Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/E...

windows11-21h2-x64

10

Analysis

  • max time kernel
    541s
  • max time network
    536s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/12/2025, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/Endermanch/MalwareDatabase/blob/master/trojans/MEMZ.zip
  • Sample251207-ttdxcsvndy
Score
10/10
defense_evasiondiscoveryexecutioninfinitylockwannacryimpactpersistenceransomwareworm

Malware Config

Extracted

Path

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

  • 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

  • InfinityLock Ransomware

    Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.

    ransomwareinfinitylock
  • Infinitylock family
    infinitylock
  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 62 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Endermanch/MalwareDatabase/blob/master/trojans/MEMZ.zip
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5996
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb67ddcf8,0x7ffcb67ddd04,0x7ffcb67ddd10
      2⤵
        PID:2456
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1940,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1776 /prefetch:2
        2⤵
          PID:5688
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1428,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2256 /prefetch:11
          2⤵
            PID:4616
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2412 /prefetch:13
            2⤵
              PID:4388
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3196 /prefetch:1
              2⤵
                PID:4948
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3200 /prefetch:1
                2⤵
                  PID:5032
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4224,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4240 /prefetch:9
                  2⤵
                    PID:4840
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5156,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5180 /prefetch:14
                    2⤵
                      PID:912
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5220,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5500 /prefetch:14
                      2⤵
                      • NTFS ADS
                      PID:5876
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5608,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5144 /prefetch:1
                      2⤵
                        PID:5736
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3280,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3008 /prefetch:1
                        2⤵
                          PID:4772
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=6108,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6160 /prefetch:1
                          2⤵
                            PID:3196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6124,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6332 /prefetch:1
                            2⤵
                              PID:4384
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=6180,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5976 /prefetch:14
                              2⤵
                                PID:2312
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5904,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6072 /prefetch:14
                                2⤵
                                  PID:3824
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5984,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6560 /prefetch:14
                                  2⤵
                                    PID:6024
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5336,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5320 /prefetch:10
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3188
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3452,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1480 /prefetch:1
                                    2⤵
                                      PID:2980
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4296,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3392 /prefetch:1
                                      2⤵
                                        PID:3548
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5956,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5892 /prefetch:1
                                        2⤵
                                          PID:4028
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5872,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6160 /prefetch:14
                                          2⤵
                                          • Modifies registry class
                                          PID:1568
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --string-annotations --field-trial-handle=4288,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3436 /prefetch:12
                                          2⤵
                                            PID:4004
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3312,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4376 /prefetch:1
                                            2⤵
                                              PID:2276
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=6400,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4364 /prefetch:14
                                              2⤵
                                                PID:4652
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations --field-trial-handle=4304,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6428 /prefetch:14
                                                2⤵
                                                  PID:956
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5176,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3464 /prefetch:14
                                                  2⤵
                                                  • NTFS ADS
                                                  PID:4308
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=3464,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4592 /prefetch:14
                                                  2⤵
                                                  • NTFS ADS
                                                  PID:4076
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=4236,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6464 /prefetch:14
                                                  2⤵
                                                  • NTFS ADS
                                                  PID:3388
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6252,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6508 /prefetch:1
                                                  2⤵
                                                    PID:5380
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=3444,i,17024951422023316592,8439023477487758362,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3396 /prefetch:1
                                                    2⤵
                                                      PID:5144
                                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                    1⤵
                                                      PID:5128
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:3536
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                        1⤵
                                                          PID:2732
                                                        • C:\Users\Admin\Downloads\Koteyka2\[email protected]
                                                          "C:\Users\Admin\Downloads\Koteyka2\[email protected]"
                                                          1⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:2236
                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                          1⤵
                                                          • Enumerates system info in registry
                                                          PID:2008
                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                          1⤵
                                                          • Enumerates system info in registry
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4632
                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                          1⤵
                                                            PID:1016
