Analysis
-
max time kernel
31s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-08-2024 16:18
Static task
static1
Behavioral task
behavioral1
Sample
razspy.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
razspy.exe
Resource
win10v2004-20240802-en
General
-
Target
razspy.exe
-
Size
17KB
-
MD5
01c6e0390faaed56ef1095f3ad261788
-
SHA1
d68aaa71f61aabc94d7c764f31f431a60d400d47
-
SHA256
80f8cfd2a62ba62b09d7ccfed9d92b0bb47fdc10cbe72c6f2d929513747970c2
-
SHA512
dacef740eaf36e4fdaccac857542316657fb13a641747013f2d95acef1c4d7fd945b5f156265651d692ab34aac8d9204fb716ceea39cc0722a2ec5a29a98a4bb
-
SSDEEP
192:p+VZRQY9ME6tRr99f65P7UqyjPkeKfFSgOlV7SajUrt07Sj5wcx/e3Q5tfnkTeIr:kRQYotJK5PI7Mtf2pSfwSdnm3S
Malware Config
Extracted
C:\Users\Admin\Pictures\Camera Roll\README.txt
Signatures
-
Renames multiple (3288) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation razspy.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.raz Razrusheniye.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt Razrusheniye.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt Razrusheniye.exe -
Executes dropped EXE 1 IoCs
pid Process 4776 Razrusheniye.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-21-1302416131-1437503476-2806442725-1000\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe -
Enumerates connected drives 3 TTPs 12 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" razspy.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-125.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\WideTile.scale-125.png.raz Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNote-manifest.ini.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-200.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-32.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\rename.svg.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Spiral.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_altform-unplated_contrast-white.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-150.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\es-es\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\Settings.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\UserControls\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-60_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png.raz Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\PGOMESSAGES.XML.raz Razrusheniye.exe File created C:\Program Files\VideoLAN\VLC\locale\is\README.txt Razrusheniye.exe File created C:\Program Files\Windows Security\BrowserCore\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Error.jpg.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-32_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\README.txt Razrusheniye.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Road.png.raz Razrusheniye.exe File created C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-32_contrast-black.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-40.png.raz Razrusheniye.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_bg.json.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_TileMediumSquare.scale-200.png.raz Razrusheniye.exe File created C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-lightunplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_OwlEye.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-200.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-100_contrast-white.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-100.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-125.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-fr\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-60_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-64.png.raz Razrusheniye.exe File created C:\Program Files\7-Zip\Lang\ta.txt.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinLearningToolsLocal.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_~_kzf8qxf38zg5c\AppxMetadata\AppxBundleManifest.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-white_scale-100.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons.png.raz Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-96_altform-unplated_contrast-white.png.raz Razrusheniye.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\kor-kor.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileLargeSquare.scale-100.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-200.png.raz Razrusheniye.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{D4448046-A0C3-47D5-979F-43D63EDFDF0A} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "2" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{72459C28-A6A3-42E5-8D02-B984F9771A28} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1302416131-1437503476-2806442725-1000\{1E33FD45-1EDD-40A5-8AA3-0192DC75F7FE} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2516 razspy.exe 2516 razspy.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2516 razspy.exe Token: SeShutdownPrivilege 3444 Process not Found Token: SeCreatePagefilePrivilege 3444 Process not Found Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 3164 explorer.exe Token: SeCreatePagefilePrivilege 3164 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 868 explorer.exe Token: SeCreatePagefilePrivilege 868 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe Token: SeCreatePagefilePrivilege 5040 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe Token: SeCreatePagefilePrivilege 5040 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe Token: SeCreatePagefilePrivilege 5040 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe Token: SeCreatePagefilePrivilege 5040 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe Token: SeCreatePagefilePrivilege 5040 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe Token: SeCreatePagefilePrivilege 5040 explorer.exe Token: SeShutdownPrivilege 5040 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 3164 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 5040 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 4220 explorer.exe 5908 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4176 StartMenuExperienceHost.exe 952 StartMenuExperienceHost.exe 4592 StartMenuExperienceHost.exe 3116 StartMenuExperienceHost.exe 2140 SearchApp.exe 2772 StartMenuExperienceHost.exe 5372 StartMenuExperienceHost.exe 5584 SearchApp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2516 wrote to memory of 4776 2516 razspy.exe 90 PID 2516 wrote to memory of 4776 2516 razspy.exe 90 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\razspy.exe"C:\Users\Admin\AppData\Local\Temp\razspy.exe"1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\Temp\Razrusheniye.exe"C:\Windows\Temp\Razrusheniye.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
