80f8cfd2a62ba62b09d7ccfed9d92b0bb47fdc10cbe72c6f2d929513747970c2

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

razspy.exe
Size

17KB
MD5

01c6e0390faaed56ef1095f3ad261788
SHA1

d68aaa71f61aabc94d7c764f31f431a60d400d47
SHA256

80f8cfd2a62ba62b09d7ccfed9d92b0bb47fdc10cbe72c6f2d929513747970c2
SHA512

dacef740eaf36e4fdaccac857542316657fb13a641747013f2d95acef1c4d7fd945b5f156265651d692ab34aac8d9204fb716ceea39cc0722a2ec5a29a98a4bb
SSDEEP

192:p+VZRQY9ME6tRr99f65P7UqyjPkeKfFSgOlV7SajUrt07Sj5wcx/e3Q5tfnkTeIr:kRQYotJK5PI7Mtf2pSfwSdnm3S

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Videos\README.txt

Ransom Note

~~~ Your files have been encrypted! ~~~. Using advanced AES256 encryption technique your databases, documents, photos and other important files have been encrypted. See for yourself! look at any file with .raz extension. You cannot recover these files yourself. Do not waste your time. Nobody can recover your files. Only we can!. We can decrypt these files, we can guarantee that your files can be decrypted, but you have little time. Payment for the decryption is ~$70 We can restore your systems in less than 6 hours if you pay now. However, we will not decrypt your system if; - You go to police and report us. >>> If you report us AFTER decryption, we WILL attack you again!!!<<< Do not delete or modify encrypted files, it will cause problems when recovery! Sent the personal ID to [email protected] We will provide payment information, once payment is done, we will sent you a decryptor! If you do not pay, we will publish your data online! >>> Your personal ID: YI21-8CXS-ULFM-LG1M-B382-MYU8-GWWT-I25 <<<

Emails

[email protected]

Signatures

Renames multiple (4741) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 31 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\drivers\en-US\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\it-IT\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\en-US\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\de-DE\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\es-ES\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\it-IT\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\fr-FR\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\en-US\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\de-DE\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\etc\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\gmreadme.txt.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\es-ES\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\fr-FR\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\ja-JP\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\ja-JP\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\README.txt	Razrusheniye.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 7 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File created	C:\Windows\System32\spool\prtprocs\x64\ja-JP\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\de-DE\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\en-US\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\es-ES\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\fr-FR\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\it-IT\README.txt	Razrusheniye.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.raz	Razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt	Razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt	Razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt.raz	Razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt.raz	Razrusheniye.exe

Executes dropped EXE 1 IoCs

pid	Process
2780	Razrusheniye.exe

Loads dropped DLL 2 IoCs

pid	Process
2252	razspy.exe
2252	razspy.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\sysprep\Panther\IE\setupact.log.raz	Razrusheniye.exe
File created	C:\Windows\System32\xpsrchvw.xml.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\it-IT\Licenses\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\choice.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\Boot\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\about_BITS_Cmdlets.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPWH0460.CFG.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\userinit.exe.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\dnscacheugc.exe.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\schtasks.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\ksetup.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_join.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumN\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0015\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\bcdboot.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_neutral_0b3d0d1942ab684b\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_CommonParameters.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\ARP.EXE.raz	Razrusheniye.exe
File created	C:\Windows\System32\ComputerDefaults.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_environment_variables.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc770u.xml.raz	Razrusheniye.exe
File created	C:\Windows\System32\migwiz\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\OEM\EnterpriseN\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\OEM\Enterprise\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_functions_advanced.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasic\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_neutral_0feacd08cb9c7fe3\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hphp915t.xml.raz	Razrusheniye.exe
File created	C:\Windows\System32\mcbuilder.exe.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\logman.exe.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_neutral_f91980f20f3112ed\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\ja-JP\Licenses\eval\Enterprise\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Switch.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\AdvancedInstallers\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\en-US\Microsoft.Wsman.Management.dll-Help.xml.raz	Razrusheniye.exe
File created	C:\Windows\System32\es-ES\Licenses\_Default\UltimateN\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\System32\taskhost.exe.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\040C\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalE\README.txt	Razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_arrays.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\System32\de-DE\Licenses\eval\StarterE\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\eval\ProfessionalN\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_pipelines.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Professional\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\lodctr.exe.raz	Razrusheniye.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-DHCPServerMigPlugin-DL\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_neutral_5667cca434e3a6b7\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_neutral_c4fe81ea47c6df87\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\MdSched.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\Setup\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00w.inf_amd64_neutral_d4c93bb2fbf75723\Amd64\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\_Default\HomePremium\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\System32\regsvr32.exe.raz	Razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\README.txt	Razrusheniye.exe