                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                            1⤵
                                                            • Enumerates system info in registry
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5608
                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:576
                                                          • C:\Users\Admin\Downloads\InfinityCrypt\[email protected]
                                                            "C:\Users\Admin\Downloads\InfinityCrypt\[email protected]"
                                                            1⤵
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            PID:4212
                                                          • C:\Users\Admin\Downloads\InfinityCrypt\[email protected]
                                                            "C:\Users\Admin\Downloads\InfinityCrypt\[email protected]"
                                                            1⤵
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            PID:5148
                                                          • C:\Windows\System32\Taskmgr.exe
                                                            "C:\Windows\System32\Taskmgr.exe"
                                                            1⤵
                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                            • Checks SCSI registry key(s)
                                                            • Checks processor information in registry
                                                            • Modifies registry class
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:4996
                                                          • C:\Windows\SysWOW64\werfault.exe
                                                            werfault.exe /h /shared Global\48ec3e4c6d7946cd9d258232750c0a93 /t 4860 /p 4776
                                                            1⤵
                                                              PID:5012
                                                            • C:\Windows\System32\Taskmgr.exe
                                                              "C:\Windows\System32\Taskmgr.exe"
                                                              1⤵
                                                              • Suspicious use of NtCreateProcessExOtherParentProcess
                                                              • Checks SCSI registry key(s)
                                                              • Modifies registry class
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              PID:3264
                                                            • C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]
                                                              "C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]"
                                                              1⤵
                                                              • Drops startup file
                                                              • Sets desktop wallpaper using registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5148
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib +h .
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Views/modifies file attributes
                                                                PID:3204
                                                              • C:\Windows\SysWOW64\icacls.exe
                                                                icacls . /grant Everyone:F /T /C /Q
                                                                2⤵
                                                                • Modifies file permissions
                                                                • System Location Discovery: System Language Discovery
                                                                PID:944
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:4104
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c 316861765124853.bat
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:804
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript.exe //nologo m.vbs
                                                                  3⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:3976
                                                              • C:\Windows\SysWOW64\attrib.exe
                                                                attrib +h +s F:\$RECYCLE
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Views/modifies file attributes
                                                                PID:2212
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                @[email protected] co
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2040
                                                                • C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe
                                                                  TaskData\Tor\taskhsvc.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:424
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c start /b @[email protected] vs
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:3928
                                                                • C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                  @[email protected] vs
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1916
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                    4⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4908
                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                      wmic shadowcopy delete
                                                                      5⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3276
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2756
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
                                                                taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:1484
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Sets desktop wallpaper using registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1452
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fraopwtwop689" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:336
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "fraopwtwop689" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
                                                                  3⤵
                                                                  • Adds Run key to start application
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry key
                                                                  PID:1660
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:3612
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
                                                                taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2408
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2020
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
                                                                taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:3376
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4240
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2800
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
                                                                taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:5880
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                @[email protected]
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Sets desktop wallpaper using registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3976
                                                              • C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
                                                                taskdl.exe
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2260
                                                            • C:\Windows\system32\vssvc.exe
                                                              C:\Windows\system32\vssvc.exe
                                                              1⤵
                                                                PID:6120
                                                              • C:\Windows\SysWOW64\werfault.exe
                                                                werfault.exe /h /shared Global\6e052c0ac709401b983e6192ca547b78 /t 3832 /p 1452
                                                                1⤵
                                                                  PID:3240