PID:4776
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3164
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4176
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:868
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:952
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5040
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4592
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4220
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3116
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2140
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:5908
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2772
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:1344
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5372
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5584
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
PID:4204
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2588
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5528
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6056
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5836
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5892
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6276
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5216
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3024
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:7048
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6260
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4152
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2440
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5088
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:7104
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5464
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5368
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2388
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6308
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6600
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6468
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3084
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1168
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4024
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4496
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:7132
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3512
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4704
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6672
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5244
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5428
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3112
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5036
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:7100
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2744
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5548
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5696
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3252
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3036
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:384
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6892
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:816
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:164
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3456
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2764
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6960
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6268
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3496
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3200
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4824
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3228
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:7064
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5616
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6860
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3400
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:384
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5316
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2716
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:3572
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3688
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2120
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1200
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5252
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2152
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6108
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4700
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:7144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.raz
Filesize720B
MD553d55e32ca8524b5f9ee09719dcabf57
SHA1b1990315b3cba03b12ed4ff3d20f51ce84506f55
SHA256d8e781077ac4799349e594aea1adabbd633aac047671a28b086dae7ed6ddf0e0
SHA51226aff54d76d39f1df4b3f98ea1cf68e3b2d26f7855802bd4b0d71e9dd53305dcef89ec1e12ebcdd4f1919cc3b7885a9d59d269019b9126e7ae1197adcdc3e55e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.raz
Filesize688B
MD5518f661cdcf99851248a65876facbc3e
SHA1e7701b342dda0cddcfd8fe9d3b6bfbe9763b071a
SHA256658af8bc68ffdf429cd80510b032ccb44e992857d3cd0cda158d6850563dcacf
SHA512c42370161789a3bb055c3e299d09bcf97c5a26491a152f61ad111ef77a4564b59909717928ccea291796b1953c0b4494795401c0adaaa394d375af7180a00887