File created	C:\Windows\System32\LocationNotifications.exe.raz	Razrusheniye.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png"	razspy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	razspy.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21332_.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SCHDREQ.CFG.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip.raz	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm.xml.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\README.txt	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR44B.GIF.raz	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECURE.CFG.raz	Razrusheniye.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.raz	Razrusheniye.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe.raz	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png.raz	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\settings.html.raz	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341475.JPG.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143754.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif.raz	Razrusheniye.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14579_.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\CONTACT.CFG.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif.raz	Razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.raz	Razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-io-ui.xml.raz	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\README.txt	Razrusheniye.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\README.txt	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\README.txt	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\library.js.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png.raz	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ar\README.txt	Razrusheniye.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\README.txt	Razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\clock.css.raz	Razrusheniye.exe
File created	C:\Program Files\Internet Explorer\fr-FR\README.txt	Razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\README.txt	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_h.png.raz	Razrusheniye.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml.raz	Razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png.raz	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_left.png.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\PROOF\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\HEADER.GIF.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png.raz	Razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.raz	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html.raz	Razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\README.txt	Razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png.raz	Razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\README.txt	Razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.raz	Razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\README.txt	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png.raz	Razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\README.txt	Razrusheniye.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Media\Cityscape\Windows Exclamation.wav.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..utilities.resources_31bf3856ad364e35_6.1.7600.16385_de-de_366e92d1fb56181b\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-16.htm.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_wiaca00e.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_545d773c9d8cdc13\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sud.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ac91535ed7d90e6d\README.txt	Razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cttunesvr_31bf3856ad364e35_6.1.7600.16385_none_efd12d677fabca7b\cttunesvr.exe.raz	Razrusheniye.exe
File created	C:\Windows\Panther\UnattendGC\diagerr.xml.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-fax-status-monitor_31bf3856ad364e35_6.1.7600.16385_none_e539ff37112f9e5e\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppolicy.interop_31bf3856ad364e35_6.1.7601.17514_none_2001b9c0d3b12e90\README.txt	Razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Services.resources\3.5.0.0_it_b77a5c561934e089\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6a01cab655265f19\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bff21f675e6e5524\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\msil_system.directoryser..anagement.resources_b77a5c561934e089_6.1.7600.16385_de-de_05efe1a6c14ff3e1\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_trap.help.txt.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_61644a76f0c0ce28\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-eudcedit_31bf3856ad364e35_6.1.7601.17514_none_5b9fee911dc04044\eudcedit.exe.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_92c644cf14bd6a75\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\es\SqlPersistenceProviderLogic.sql.raz	Razrusheniye.exe
File created	C:\Windows\Cursors\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\combo-hover-left.png.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_6.1.7601.17514_none_12d42225a9a7aef7\rpcinfo.exe.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ntlanui2.resources_31bf3856ad364e35_6.1.7601.17514_en-us_a12d04f6f74c4893\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_prnky008.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8e1d7961b84e74b1\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\settings_right_rest.png.raz	Razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_it_31bf3856ad364e35\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-radar-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ab769d00988a82f0\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wordpad.resources_31bf3856ad364e35_6.1.7600.16385_en-us_08fe9bbf78f724f9\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.1.7600.16385_none_6eabfbd9c29ea607\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\msil_microsoft.web.management.iis.