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Reconnaissance

                                                                      Resource Development

                                                                      Initial Access

                                                                      Execution

                                                                      Windows Management Instrumentation

                                                                      1
                                                                      T1047

                                                                      Persistence

                                                                      Boot or Logon Autostart Execution

                                                                      1
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Privilege Escalation

                                                                      Boot or Logon Autostart Execution

                                                                      1
                                                                      T1547

                                                                      Registry Run Keys / Startup Folder

                                                                      1
                                                                      T1547.001

                                                                      Defense Evasion

                                                                      File and Directory Permissions Modification

                                                                      2
                                                                      T1222

                                                                      Windows File and Directory Permissions Modification

                                                                      1
                                                                      T1222.001

                                                                      Hide Artifacts

                                                                      1
                                                                      T1564

                                                                      Hidden Files and Directories

                                                                      1
                                                                      T1564.001

                                                                      Indicator Removal

                                                                      1
                                                                      T1070

                                                                      File Deletion

                                                                      1
                                                                      T1070.004

                                                                      Modify Registry

                                                                      3
                                                                      T1112

                                                                      Credential Access

                                                                      Discovery

                                                                      Browser Information Discovery

                                                                      1
                                                                      T1217

                                                                      Peripheral Device Discovery

                                                                      1
                                                                      T1120

                                                                      Query Registry

                                                                      3
                                                                      T1012

                                                                      System Information Discovery

                                                                      4
                                                                      T1082

                                                                      System Location Discovery

                                                                      1
                                                                      T1614

                                                                      System Language Discovery

                                                                      1
                                                                      T1614.001

                                                                      Lateral Movement

                                                                      Collection

                                                                      Command and Control

                                                                      Web Service

                                                                      1
                                                                      T1102

                                                                      Exfiltration

                                                                      Impact

                                                                      Defacement

                                                                      1
                                                                      T1491

                                                                      Inhibit System Recovery

                                                                      1
                                                                      T1490

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      icudtl.dat.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 16B
                                                                      • SHA256 fbf3365ec7e44b9e1136946c392f8791081ceed461d527b0960eabd0f1308cc1
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      s_remove_18.svg.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 720B
                                                                      • SHA256 e97d5c75a8b5518ff3dbf49062adf65f30a8a74fc48cd0455647ec41b29915b0
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      example_icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 688B
                                                                      • SHA256 85c2af6441c243243d0a766dbd849bfb1a4756b45055f7def581ceb194c72af9
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      example_icons2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1KB
                                                                      • SHA256 d1062e365a42d21ff7536f30b40130dbe11abd01cd4f61f250bd3a7b8bb288ad
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 448B
                                                                      • SHA256 a1812a98fa86daa6769ff7ed32074767cebbfbfd94e390551fa7f1b030a6a9df
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 624B
                                                                      • SHA256 73594d3fbb63dd449f26ea8610cb2553b433076e9a6c8f61b71ecb0cb1c414ef
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon_hover.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 400B
                                                                      • SHA256 ba8d1a595b46e9776963524666fe49d437588188ea1d8e920ff9769c1a16f49e
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon_hover_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 560B
                                                                      • SHA256 09a7818438246f18779f04a8903899b7fa20508c28f066d8f177dd4b4fb7088f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 400B
                                                                      • SHA256 555f19a850cb8acdd0717e75fbf70c6066f2beefb51550f3e5b2771edc062d0f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 560B
                                                                      • SHA256 6a12fc21c524ca368c76e01390860bf196c62aa56a5f367a408de195cfd9d722
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon_hover.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 400B
                                                                      • SHA256 d80db0cf0d9a07f2c2ef94a6800ac3a4d2b3856e74e8360fbaaaf892d0890d22
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      rhp_world_icon_hover_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 560B
                                                                      • SHA256 87fbda270e3def5d574a19688732c59e75ebf8994f85407412fc60db9b196b76
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 7KB
                                                                      • SHA256 8abfe8aa9fe14c0436dcfb01eece86c810fb5fc94e96511ff81a657bdc22816e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      icons_ie8.gif.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 7KB
                                                                      • SHA256 42bb6ba8bcfc81a2ac68da8432b99dec60629b68207e4163988e01e6d34b9f19