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.raz
Filesize1KB
MD5385dd901d8bf466e1a16401ab3c44049
SHA1cb3c03546ed3c1641a6cf55a554e4dca4ac47ba1
SHA2560fffdd49603bf0a7761dedceeb5e73f2561828053dda2875e26fb262490cd343
SHA512512ac35ba4c61da5341155042aa071b2645de8317e53eed76b1d0b4baebf5a296ccd53af575f73b6c14ed54ea3b0dbb2b34b1a584a3486369b1348d58cdbe9a0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.raz
Filesize448B
MD5fe643f40a3f1401aadd78938c42147eb
SHA1eb3b435399072b1813e107f79648483a7b357c61
SHA25644729cfb95b4c00f1d719cd5291fdb3839a95a8fa2a0df17230f7d89dcaa4109
SHA5129859aacd62fe168c968d8f7a680981b2eae15e2200069e0d6cd7663abde6124e7a9354d0feaade851f01cd7471d0865708ec83ee1403df860ac2cddee8098227
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.raz
Filesize624B
MD5c1ad830229b6e55ab5c85fd8cb4b6e36
SHA1615ce4525f9bd1f4c0494ce97a91b2872b7abe2a
SHA2569ef1b9d248b0dac6f374adfa68882b45fc8201b4076f85646a2a270075e01b6c
SHA5123cdcec8d0b9291fbf23404e736d31b7321f7bd396aa489bd7e723b64def164b471de754939568e3c279566798fbb88559327eae19393572367340b5660426ff5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.raz
Filesize400B
MD51d15a0c6a69bc5121ff67c95f37afea8
SHA1dfd6a57142b1d2e5bc59749ebe65a93aa0d76eed
SHA25685b38a320f1b88b884fdef70810ee367d91fed29e4030045a163afd1ccc78cd7
SHA5129bbdf7fb0090dd2ff6f5bbb67a61fabe75655ded557acf422f61a0f4d566ee5ee0004c1bbaff0f0d12644aa1613d6857e5385d94f45d041234c8abefc23a4ea5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.raz
Filesize560B
MD5ba329ccbe4b5641587c1057ff7c6c7d2
SHA11d093a1ce9f67a89c8d6c037f25f9a3d95512212
SHA256c15c37bd36a91161ef0839449390797fb3c746c806debc23ba4eb9e756b66862
SHA51213f3817a39fe276cb48a2c7ea1ca69d8f031e4d448e12b4d8503f3c31f8cc4e66422f272d10f31479c38b853a42bebbb1f5ddec046e93b2e4228fe166334a60b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.raz
Filesize400B
MD552d739e792a43d18628af84e8138ec87
SHA1ba2b8030843c16ea7e0a3108ff4b7e7b8b466277
SHA25628c18a22776f93f097ca7d00b12e6d13ec09919fa0379eea18f8207de87185aa
SHA5124c656e7c1c522f2172a7f3f724f2aeb77e961985d47000bc8da5b68bd960547207b1eae50a900211f70900ccbded437f2763532b41d9040aeb2edcc63c7f0074
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.raz
Filesize560B
MD57cdc7b66de7ed1f74814b1d6e09fb15e
SHA10f1c9a689f1af56b30c3cbfacdf378b9ec4d3a16
SHA256b12180086fc171ff1d95d494eda1765c83f2a2d09fd8096c05e756398ef9a061
SHA512dee0a3288a8163bde266c972fb55d2a8ace0e71f0ea7b55a249fbbe13a85c82a2c4110fd5d2ab0b5e842e66fe6642497e570a1ada007e930545927f736646526
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.raz
Filesize400B
MD57d24f9ca335fc5356a012eec28e10f23
SHA10f2adc402876e2c1753a98283f11470d7bc40df8
SHA2567db7dd863423150d67d7ceff561ab01ca820cd2a1349904e6c7ae0cfaa15a93d
SHA512626edff6f004f8a8c50724148ce29fadd2f48792eb263d121898f932fd841b18823a65c789479e96e55b62f5f2b3757971f835fdb60d432e8da132df0cbe6ee1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.raz
Filesize560B
MD5be1820e58e19d651c58888e0b1be3c74
SHA11ffbfb47e5843d119e928f2d9eaf04153ebdd445
SHA2560a9db9864f97d94bd84eb26689a8fe87117677e0d3b89386a23614e8c7d491e3
SHA5127f1d024288e52cfa5719a0b276d05c6a636f419aa55ff7a209ce35695fc9e08a29b13df625dced577c408d1281cf9f9e0d8eb28ebf898a8da94171b7d10521b5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.raz
Filesize7KB
MD533d7c58f01c485da6be42420a7fe02ca
SHA1ee4e21d6159839a82a7c07d6ef9bbdcdc2a6d2ba
SHA2567661e7dfb07308ef5f05d12c5c010f7c97f7fccb4fbda5cc661a4fe709e249c5
SHA5129c6f06bddc19a95b01519fcfed3a4ffde7afdeebc166b82843dc4b4e2633cd2b48b2a3d3852d340673f7c1a9bb8552871608875cdebc461cc5c132c71b4a4896
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.raz
Filesize7KB
MD5885e805dbbc9318fea58ff4587b9e4f3
SHA1cceadba3ff289e488183f13929b081f051525524
SHA256aa16599cae13aaa341be553d4e83c9791b26ef1da7bcdc7b201c34216196d734
SHA5125377cb1a58da7ebb96a42cf619417924a77580b8c9df51d7f49246a225e9abf305b1b86e713d392030417d08e0f7cf6aa8d02d3ec38606f4312f52688efcca17
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.raz
Filesize15KB
MD5fe6dd5ce09999a526d9b7ea2bd68d0c8
SHA15585a820de856818d75f4b810a754b284c3be205
SHA256f22102bf91816e7dc42d410f14d5bc101c4fae0e8b5f3a6f509d3f810f724e24
SHA512f4991c163c21f75493facf60f16e7e40f7eed93be3130971bd090a31aaf60e35854f1a2f8e74066dbe7a814dd188d3cf70f8490229d45074b953fcb476288618
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.raz
Filesize8KB
MD59489f3273308b2feb6b79b74e524a20e
SHA10b832a6f8d8ec2a30d521a12a9f493585d26ba3f
SHA2562e230cfa6ef473a2c34a55f2384fefcc8f8d38363354805e46888c2d811e7f2d
SHA51261b9a13cbb1294a332c2d104582f2858326d7394c316058a8d0d24a304648014739cff355c7e932a883201944a7a518975cca41547fb6abd1c53b986f5ae4f2f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.raz
Filesize17KB
MD5da89394367900b76f27b4ffe66fea3ab
SHA1c3fbb4fde4c318f092fd338e3c94f4fec8d9fa4b
SHA256d38b2c67b3725e4127a01108927d78a27a5ba97a9a415ca82d7f728229c58e70
SHA51215336f2ee33739a3defd0916e147cd4d52ce8beb5f9cc1f64e3bae244bc5265de254d5715506511deb6fa2e667935bf7d6966f4205f007a5bc39dc21dd5d66ca
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.raz
Filesize192B
MD5851402290c716b2ef0a262a82b60f5f2
SHA1a34fa11816442a73ea0f0fe211cc6450dcb56f7c
SHA25655add73b8e4a5e7f29f1889ddd3cd866972e2b0fcd199ba499bcd270731238ca
SHA512823e61ff110260a6fdc2e2f3e7e32d24ee7ef771fc0138e6ca6dc1e2657a56c54addc9db16d9df185a70caac3067000edb759912b01a77a458683f60aaf223c4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.raz
Filesize704B
MD5235e01fa1dc62278d3936eca7e3cd10c
SHA15b489726f5da4a2a5d34138eff16d322f33867e3
SHA2567149c06f06a659deeac1a2ecde2fc68f08cf9e76c092df4a45b7dcc9e524babc
SHA512af5c16644319d557d9bda4ccb9a9cdfbc086e82bb1d6600eb483824bb16913fc9745d2fdbbdb6d98eefc9e336f2a0b1768c03d691d013b2ce1008d5b612ed004
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.raz
Filesize8KB
MD5065028d523a653b551be4eb6152fb1dd
SHA18fb7d56e8e2ffcaaafe35b364b2898c02105d7fe
SHA256a4f8553073b925ff6454cb0f96790d7ca91684485930fe7f260037de94bc7445
SHA512f6f8bc5a3e7c157eb0dd5a4ae1519f6b46b51d5d1747abf005dc5b7a973cb55faea4acc99aae3746555496a35151c743c7286b60eda0a617c62140641c2ca7f2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.raz