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_b94644227a7040f7\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2b518fdcdf2e2f55\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-powercfg_31bf3856ad364e35_6.1.7601.17514_none_5faf24b6d52ba3de\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..how-other.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6469368d18a3ac1c\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_55452580aa055eef\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_f7eb9a7e570cebb2\license.rtf.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..stion-detector-core_31bf3856ad364e35_6.1.7600.16385_none_54dd4ad229c92897\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-runonce.resources_31bf3856ad364e35_6.1.7601.17514_it-it_00549ab0f94c31a1\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000461_31bf3856ad364e35_6.1.7601.17514_none_4fbc4b5caf389f8c\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-photoacquire_31bf3856ad364e35_6.1.7601.17514_none_363dce826b046f1f\README.txt	Razrusheniye.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..layer-vis.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e89c52d6f87fae01\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_prnca00x.inf_31bf3856ad364e35_6.1.7600.16385_none_e90677c70609283c\Amd64\CNBP1.DAT.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_prnhp004.inf_31bf3856ad364e35_6.1.7600.16385_none_306093dc85bc087c\Amd64\hpc6300t.ini.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..mostfiles.resources_31bf3856ad364e35_8.0.7600.16385_es-es_97753f09331df5cb\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-j..buggeride.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_d1017a546700153b\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..grams-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_fc67d9b6332e34fe\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-54936_31bf3856ad364e35_6.1.7600.16385_none_36f037fd59607046\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_it-it_e758f14e24a55ab9\lpeula.rtf.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0212532a5cdf4b5f\settings.html.raz	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ceruntime.resources_31bf3856ad364e35_6.1.7600.16385_de-de_90d7ec18d9790eed\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4f22d831ba835543\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-themeui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9d95d7f2cf298df0\README.txt	Razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_en_31bf3856ad364e35\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_mcx2.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2117d6308f6c394a\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..installer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4fca51c9a68789a0\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-ntdll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fdae97456779bb9b\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ment-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b44adc711588829d\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-rasapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5ca843a91ebaba76\README.txt	Razrusheniye.exe
File created	C:\Windows\inf\.NET CLR Networking\0000\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_19ec38460d920c99\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-usbui_31bf3856ad364e35_6.1.7600.16385_none_b744079ec68fe661\README.txt	Razrusheniye.exe
File created	C:\Windows\winsxs\amd64_wiaca00b.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_158564b1eb7c0bb1\README.txt	Razrusheniye.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	razspy.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	razspy.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2252	razspy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	razspy.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1196	Process not Found

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2780	2252	razspy.exe	32
PID 2252 wrote to memory of 2780	2252	razspy.exe	32
PID 2252 wrote to memory of 2780	2252	razspy.exe	32
PID 1196 wrote to memory of 2140	1196	Process not Found	33
PID 1196 wrote to memory of 2140	1196	Process not Found	33
PID 1196 wrote to memory of 2140	1196	Process not Found	33

C:\Users\Admin\AppData\Local\Temp\razspy.exe
"C:\Users\Admin\AppData\Local\Temp\razspy.exe"
1⤵
- Loads dropped DLL
- Sets desktop wallpaper using registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\Temp\Razrusheniye.exe
  "C:\Windows\Temp\Razrusheniye.exe"
  2⤵
  - Drops file in Drivers directory
  - Boot or Logon Autostart Execution: Print Processors
  - Drops startup file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:2780

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1196 -s 1896
1⤵
PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.raz

Filesize
27KB

MD5
94d8ff2933096b58be53cc3a51af62e8

SHA1
2afee826b04f806b80e2d4b8d3d232f53a03db1a

SHA256
7ae70917d20fd36c12339ddae64ea595011828881cbeb8866ef572d9e8a5b68a

SHA512
9509a09abdfd38170fa32c3593c7ffd830a90995c8fd3135c0edccb19cc11e7c3be2ee9807df4b64f471219b8887c8b86f1bba4127eb3959b2a6cd973da2860f

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg.raz

Filesize
5KB

MD5
de1788a8b2d643e6f61e2de051d3a1c0

SHA1
9b506b5c04105b2f0a4ee0da668a0c2e9b7eeb46

SHA256
b74ea3ad181ebad40ddca4273ca1db68c74dfdb1d1071075e7f60ff5d56be76c

SHA512
30af2a20f866f34cfc8810ccf2dfe04962607ec23f7542047fa9f8b0e10d1a620ebf447c6bdb5849f4fa9049c2357ea782ef452f17627c754557c6a0d65649a6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.raz

Filesize
352B

MD5
38b0fe7b0d3aa9b6b7ad79c0c7de35d7

SHA1
6bab35682b97f57e9b5f34f7ab95b0c7dc0b8438

SHA256
779215b524bb4dd1db9fcb98456c46b375c5c3e85f78db59cabac05617cd2e1c

SHA512
6d0be64da6438c2ea8cefb4d0dc38f9416998e211654116a71341dc7ba967e94c6f9a1001259885a768dc9503ad7cb96b7017984a91a70dd2ee2b6862ce90d10

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.raz

Filesize
224B

MD5
b9af1897f1262631232b7b393fe09c73

SHA1
859fff98cb3de2012465fe99ff416b0a1bacce2b

SHA256
d7493ea6adfb2945fe3588849ae65e86d6abb77ee1264913b098a08471229b5c

SHA512
718597ef878c93db2fa29f1486ba464568c6ee5c2107f8593ad69ee64e2d790db83594a749800a6d9258a69f3d89005a1ea7a7c4900acc81b533fc96d62df683

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.raz

Filesize
192B

MD5
ea7a9b3410cadb2c5a1d19cb215d731b

SHA1
75aed68c0ad8a020119f710076ec26ca2cdb2d07

SHA256
a88a77f1ee48cfd088ec1cc620e21faf1e06d7766b12bb1ab392a12adf91965c

SHA512
06708dda65cae8203040c7acc38b7c33f15f1146c656298c73ee50a1cbaf97e41f7f87c39c9e7480ebbc26cf8c1d041d3e11b53f07e1ed24f053a24e12d7643d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.raz

Filesize
512B

MD5
58ed2f01b4ecfc97b158d3bf3cafb11c

SHA1
