744eb8fe5de15349ceeecc64953b0c7

            SHA1

            f391e02f3b7d1e061c64eb0f5d66cb905b9c35a3

            SHA256

            3b9e41bd8f0905645d465a462ba0473e201b907171c43df649f218a6abe4ac72

            SHA512

            9cbdf64af459ec7c4b7ad5300aa20a81f59bfc3cf292698f1a9e9b48b3b7482939c264b4cb1b0b5421617d178c3818baabab6c46acf51c18304539df7eb9cb32

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4be1622c-5eee-4ac0-8d86-e3ec933fdfdb}\Apps.index
            Filesize

            996KB

            MD5

            1255e27352432b816bb0361283dd5d05

            SHA1

            d78e5cb736ea13bcf6aebbb3ff0428a1dc9e3baf

            SHA256

            830c6179791682df189b19774d33345d3ecdc26bd88fd3bee4a14c8c5cf9b026

            SHA512

            a1c605925f0414d21da70259135a2f78b908f823759c4bb7a9f5a26d0911d89f16a2f0333f7b685b70c6fdec19db27c0cfcae163d625d0c7afc542f272888d4f

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99a5c5df-5835-4068-92ba-296304d9afc8}\0.1.filtertrie.intermediate.txt
            Filesize

            5B

            MD5

            34bd1dfb9f72cf4f86e6df6da0a9e49a

            SHA1

            5f96d66f33c81c0b10df2128d3860e3cb7e89563

            SHA256

            8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

            SHA512

            e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99a5c5df-5835-4068-92ba-296304d9afc8}\0.2.filtertrie.intermediate.txt
            Filesize

            5B

            MD5

            c204e9faaf8565ad333828beff2d786e

            SHA1

            7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

            SHA256

            d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

            SHA512

            e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133789449700951333.txt
            Filesize

            68KB

            MD5

            c49501de1bbb5093472658120120f742

            SHA1

            253193982c9e3cbd30d9c231b84fae9e3aa7656b

            SHA256

            76e3307ba0fa4f4596e91263f76833acf7e4d84fbad76898cf549d41d831d7eb

            SHA512

            a3f1dd3e4772c69e8681988f21faf6c31a3b182a1fbf0c0b0cd2d5f16566f3b6f2d233cda59b8e5659ee2c8457b3b28c2b83b4ff906c48b7fcda75038b7ec9dd

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\1P3ZL6PA\df2-pn8udkWCVTgFx36OU5ORGow[1].css
            Filesize

            15KB

            MD5

            1785d03dbc5ede62fad73e19ec2a6db4

            SHA1

            409bda051c53c59f926d57b1197c9dd5bdc5f92c

            SHA256

            b8f1c54f6b23cf5e16de39520094a5f78f82a299d30c24b41db319dbaa384a9c

            SHA512

            e33bacc5a3ec50a4e50a02d5902bb2660e60eb8ebaed0eb99c66576b2d1663dc7b3b6ed09cbf475a07ac3a20905c2131eb81467a3bb7d03c7f01e2b6f86de7af

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\SG8ASHJA\FgBbpIj0thGWZOh_xFnM9i4O7ek[1].css
            Filesize

            19KB

            MD5

            908111eb0ffb1360d5dd61279c21703e

            SHA1

            9144330fd728fb48fd690335cb0ed897888e1b9d

            SHA256

            1ed87cf425ded994b05a842271ab4d28a76f399e571688cf2e7b186f70dc3059

            SHA512

            3dc1414091d7872c108cad59a0ca53f7f4e4cfaef716d2f719ba95e9f812e0e22b61b8c84ae0af45258d4974b4303b50ae56a4915c6256253a91b50f27239123

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\SG8ASHJA\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
            Filesize

            6B

            MD5

            77373397a17bd1987dfca2e68d022ecf

            SHA1

            1294758879506eff3a54aac8d2b59df17b831978

            SHA256

            a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13

            SHA512

            a177f5c25182c62211891786a8f78b2a1caec078c512fc39600809c22b41477c1e8b7a3cf90c88bbbe6869ea5411dd1343cad9a23c6ce1502c439a6d1779ea1b