Filesize19KB
MD5fb457a0870eba6e53e8fb1c9bb5e4b03
SHA1669f4915ed63bad9f22aa5e5ba079e57a396ee99
SHA256e478a96e9d1921b3704e1db736119382d40559f92248e4fcfd13ebe247b0e384
SHA5127c1f527d9081c2cd8023dee4823df4ac5c14cab9b199ab3ee357dd22101c41a440eab7e706ce8f74ed50b2a4a89f9e7a90dbfb166dad4391625566bd74eb9d1c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.raz
Filesize832B
MD54c80e52e18711e5979eaecf3f4708f0c
SHA189fb2a43bd1fef49ab5b8ea5e334c242a9ed87b7
SHA256c4386fd5afb28c1f1a5ea1fbf12f7d38bbfc347ec99c1bc218cd886142c7ce72
SHA512ef5d302d2985942f46f455de1f74b4290f9894d7375c3a7b543c0d664ed9552f2809e97047d06786baad2e1e373e0e753de058a058b9f3dc73706d77c0bb3acd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.raz
Filesize1KB
MD59119aa594486580e8b916d7c3fa33681
SHA12631d2dee0e571f90d89be34986b4158a0436256
SHA25681836112dd9a36e3e826cc552da06d27ec58601795e55afc5182081f9fb4135b
SHA512fe8f52b2e69d662d8e103d8a4d75f68e3c00fcc8929822c6e921fe778df16e2122061764f6eee3a5036a3cf86eac6e4e7df56e6f4ab452d5acedf17ac1e4c755
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.raz
Filesize1KB
MD5411a8f891837d34cf2da0c9ab24141e5
SHA1b56a7894d2d24a2ea3c14d9d52965315bd75e584
SHA256060cc442a9c67150410ad31f62c1435e90e18fd03a226e0f0e12df1b8424efe0
SHA51256b96ab818d76471a1d45da665754929d84ece97934eaad790deee0f79cd1a47eac604b03b40b2dac5226f5d8a058e25b4558c406a9abe46c0811da035cf3b99
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.raz
Filesize816B
MD598d4acee4d6cddd18db2a82c31fe7f36
SHA16c1a8787e328e0ca441b386b1bd1c3cc9a382118
SHA2567abb958c7733310b30698a24759453f2a77378080daee57857afe4eb8c47e52b
SHA512129bfdecc375cece0614ba3b12ebe4211a248a6e8a7fe6f6df1277819d692d89b78be98bb4edf395118060ab435df5b4088530eb449c561fd446f38851d7cf0c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.raz
Filesize2KB
MD594f19971dce1c918f80090bf491c2237
SHA1f8470a7437d0d6dca21cefdbcb9662b1055caced
SHA25684f25c5589b2b39881cb5431bd44cab51a3e0aa74b7a7a627984e5bd85256ab8
SHA5124f64225b9adfbc055235aa0671e701d7033ad4bcd7769c8c7d3b14ed208644d26f006ec115d0992528c7f7f9cddf20f21c86ba54986345e92835984ebd429019
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.raz
Filesize2KB
MD5e858e447ffb3934cdde71b54821f82f7
SHA1da34adac84e19dcfa73ffc433e2fca694c8f95de
SHA256951a8668b8ca41faf3fbde9697c47c7e06dc1aa934227e347d9b6ce2147d5230
SHA5125f50b820c56bd47bfed4c65d53413fc4518e89c14b4bf2d7035a9b80afadc4507f75f7859e54f6956d1d75d688470ecdfbd1d734ca8d2729e3b8d6028e7b8058
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.raz
Filesize4KB
MD500f98bc25f07c212b42f452840a67c15
SHA1b665ecd4afecba674baa8ed0975f6a8160325254
SHA25645422010dadb26c43915bed1ef6bb5005269d6b958d19deb8bdeb0473bee5fb1
SHA51293bf240688ad931c1b6b0dd5a99a61f9fde0b03f914f0c455b769ce27e114052bd475ce78f57c463a1efcef9ecf1afa965a64a8212f46f9fed2e05ea95d91722
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.raz
Filesize304B
MD5e9ea39ab705370162293f3531b229415
SHA152dc1e163e59126e4cd7a9afc2f5937226e7cf90
SHA256d81e608afa12eb20f1bb8e627758cb8aff3252567a86cb98f60977acc50ac5f5
SHA5129c3a2659dc7f8253dd4df041f5c4f76738192a049528f19e97cbc8e335675bb224b38b067d15448e0981e2432815430fb2a3555330431132688037fc7658037a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.raz
Filesize400B
MD5b1fa47b2930fa4a7f9b9ea0dd9ce3ff8
SHA18727c6466e47ca8adeade2aaf4777151442c4f2a
SHA25677c8f175f53cc382cbca066150afdc2e29405b9625a36252714b8bb53c5d3cf5
SHA5127c426ab36d2949c707662317eefb0edb583221e9b57a54238ba6edf26d4841dedba14e951546a1e26b712ae371f380e27b29a11fc3a857be233178f8f0df6761
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.raz
Filesize1008B
MD516559dbf31d497c61562bed2266094a5
SHA18d98cc84dad7d47d32dbf1143e68b05698a4298d
SHA25653881754a48b7a6123dc33e9389eaeb17a79a3a293fcf13849a846d21ceb29d5
SHA5127c142e20b22be38880b70f38c506739641c0e60631eb37c0f6740117fba578523a65d2b1d4da153844388cb099c33e23bef0099b34001d51036112bc476e8156
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.raz
Filesize1KB
MD54f8bbb1ff42ea3d2c7225a16b5c55612
SHA1d2e7e2b384b9aab5307909dfb5f84ec6f2e5491a
SHA25656032e75d694974aff3423ba8fc5fa2db65ed24c0d350fc3e50c44eb4815eb7c
SHA5121f31ad6965eac5df857c3f2a4bdf9fd91567910623d9dee3be736472cde175941220bb9c4822a5c708d693c0cd7e39359dd04ffa178e5adf5b6819e0cac6d8e2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.raz
Filesize2KB
MD5e2fa6e1e9a0506ce2a8e0a126e8745cd
SHA10eef4c7666a1faef262ebc091886ad650e6de6df
SHA256ee0ff386dd3d5689424906f56516b13bc95e7405bae9a3186b3388117a7e80f1
SHA51207f77043500b03a270b766ac9f8b76739426fccae04f8793f74570c405786efe3b945743daa3ae7114b9b2be831c51598a03e3793c7764cc2707e953934275e2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.raz
Filesize848B
MD54a21aaed6a95af5019a63b553ac13a93
SHA12ca991dcad728a846b95254bf9b2fe4ac791c55a
SHA25608664d4f1c726afa11f012814b06fd6463da40d43c2b1f8dc4219d85bcf7615e
SHA512914faf01bd678842f9a87f2a621da48f04d16c68adb37a6da7ff925715ae713027ab64054be2498dd9218d93e96a4fb8dd7134f73c9b5ab7d388b8227fabf4b5
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt.raz
Filesize32KB
MD5bcd5c921ad5c18cbe1cee77161465f64
SHA1e681e8585d3abee46c255b8da4f3ae6d15b6afe7
SHA2569120f5d8eabc66bd46bd3ad627bdf8d07383c90f5e76faea4d538f4ab7f493fd
SHA51252ace7da8a5a9c3cec380b032af97adee5b911e8f2cc1cc8872c8c153ce5289fe124aa58822cc35caddba44a6a6e9633fe311e4fcded1e48ab0ad9d23cfe344a
-
Filesize
160B
MD5ebfd98e511eed84e053a3569275115aa
SHA12ead5542354acdfdc5f4733e6bc77a9aacaa745b
SHA25625719be1981c6e511eb423e7a6f4900f21dd8ebe4fe92026e529de5bb56ea166
SHA512bba0ca3baec2807035f7a2c30d06e905dc6b1df22fa19278a102e97f243fb0c110eef9d83446f0c8a39d455720240f08690ada28285b7de85c3a3619eb6ba32c
-
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.raz
Filesize1014KB
MD5aec7df4baa146d1b45fd0998127c4faf
SHA1b5e013e2ce388e6d2270938e6773441d31897d36
SHA25610279747b52e7e8e338dab7efe1c62d6ad9d771ee53b2647ef6a59bc78514d61
SHA512eba0c0eecab79806ccfd3d2815b4d38919dd409e962912b63617b186ff05f3c8f2fe0a19be125ca5afbc91304eceea328d8faf3dee845064a76dd8c661aa0fbe
-
Filesize
14KB
MD5cc20f5428b65a15505ae6412fd871099