2e6aa2ac02435346e2a0ea50ccc0d660ce3a3fce

SHA256
3c130387c6e77f9795174b209c00b7dac2333316bcebfb452d3e6e0f99ccc4f8

SHA512
5d12140acfa3127deef1653719f278bce8052aa927acf2d2505d65d70320948e7b0180b074e57e0937b4ececbab1d060452eec2e3262c135dd8f067edbe17a67

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.raz

Filesize
1KB

MD5
b9045ab84f9d8640ce361198d6a48577

SHA1
87bf3bb86cfb417b5aee9796c20d5db6781a8bc0

SHA256
a83c48d2accfe73990bf1e0fd13cd00a437fe502e4ba56fb7ed10661f3993c6f

SHA512
8634ec9e3967ac762988f9b354f7e90d989080cbef8031b927229608923bbc84d14a65760edfac81f68a9ac8a0bda67dce5dce100ee90c965bc73f58f83db3ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.raz

Filesize
816B

MD5
1fe666bbd11e4c8d735147fbef53c91e

SHA1
27ac8b6981b7c33aa17efab37ad7cbaef671feed

SHA256
58dd2026c8b3cbf4fd5e83aa42108aee5be07b4a5123518f97bc85564fb034e3

SHA512
a305fa9845191a1c5e749e5cfd20b00cd731752f250cf1af5e900759d4ac89214bf219b0835ce5102ab0672ef890445823b1a37bc42daad13432a76bccba5828

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css.raz

Filesize
19KB

MD5
43ffb4087ce7f54ceeb241ebfd0bb7bf

SHA1
50b4c6881a8162b72cea7fc7a7e66b5aa36fc28b

SHA256
3ef1428bd043d9fe8e9e583fadecbb9404e407c3df960e5204b65f29debcd290

SHA512
204f17825baf00aaf1414bc0b4067de29221ceee3c5e9bf8258c00bec0d28abf9e6d95d348c292cde209534d174496f843ef20633c41a7c9bbc94ff97afff437

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.raz

Filesize
5KB

MD5
06e21afa629d24d096393bb7f1e6ae1b

SHA1
615594d6658db2f9e88af569fc47709780ba1c2f

SHA256
c5d2858060f3ffb0c424d8432717c7668d92f6c33da090ed9e7cb4b66628c8d0

SHA512
4854cbc4d4e453ab024a906f061423095c39af040de0ae043d3f9c0247037ea56fa11245bb95b22ae8859e397d41e9200a10328d511d83035f6867413ba643b3

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.raz

Filesize
5KB

MD5
63e7b31eebd2a5c317b1570dbf40149d

SHA1
afb5ba410fb6082f1315240c8e725734323821fc

SHA256
11c0a856744e7f949d742bcc87be4431054d3afd1298c8aad8cd8750ccde0691

SHA512
611f24009f193e6fb327453adba266c523e8503036626131ea0bde11eeb93915e03a22a2fd75c653eb911f8f0bb6776c934cddb5f1b64194d7bac12aa8dcba14

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.raz

Filesize
4KB

MD5
7482543e4a084a16a462712e5bc00ca6

SHA1
8b0aa49fda57ca0ee915b3bb8131086075fd9669

SHA256
07f600befcbd686f673199cdbc8c36749dbac7b515a0be4e3efb4f597c170bfc

SHA512
f38ec9c0fff9ab6bd28d0c6b2f273615c8c74262a7722b84c8c9203bd387dd7a891c8fada92698c4f6a8ce64261ecbea3ebd8b91e0e7c99f66df5ab8f6c666eb

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.raz

Filesize
4KB

MD5
172c7d0ffdcc49f094435a09d2ffab13

SHA1
4c1e921d99497980cc227b64211402cac569f05b

SHA256
fce5d8e8473bd104b58bb56baf0d1b765d5e2a460773f7a213781c6cb4bc420d

SHA512
439d655e36ead223367299067addf7854dfd01360da3501737a03045a2d474ddc9e4730dd18d1d69e145851fc830e4e9ad5a699517fab36ee693fa5f3dd38e0b

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.raz

Filesize
5KB

MD5
5645c229dfb7f57307f21aedf56d2fdb

SHA1
ca310ab8188560fa3262b14fc9269b2baeff556c

SHA256
08e0d299cbe2a891edad00f38f54dee012b5f9297d3b042fe4c1aac612453a19

SHA512
e5254a63c1bb82e0158ee3bb8d5d1dbc4bdb098352516eb6962f930e0bbb19d3b33c1acfb7d9d8e1f20288f1346ad33bd9b62f98373dcc2b765d8e4823ad2e73

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.raz

Filesize
5KB

MD5
112f04b51dbfca9ce31a01912bf0b837

SHA1
eb836e6022a19d161fd7191b37d0f0efa1e25770

SHA256
5ed448ed139306d6ac4bef54c619c3add8656f7f61568f9970e2f8fc7d4882a7

SHA512
76f5d80c82049624dd5f502de16b317561c3cb512c9a7fa211eee2286162b2fbbd42d099ead119ebafd3729ecafa66ee4fc7109cf877b24de0edfbd7669423b2

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.raz

Filesize
4KB

MD5
de416a2c0b212a2369c3586c2aa76af1

SHA1
323461f66d92af7951617118eb4f09dea3a757ad

SHA256
f811916d262e8a7ea8202542bb0656fa2a9560537ef8bbe1cad71d5e599f1ac3

SHA512
b21fe1b32d56f10923c5e48821c151148a9fc6cdb94cb3786b637e8331f3148575761338242f12479719edd7b142f703f73eef11b94075bf1de1e6471f99cd44

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.raz

Filesize
3KB

MD5
9f40eb0fc9fc2cb9532bcd50b756d597

SHA1
e6425a1618b4166f6d9a1f13296e8eaf43d58d80

SHA256
2e5bbffa3987e5f86a22d9ea130224fba1f36eee067639376126bdd4a0a72c6e

SHA512
a449e5d59a11c7561be4f9ff8091ccb5a9e734c6126fa37803171e9a52d7b94c5046958d9d88e8cd57185de2d63ff6dc4f82ce83ae039325120c6c9e0398d1e7

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.raz

Filesize
4KB

MD5
18d75e4b74ac9dc07f717b6e0501564a

SHA1
56a5977cdde5fe30a5450607fc346079db1701cb

SHA256
5c55d19b20ee73ecd899df1db7842c66cd25e0b36a16c4ca1b76587da4c75adf

SHA512
03b8c60183f01f6d5c868a67293fa7e5c6602d97af0545ec75ffc00d13adaca4d55abdcb62eb0ad61259c4d3a008e1454a5265cc2473a403db8e77881a0969c1

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.raz

Filesize
3KB

MD5
7b5477685f24b4fa2329d739916594ad

SHA1
7c36d501113bb6a766eb8f12034df074d48ef873

SHA256
aa1c006d32455b1251e18f3cf2cdd39fb5a079ecadfbdf001c63260fc6a554af

SHA512
7f4ef1d2174b92901994295dc11a30608f9bcddd5f53cd4bbc42ac2d9d19e0547eee896481898e8d9282fd9d047e996f4ba0b6740a826cf9251425a649c34ad0

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.raz

Filesize
4KB

MD5
1b1f3677035e61166536b85ed2f8ef98

SHA1
065e50415902dd52ad8226a8901431c8f9582af3

SHA256
471a6fecabc3e59de1ba187e4a3c3ac52e559ca9fdc1db862609d476770cf225

SHA512
e8db79e9260dd1f47f29e98032a2c5b34f09044a57f83a275f004d90ade6df976d0ed64abd986f676e4978b26c67e4e60a0cfd7ce9c61ce6e685170463ab813c

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.raz

Filesize
3KB

MD5
831420a113187c8cdfe41990dcde62fb

SHA1
26a0fcb6ba2febda2c1b1ed50f1620e845af101d

SHA256
baa8d746a6015d1695735e2621cc3eeddd2950b15a8353d10f5ca2a3a8738311

SHA512
ecf42bcc1fc1e2650025eda77207bcf27d2004eef160bd8cf5deb5334927e0c023506ce7941f063f31b4179522c6d05fde59d153249c258a398fcfc62ac3fdec

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.raz

Filesize
4KB

MD5
15ca3ecf7098ebf6c7ab87b5f2193016

SHA1
e86f2e62d52d24ec08d8337334b417e64b9b5898

SHA256
1a4ace02e1ae46081cc2bcaf585ab4c02609ea6fc17761aa1885550b54d0b75d

SHA512
3e83fb1cc4ec071cb195615c691bd4f48db07d15d6ae0ae5177a2d6a1939f9ca50400466460754f8567f77d54d1f95c420153a5f370d8aed138033dbae0bfea7

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.raz

Filesize
2KB

MD5
3d3b7ec1465c83a6dd4b53f154006a87

SHA1
05e600a64eb3de8747abbe99a398c5037f5b1fa0

SHA256
fb679c36f4db8c12dc618772e36dedf483183fa7d9426d2af6d6833a52a833b5

SHA512
187fe2bcb924056d74b02b4d2ea8a384a08b4f37d57dbfb818fda8e4dce3e9d6a0b7c837e015c1be06902a261fba87739e0b43ed8eca4d77904a1e03860d59b4

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.raz

Filesize
2KB

MD5
4cebe262d916a8447bbbd42ab5f187d5

SHA1
e9e06b2813c9d747a6c689c67bb67c25f6ac4a1a

SHA256
e52851fe5c60b2d5c5b7d7decb406848e16d9ae8d5ad235adec6de119e46999f

SHA512
2de1d9d6567b5af553bd19142d9a5a833351419155078616ba5fa0e429c369d833851756e111c5a1f324c74b8868fc7ffc0c9c836e279a28735e1c98426b353a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.raz