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\SG8ASHJA\dg0bEoz0nxScOpJJ_JI0IxFBuTs[1].css
            Filesize

            5KB

            MD5

            071cd9cdfb86b42f65ccd66a7413eac1

            SHA1

            fa2daa80f2e8be6e08632942d4713247095d2130

            SHA256

            c1d6f71af2376013d3b3fc25db91cc9da8d961084641312ccb96b3045ad921d5

            SHA512

            2f9b04d9e383b0613b4aedb0d3cd044e0c683b0da203452d15a3708527873fa0d79beeeb453a726e4bf79173406a3a7430067f22ad7d6b1ed2e9c0f459f816a3

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\SG8ASHJA\onra7PQl9o5bYT2lASI1BE4DDEs[1].css
            Filesize

            65KB

            MD5

            d167f317b3da20c8cb7f24e078e0358a

            SHA1

            d44ed3ec2cde263c53a1ba3c94b402410a636c5f

            SHA256

            be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad

            SHA512

            afc65b0fa648d49a5eb896be60331aa222301894e228fe5684399e9276342f6510773dffa3e7e75b8d6197bc51c732bc7fd7518e593ecd20c4884c47058d46d8

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\WBBEPW1N\0JAyi_EranBDK8eN2mQk1X4guLs[2].css
            Filesize

            64KB

            MD5

            9c39b3ceebe82a0531b03055d7331336

            SHA1

            b5558d73d99222976d1031396cbb0ef56092b1d8

            SHA256

            43028921e23efc9d9031986df77ad99d6a0f4d7cb3235535c9b1b8d27438c8ef

            SHA512

            69d1c00c82b149e7f677ba29866fdfb7d45bda4cce24a002b3327b33708feffde27e16706fee9199c58f5d7140fcc1c0c3b39a751b68761c91e91ffb95e4a2bf

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\WBBEPW1N\6aa-EF2IAVwnTTOiwAbhwI_VmCw[1].js
            Filesize

            21KB

            MD5

            b2c3cbf8a1d940d6c83d59a67486675c

            SHA1

            efec7fc9f309eea128df3cf7d2d12c3ff157ca74

            SHA256

            08ea9109346e9018ed50567503d2c141f7a84cfde80eb25e97fddcfe270baa67

            SHA512

            0e4802b050dd78ffb7883a40ff2e2e2394b928480da121fd8d25efede5010404137478ab20682c206bc4291a3d6f3906402aa99ebe3d57f80d4333ddda6f2896

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\WBBEPW1N\kDSgcaRKcOFnb6hWbBMgcX1lzrs[1].css
            Filesize

            955KB

            MD5

            1edd8f8c6e55870e426c806c7b23947f

            SHA1

            d92b3f746c884becf0aa74dad13c53239c93a752

            SHA256

            a0e36b5b2192f3517d7be3a94978a394d8ef02a5e1b26d6eb20a34ab54840f1e

            SHA512

            f5ef0120befaf179cb5ccdb84bf06ed5d77b951fcf64d50d217afd75d5e1e9db7fe823bac146aa347750fa315f06fe161a51016d4944a55ce86a5cbbc1b1c934

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D
            Filesize

            312B

            MD5

            1bed40a0fb6c8e62de124b1691551673

            SHA1

            b19a4371ad91b21a9e4a506b7a5447c398027f69

            SHA256

            bec2a4e041be8239799920a21ec86b04efa8e130d3bd6a106c5a9820e6b92d00

            SHA512

            1c53b072330134624b41fc2e4e4bedb74ac97f38de0c4207d67898748a9175872141cf779fc3ab36623558f69844498d422f16af82b261b2ae063b48e9f40572

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D
            Filesize

            400B

            MD5

            d5998b9a2ead1bbb50b8522e75841c6a

            SHA1

            13d97009cebb8a5a4a1b93e7081014fc844faf95

            SHA256

            29e951bd9421715e736a2e737e8dbb8436976dd5ed29269f37773ab25c00b77a

            SHA512

            32950faa71af5dcaca19862b57af08ae76d0e95deef6453866bba251c0630bc0fd28316d44b1fa0a85111efca758efcd37e42631c41b307be91a979dee8bf570