SHA1fd91094bdb68e5f23b94c91ecade9857329af3e3
SHA256f3fe16fe312e8a2ffda045d32973c444c84e80ba4ca8d1e5711d183de6e7cc0c
SHA51260d165f6dcbb3bd12a9349628a8cfcecddabebffe7ee80c47cbfadb051439ad10d69dcb495329b87c5fdc8d62d4d6da67170d271485f2309b60a9fc0fcbb4e27
-
Filesize
169KB
MD5d539f5346013c9ca5da63955e8a43d7b
SHA17fdf68adb4db40ccdf357a46e471d999ffbc3040
SHA256d696a33e75b663089f3fc9c502995aa50f6ec3ee7938e3e5e83c7ab7a1cbbd0b
SHA512d4668d07e5e99967693e1859eeea56300ac49d85a260c069d62ecd03260071cc71c3c03670d4e33815c07bce0fae2af7d42ae11b54d4c42c8af2d77c4b4bf146
-
Filesize
288B
MD59532364a343b5d05e8e23ff34aaccea7
SHA1b8250d571622205231d9e7fec50a424b2b50484c
SHA2564d235ae12e6420e70d1f9ef3173aa96dbb859e1dee3516508a9d53a8f27ba6bf
SHA512fd582d729d2e23e49c7936f1ce349f50cf27b2d36704c08be43eec03f299bac0b2865bb7dcf71f64682016911c6884d8a90c63bb07852a855612bb98311f8ea7
-
Filesize
296KB
MD53924f8360c7ecf23ede42033d582879e
SHA166657fdb052b30ca8587ea9e48a159bcde290a73
SHA256b559c8478e0a646b258fb514c1b68eba3f2bfbe7f4196edaaaab3e70fd958706
SHA5129c3d76698fe99be0a68582a9e66772226cc5b7b7110b55f82916d3623df0725bce0f72f6dc6442e7470908e5addee7602cac1ce33846e05ee5642d0b3c29649d
-
Filesize
306KB
MD58b36580e6fb2637de778d1c927221307
SHA1d79ffa7e8a74064dbf5fdb170c7a002fb8cab0aa
SHA25656f794abb6a562bae50fa8d4d54c402ff9a7044cda073f15393ced3700cb688c
SHA51250ef4c7643ee0c607fef24dbbc000bd1a78d58f80659c7cfb55ed667a35d77ab2ed822a1926807201855c3ab4f544dabbf02a0023345b7ba3ef9255d5db5c460
-
Filesize
190KB
MD51948da5f094a0d1cdcf90aaf33ea4fda
SHA13a49c028c54547273fd2809d6ef938d295a32e0d
SHA2565f20d2056d65642de10059725da90c630187fd1ee3fd9bd7c15a91c6b4ab83e0
SHA512dd53a8583f14d06de289eae9fc6464fab619fdfe7125de1a31b79852c3501ffcaa6281826ad28df9b2dc74fcd70c5eacaf62a66bcd570ff1ac950d9e8d7284d2
-
Filesize
211KB
MD56b285a2ba1e2b83627c3c7d4afdfcb3b
SHA1d2e8a0ae54140f8e25dfc86e356e711d0b5753c7
SHA25667b3f64217c9d83ca729402e8136e2b4061165096f91c52066a8c6246434e291
SHA5128741b5632c9442dddbb1151e161d76cb5091e994ff7431308c4a157b22e89c9ed74b5aa67a1d7cc80f632519fdd3de0a5e1e0fa7b16b0125138372be21bb4cbd
-
Filesize
16KB
MD5d85e405bddcf8a0a090fd6960f25ddf5
SHA1f66ca3371ffb0805c19b4227e7d8d1717600c611
SHA2565c7fdf247f4ed00e93a6550e94137e14d562ff56f44e91cc3d828d3d8be2c64a
SHA5129a38762e643d1d1dcf3c7de29856095fc1fdb4ff7a726884358103daf6bbccf28f9efdb700ca3bbf4f5c79bb6eb07a46ff57b7016cae3f95ae70ec394059acf8
-
Filesize
10KB
MD5e732556cacf08d3f87886ce8d61d1628
SHA1a3c8b0bc36e1e490a4f991fa87b32a2ff2f6ace0
SHA25632f670fd571f1d9eb558ef504834f1718fb8bcfce694bcbb12d48a256933e2fc
SHA512d43bfd781fb3ddbffb88fcbcb2d7086a8bc7ca4ccbb6154d965d28ab77be9da9d74ead7badb9a6c4068f002282a3c327d53aea34d4103b1d7313b345237746fc
-
Filesize
455KB
MD50dc96035911804261ce67645cae31cc9
SHA196284eef04990af99c89c090376660d7986f9b60
SHA256e7bc4ef77465f437bb786f70e615b340e8b682f1f4cabef96d92ac8eb254a8fd
SHA512b4059796cd5111672e175ee21f29eb420ccc4267711c8f5f6787da169076477081c5b3293d2c8b23708b66559bafc73c6cbaedcd450952617c4f09f845c445f7
-
Filesize
232KB
MD5daeb61405b7d4d4bc84e050d0564b5c2
SHA1d5939dd2ab5dfc7a704b957c8ad439bac9dc1d83
SHA25677bb02b096091cb0d1de4577303753c9168bf4dbafca10299973b9068982581e
SHA512338d33991a8a883d05fec228dc4036c979ab9acd3cd4261b83eea2eafc5eb64a58c97870e7f474bb536e7c2a2a7fa34f3eda06e25b895077e2e9d02226031edd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize471B
MD565b53edbbfa965c19b8af0fecf6b3fe9
SHA168f8a46ac66e157896f80efbee6ebdd2063f9903
SHA256d44b59cab5ad520362dc342e367c92d96134489f796231aea4ba2f45776fde51
SHA512095b7ec378dbb0e2541635a98f9162074bca149debaef54554006b34cf6c569c1cc592df7d1f0cfa8d103c40b8aee3a182034de0b7c96d356ecbf36d0142de73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize420B
MD528416f6e0f109dafe94f086fe5ad3243
SHA12845ab0732ae07787e73d8bffcf645964f6f48fc
SHA256c572eccc0807ee202ead7c9bf26b7c98f43d1cc829bde0914524cc206bb2ad1b
SHA5124d686b70c21d06348f6ab3a9557b747a34ef6f8e1049c037f0b897f451cedcfd6e736ea7707ef9068237a3a083c2f39303ff48dfa0d458bb6616b08c81edef58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log.raz
Filesize16B
MD549035fd9a0a9f9e2cee379a1c82c7f2b
SHA1a8c8df7adffe1f41e599ebdcdd18077e8ea9dd97
SHA256e3f2f03326110c9364359e4b571128bd26fbb685868bf269c527f4971be54dab
SHA512f14c940c4e9c28661e263fe657495afd55a807d6c51c4665e2e5f45ffacbc6e358094ca6bcb595d7f8180d7ea6985776faa8cf8b27a508dfa130975144d5bfc5
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.raz
Filesize413KB
MD5570387b00c901bca934632816a696acd
SHA1a8443028b76eabe4a945377dd8052d7f928e4ef8
SHA256a6bfa319e432582eebafddb970db77803cb911bf54f2c9ff9db97d7be05d5d23
SHA512972d7c4784790712c715467b31ce7df3452d91ca330c0f6751e448c1ce045d5bd983ceae282eccf3981254dec65fc75489e28b0a707bf2fd657d76df24539464
-
Filesize
1024KB
MD5cdd90367510e38fc0fd1f23a0d963a6e
SHA13eac52b3855b7a9c3f5ad8d024adfd9f851c1986
SHA256b25f31326405c4a20f474caae435f61e6595c88fb8d632a233127ee3961cf85d
SHA5125172bae16a17c183e159a6f2e3981ba398061d421ece72e194084ba739bd7ecc58ad7831e2bf2dfa64b7eec9fbac173ce1cf8e3ef232f7e0ecf122593caf6d05
-
Filesize
24B
MD5f6b463be7b50f3cc5d911b76002a6b36
SHA1c94920d1e0207b0f53d623a96f48d635314924d2
SHA25616e4d1b41517b48ce562349e3895013c6d6a0df4fcffc2da752498e33c4d9078
SHA5124d155dfedd3d44edfbbe7ac84d3e81141d4bb665399c2a5cf01605c24bd12e6faf87bb5b666ea392e1b246005dfabde2208ed515cd612d34bac7f965fd6cc57e
-
Filesize
1024KB
MD52fbb0e812240b328a5dcaed5820ce637
SHA1ae0deb725c2d24e8150d86bef132bc47551a6e26
SHA256b9cdd656626b4b7bcf33807cb6199c0c24ce9c43c7aebe3e00d3b611e7565673
SHA5121f02f14614a67a7d43f2eb6e9e0610cf81b09d1007624f3792c9701dda3298c3ba2fb14fc7b4ab37eddf2079009a10e06f630076ead7cd69d431e5532d860004
-
Filesize
1024KB
MD50be52690be0c8594098cf9b1b468dae9
SHA1f9e80b1ab9620f07a9c7027a73ece69168410da0
SHA2562379a05a2abdc114639b46c8d6c9986e207c26ae4f9c1d9dab488f4665d9852d
SHA512865f57d93ba0a6fe31c493a8191468ad59bd830bfeddd3a06674e0735173706a93dbad891568f9425a800ee56215bea52106065d3d8c8e5bae1ba96611780d5a
-
Filesize
24B
MD52a8875d2af46255db8324aad9687d0b7
SHA17a066fa7b69fb5450c26a1718b79ad27a9021ca9
SHA25654097cccae0cfce5608466ba5a5ca2a3dfeac536964eec532540f3b837f5a7c7