Filesize
12KB

MD5
a49fe34f23a9c58a89449f52e1a0a415

SHA1
f90954ded049f08a9b71637826dfeb024ad4885b

SHA256
9046b4bcf8203969baebb896dec4a362297933ccb5bbd2d3a25f9c95f5b5e730

SHA512
6e8d5b362722c74c5e633a16aa7ee8393f71173b0dae0eddad8ae6949a823f27ce7def7eda743a2d65f458bddfde2fd420bff7d7968c0a454bf10f2877db593d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.raz

Filesize
8KB

MD5
1b49a02914e0f593fbf5a886b578c05a

SHA1
391de50e61161fc3ed22682239f327d09f215da2

SHA256
62a44b01dc7af8471eca46b2f0bde8063f974bb43a359e94ceb8b75aa4c745ba

SHA512
7194d5a969baf2c92d8444418e97f114bc778f9e16c1c3a88344b2d5914bafd1f16fa63e0959047a9bd9bf9ebab33f4ba40a6d543ed70ca601606ea572dbba5a

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.raz

Filesize
160B

MD5
1da48e8578a618c9379e46d5a3692529

SHA1
580729bb1b36888576c1efa11674a07b0fd8b680

SHA256
20da1d99ebcca3e823af3705899c4ab0acb8fd205316e36b57a5ab9b371aece8

SHA512
eb0aa506008aa8efe91a7480abbca15136edfda82f3b8e2de4edf94cdf50c541828e5eaaafa95ef30a09a18b32385a8cb3ef33ab0c797813c22edf48e93ecdf6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.raz

Filesize
1KB

MD5
e953390be8fe0523b742c704f76b59e3

SHA1
e92a37d2d08a21369faa68f858cd0e34967809c5

SHA256
883dd2a9892289784ea2c8abef371bb30c5c1bf0176d00febfb2d74f53abae62

SHA512
f926f2bf192acec68446ffc0e62ee06d98ba95fe5d4c6eae85aacbd762e32e90aac4e04828bab255dc6806bc2fafeced98cb3dd11c79efe3ca1dced8566d23cf

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.raz

Filesize
4KB

MD5
91a2a6e2d213cbff40ce5e4f99a3ff47

SHA1
79f364528ec4b639055b2e2da88a1c171487e94a

SHA256
ec39b6a57353605b0adc1123a10b880d27351b90aa274d1e320f5354e1fd1dfb

SHA512
128abcbb9ec0179df1866f238125f3be4c366555c8903c9561973a8975d2fd9ae57fef3bd29536085fcd7f8209d557a0148c195ea6c54340700fd264a198d1c6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.raz

Filesize
4KB

MD5
0a130ed8f5fc2a10334734a4ad5d1c50

SHA1
3b5a53de0ee066ff8732e5d8c7827ad48c52c86c

SHA256
adbae9a5160deb72d7a05df9f8a0a74a43d3f2ac5ffc1c5afe5559ad15556c1e

SHA512
5e0c14e8582ee0ebc00806aa823d3295c58fb68a3872e4aa85f49c1d8452a3d6cca176c4d34743f30fb2be44b41cb07840312ff3fe220f47aeb180f72b65afb5

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.raz

Filesize
688B

MD5
512414a655ff983fe8948c4ab83b748a

SHA1
4d8b2e1786ecd9f16169eaf43fe08ca1ee00e11c

SHA256
19dd0092066c66ecb4302ddc73166629826506df48129a1830e2650e95451cc6

SHA512
2be13ad14ea9733f2a5f316112293d499b13710ddfa6929f681c7d6564ce778a28d1c6330e19cb0205c617cf6eb2712d5d251e0bb293af9819e9875b6a4ca753

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
064eaa15586e33c68e7bef5fafe915cc

SHA1
b9303b80f7a9cd8c2aa5bf718f244f1b257263ba

SHA256
efd60f876e113493faa4d5c5788f8f9f7d60fcae3c7717eae3be1722fd110a05

SHA512
8812e491b76367a7d4cc8e5e54a149e43ce54f3d9c95ed63fdf0543fc85be56c2220b7b76a5025a03ab46499f73dcc876f424b14d65730937557bc53ad527464

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.raz

Filesize
17KB

MD5
59a0ba837c1a75b208fc3558ae877ab4

SHA1
96d2c7580fa67bc4f5253ffc294daae107f890c3

SHA256
8af04f390d2f0c9213e9a312f983b91f15316200a4fcdd4f25069c1631a82c02

SHA512
8be0249c3aaf1115b9d8ab0d3be93c5efdc9993a670442cbfe0f78ce90894c5133e0d0cab4f600b1053ae08868ef55e3073c82ecd1168903dca4dd8beed7c115

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js.raz

Filesize
9KB

MD5
2f5e2af080470a7e18d3266339347ddb

SHA1
78ac405ff2a61cdcfcd72f0298aefde8f24f5097

SHA256
80edf42c091b1fceada5ad4299e08540cd3b658c36f559859c0259302e9b6154

SHA512
a402cc54d19e379ebbe78e88363f2a7b0ecf1b49624077bd6bc647ff5e637e92ef1b78f58fe8868dd4a2f6dc3c91f3c635c53e630226d92ee985053d188cd530

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.raz

Filesize
5KB

MD5
e723b3d1015e648df8aae6535c99f170

SHA1
282d9e0937dd3973ce3eff3bf28411c95d4be57c

SHA256
880ac3e5194f08ae608ad2d41d11f69dca2e71d19b95087bffce8a1ea6f60210

SHA512
ed1a1bafab3f51f792d091aaa6dd4a3cd346480b115e25c17bed2a87006ed4a277ca81439589f43c7a7d514156c36628a6eb99f88214fe4e55c08d769a930d90

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.raz

Filesize
65KB

MD5
770a4e5d9ad4274e501c6b2e21b1adba

SHA1
eb1d2af6a55db52c9effe2292027bec79c8a3d59

SHA256
8da13e5a9d30ad0e06a2f9f7db91780b37e2d8fe2e68fe2985f161de8a32d08f

SHA512
510f65e253b3294a5f00bebcdb95ab85fbd3c1adce1c3a904e3e17ad0acf39c7f1598db1a723c68fd5ab0d8b2df2dde0daad300dbc6854d3c58a46937b5757a8

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js.raz

Filesize
736B

MD5
031d2dca64e6cd3ccaeb9d5c2dc48e43

SHA1
7872adc4ff65dc12974a4f98a79a5a80c8a812c3

SHA256
aa55f989fed298bafa6e2afa237e4485b9eab740b2ee44b4dc36012d67b3ffac

SHA512
d828bd8977f4eb3bd59071914efe77bfa2c064ef17adfe0ae5903a44336eada4e69df064b6c121a0873eb2ec5e8cf7ea7899d569d664cae5bcbd51ad001adf29

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.raz

Filesize
5KB

MD5
67fe5ed2423659cecc276b4c8eab2141

SHA1
7050e952fc3577d26493926184e0874abf345eb3

SHA256
19c3fb3b950a2a30dc022c3c56261c1dd895afb42c978364e59858fbda04c5df

SHA512
adfaf3462996b7d3068911801fdb3380d55f8c3690b65119de5fc963bd7c0277c1c45593d553c1181c90742c76053e66f61a3841bbcf5299569ede958a17fbb8

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.raz

Filesize
7KB

MD5
4bbfaf40608323e7d0e1600383c707a0

SHA1
1c87eef0f4183e0ce4a82b1ac0d7b05abfe571ed

SHA256
263c27f83e3d0bc7e8e0e0193ad3eb7e6d906e6d84adba5081d66e5e73ba2665

SHA512
e560b00bca6593df439ebd28ba8a9b1c61bb140b4b0dabbd2f67e8da62eac18cac7c3a6ad6072b073b8c67011285614c6bb48a1fc1355a4d4052a45400849d79

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.raz

Filesize
4KB

MD5
252cfa3862ed03c8ea3e75305d89ea6e

SHA1
a2f094a8fa55d6be1688f17a817f7067733a1e30

SHA256
50db34b1e912b0316caab560e180ca6cb78e9a290cb9484425f1328a7f0349c8

SHA512
737e798d5f88fa6589fba0bb86dd03f98da60b2b7f843a5712a264eff5c43f7685ab63fbe6683fc9dd38116121ccfbf50a8cff3b943e457132e6081b7582a6fb

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.raz

Filesize
5KB

MD5
ba4e8f39d0e33004484cf0c30805ebd3

SHA1
5935bb579285410d014aedf8aaec614efdd7be88

SHA256
a8159fcd3656fdffb0fcd551d0c342d10ab3447b18ec69400f38dd064bf55b97

SHA512
c63f40d9caabadd592dab2f46bf82cede09b037a5dffd4fbb1ddab68d9573e473ade0f942af97aec60318c47a50cdb29def94fe8c8169e4f9f687c7007018d28

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.raz

Filesize
2KB

MD5
ad848186de9b52e365706f2134a08148

SHA1
2ec85e25f5554b40ea02aa88ca1c75c9f45bc2a4

SHA256
fe92a6309339f9c3425be27ada340a0e69c68114ee129485f885b9f1c69e69ed

SHA512
e62fbfa56925f53b29f02f97bf116d12e15f47b7bf5b33e56526c2ce598f31bcd465aed546dad1e0f24960c96b4d146666db026e9585083aa780f85b69adfca4

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.raz

Filesize
2KB

MD5
f5c561fc173553d143f4e11515c7c72c

SHA1
fba4cca7f9a344156c9267099d6613ff2a05c776

SHA256