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1MIIYRO3\www.bing[1].xml
            Filesize

            19KB

            MD5

            ab1c83e6229ac545ce1dafd0c7a0f5ea

            SHA1

            743b488123baff7c92a4daaf913fd95ea545a003

            SHA256

            c8a5fadd8d55ac76e9c4157ffdeec4181a5a44d9d191951d36aec5b6cb991188

            SHA512

            ada0c446d4b7e0fc5b897c87ec10c578d28aa4fd00ebdaba00c46c610be4519f6ea66dd0a5a38f5021391b2a15038f2922e0b1cd29fbf408b03c053e66c16597

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\ept2B48.tmp
            Filesize

            19KB

            MD5

            cd9dbd3f5ec5814a4f1fa6542be9352e

            SHA1

            04e8e94d40cd784a7e75bc52305c879b0f6e367b

            SHA256

            7ecd4088669a573db2c9f5d6d3d0a75f65d6271481cbdc195f12c4a88e01c733

            SHA512

            920b31ac1f11f59bc3191a64734a02801a1e5a0311663037e2f0c0e7918e9fd9e1e79d6fb8affee21b50b400f0f137e183f8e010782dec351d4b437a7103451e

            Download Submit

          • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
            Filesize

            5.1MB

            MD5

            ffa9dfa90c20b944c021494f8a9e1199

            SHA1

            c700b74c89d0de5279f034aa1a0b0ce9f3d7275c

            SHA256

            25a609fb9091cf2bf30724e59c432e74509136cf88d928f26fba4ea331d6f386

            SHA512

            d709e52511e36b601959ab3a8176e598e74f74bf477d26381ac96e39dcf224d5d1435e206f3d572e808586b71c12ca5f2e49ae6828a8dded75b2818463664629

            Download Submit

          • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
            Filesize

            16.4MB

            MD5

            2e3682c2244b6604851b0d6b3eb7b248

            SHA1

            047c762af86b37f582573d3a88b68ab1ab8dbab3

            SHA256

            9ac8bf7c0a79fe47bea4ca8d364aa3e7b3f92b02a27507d704528b89e7e0e776

            SHA512

            834bec41cfb5cac51e3cad91d21327581a1180df98ce5cbe1a04ae8c5a5c793a0ac49b95dfa309162d653fc8d174b4c7f38c7f1f02d3e0907582b8f5d2ec6c87

            Download Submit

          • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
            Filesize

            24.0MB

            MD5

            def29fd81caf648be9b71298bb7513d0

            SHA1

            cd3ac3f22d51dc9d949409fd84848c4b1d8f6bab

            SHA256

            745f3e5f484b42c4650847b82ea36ff132b228d4096f49c493a2a7b1e32d5dce

            SHA512

            937ce45ba86505225e272b9ab8f1628722a8d70e523253758d6bdf8d531e279a256da3c9682aa63826c7ff0d41340bd936e88f066ba6b6c87d73370eda6ab889

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
            Filesize

            7KB

            MD5

            7515f422096634654f2e7af55691b3fa

            SHA1

            01223bd2c25890269ebe6f8a2948b52101381fb6

            SHA256

            ecab64a62b6d4b4a0d6997c85d708d01dec05e88bf25ecdfd7b8ac2e254ea672

            SHA512

            bcaddebba5d3d2509dc789141713a65eef2577b09bf2bddc7a9f44a0f35b40ae1435704df43ad224befb3ae692e9025e306390f790fa7f8025b29b9f2ae3f335

            Download Submit

          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
            Filesize

            699KB

            MD5

            8bfca71add96d3de75173d464792e2b9

            SHA1

            fe6bc3c30c26d6ce1c149b173b5d79c80102d5b9

            SHA256

            5aaa6bab20b7116b32bddba1df216f7476557bb48397e1968a49ede14e6c377d

            SHA512

            b560415727d15ceeb09e5d9e39ea2b4043848bf4239fbf5068aaac86f64b3d05d4e21eb197416db0fb4172c68f782c05aeae18ac70c27f80566040b6ba79159a