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      icons_retina.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 15KB
                                                                      • SHA256 e6f87c448c4648dfb47692b283da102cae6239d489869e571cd342f200b28d04
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      new_icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 8KB
                                                                      • SHA256 e280006b764a57b8e5b0c1a0211acd93a6268c9b07658a60185882d2ce068aa9
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      new_icons_retina.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 17KB
                                                                      • SHA256 8fd62173aa45f126cad4061881b38983f3c83222e40d0baadd4ba07131593541
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      bg_pattern_RHP.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 192B
                                                                      • SHA256 8b201ace12b46fcf0c0e0d9ee8ac9317fdd283e3e274c5dbd044165945409cf2
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      bg_patterns_header.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 704B
                                                                      • SHA256 fa1839b5e25ff167680fda6ee92010bf5f1145254a35d62d2696959521668441
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      illustrations.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 8KB
                                                                      • SHA256 7f53f8ea0bbe0a2a95f11d70444a38af9ad43339aa548a862887e35b2520167b
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      illustrations_retina.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 19KB
                                                                      • SHA256 40055c0a40267ca056bfa23a24ecfb99a5105078e5aac888a7da8301863ba834
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 832B
                                                                      • SHA256 55eca19166c1d3ce7757c54e2c739da432c743c04f11f1c58ab2acbf8d3be69e
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1KB
                                                                      • SHA256 953b54add46ad2e8def7adaf6f199faaddd7b1b69fe4a59b4944cfeb68232c48
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1KB
                                                                      • SHA256 400cc5d1cbcbde4655d2eb4f2bd16e41088b14ff03543a9fc800e05d8a78de33
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      main.css.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 816B
                                                                      • SHA256 0932971a48b216f6f1369369d51cbc4433f507b3d9ca3a163283b72b39fb34ae
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      bun.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 072a02c8d101b0a2512ddcffa99d879588e65aac9aaeae7213db81c2237470a8
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      cstm_brand_preview.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 248561de19fe166b25bb4aa5171a5458c3fdcc819d920de26d78458fe7fc050a
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      cstm_brand_preview2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 4KB
                                                                      • SHA256 e70051d0a27dc6b9f127b1a78fa27217299c46853dbefd09ca8a50d0cbea6120
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      dd_arrow_small.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 304B
                                                                      • SHA256 aeeffcaa1ab41d6b11ee4d2d4ed1f3a4df19d25c25149f4f064d09790d90b7de
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      dd_arrow_small2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 400B
                                                                      • SHA256 65eec722e7ee6cf5537ec36c5307feb2fd5513ff6a2a071d52c53b8309798c8b
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      nub.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1008B
                                                                      • SHA256 11f11c5c5225f6971cec042152842d119a96fb2d4675e3c07e72225347b13d82
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      share_icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1KB
                                                                      • SHA256 3b43286c92a304cbae332e86c7b79b740dd6e902c9627dd2874190423a31d73f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      share_icons2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 98a75859706af03f1135fd370cc217067f962ec8aa7fd120f368fcb72433f7f3
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 848B
                                                                      • SHA256 8b37f3336f8f325aa21544815b6ef3aa1dab34b713e08cced5ae24173f896447
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      DisplayLanguageNames.en_US_POSIX.txt.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 32KB
                                                                      • SHA256 fcd718639c0808e0d6b6357911cf28459d7140032c428f1b7b2556e45aaf3a22
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      dao360.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 596KB
                                                                      • SHA256 21cded6e858664c859b01fb9caf75d99bb5905ffaae11faf72bc3b57013b7806
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      dao360.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao360.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 596KB
                                                                      • SHA256 0e602daf498dfdd2b0f4b2788772941b8d2381a3fedb4346d988fb19784bcc76
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tifffilt.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 184KB
                                                                      • SHA256 59534333644ed4d49f8b4da6daf169c56912425a1936ca3ef0fde92804b8fe26
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tifffilt.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\tifffilt.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 184KB
                                                                      • SHA256 b610985f8235de739b1e5f6e0fefc3182b5d640785d88bfcf8846bef04749a36
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      msinfo32.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 267KB
                                                                      • SHA256 8d09e4458d05e4db4d641c886030a4bb25fe4c3066d1307f045144f23b9cd538
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      msinfo32.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 267KB
                                                                      • SHA256 0dda6086df9e6cd67e8ffe0cba7c6cac801d08875bb2a2cd15900e4029fb7502
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      msinfo32.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 184KB
                                                                      • SHA256 17fc358315b7af477430bb89781502902aa245f045d6be3c9fec9727fc53db34
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      VGX.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 802KB
                                                                      • SHA256 224b107a17fd4034ffe5b4b003814e0ae4fa288140ff86f653d4e8d049774806
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      VGX.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 802KB
                                                                      • SHA256 d056409e4704710a45814527b82bc83fc7577e443b7445dd5657004d224e1a62
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      InkDiv.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkDiv.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 303KB
                                                                      • SHA256 17f4e981732ce5fe7798b3cd7d3fe285b71eade79a5db1a7196e8a98b3f55d7c
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      InkDiv.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\InkDiv.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 303KB
                                                                      • SHA256 6940b5de8d057388caf6e5df679a931f728383dd305bbc5a6285a17dba594ea8
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      wab32.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\System\wab32.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 740KB
                                                                      • SHA256 41c7dcb0e6ba2762b54edd066430329e98a9735c44f9882ff7aaa73d9bbdf948
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      wab32.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Common Files\System\wab32.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 740KB
                                                                      • SHA256 5f921d77deef47578bfd858026b3c94ac46033ff1cc0a17ab12b823088426496
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      ExtExport.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Internet Explorer\ExtExport.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 47KB