8a011a56d4a1e4645c660e49a6a84477f2efb0486742dbf54bd979f4b7960b50

SHA512
ea700c1d0b9ef3e145f5b1e034e26bdb7a01428b87a1b273443c3a0db716d98fc68ff0b6121ad2a5d25674cf17e60959a7a305ad0b37d6e1111ab690af4bf626

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
6427276f4ea2ac48c8a064d8010890ea

SHA1
730ff78b288c359e27a1b55151d93a420092c788

SHA256
916a5b6a6a3709f5b889ea4c82225ae912bd2126ba314c476254c262562eb8b9

SHA512
e5741f1d99d6f29a242b221b6967ca761e73e7a119a5be235f8606ab4633b9d260c2f80956795a8df12141278f83be3d8d8eade6a897ef7aaf80c57556b76bb7

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.raz

Filesize
5KB

MD5
5b35b88e7acff590cc49d4d087f61666

SHA1
89182fd49e9f0851bfe63c61865abdc3f1fbddca

SHA256
8ca9effaaaaaf35cb4dcfffc4e3fe84894439836ea04cfb4049d5c2fb6c2c815

SHA512
6cd93b2ed6f59282a5157bb21287ee429aaa25789623b31c940e88bfa832fbe70adac611ed1bd13ecab019e5a957b80a2a65fa7e23d194e1f54748af42890f00

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.raz

Filesize
6KB

MD5
aa927dd4d1f3c51aa24e8e5285a663f9

SHA1
15a7338b63f2a0e335a8e5b325dc4160b93ffa06

SHA256
cce8abd2625d04dc0d9948848b1960c76d5de8b62b9e8c1bad06836cd02f3744

SHA512
5f3a811075bca86de07a9a92b9170de9cc9efa913f21c94c596eb2bb24c96370d26cb70a2a90fe515feda5f8835b39d358418c24fd59d8dd404f3bd6d650c674

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
7bc85e4dafe7ac7d29d078f787fc066e

SHA1
61cea616a6d72f719c7fd63d454c0d567a637b09

SHA256
c7977337b74d708c44e8e46756b94a913b9e866246127d7f0867e3acc72c7ba4

SHA512
581e1ada89e593ecfc5cac1b22e64e8c29dc6f29aa9ac75c77398d2ee66447691b1cb935e3f90f4703e136abd88f6feb53f5566b12d540256714bd93bfec02fb

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.raz

Filesize
4KB

MD5
111dd2ccf6155094c3d32b13192d8388

SHA1
e272d9717921d907e132887c97e0aaab73436073

SHA256
e5b810282a7f23b306e35423d835a2c0440e80802ef99a4d103abba512efabb2

SHA512
00965691c4f04adec2e06e4f6538c977a31a8cb715088889f67e38001bf17a586c7711ca513154abebe29b9ecf572c812295e299d1b581a36827556ac53e6244

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.raz

Filesize
5KB

MD5
bb67b57db7d7b56bf248759e27f27592

SHA1
46f2aeeaa608a781bd5a15704a52b3b4b2621efc

SHA256
901c30b8825a6fc85f9720fa6fd23267b990d8ce3d7d80a69428bb5b0bde6b3c

SHA512
3085ddb69e55f338d5c3c1c0ff99fee17c70eb1298b6f8cf107ca1242ab24e389f02f51f8b6a50900866d954dc0c19bbdf0faa843012bf057eb1817bd166223c

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.raz

Filesize
5KB

MD5
cc902b4c54e31b88b3647b0bdbcbfff8

SHA1
424d204ab9a288550204cb81bbd809eb9d35e834

SHA256
4da877e292611b960a6e90334fcbfce0fb31a9efda4b9471b727803efa71a6e8

SHA512
58ed2b8de1803ca3bb120bf39787473ad82fab43b5ccb87e871ec3b2d55546a6598be0724c17cefd2f6629251ade3626eda8cdc000c85e1650ded6bedbb6aaa1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.raz

Filesize
3KB

MD5
981903b07789831ebd4b0a4a3d957a9b

SHA1
ffde738f6120e303e7448404d973fe460ebf5535

SHA256
68ab41682bf72ef91142c6839e2ea080b4c6d60c5c2f11604b2d0acc50e7c213

SHA512
700e6091ac425a4d69a558146ae0784055d2a3a8ebdfc9268c946c49dbe355374b9da1516e54fdaf510093962d2ab194fce9e3f084389373737736606217be74

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.raz

Filesize
976B

MD5
818e8a2c745f8f86fb77da51dd7557ac

SHA1
8ccf63a0a298fcf7f1903726600f2519313f1d3b

SHA256
d55ea61251e41059269477b6fca180bf92c579d1d6f77178661f71f4d4f61711

SHA512
499329f1caccb9d5b73f9dc32cdc7ed609181533d5cc9bb473da63446aa6b2aa28d729bc12382bed5bcaf6cfcc0dcc6cef5ab8b377517b01dc311e930bbee63e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.raz

Filesize
9KB

MD5
7500af1e8f183a9b6d6afaaa184040b8

SHA1
86d9318cb8f4ec387c25faadafcb4a312dc83bc0

SHA256
e8ec41499254992949487348d8dedb2b7704ec0a57407a79afa516c4b5158b23

SHA512
86e82ef7da33c82410be08e2bf92f174c294cad596f5bf3d675862c35a663f7c87b99ac2a91026466c3439c3ddb8ca9376f14196539ac775b6573cf628eb8229

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.raz

Filesize
24KB

MD5
bdb6ccb42e313564221bea3daea8383c

SHA1
180196f62abc682b26e55482a62ef18a171c8f42

SHA256
42d25326e6790f378b9aabad0511032a40383ef654acef9538ae5df4e2710e86

SHA512
fb82b24a781cedfac25c6ad7e9bbb87468e7605621246008bed564a551c0de17d5c1efeaf08d83f7f4c6f99d55ba468732f7952c28a69c28ce3d5483ba45dac2

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.raz

Filesize
1KB

MD5
daa0b9149fc5da17cf037c438d7021d7

SHA1
231d564c29e17106488f388b723df64b8bd80d0b

SHA256
ce8f41195d3dc98519158c4499ff18a979220fc1b776ce9efcc8ac80a41754b2

SHA512
23f723aa1e7fa280b337afc738da11c13a61f298dce3ec2c894a67d6e70fd1636085173811817492c2c60fcb51b410d13b746728676d1c22d6241ca4de014523

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.raz

Filesize
42KB

MD5
34355c8d725c58e25d9ff7938d011ec0

SHA1
400041d39eb1f78792a06d41b1d49aee0c6db94a

SHA256
a1ef6d8683516c76d64c1de36fe3b39a6f8d0276b3977f1a9f62c8e3744dcabd

SHA512
b3851a0e7b71c1c7f6e77514c7eb50f2db9673c42f2baa4d76e2d9a1c9c4cfcf79751eee55a9da9b1bc33f8eb0ec435f59103310748e639fb15554bfaed6885c

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.raz

Filesize
14KB

MD5
fa2503a6925f3f34184bb7cf52c92e6c

SHA1
cc4838ad2d55e4479e95cf6f8cc3d3386a2a9556

SHA256
e393c2f98184cb399def81f56894ea23ea7953591796f2bc2bcb6e23c3611ec5

SHA512
a46a7f295c432fa97465652a1a47967b188de518007620b145a8470f74fed7cd1e0b0c99310548557dc0725fae01d6aeab1fafb71ebe4fb78f53f56c5ec083ce

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.raz

Filesize
56KB

MD5
d4ef0214a31175232ecdd0d13ebd62fa

SHA1
7ab00369ed2e9b696a20a7a7d47dafe00fcf4a6e

SHA256
df4987ad266f0d6d0386470f7f472ca1d53435266f84e096fe3a3f01366ff5ba

SHA512
77a543ad616f6af3104e883ce2a77ce749b9daf4096d248a79746bf5290d9f5be1e23ea389c06f59a496e109eff28afdcadae48f6a6094db2cf64096c671bbe6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.raz

Filesize
132KB

MD5
c08f1f465dae1d8901af2830c563c941

SHA1
753832e1d4fa0c38a88cc396b7cfa86fc41971af

SHA256
9886986c4171c2a14779bc6068e5ba92993095285a089bf49d33062f73686cac

SHA512
3385ff77de4c7ba56f4143af330fd203d69d6ea50d83c91312149904167c45d75196e5c1abbec1b7b1f96860010579422e02da93522bb5cf8ee032bcc647bf00

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.raz

Filesize
8KB

MD5
7b5fabff5d3a8f0abdb666a204cf2394

SHA1
f2a262a4798ae3efbdfd1ce7b1cbbeb9247d12d5

SHA256
c9d825673e2fb4554a79f40355b2788025b6a13bb355f9875bdfc60a008768e8

SHA512
8c24b99a864a311e1c1c59e1e03533f06e5ae85eefe64c92ed6926bc0decadb7236732b926c265d847c1b4f107cc7e8d6c87301ed95f75cbfde14e39ae516948

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.raz

Filesize
15KB

MD5
23b34d9f48e07d47529a58171aede313

SHA1
121b1b3b67b028aeda866b4e9fa67716a6817472

SHA256
eb587c85d4d765bf8d0196addcc8cdbd6314a6091822349d785258505404618b

SHA512
9b399ee61935b2b809ed4e96d60780a40c9740add5646997cf6725bcb37892ca353b5c68fbd24b24c01e3efbd5a0309c5dad755cc9c5993a3a88fce663ce77c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZO1X14N3\desktop.ini.raz