SHA5122c39f05a4dffd30800bb7fbb3ff2018cf4cc96398460b7492f05ce6afd59079fd6e3eb7c4f8384a35a954a22b4934c162a38534ad76cfb2fd772bcf10e211f7c
-
Filesize
24B
MD5f732bf1006b6529cffba2b9f50c4b07f
SHA1d3e8d4af812bbc4f4013c53c4ffab992d1d714e3
SHA25677739084a27cb320f208ac1927d3d9c3cac42748dbdf6229684ef18352d95067
SHA512064d56217aeb2980a3bfaa1e252404613624d600c3a08b5cf0adcb259596a1c60ee903fdc2650972785e5ae9b7b51890ded01ec4da7b4de94ebda08aeaf662df
-
Filesize
24B
MD5fc94fe7bd3975e75cefad79f5908f7b3
SHA178e7da8d08e8898e956521d3b1babbf6524e1dca
SHA256ee1ed3b49720b22d5fda63d3c46d62a96ca8838c76ab2d2f580b1e7745521aa5
SHA5124ceaf9021b30734f4ce8b4d4a057539472e68c0add199cf9c3d1c1c95320da3884caf46943fc9f7281607ab7fa6476027860ebed8bbaa9c44b3f4056b5e074d3
-
Filesize
7KB
MD5a15f677fa5033b4dfc9807d992ed7cf6
SHA1cfbef1f5e11942e43c5c5414bb1445d07b60d6c4
SHA256960d65b6c7b6b77b82de277db2cbd825496fa812a9415e1c33cc77f408d51200
SHA5120a3a1ca13da324922d806c45accfafb783a6445371f452bedf9a027915301c5b960320e18d495b3316cf3f21a20755e2a8875fff970948157a6c138b334265a9
-
Filesize
24B
MD5379523b9f5d5b954e719b664846dbf8f
SHA1930823ec80b85edd22baf555cad21cdf48f066aa
SHA2563c9002caedf0c007134a7e632c72588945a4892b6d7ad3977224a6a5a7457bf4
SHA512eca44de86bbc3309fa6eab400154d123dcd97dc1db79554ce58ce2426854197e2365f5eee42bac6e6e9455561b206f592e159ef82faf229212864894e6021e98
-
Filesize
24B
MD55f243bf7cc0a348b6d31460a91173e71
SHA15696b34625f027ec01765fc2be49efcfd882bf8e
SHA2561b1aed169f2acfae4cf230701bda91229cb582ff2ce29a413c5b8fe3b890d289
SHA5129e08dfbbf20668b86df696a0d5969e04e6ee4a67e997ff392099bc7ff184b1b8965502215744be7fe423668b69099242bba54df3f0bfe4e70acdc7cad8195b02
-
Filesize
24B
MD5db7c049e5e4e336d76d5a744c28c54c8
SHA1a4db9c8586b9e4fa24416eb0d00f06a9ebd16b02
SHA256e8830e7ac4088cf3dd464caec33a0035d966a7de5ae4efc3580d59a41916ff7b
SHA512b614037fb1c7d19d704bf15f355672114d25080223e7ee4424ad2cb7b89782219e7877b373bbc7fa44f3ad8df8a27eef4e8ccc765d44ec02a61e3b7fae88ae69
-
Filesize
24B
MD52dd3f3c33e7100ec0d4dbbca9774b044
SHA1b254d47f2b9769f13b033cae2b0571d68d42e5eb
SHA2565a00cc998e0d0285b729964afd20618cbaecfa7791fecdb843b535491a83ae21
SHA512c719d8c54a3a749a41b8fc430405db7fcde829c150f27c89015793ca06018ad9d6833f20ab7e0cfda99e16322b52a19c080e8c618f996fc8923488819e6e14bb
-
Filesize
1024KB
MD54d0b9bd9685a357010dea68291d8d529
SHA1f8e6627db30257c635575f140f2da50ee14a9628
SHA256d6114f65cae8b08ae067a23f55482860ea142a33b20576e9197ac1acbc4ac726
SHA512e9132aa2b986754b5c4362c121dce73c0dbfc79ce69e6a21fad2121e44f022526119c5756738bac2f3710874cdc7ebdfb756c3dd0f03191f119055de1394d04f
-
Filesize
24B
MD5635e15cb045ff4cf0e6a31c827225767
SHA1f1eaaa628678441481309261fabc9d155c0dd6cb
SHA25667219e5ad98a31e8fa8593323cd2024c1ca54d65985d895e8830ae356c7bdf1d
SHA51281172ae72153b24391c19556982a316e16e638f5322b11569d76b28e154250d0d2f31e83e9e832180e34add0d63b24d36dd8a0cee80e8b46d96639bff811fa58
-
Filesize
1024KB
MD5e0b4b6cd8300a2a528869a1eaee4ef18
SHA121c2d348732c5d2b3c170cbb9ea16dd921b5b529
SHA256fa0a32639b38bda273e8e0c48880255d0df984b82de69186781e8a4384f10553
SHA512ab3276615424cd83e614909342c98cf12359946506c06c63778da4eadc9044735098cae09c8b27c453da755b18b13483795f25ea36d490282e9a2bdba6b48b62
-
Filesize
24B
MD52d84ad5cfdf57bd4e3656bcfd9a864ea
SHA1b7b82e72891e16d837a54f94960f9b3c83dc5552
SHA256d241584a3fd4a91976fafd5ec427e88f6e60998954dec39e388af88316af3552
SHA5120d9bc1ee51a4fb91b24e37f85afbf88376c88345483d686c6cff84066544287c98534aa701d7d4d52e53f10a3bea73ee8bc38d18425fde6d66352f8b76c0cbb5
-
Filesize
24B
MD560476a101249aedff09a43e047040191
SHA1de5b6a0adc7de7180e19286cf0f13567278cdb64
SHA25635bc77a06bfdde8c8f3a474c88520262b88c7b8992ee6b2d5cf41dddc77a83fb
SHA512f1d2dcc562a36434c6c6405ec4eac7ecfa76fc5a940114da6f94495b77584a132d5d82ad3556df749490be096cfd238fa8b484b7c734cbc4d074e963e5d451f4
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
24B
MD5d192f7c343602d02e3e020807707006e
SHA182259c6cb5b1f31cc2079a083bc93c726bfc4fbf
SHA256bb4d233c90bdbee6ef83e40bff1149ea884efa790b3bef496164df6f90297c48
SHA512aec90cf52646b5b0ef00ceb2a8d739befe456d08551c031e8dec6e1f549a6535c1870adb62eec0a292787ae6a7876388dd1b2c884cba8cc6e2d7993790102f43
-
Filesize
7KB
MD5de4c341ace3844985c1598e57d61495d
SHA1cea4d72d07b3118215c52308e27263399bf55431
SHA256b760bbd1540585a22ea0c27563fbdf325e20f1715e5d69825776e144f334a47b
SHA512e8648740d5dd14d492c3f043432861d3c3361c3c1a0dbc278eaba04ccb65c00918d74e3d57ca0cc33e00aafda07b11d2974709cc811f5303f98dd86674849ba2
-
Filesize
68KB
MD5e49d81a269507e2f4d8884a95dcd052e
SHA14ffbd910b3cc7cae81b18a91977334db061a8a5c
SHA256da190b28990186459e574efe097ee86e235deb26f31797453295df99bd67a320
SHA5126dc68299ab443e2311e3950005945f6ec60d34818208f98fddef8ac9f5099d9518f7f8a6f0c0ed72b683377d5ef20273e8179b600098ef4f1d022403337e724d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.raz
Filesize8KB
MD580f9b3d821988bb0606f7ee920c34b6e
SHA18d68a32dacb08a2fe103824b0115ed74c32b17f5
SHA256079f3abac1184ab71b1e56328a50a3ea643a7c3fbf00f8939d7a081c22fa01d4
SHA5129d180b44da3d012243a720fcc23ca0726fa39fccab04e0e5bba93b4879ae02ffbb4c11118474cf1d78a4e4f9fcca2718bbc9bbab2a75a37166543ecef4724acc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UD7S7V2K\microsoft.windows[1].xml
Filesize97B
MD58ccad11b85512e3ee95c53ea24b112d9
SHA1ccd88f58310ac2e9844dd2b58315f9b542b98ffb
SHA25626655af59ac557f17c46d7d31f4a173fb0743fddbac9a787b96a234db1031b63
SHA5129ad4c830598aaa2655d06c0ed1c8591f05b5e6913baa614d61e5531a5c952dbdb4495394de477d31a99d8315c01e3ec807f568dee0923583f73d33f640728dbb
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UQAHUTT7\microsoft.windows[1].xml
Filesize97B
MD582dc88f9021b6b47ba8d6608d216f664
SHA120a3ab9cbfc45ffe161e491ef4ffae7e28d56bf7
SHA256b0eafa42fb1555169edc53f2d61d28569ea68f16e74cdbc92626616de56997a2
SHA5120398b91968f63d7767ae7f9dfc89c13544087948cb67b4a88da855a33bed0b38a271290b9a11ee0dc7f653b24787d6514f1272f49ce8ab76f1ae650053dfcac1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
Filesize2KB
MD5132415614427a577a55ae52e711d3c92
SHA1ce06fef8f411b41b097ba863d5c79e2b9075a078
SHA256f826c9f9ca58ace4008575ad959d475a92301941f2aaa7deef0f978a4a795aed