            Download Submit

          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.dll
            Filesize

            164KB

            MD5

            b80816ee9fcdb1d9076b73fd929fc96b

            SHA1

            ff9a5a12dca164652419f5dee082af4a49b8a03b

            SHA256

            d63b9fc13c99000cf77d02ee6e5e84c825d02a92d87b728cb601681b5eb21671

            SHA512

            21cebca787a0fa0976b44315bf05b6eb4719306653ddbbfce41231244219bcd288cd8045980bacf21481ddabcf464c82795147db755148cc0e23167bbb874fd7

            Download Submit

          • C:\Windows\dxgi.dll
            Filesize

            699KB

            MD5

            047b192a9c703fc5a2c2764db869ff5c

            SHA1

            8c1494acc3119fbf8332ae3b6a4f854e5b4d37cb

            SHA256

            1971c57f88849b4069be06d3784e0968755c916fa1564a3f8f05610d3b02cdcc

            SHA512

            c7f80703db23611d56618a8b1b4ffff814a9264135e3846df99120c0ffc16da9d5b37c6465ac25d61d4f6e386d36b3de640c57c460098f06778c658cc19454cc

            Download Submit

          • memory/956-524-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-518-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-508-0x00007FFB871F0000-0x00007FFB8799E000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/956-511-0x00007FFB7BF30000-0x00007FFB7C1A1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/956-509-0x00007FFB871F0000-0x00007FFB8799E000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/956-514-0x00007FFB7BF30000-0x00007FFB7C1A1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/956-510-0x00007FFB7BF30000-0x00007FFB7C1A1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/956-526-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-525-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-523-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-522-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-521-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-520-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-512-0x00007FFB7BF30000-0x00007FFB7C1A1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/956-517-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-516-0x00007FFB87D60000-0x00007FFB87F0C000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/956-519-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/956-515-0x00007FFB7BF30000-0x00007FFB7C1A1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/956-513-0x00007FFB7BF30000-0x00007FFB7C1A1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/1616-317-0x0000029A61190000-0x0000029A61290000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1616-183-0x0000029A5D290000-0x0000029A5D390000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1616-209-0x0000029A5D5B0000-0x0000029A5D6B0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1616-208-0x0000029A5D590000-0x0000029A5D5B0000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1616-229-0x0000029A5D3F0000-0x0000029A5D410000-memory.dmp

            Filesize

            128KB

            Download

          • memory/1616-91-0x0000029A29540000-0x0000029A29640000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4912-24-0x00007FFB709A0000-0x00007FFB70C11000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/4912-31-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-34-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-26-0x00007FFB709A0000-0x00007FFB70C11000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/4912-23-0x00007FFB871F0000-0x00007FFB8799E000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4912-60-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-36-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-39-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-32-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-33-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-35-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-37-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-38-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-56-0x00007FFB871F0000-0x00007FFB8799E000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4912-41-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-43-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-48-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-44-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-45-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-49-0x00007FFB71500000-0x00007FFB71ACB000-memory.dmp

            Filesize

            5.8MB

            Download

          • memory/4912-51-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-52-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-53-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-50-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-47-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-46-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-40-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-42-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-27-0x00007FFB709A0000-0x00007FFB70C11000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/4912-30-0x00007FFB87D60000-0x00007FFB87F0C000-memory.dmp

            Filesize

            1.7MB

            Download

          • memory/4912-28-0x00007FFB709A0000-0x00007FFB70C11000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/4912-59-0x00007FF7C4E90000-0x00007FF7C5354000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/4912-22-0x00007FFB871F0000-0x00007FFB8799E000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4912-29-0x00007FFB709A0000-0x00007FFB70C11000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/4912-25-0x00007FFB709A0000-0x00007FFB70C11000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/4912-54-0x00007FFB722E0000-0x00007FFB72B13000-memory.dmp

            Filesize

            8.2MB

            Download

          • memory/4912-75-0x00000000034E0000-0x00000000034E1000-memory.dmp

            Filesize

            4KB

            Download