Filesize
80B

MD5
f410575188a46df9eec940af3b455b52

SHA1
2291ddccd19c5fb51dc3d0fe78a1b9069090de53

SHA256
7019ee3fcf328a8bbea7757d69a4fe880d036d1274624179b18bad459ac1c57f

SHA512
c2cdebc4ae5fd54e357245bbe07c15e4ec41ed2211165351d40214805e08af951b3afc67c9e1f4ddc66951653a0c2ec874f745bc6aec104224d0722ebb6953fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\container.dat.raz

Filesize
16B

MD5
4afb1dba58dd0ea9a9f7d2f4e907c235

SHA1
f73527cb1c03c65d6f3aa0cca3b3f7823fb5325d

SHA256
8944e413a11a86140ecd3d889bdad2538b5081293bd494a20b69dd57a9fd8909

SHA512
e6292e9bb061ae8ecc55f2b49876c5f0fd6bc7510e62c83a9597f66acc1fa5c14cd875a7545099bb5f8ebcf2aa26bccd1b9d289c6a79b0eae18b7cee6d6d5d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\wallpaper[1].png

Filesize
68KB

MD5
e49d81a269507e2f4d8884a95dcd052e

SHA1
4ffbd910b3cc7cae81b18a91977334db061a8a5c

SHA256
da190b28990186459e574efe097ee86e235deb26f31797453295df99bd67a320

SHA512
6dc68299ab443e2311e3950005945f6ec60d34818208f98fddef8ac9f5099d9518f7f8a6f0c0ed72b683377d5ef20273e8179b600098ef4f1d022403337e724d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nyws1jjf.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.raz

Filesize
48KB

MD5
e9b73a312a4a3f84c7983d56c3560db7

SHA1
ce8ca7b4b6325fe4776c9b864ac87ebb9d709751

SHA256
d7047f523e9a65e683cf0ae9bafdaa784e529757aaeae2dbcd9fd6750e5e70ba

SHA512
3b2c3ba849abf3f665c1d49ac4b047e75d80981bc961f6596fc5b3b02cb88e9a047b4b02244b920dad0a3734ce30cd0c362520fbbc554c7cc8287547d70a740a

Download Submit
C:\Users\Admin\Videos\README.txt

Filesize
1KB

MD5
abacfd800ef5eda0d70843a6330acc81

SHA1
7915571d80bb65582330cb03801b2a23091646e9

SHA256
79c6d2802da81c38bda1d199b0ebefa0bfc5ba22ce017a9f7ea3bf98064b09cb

SHA512
91533dee6bcfd4427ac2f843e4e3389b7ffc29d6acfac7b22cf79817ff674ef693d3f49553c388e47f26436d3575cbd7b8cd3c7744fb6c09156800c7e15b578c

Download Submit
C:\Users\Admin\Videos\README.txt.raz

Filesize
1KB

MD5
2b506268a7338b19d586fd5ff2cf1003

SHA1
b303a255c1ea09d5c0628fe890b9ae82c3a9c853

SHA256
f8b313be2b5e6e53250cc302af73b97c6d166db7b90ed9ed74c97a7ca5384b12

SHA512
128b5996c92d26b04d9698ae46052e83cc7a1e139061c34795457c9048fb3dfa5a1223bd1c671aa152e59d2adf7a9ac8f0c12d3eaa7d45122e79d615110f3d55

Download Submit
C:\Windows\Media\Delta\Desktop.ini.raz

Filesize
1KB

MD5
788b3485f7fc0515461bc9fd0fde9f46

SHA1
c74fecf46eabb41770f61698b68dcb5d3b54d9f8

SHA256
d489c916df4839a8849329be5b4311cca1dea8d2852ae9b49d30bf590cb4f5f3

SHA512
573708de746cf07b68af1fd1d581b76ac2661182c7c7b68bf277e3127bf2cb8f22cfe1c1c1f8d9463ec935cdf40d98dda8a94edb932ca5a867ca3136e03617f6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif.raz

Filesize
64B

MD5
4bc9d7bdac82958754058069ee455ec2

SHA1
2f2830648fd6bada14c6049d98ade053331f3da8

SHA256
09925c426a0c142e2376ba8beea22a63b5025dc04710acb000072f8d37942b74

SHA512
2e29fee48dabc71b26fd3b330424414e76caabc84cad5e6faf67cdd3cdea7992b803daffe4518daf19a555c2a3e6b93ab13001f2fac9ba15d12f9f1b97b5bd29

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.raz

Filesize
80B

MD5
3390694dafac7fdc900257efeca4021b

SHA1
1fda5b070efeb8bb90feccc1766c558f0710f173

SHA256
2db995bb7d84302b4859e52ed786647e36ad664c261c26fd45a8d4299bc660b3

SHA512
8d48fd4a47d504b390ece222ba88a6da5f929a2125bce149eb7100a8951c8652895f45036b167a39602d45faa7f17d298ded07d2857c8b949879907ef7a5f13b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.raz

Filesize
80B

MD5
c4b3c4bba3634b01e4fab63ba68776e2

SHA1
862544b18cefe06e86cd2d7b3cbcff5249dd81c7

SHA256
650fddbcd0c6899ce0531a5287b1f1886e21a2b90b754c3bc74fb3decf8c57ba

SHA512
ff93a23342e74343afaaa33d2b8478075c1e57fd07846ada2fcea6bb84e7afc82ae3c9a1a2ffe8da4af5adfe9aa595baa1d5dad8ff6f0f05d3914282cf01f8a1

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\DropSqlPersistenceProviderLogic.sql.raz

Filesize
2KB

MD5
c8bf8316e247de8c90c4863e532e9e1c

SHA1
d12f2dcbf414f348589a7cbdef296eb44d36a6ee

SHA256
8a371adef1aa216888d0f41a4567c68a2d76845f5c3a671ec58a719430dd58c5

SHA512
9856b399f6cbb6de2db09b6cf9730dfc7ced7b5e4c4c3aad92263fecaf87acb7da7ce784f3867bac51aa53d58458a20120da25595860349c18147c955b20c5ac

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderLogic.sql.raz

Filesize
13KB

MD5
0170ae6ad1d05cca2307240bf63e2609

SHA1
97f31ad931c545f5a6e367168f6e7916a0b288a2

SHA256
ef26ed5f6220f671571381757df5ef73aca4f31ef21e29d075e4dc9a48c8b51a

SHA512
f0b47134cd346f3e7500dc21be0f46a78a420f004e23f6ea8229c3c4912fdc87a43de311799c9d8aec384828aead02ca01da35dca7ee61f34b4d7e87018ef67e

Download Submit
C:\Windows\PLA\Reports\it-IT\Report.System.NetTrace.xml.raz

Filesize
80B

MD5
aeee8abee0cd0f32dde5e9a023e9988e

SHA1
07788d82690515fc2a96d3ab1d0eb04acc76f31a

SHA256
1de2aad9d7878d4757e361584ada7e779489ab5e476613405b496fb9629bfd4d

SHA512
bece431c1f7f422472b6780755f91c4f1f04f746bba4554659319beaadc33102f83d009b54e0341cc435bc98ba57daf0f92a868059c7a564a4d2bb3543cbb6fa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini.raz

Filesize
160B

MD5
7d19b19c898fe587825758f9d03fead1

SHA1
ce143cc4a6cb1ebcb9f007a4b3a1565411d20596

SHA256
f63a61e1a8cbc70674378e8cacb8a49270a44996380bff89d02790ae93b4ab4e

SHA512
0cc192d635df29bedfdb45061315745e6d7d327863f7610135f71792cbc6b3ceaeabfaeab898dcde0138b9dbbcde90a4f3eca00fe0eada84a9e854fab1d0e086

Download Submit
C:\Windows\System32\perfh009.dat.raz

Filesize
646KB

MD5
7cbadf80a78d7fb865d9f015a9f64098

SHA1
7a04e11c379775077bd602d8d64862a74ddbd23b

SHA256
8d0ab794c8b94a9d1547e53923bd5d7a2a3d8cb459ea3907d9c170ab7950bc35

SHA512
8ed54b772a062fdb44280675dca2d8ca6b4bb950aa4ebf447a2bea52913e5daf4059f9ac4868e1aaa7353bc82e1f33d802a1d91107cd403dbafa6d9465d06ae4

Download Submit
C:\Windows\Temp\Razrusheniye.exe

Filesize
19KB

MD5
15ac26d3ece330815baf9863bc1c6bd8

SHA1
94319625c68247f69f8551a749f9a8f1378dfc65

SHA256
ba9702eba6870e51391a20a31b8a6f5742459babfbe8146ef248794202ab328f

SHA512
f3b443e1fe3b3a16b38be1e18940dbe8bf555d7febbcd802a6de993a62e5f89f1b221976d875279fe7a1baf6d9c09dfab1cde484efe2f767075a91c39a6fe6c0

Download Submit
C:\Windows\inf\.NET CLR Data\0410\_DataPerfCounters_D.ini.raz

Filesize
48B

MD5
c919d546c3ff3281c8886a1c736a1246

SHA1
482fa9434557d6055e0dcf694c7fd7efd1cef9b9

SHA256
40fdd5743a66d76e155e62f20ccf9eaaf61c10e87349743afa670fe01d5735de

SHA512
21b2ed5da89435108f744c6c26461004c0c7fbeed4b185a1fa7af336fa435721ecbae8f36aa951ba48f729596096081e9b9857ac8385f0e536af05df3df03531

Download Submit
C:\Windows\inf\.NET CLR Networking 4.0.0.0\0008\_Networkingperfcounters.ini.raz

Filesize
162KB

MD5
888c89f3465c3ad9fd3caae16cd6864e

SHA1
5899f46601821f809d70a2185a2c0eca5248084a

SHA256
ecbc8dc911259c569205e1ed3972dccc7d6de26a7923e7e0a784a5f50596a8da

SHA512
6a1d118afbf857a0fae502e9520f265b75888b7bb5284df3d31b90f4eb67f5a8f994c9874ef7456018060415e483478a2fdddd54353f71720b372961a3187de6

Download Submit
C:\Windows\inf\.NET CLR Networking\0410\_Networkingperfcounters_D.ini.raz