                                                                      • SHA256 cfebd1230925d04ee55664778bbff92b5c4b7a81afc7b3c5320319ec9853f19e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Workflow.Targets.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 7KB
                                                                      • SHA256 b74543688a648cfaf5c4a2fabac62eff88dffb816d9a89efc792a07d20ddc478
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      identity_helper.Sparse.Internal.msix.DATA.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 56KB
                                                                      • SHA256 ee72440ccd094f5335c6d13d154eb03eae4e68109ff23b16391c43be605df6fc
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Advertising.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Advertising.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 24KB
                                                                      • SHA256 0f2b11d5bb63fad325b16555f4843f895d879e796ec21faadd2acce62d273562
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Analytics.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Analytics.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 4KB
                                                                      • SHA256 74f32e8d2bbe749c00eba8fd47b9062374ecaed00c51f9fd7b57f39b30de3f69
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      CompatExceptions.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\CompatExceptions.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 704B
                                                                      • SHA256 ed1ec563c8caf46c01555a70cb516c7cd4afacdb77a699514f99d09901046d73
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Content.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Content.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 6KB
                                                                      • SHA256 035fee56b954bf376a02653e5edd707b785f21b78d8f1c2bf80ac8ae9ff5832e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Cryptomining.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Cryptomining.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1KB
                                                                      • SHA256 0a3597f2b045b1d0cf7124dbda64de07bf779615a4af9fe1ceb95a455b357ade
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Entities.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Entities.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 68KB
                                                                      • SHA256 708f4583126d9e7eb9c05299e1d955d5aa431d1603458e2ee4bbd7daedf411e1
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Fingerprinting.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Fingerprinting.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1KB
                                                                      • SHA256 940f821c596652518a097c72c531f1ed9db4c166b90b1e2becf92eb3244ac598
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      LICENSE.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\LICENSE.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 34KB
                                                                      • SHA256 2256bcddc7830a2743c6abbf4dc5507f41e7a033b1212eb39ac42bbd632099c4
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Other.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Other.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 48B
                                                                      • SHA256 0e92c37fb54c1046197158fcec64282eb8feb53f3321829ed9d52a442de3f0f5
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Social.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\Social.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 368B
                                                                      • SHA256 1cd65464fef750468cd73eed1169d54943441aa5a740eb9acb78cb5307750bed
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      TransparentAdvertisers.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Mu\TransparentAdvertisers.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 112B
                                                                      • SHA256 a49e23d01c7ea726daddc1d8a6ae7fb940c2c94be159cab39230b25c5d6f186f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Advertising.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Advertising.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 1a60462a5316731cd49bb14aff044e2cabfa6d689bae37f36ef94e49fb8ca861
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Analytics.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Analytics.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 448B
                                                                      • SHA256 b9ec9163ef32bf26d34711a9b850247f1af80b576334841cd05540a87b728938
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Content.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Content.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 64B
                                                                      • SHA256 0a5271e3096c0be4549530478abfb4f401ecc0437fcf6873eca1c301c1f8abe6
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Cryptomining.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Cryptomining.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 48B
                                                                      • SHA256 8347ece8361a56b24fe439e69f7b65d6cce3401b4bf920deb56c73fb6fe29f2e
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Entities.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Entities.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 42KB
                                                                      • SHA256 4a54ab0d880c4d12c458fc91751fa5cca382da37b746fca1b92d382fd67f88c0
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Fingerprinting.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Fingerprinting.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 176B
                                                                      • SHA256 98afae607db48ed2a4f25d4d543dd4ed3106d1c345b21e2a1786894ba9b582f0
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      LICENSE.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\LICENSE.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 80B
                                                                      • SHA256 409e3e48dc2ecd6a4ddff81f1268788c3ce613b922366ab506832099a28d3db7
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Other.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Other.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 96B
                                                                      • SHA256 641406f5bdce72d41f8a4c2b38b790bbd76e0146b5f1a0eabf708a66e1ec34f1
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Social.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Social.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 3KB
                                                                      • SHA256 fd31f6720af4aa5ac7715ba8c8242839c722fa95113ed74f99b4f115cc5b1db3
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Staging.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\Sigma\Staging.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 16KB
                                                                      • SHA256 6fb621e041b1ff9b4022b0ff5c3dd166fdb6ed56b2789d0865f7905ca5862a4f
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      manifest.json.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\manifest.json.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 144B
                                                                      • SHA256 39f2296bce4774100332dbb272038c2a8fa9d5e8814f0a0fdce69b95b620d958
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Logo.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\Logo.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 31KB
                                                                      • SHA256 a134ef52a7cfee0ce44a7e54a746b2390e57b298556bc070a904181940834838
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      LogoBeta.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\VisualElements\LogoBeta.png.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 29KB
                                                                      • SHA256 69fc6fadc22e681aa1f263b4895c1b437e18bef114adbd68ab12963b7d43b735
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      manifest.json.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\manifest.json.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 1008B
                                                                      • SHA256 ac22237f8d1b7f466f4575fb5cd9d49cf3249b21296380f845ce85329cbaa3ca
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      identity_helper.Sparse.Internal.msix.DATA.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\ResiliencyLinks\identity_proxy\win10\identity_helper.Sparse.Internal.msix.DATA.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 56KB
                                                                      • SHA256 487f7a982ee80e7a8faf6ec6c5ede079e84c35d328c1a15d0c55d98ee99cb962
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      PresentationBuildTasks.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 584KB