SHA512560b9118f2649a67dc5bd721b007901aa81a860d6e683a841689442234bf5e818fa418109b2d797c20dc52186dbf7111fb391dae74a7638dc425a79d18a61388
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{51325390-AE6A-68FC-A315-0950CC83A166}
Filesize36KB
MD5a38fa3ee5eeaade04580a713f3b6170a
SHA1bf653e5b2d754a7aaa2df9b7022030ba40d81c8d
SHA2561c37cbafd54141b5e20941eeda176efa083e2c5e0db3ea11404280b9031e221d
SHA512f906a57bff4065e07c6a5b587f0da96d7b2091074af766d0567fb4feaf516e9e8e0cdd6c032372bd05bb619042ef3ec17e110294fcd8d18a6d183106025717c0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
Filesize36KB
MD5bad093419be1135cfe9694ea77088c78
SHA176204c7ca72cf666add9c9931389d635c82e8af0
SHA256136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
SHA5123b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm
Filesize36KB
MD5a62d519be58c4ec079cd825e04c1f4bf
SHA191c59ff74e1911d942cdb7a68ebba42f10dc3510
SHA2569af30e079cc36bdf17fb5fffebbe68b2275616f9513b07e99f15f7065a2d99c6
SHA512637a0dced1a940af17c47abcdf30dc1a2ab2c1a1f70b9199789670398e87d2c9ad445f82e05fd1ea84cccfb62d25c8253218426c1fd9784b14dd5c7bae881b69
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{901ef2fd-7f2a-4b83-8a11-315360bddf57}\0.1.filtertrie.intermediate.txt.raz
Filesize16B
MD505dc2b9b90cfd7d8a90fd92bcafddd32
SHA1603fcb4d6412a5c54593591c3dd1767a677b7e5d
SHA2568b373e674018a3ac802ec6350261828f3fe8d81bfcead31da72c2b8c9aa69b5d
SHA512c7fadd7668be806bdf385aba602c24d60d6b66992595ecdf968f3126f3932d920eeb257864c0a5c78f45f865c6f3368bbe042d519bcaabfb8b2b59168afd25e5
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{901ef2fd-7f2a-4b83-8a11-315360bddf57}\0.2.filtertrie.intermediate.txt.raz
Filesize16B
MD5357d49c710a720db0036293f88df9294
SHA1b78ed32c136ea33ccfa5cf5add83712825cb56a3
SHA2566cfe43a3029ecad08abdbbb5a0c1547b0ea90196d3ab7387317af493385e2b75
SHA5128283e74c0ac6f6e4b7b0a0587b123937ba588d07a3d1fae4cac857545ebcf3e836a56b6c8386c1a6af3944e477411e3afbdfcb1bb139d0bd55410d2f5ef4f71d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754108717962.txt.raz
Filesize77KB
MD562ca7116f63c8461cc9de1ca8b08befa
SHA1d645a15cd427cab7962cc1e5b521fbe17ffac9c9
SHA256834ad1a01d7b4b931e60641af7a62604a0e537c7987888b2435d4430558ff98a
SHA51270046503e925f4ba42f6598e6e724c5b59084beabc68905b37e8795a56124ea15071549be953256930c225b1b921f48154633ece1de21fca4b73a987cd4a757c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670756572311376.txt.raz
Filesize47KB
MD520562919068ba031b16a96b30347e563
SHA1aece1771bc63507942dc8d3bb2c9e1b1115dff4f
SHA2567a9a7d434a9e37612cef04a6f461a519700d5085383042b55b9004e57f43bd37
SHA51201ff44bc07085194bce1ecdd028aaabd5ee35f2124baba7e4e9512f68b119f2611d8ae183d5a8f91c0928cb41389928a36408309ba76b365cec797dcad92fc53
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762450082308.txt.raz
Filesize65KB
MD50754c5c387daa4b8722777606162f850
SHA1fff390e48c7d6dad2068edf5d939d06d9a4d9fc3
SHA256558f17fe90e6e9ec6e6eeaf4ffa50d56f6ee96583d021453080c1fbcc0d4e9df
SHA512e9efbeb01ae96d53f5081fea677c3539f097d172e56cc2c95f154248349de81cca5e90098cea342cb956a9f14ab92b4f3a54699d6ef97ef2ce78df3e396b667f
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133686443057212748.txt
Filesize75KB
MD594e3880dee7d80b6ec52009e2586cc03
SHA150a9a4e76d90212da08a5f2317deeaad8f8b7c8e
SHA2565f41214c116bf4784f166c0c94491c7f2ce522575cfdf974d716ef9babfcd439
SHA5124917ab87f24a0cfb1383c1bc2d2b4cb2ac4b74da29da5df371c903567d26c54fd274cc490b37a310d327eeaae22b955d7b93be8ebc6362169d80733b986f5fcc
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133686443057212748.txt.raz
Filesize75KB
MD5585b932b55f9c03260ccf9e144cf10f1
SHA159d414d689ccdec92cfd3bac6286c1e0f0205892
SHA2560c220a05fced17a6bb8c3c5db89849a7cbfbfcc86817512dbaa5342cf5416d1e
SHA51286e1ee3da24bb0b771e9bb2c6668789ac40f923ad89bc7392b136ebfd29b05e16d0a0e8640738b2981f9c93815c05edc20b7afc0911bdcaa7b81ce3ac96e85b2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize9KB
MD56d9400de24aa15441b8696f1a897b4e1
SHA1283e4cbc723d96f893f66982da2d210827e5a0d5
SHA256a00cfb5e872ff0aefdb88d566b3db2950272930534b95cbcd2967cdb4cc9bdee
SHA5126e48291c16837b2a2a4c1eb1b48c5b14215375520fe26d72da039e49bfca6dd67e8605b5a6531e7c0a01f55e369154161ccc87d480b9ea757c4a977464e0eb6d
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD523ea866acee8858d8b29b3d6cb81a01d
SHA1605dfa2ca46c133b64d942630c3000dbb4cd32eb
SHA2564a32816e0c19909e335295905419d7f6156c9b736a203590216b3a8983f40479
SHA5125ac2d926795ae0cdb87d420fc040e22de3ecadb598557b404e207caf06f74ecc2adaf4b379f9d1a91511b9fbdbc85dd1d90860596b9950e372df0b533e81f321
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD5ce8b0b424954addf78d93995355bc073
SHA1b5e853bf764bb0f04ba610899ac1d28b8135b52a
SHA256f488340d4c0b68e2ce2eb0d30b16c57b42886d7610dede69e59dbab873e38638
SHA512e6bc71f26971cf4dc5d3f339952e29c682ae123f2d1f8a3ccb2178c6ebb12de17b7318ccbec5c263976edd3c2e435df72f76f84653a10444b31806784b75c678
-
Filesize
5KB
MD500e5fcfd833151f7cbde607e2f7afeb4
SHA155839875c0947aafebff53d22ccc5dad29fe3563
SHA256b80192aaabe007baecd0603e3ce183e9d554b8a6b0411d20716acfa086ae3035
SHA512f056777a1987c3becdc217bdc2d82e6aa41086d38fddaa45c42f1726b6f7b7616a10918081650e825a724464ef148b669bc258d38a62e0de8642e2607a0b0de7
-
Filesize
85KB
MD58b12ffc6b62c330fe978abf02698201f
SHA1739e03f81655da777c704eeee64ecc87a8a4b73b
SHA256bb7b7a430471aff51d64439659c66183ce3f583f53ff4efb3e1c75f6a107e0d1
SHA512405d1bc677d1045243e899407871bf89687d6175582ccac4d8e89389d0bec1e14adb209c9c3181d827d869351a4df4c21d670c15b062d7fcfb255ef2bd0148fb
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fz3nlbuq.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.raz
Filesize48KB
MD55f6936ab11e431456562da8c694a1974
SHA1dee20d2c66d80c5254c76a94e2afee86a4af60ce
SHA25610fc36e82d220694c52f3cf22fa07fe0255db27ae2442fdb275dc71ead0bb308
SHA5126d9c6d012072cd7e99953473f7543a8d3900ce609162296b329e86ba3f9c46f2b5e23f4e9ec93096a3b200f637970367074fa233910eafb709e4c4f4d75790c3
-
Filesize
1KB
MD5e944aef7e48729df1abe6539bb3b265c
SHA1369e25e8b46c0e90a786a8d69bd8a53f8866d72c
SHA256cff553ba3f93f5036e88fa4feb18a2f844dbd910205f4243971729946c95bcec
SHA51246cdee86f295d41114848d69cbca4385a31946890626d5737154a4f6eb183e3e92ea670dae42b48ee66ba0284fd0db10808b527bc7eb398e6615d2a42385c0b7