Filesize
48B

MD5
6dc57023a2ec682a8d89f5bc4959f333

SHA1
5ac545fe0341e85dad6aef674d67b2c766eddc5b

SHA256
be60b17330a4bc8fe460dd237351a172c973b46d5223638c3308808d35ff201a

SHA512
10c81bd7a4aea834b69c9418c1485dcbfa10788e98d53f1b7750ca24bd25b1d1bb3af820f1c444b78207d4dfdad42a5716556fc14acc406952279ffbf7f22605

Download Submit
C:\Windows\inf\.NET Data Provider for Oracle\0410\_DataOracleClientPerfCounters_shared12_neutral_D.ini.raz

Filesize
80B

MD5
e3c2730b3808bc1077b4d3696e34386a

SHA1
d8250432c92c07371d136ca80f126b623db77589

SHA256
79d0348737c432d031cca1ff666fdffbbadd98ff80d259b99cb0134c7c8278cf

SHA512
43315b32fdaf65fa505f982dd383e55dee214d19f71bb6c0929cabe095421c716109acdfbe7cc3a4308de9a8178284f85426f9aa8d14ac9649252a4c662e1a60

Download Submit
C:\Windows\inf\.NET Data Provider for SqlServer\0410\_dataperfcounters_shared12_neutral_D.ini.raz

Filesize
64B

MD5
18f0585a46cd4f5ed59a6ec63dbf9494

SHA1
dfe3d7cfa597f3f0d7116e1f2d99a2ba3993aae2

SHA256
2a522757f848a0af60e3164e9db4b808f303e7199a56e2736326ae7bf466d331

SHA512
f4781d76503d082cbfe0a4abd290695de21e3e52f300465a3d8c9cc4f52da4b0e2c37f1bf71b5810c7eda73905c4d59a9d56c2a3f2565d705b4646eb06afbb9c

Download Submit
C:\Windows\inf\.NETFramework\0410\corperfmonsymbols_D.ini.raz

Filesize
48B

MD5
32d20da5082ac2818b0ee4d5e5e5e0bd

SHA1
acdebc45f2d6d36383b13460c998ef85ad4fc5b8

SHA256
8a971ea036b951cef511f1055e5dcd39e4f62a2c473b7617806a668232d2dd04

SHA512
590b9daf81f1dceeaff1ff97728689dac65218e5a81e5a20076fa80ae2895877006b6a04d36cb8856f13fdd9c3bde5b9c36d02b26839dff3282053ca0eeb4aad

Download Submit
C:\Windows\inf\ASP.NET\0007\aspnet_perf2.ini.raz

Filesize
972KB

MD5
7bfdb70d1a227b18f239e2be37b1e77d

SHA1
f2a30e0f85895ac74fc0f3bb3430fe5cf4dffdd4

SHA256
9f8682ad1c1a85847fbd2b91c465ece4b46b253d9fbd4e7e8d698b20755f377a

SHA512
2fc6286b9b7e0af1cd430cbadaeb07f927ec12b28027326cacac122fa58c4dc594185910fb2654632a0f2b78c351c11a9c4de36bf708d7f0be434312b1130965

Download Submit
C:\Windows\inf\ASP.NET_4.0.30319\0007\aspnet_perf.ini.raz

Filesize
974KB

MD5
987ad03c80c6b07a7e5937d0f9e68262

SHA1
f897719373043f9ad53cd1658655f893e3cec52a

SHA256
de8e27ef3b03a9551467febc0132173e8f79168922b2c30ad64058b94b0bda2c

SHA512
f2d7b6607abccda79062695ee44dcbc789e83d28e3d85314668d54e4c834d6a345e40c9351603c559124ede80fd44ccafd58dcef809a0739d79815afa0812be2

Download Submit
C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\_TransactionBridgePerfCounters_D.ini.raz

Filesize
64B

MD5
74d742760ec5c368a272623585552f0e

SHA1
1eb137389a477b30da3da108c27ee06b18e6ccd4

SHA256
a8968486113121337d29085d4b5087775a4cc3cced1aea6019f72575b7f618cf

SHA512
fc9da3bd3d7bfe70c3dec4d1f35768a9f6994cfa268fcb05c9e1a0fee8a0ef8a36fb75e21a4a545752ee202ef7db07166bf7710a62a06ae52b5dd4def4eb6eba

Download Submit
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\_TransactionBridgePerfCounters.ini.raz

Filesize
132KB

MD5
39adcac504602fa91ae6180c2643c57b

SHA1
da73f1e60c67a13670e48727ce5d20f015e08f3e

SHA256
7be33b0eb5f54e77f36c9e0bfc36803fc09217d6323550b2213633f0a955fcfd

SHA512
1f29aa604c22c940df990f9ccf8fdd5f08e8aaf04bf8801b5dfb3ba595dd410fc4df292e08c8f4b2d057770c6b51c043f18b8f496960352d1d67ec6ea31d1682

Download Submit
C:\Windows\inf\PERFLIB\0411\perfc.dat.raz

Filesize
30KB

MD5
3b76036ba288c9803e1bccade8c88e02

SHA1
8147f11059f0b56119d3edaf2c0b04f0611fa189

SHA256
cf479d158f8e087d85b4bff7e559f08f4196170fad1998a26dbce4609a121ef1

SHA512
c851ecb8c2aff42f54d8525f6d6ed93908fd740dedb7757e2a24747ba5b4e6bfa71f1903f38273e579d1e97edb574467e532ad0797f7d36943fa08ea097cad27

Download Submit
C:\Windows\inf\SMSvcHost 3.0.0.0\0410\_SMSvcHostPerfCounters_D.ini.raz

Filesize
48B

MD5
4ecb6d7b9d937ff704ee235d9024c21a

SHA1
fb928e68e06d1a7e4ed4bd914b1e60ba55b924a6

SHA256
5a19eb9ffd6d0822b275d06608cd508bb8b7e1ba7a1fe57fb5fbcca4ea122f81

SHA512
cef487478e7b5234c90ae801ea9c58f93383d3c82c9a1e2b14e40b5e54670ecc9d55927bea1283f00aed3abf65e7ec799afbabac81e22f3a340305dd7f890c4d

Download Submit
C:\Windows\inf\SMSvcHost 4.0.0.0\0008\_SMSvcHostPerfCounters.ini.raz

Filesize
130KB

MD5
97d6040ecf3555cb06b81ff79d23a54d

SHA1
c2531162a1d789d6842fc99dd37a56b6c9faf7b8

SHA256
0ce779d6d13accad9d755a5f90a55abaa7cc036707e1b404b1632c0303f832d4

SHA512
836b10d4a2abd11e582bfacc6f35f36b38ea269d476114a1249b2bdb836d42466c9a48a8d39deb62a446feabe8774223875f42aae77c6eaea6e5d1db0bb4e766

Download Submit
C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\_ServiceModelEndpointPerfCounters_D.ini.raz

Filesize
64B

MD5
7793e3d96ccfacf4d8988212542482b6

SHA1
f38fd69513f02de2fc9ccc5bf8d08cee121ef9e4

SHA256
e66e1fc7de7afaaafe96ae35d70cfc939676772ec5f0b154b66e30d82e9d8b4f

SHA512
295d0d15cd275992a3fed87b5c583d3b71ea34dcb52bb753c5307ed51fab212af9893e2a3c25d05bc55c8eb98827d7784ce086be1e0c693eeda1876fa7bc7c5a

Download Submit
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\_ServiceModelOperationPerfCounters_D.ini.raz

Filesize
64B

MD5
a0b32492c5124247a7fe56804d037781

SHA1
54dd13e559e9cee05857520c084b33423b36db31

SHA256
308704c6a51da3de8d457e56b1d4ec16832aaa26d1ca54a2a9e01e643e9d4491

SHA512
e8b67ba36fd20943997713bc00448157a29d6cc7dc7f9651b549ad24924677efc09af244965bcc20e8c1b75517348dcdd32e0f5b56195899d42e93b1f5ef1992

Download Submit
C:\Windows\inf\ServiceModelService 3.0.0.0\0410\_ServiceModelServicePerfCounters_D.ini.raz

Filesize
64B

MD5
c0fe0300273e96beb2a5ee83bf31e03b

SHA1
ffe2dfaf43be7e3f911fdddd2e43604444cf9f9c

SHA256
bc64b989f0d1a5f8952f89445cd61e399a15c5cda7a7ae4c86ac557fbb356d28

SHA512
8122ad992aae0e74b1c17c1772c01481713dad0e4ac3e9e91041d98373f2b5d89b2d8f948a03c97b6b9322cbf9343ec91351715789a7f07fa33bbfcfb8babaa2

Download Submit
C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\PerfCounters_D.ini.raz

Filesize
32B

MD5
605dd1af5732780b3ef8991f24f6ea79

SHA1
e7b3fafef2b31059f650fb89c885eba62393ee58

SHA256
c20dd00577db4d6d84ad2ef8e72dd2de4f6b865f93541f1e1f84d4aaecad6d41

SHA512
342b97c04f9976a7a0b2ea7e506712a9a1cdd6c7a934c8b1142f0cab523e6314802784cad5763c1a0125e0d1ad4dda7d6fa2029e6a7edc2b9f23aad9ca27277c

Download Submit
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0008\PerfCounters.ini.raz

Filesize
150KB

MD5
f891e1ead15ffa54fbd3a0492f451777

SHA1
31c7d31094af5e84837e3208784e4204375f03cd

SHA256
802d2946521fd058900efad4888908ba94224ef61111d64dc80cde81eb9dc31c

SHA512
d4bec6340d88e151b416ff0b1715fc5d61f76f97d25dc95fe56cdcd1dd66f4b84949afe52996992e4b92c66bbb9ff96306c727195914d99bcd54d5da0d9c4e54

Download Submit
C:\Windows\inf\aspnet_state\0007\aspnet_state_perf.ini.raz

Filesize
42KB

MD5
00bae3878d7b704a7a791f6c2d403019

SHA1
dcaed6970cd443fc79a52c2af5f6394f3cb6a9de

SHA256
71dfda51d2a9b6c3f6539acf7da9447648be1c881f6d9c7d514af810454da8e4

SHA512
a9fd1c9db977e21cc79ab7a588b059edd995a6c8117c9026ea1451a2d8417c68a076ddd5bcf0d4105c3ff2e42cc4558eda26814b53ea4a56a0f89f01a75fe110

Download Submit