                                                                      • SHA256 10a2b2926cb10418a027d5d5fafe7cac06fd4b90459fd88147ae3b50bb6f05d1
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Microsoft.Build.Conversion.v3.5.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 104KB
                                                                      • SHA256 dff082a18100019e97eb52c688aefde4e325948cdd8933d69d6d1f5445ce9c73
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 e802fb8957c255bf74bc8462a9e3150dd3171b00db490d983bb5dafaafbe490f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 3KB
                                                                      • SHA256 e4fe801921cfbf6f80a662e94bc7363628d45e2bc5e5ad784f8a5de47663550f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 3KB
                                                                      • SHA256 de7e19b94fd062fa5381d65702f8abc9d84f3008d5b6fda2f275e7383ad7bfeb
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 a8da231bbbccf8f50d740b5578e0042b340ebf6932aca06bd93a731b81e15cac
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 2KB
                                                                      • SHA256 6b6df521c49abcf42be3ecc107bfed7b28320c03b1954ac8d0faaa7fb88c5df2
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 3KB
                                                                      • SHA256 4927a5ff728d7e13d5df88da536c1609c81d5f6ae79ccdc44077eed0cd2353a6
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      wab.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Mail\wab.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 505KB
                                                                      • SHA256 90fa21207618939675b3cb286305320769cb9148a948bf71598b2f4ceb3059ab
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      mpvis.DLL.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Media Player\mpvis.DLL.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 161KB
                                                                      • SHA256 0c5110d91c6e39d605cace0c0337a3ce6b88525d6a6d9f33fd06b879a953cf46
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      wordpad.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 56KB
                                                                      • SHA256 46c356762c92ab5a7bec86603697086744736997bdf26e72a3f9f6fa648ff742
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      ImagingDevices.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 93KB
                                                                      • SHA256 335bd897756fe3062f1a650eb339a4e13a5bfbffd56da49b6943177e23fd4b78
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Microsoft.PowerShell.Operation.Validation.Format.ps1xml.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.Format.ps1xml.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 3KB
                                                                      • SHA256 cbed036339402bb304c1ec7dde151091419df0a61cefd9b5658b4ad5beccace3
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Build.bat.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Path C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat.9D2B29949985BFBC4D6E13C8E40DE518AC950B1348D5BA993889032A60AD7D72
                                                                      • Size 752B
                                                                      • SHA256 a51d6a0c960c2f98483e492118e1b1d4f61e19b6448c3f9c28415dc56c35cd58
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      @[email protected]
                                                                      • Path C:\ProgramData\Microsoft\Diagnosis\@[email protected]
                                                                      • Size 696B
                                                                      • SHA256 8904ccc41682727d1ed8f7a5a61bac9c3df489d275899fa50c9f44b358efcced
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      settings.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                      • Size 40B
                                                                      • SHA256 ab339cd648cd26ea64083d6ced7b3fa194a3b2055ab33aaef61afdb17c94be45
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      BrowsingTopicsState
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                      • Size 414B
                                                                      • SHA256 8b124f120c3a80c5a890821c53cfac34ae6786a40d4cd11e745130f6bafdba89
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      • Size 2KB
                                                                      • SHA256 a772550f605124448fc0828be856b2f869c6b0653b23aafe98786d572f4e59f5
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                      • Size 3KB
                                                                      • SHA256 6ca8102404756ac434c7c61cc4236c278f4c38c2f5e29fe652c1cd508bcd1b3f
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      data_1
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
                                                                      • Size 264KB
                                                                      • SHA256 13a54b2fe97915e3f84766cdc7ebe7d2615aafc200d1fc2b1bf11f1433129e4b
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                      • Size 8KB
                                                                      • SHA256 6bb4b750931ef02607a16868b4437d8fefab59f83ca24301a13cb999e7939bc6
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                      • Size 8KB
                                                                      • SHA256 840c35b15f0fa86e643f1689a6a416332f461ed7792832654de533828b928556
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                      • Size 7KB
                                                                      • SHA256 e518befbc8381355c8c0d3e22ee232ffc57c5068fdca42799ef8627422136d83
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Network Persistent State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                      • Size 2KB
                                                                      • SHA256 8b423469e032b694a884499f4ddb51832943f8b2cf55eb281648716cc9cf1632
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      SCT Auditing Pending Reports
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                      • Size 2B
                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      TransportSecurity
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                      • Size 2KB
                                                                      • SHA256 25c6c450fbb54edf212e336c449cb82c571e6f92f9e77285af770586cd880185
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      b3e872a4-a624-4f46-868b-b26cec4f7e6a.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b3e872a4-a624-4f46-868b-b26cec4f7e6a.tmp
                                                                      • Size 8KB
                                                                      • SHA256 108f95876bd7202738dd82848cb7ea3d1c8a7e23663ff9b8511113cfd9da7808
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 11KB
                                                                      • SHA256 dcfe3f184928bcd364e4c8c6b513a1d0f3e8c237e836b680482d05cd0121f792
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 21dfc64ccffc11034f395f0b35cb00787e331368fc9192b92ab4c89abdf59ded
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 12KB
                                                                      • SHA256 574d2c9c3d540dfd814d29a40d00e281024b468abf9dcfee1b3552adb37bc8f0
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 7f3379b307355fe0bcad17f6965306c5616ecd71c7fc85a5c6ea805764f74b87
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 12KB
                                                                      • SHA256 191d0c8df625cf48cc51c4d30434761e3d0b0da0002a8e2e9ed4684794ee29ba
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 12KB
                                                                      • SHA256 5845b90720a3833034347a237d8cc51e9e950282794abe522eb26867d45074af
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 12KB
                                                                      • SHA256 28b1816efed460b52b605fe5a9280ff20c99f4121eb93ee434314eea55598c25
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 12KB
                                                                      • SHA256 c5af2557d7d7116ee1fbf8421759a1d4b868530b723e20e1a03ce8916ca3736f
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 13KB
                                                                      • SHA256 c1fd5e7045e0e9c3430ae177a879f507a98863e3ed0433ade88405adca406c9e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 11KB
                                                                      • SHA256 0e523ff6a25e1eb94dd1caebba23c46a7ea4cb70b56ac511b7cc18e39572f528
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 11KB
                                                                      • SHA256 e8a82638796a40e3b47c2c5c224dbc52c37ad8e33393f8a401452adfe1852b6e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                      • Size 12KB
                                                                      • SHA256 d5d749397f34f588e7e18c015a3247120f4b77bce38180fafdc444487dbe21df
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Secure Preferences
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                      • Size 15KB
                                                                      • SHA256 4d3d603e82a1779e58dac874bb3befcbe5def9bc2364b44ea13d538c186c20a4
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                      • Size 72B
                                                                      • SHA256 04864fb5f2a6edc8ac6121defeac7134bd4fbccfcc09d1bfacf354ba49d9c490
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      the-real-index~RFe57c18b.TMP
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c18b.TMP
                                                                      • Size 48B
                                                                      • SHA256 b27782130ecc6296ee9c1171158ca2a9698d245fb58a9216a1671402f6687605
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      index.txt
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                                      • Size 82B
                                                                      • SHA256 34291f16a0ca09f3129132c388fbf0d909778432ae92059c6d85f77a622dc004
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      index.txt~RFe5a0a42.TMP
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a0a42.TMP
                                                                      • Size 146B
                                                                      • SHA256 8a890e3966ff9fe092a556e2c7feb8fb28eb8f32078219426c55985d0043095e
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      1
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\blob_storage\52db2edc-4626-454d-a72a-b7c0d4290dcb\1
                                                                      • Size 5.7MB
                                                                      • SHA256 e6b6572114d029c02bde221a869eb9e54959bf490537e9a2bfe05bda20650d3d
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 118KB
                                                                      • SHA256 bdca6a539797ec7f2bae4ef4dc4267e635a9b30ec4dd31b79969932ebd8ef39f
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 118KB
                                                                      • SHA256 7af71258c06f200b6aba92c7478088cfef1b085b2b2d90911075cd6ff0944f70
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 118KB
                                                                      • SHA256 734bc1bbfb470c9a32951abcf27a1aad8b388e24ebf2e61f2380e28a34b5ffba
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 118KB
                                                                      • SHA256 4c704e89e467ec2b02ec3cf5bee116b1d8cbea38d46ce83b4c54567589fd897a
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 118KB
                                                                      • SHA256 4d7143622a275627e0a3493c59442b54e530568505ea38dd9e0a7324d77343a4
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 118KB
                                                                      • SHA256 ab8ecdd2e98bd263c059be91ff053a26aaf0efe15c69710fb4f0b0201d02eefb
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Local State
                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                      • Size 117KB
                                                                      • SHA256 9e97b656c21df137cb3f1bae8a2cf1ed0b1567c45bbe5cd87e770bcd1c8943de
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      www.bing[1].xml
                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2Y3KLZLS\www.bing[1].xml
                                                                      • Size 1KB
                                                                      • SHA256 d853423ce83da7ca33a6e167f6bc219025e03bd39a4ee083004c711e7ec8f8d8
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      www.bing[1].xml
                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2Y3KLZLS\www.bing[1].xml
                                                                      • Size 11KB
                                                                      • SHA256 587c5cb6eab9f56f58f106fe3db6fe5466550d87e5fd71c33c2076ebfd6ac6c8
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      SearchHoverUnifiedTileModelCache.dat
                                                                      • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
                                                                      • Size 22KB
                                                                      • SHA256 d18366a71c84dad1d481c40dea1b8593c29d1164d2ee9244a58d9fa770ef21c2
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      5d696d521de238c3.customDestinations-ms
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
                                                                      • Size 14KB
                                                                      • SHA256 c74ad7d01ed3f0d66a146d8c08da390987f4103037b5e10d7b557154ec75bf21
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      5d696d521de238c3.customDestinations-ms
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
                                                                      • Size 9KB
                                                                      • SHA256 f9b7f75a4a8bb6602c08af64d2f0ba8453c9ecb419f78672252b524f9dda42a3
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      InfinityCrypt.zip
                                                                      • Path C:\Users\Admin\Downloads\InfinityCrypt.zip
                                                                      • Size 33KB
                                                                      • SHA256 cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Koteyka2.zip
                                                                      • Path C:\Users\Admin\Downloads\Koteyka2.zip
                                                                      • Size 721KB
                                                                      • SHA256 b5d89cd72f3ded5ee31a61775738c3881eb8984f37a265056055755847817785
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      Koteyka2.zip:Zone.Identifier
                                                                      • Path C:\Users\Admin\Downloads\Koteyka2.zip:Zone.Identifier
                                                                      • Size 55B
                                                                      • SHA256 2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      Krotten.zip
                                                                      • Path C:\Users\Admin\Downloads\Krotten.zip
                                                                      • Size 25KB
                                                                      • SHA256 8dfa496c93680adc10e77c0946c7927d3e58d79900013c95dfca3411d766bd16
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      WannaCrypt0r.zip
                                                                      • Path C:\Users\Admin\Downloads\WannaCrypt0r.zip
                                                                      • Size 3.3MB
                                                                      • SHA256 283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      @[email protected]
                                                                      • Path C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                      • Size 933B
                                                                      • SHA256 840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      @[email protected]
                                                                      • Path C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
                                                                      • Size 240KB
                                                                      • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      tor.exe
                                                                      • Path C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\tor.exe
                                                                      • Size 3.0MB
                                                                      • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      m_finnish.wnry
                                                                      • Path C:\Users\Admin\Downloads\WannaCrypt0r\msg\m_finnish.wnry
                                                                      • Size 37KB
                                                                      • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      @[email protected]
                                                                      • Path C:\Users\Default\Desktop\@[email protected]
                                                                      • Size 1.4MB
                                                                      • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                      Submit Download

                                                                      memory/424-6980-0x000000006F410000-0x000000006F62C000-memory.dmp
                                                                      Download

                                                                      memory/424-6951-0x0000000074990000-0x00000000749B2000-memory.dmp
                                                                      Download

                                                                      memory/424-6965-0x000000006F740000-0x000000006F7C2000-memory.dmp
                                                                      Download

                                                                      memory/424-7126-0x0000000000A70000-0x0000000000D6E000-memory.dmp
                                                                      Download

                                                                      memory/424-6974-0x0000000000A70000-0x0000000000D6E000-memory.dmp
                                                                      Download

                                                                      memory/424-6967-0x0000000074990000-0x00000000749B2000-memory.dmp
                                                                      Download

                                                                      memory/424-6995-0x000000006F410000-0x000000006F62C000-memory.dmp
                                                                      Download

                                                                      memory/424-6948-0x000000006F740000-0x000000006F7C2000-memory.dmp
                                                                      Download

                                                                      memory/424-6989-0x0000000000A70000-0x0000000000D6E000-memory.dmp
                                                                      Download

                                                                      memory/424-6966-0x00000000752F0000-0x000000007530C000-memory.dmp
                                                                      Download

                                                                      memory/424-6952-0x0000000000A70000-0x0000000000D6E000-memory.dmp
                                                                      Download

                                                                      memory/424-6950-0x000000006F630000-0x000000006F6B2000-memory.dmp
                                                                      Download

                                                                      memory/424-6968-0x000000006F6C0000-0x000000006F737000-memory.dmp
                                                                      Download

                                                                      memory/424-6949-0x000000006F410000-0x000000006F62C000-memory.dmp
                                                                      Download

                                                                      memory/424-6964-0x0000000000A70000-0x0000000000D6E000-memory.dmp
                                                                      Download

                                                                      memory/424-6970-0x000000006F410000-0x000000006F62C000-memory.dmp
                                                                      Download

                                                                      memory/424-6969-0x000000006F630000-0x000000006F6B2000-memory.dmp
                                                                      Download

                                                                      memory/2236-1390-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-446-0x000000000069B000-0x000000000069C000-memory.dmp
                                                                      Download

                                                                      memory/2236-1142-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-4278-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-470-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-1508-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-1598-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-1563-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-460-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-5613-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-5659-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-459-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-4801-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-450-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-3182-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-421-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-422-0x000000000069B000-0x000000000069C000-memory.dmp
                                                                      Download

                                                                      memory/2236-423-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-445-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-5248-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-447-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-5674-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-5676-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-489-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-488-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-487-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-448-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-1580-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-449-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/2236-1597-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/4212-5279-0x0000000006470000-0x00000000064D6000-memory.dmp
                                                                      Download

                                                                      memory/4212-1603-0x0000000004D70000-0x0000000004D7A000-memory.dmp
                                                                      Download

                                                                      memory/4212-1602-0x0000000004ED0000-0x0000000004F62000-memory.dmp
                                                                      Download

                                                                      memory/4212-1604-0x0000000005060000-0x00000000050B6000-memory.dmp
                                                                      Download

                                                                      memory/4212-1599-0x00000000002A0000-0x00000000002DC000-memory.dmp
                                                                      Download

                                                                      memory/4212-1601-0x00000000053E0000-0x0000000005986000-memory.dmp
                                                                      Download

                                                                      memory/4212-1600-0x0000000004D90000-0x0000000004E2C000-memory.dmp
                                                                      Download

                                                                      memory/4632-556-0x00000199DE760000-0x00000199DE780000-memory.dmp
                                                                      Download

                                                                      memory/4632-533-0x00000199DDD90000-0x00000199DDDB0000-memory.dmp
                                                                      Download

                                                                      memory/4632-500-0x00000198BA2A0000-0x00000198BA3A0000-memory.dmp
                                                                      Download

                                                                      memory/4632-512-0x00000198DD220000-0x00000198DD320000-memory.dmp
                                                                      Download

                                                                      memory/4632-534-0x00000198DD740000-0x00000198DD760000-memory.dmp
                                                                      Download

                                                                      memory/4776-5694-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/4776-5690-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/4776-5689-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/4996-5673-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5662-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5667-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5668-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5669-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5670-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5671-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5672-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5661-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/4996-5663-0x000002390FC90000-0x000002390FC91000-memory.dmp
                                                                      Download

                                                                      memory/5148-5783-0x0000000010000000-0x0000000010010000-memory.dmp
                                                                      Download

                                                                      memory/5608-907-0x00000163B3EB0000-0x00000163B3FB0000-memory.dmp
                                                                      Download

                                                                      memory/5608-696-0x000001629D840000-0x000001629D940000-memory.dmp
                                                                      Download

                                                                      memory/5608-671-0x00000163B0AA0000-0x00000163B0AC0000-memory.dmp
                                                                      Download

                                                                      memory/5608-649-0x00000162AED90000-0x00000162AEDB0000-memory.dmp
                                                                      Download

                                                                      memory/5608-647-0x00000162AEFD0000-0x00000162AEFF0000-memory.dmp
                                                                      Download

                                                                      memory/5608-614-0x000001628C870000-0x000001628C970000-memory.dmp
                                                                      Download

                                                                      memory/5608-625-0x00000162AE530000-0x00000162AE630000-memory.dmp
                                                                      Download

                                                                      memory/5652-7179-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download

                                                                      memory/5652-7190-0x0000000000400000-0x00000000006B8000-memory.dmp
                                                                      Download