-
Filesize
1KB
MD55e8e08dc07432471c93ce4cecdf57895
SHA159e9c8520de37e9bd71f28188d756f5c19c2a23e
SHA256900b26dd6e5c5637a416f9a77f5b49b4d0402fdfac8443097e154d68b97d077c
SHA5120e33d3661c3bc31b7f6dc179c1a8cc2f41f171ddb2facd7ba26698969e6bccf1f3421d2c67a4d14b167447745e8a991d90d970b9186d08ad86b67a1c8442e03e
-
Filesize
48B
MD5716277b1fc5de4f9949e29d5d1664a72
SHA16584fd2c17a9b4944c0f4d0ebcd0f88aaac10e5a
SHA256d59a9d9c36c236b51c02361cfe8a7bbc8c10e7f02d8a9573488cc1236174ae15
SHA5124155da06ba6899e2e17457e064a62076a030ac1362d822772bfa1a2d7e0f1319d25b70217a63c553271077b38072957c2a2612205f817edac93ee589ee33bdbf
-
Filesize
48B
MD51ac2185dc0a3039a5f2d91ad54bc100b
SHA178cfa2a7bb496b2b889870a7457ad412734290be
SHA2564bfa4ee6c7f2d1fa6498d25e87e23274ee1a5b2128eeda7f6fd05222607b7cc1
SHA512a3ec3e78de7e1b46083fd642c5c390100363c1e64cd5bdf23bc8d56cebeaa346f68b965bf91480f0a9fe7e58952806aab1bf451a3335d05c8ae2c984c64f1207
-
Filesize
48B
MD5c151b56edacd0845e9d24cb2529e4f48
SHA1401faa49ed545fe40b01265f391779a65d80b455
SHA256011f1eb5bd11c5361fe61e48954000efb353da922d7cac90b21bc771a9831692
SHA512bddd473b87b0d615c467d4cca68aad456c82c4fc43ff9bf807d06332652d9fe82a4a3b1b38de600636a557af02f15838e75cd14a3e189ed3045412c5bf6e0280
-
C:\Windows\INF\.NET Data Provider for Oracle\0411\_DataOracleClientPerfCounters_shared12_neutral_d.ini.raz
Filesize80B
MD559c08d59d21cd403a2a9e39d03792f8d
SHA1f698f664a6b9962c4cc6e060904c1992fb2ec509
SHA256957ea69ab1edaf79768a85ff59a34d11b9ba70b2fb04e3f01a459c9c6a34b3d0
SHA512470027467cb9cecfa355848f2a1494b1563686eacbc320f0f3f303fa84a060a1898d8374e1d17e50fb694235ec4c429338000e0cca26cd68d40806c7116e2de2
-
Filesize
64B
MD5a8c0dd3acee55dcd78b05325d5ddee09
SHA132634b4282c8dcc1384bd967e10330aa6d08fcf3
SHA256373d58645b4b5d48473921b6001eb4b9dac21d34aadf7aa7654f835edbffaace
SHA512859273c50918b22acb6295f8af1f1c7717092ef012418f029e1849886b583b27a9f474e82b617beedaa70c05af0c4b6bc8dfb57d3dff140e6673fd796561ba82
-
Filesize
48B
MD51d5ea393af7d5827bc1e8b609fa47943
SHA1c2c096816dc28c5b7440a3a213d4601eea965520
SHA25630f9a211071b132b7466f61ab962de5c3b5839c684a15abcd8050b5640e42eba
SHA512cc75f5633f88cb7f07aae844b96049f4770d23edbe578eb0702823bad3f6162573a3049dca9247cefb5f5f604b9f27c5041fdd36b17f27c109b5cdc2e3491445
-
Filesize
48B
MD57698788126f08f65d1e9b57de0b01ee9
SHA1762fca1bff6779640dcb4f6c7588c9f8d109837a
SHA2561c91f4e4275ff689271ca308ff3fd16fb94a641ce7a9a2c50a433b090af812e0
SHA512b67e137a6f2c5395b67a30d6d3acf61d3a9cc35b693cb58f2a8fe0218f0b212bdef7b7eea5e56705a8ca80ffcc140150eece5d61c411f0da77c46b084e55baeb
-
Filesize
64B
MD55000dd656b0a7d2e2bcd38218315ff18
SHA1fda5682d906ee6b5e4070b0c4010db4cc5fbf00a
SHA25664bdd8b55b13eb1693d47e0f9d35b5b4cfbfc0d90b92989ab5077e10e699776e
SHA51277e1785e7068380da548a30bc525c8917040590948e7963f3684b632a3b5eb2badd5b0a81fedefba4dca90522ce30fd41ebd4b36cd13aca669f3937021d6e694
-
Filesize
48B
MD50a0ae00d11ef42e7415a0c05675274f9
SHA1334ab23123af683ce9bad7a21847c1b7cae9e3a0
SHA2569680700e364ca654203cc0787a6fff7d4350abc23f59c52e2b1362a1e5e0d226
SHA512f7f86d0f4bba56b3482d8c553590d771dfed857682e019e783cb560475c2a799155e111d335adea8d11495f9a4ef6de5126f43b77ff00c9d5f13df0719e6805d
-
Filesize
32KB
MD52641d5baf41cb97343a0929b4d650bc5
SHA108d66b983d399b048331cf951d947638f98fbec8
SHA256d327e58ec3508bf6240ada7a01042da940b2c2c126a03df9663393226e2323d2
SHA512f4267d6d3d02694aabd050120d1516f631c0e7260906ca95a2a72445b060abb5257e0ae87ccc2a9e4578eb25098a7f7958c329562574f45d68b623325be3addc
-
Filesize
48B
MD569189b916ff33f73658d07aa04f150d4
SHA1a551faafcf0f326ed8bee339412eadb390567f18
SHA256bd3e32f942ba88e65a95e956b99b89f8cf8ddc13e9d9cc9e76d078fe2560f7fb
SHA51244413bdd98d80c8ca1d121bc899e5377b87d45e920213e29066653d39b4be95545859ea12be978b1fb85ca81195d474de8298f06d62ba9338432cc67c6c9bab0
-
Filesize
48B
MD5c7b45e53e4b2986bfd1ac4d34b1c59f5
SHA15818cfedde5cd0e8c4efb2108f00f8146dd26822
SHA2565b8eca4e03e75b7eca772e9360a3b10bddc36a1e1150f08adbde2e11aa28f08a
SHA5121d7c1b60ee25b20a7cc1ad73158617d669b046497cf5dc611bf38b8868f986d37c0e1ab75c47b56988252c3c2b1cde58eed6ce357592382a26e7e7d7cf286f43
-
Filesize
64B
MD5f2e1fe862eaa6ff2d2e3672c97fb424d
SHA1f305cdb1ba85340e62d9dff4c96b9d05e0951a0e
SHA2560fd54a0f979120185351f473da9026521f1ecbcb393fe47828017ebb387c3e75
SHA512467eef2fe159f2503c2cb3929bb548c3ec480e7d90e7eb32866e3e156b03c3998de5752cfec5cf0b56cbb59248864c63b44b679f8f3953de3b008815ffde111d
-
Filesize
64B
MD5277a01d62648f6f7d4e5c78adc986ce4
SHA11c56e719cd3dcfa12c9b7c3e75997b5480738126
SHA256651e667cda778e67fa3858eaaca284313058c27c7003a14e8886492ca13d8875
SHA512b92ca4d4f33e63d479811758944a46883489606d2bdf39e322bc65b583a65673167d5f206e4cf0ddfbfbfe743c57f772bf9c9b49fcd7914529bb93c870df6fb0
-
Filesize
64B
MD559f9ffa9442bcf0f72d1152a40dbc5ca
SHA1f1e43ebe63f7cb6943fcdf80b0f097fdc66dab1c
SHA256cd3534bd029be0ec20e06aada5d1f0278902c32fdbec92466dd400620f7aeff4
SHA5125736ab0190db6f8eba6bf6643424228fd29e8c48a3e854f5c9385f5056845a8abdcc126f62540c02dbb079506feccaca74f6510062141f662b65c275ee92c1a9
-
Filesize
32B
MD5e4d617080e2f10558025827178952cf9
SHA105943087b2b8478d9f188776126d2e7d992ad5a4
SHA256ab9fbd9be9dd6918eadbf0cf1156f97f84a69c99eb2b3133967bcbe1e5062158
SHA512c176f2063fc3e3efa0acf63f53d3c0888e65137dbdc4d15ced3e931786ac4e8e816d5c9d0726009fd473a4b659db6b2b397bcbd46095b799d31e4d306a257e91
-
Filesize
992B
MD5c36e8b00b1597c1594b8fae7a7c67cda
SHA116aad2a91553871fd0ca0fbf5323df9aa7fe53d8
SHA256b2aa8b610cdd97bd852508332bf9ff7720c9c230c7e6c3a2eeee49994cdd4949
SHA512e2de170428c2a34fc79193a00ed30044cc0797366fe2541691280ba3e75bbbbb5b0407453d2607654718ea703b39333c8269ed4ca75bf6f3055203e634ea9a5b
-
Filesize
576B
MD5a8e6f6458eb2d0abb2e7c153ecd21b1e
SHA1c920ead61b5e3031589037e2cdb1565010d78938
SHA2561eb695a15626019920fd1430dc90b0e4493b7be09461412e1dfff2eaab027d42
SHA51298084ba3acf156e29bf7fbcef8feab63e2c9b2748e2e1b952d651224ec0f2918eeb15553e6c0949b826141ff19920e7e84c38ee6380a28870c2585e210648c15
-
Filesize
368B
MD52734721c70e2c3a2e3243778bc482b10
SHA140c47206a4c4c0912eb41fb2e2406589b4a06809
SHA256e03c8bc48fa9c713d4f6e535102e333c55bb282c723c65b029c7cbfd716dc7c6
SHA512aea3973b9344089bef88e371b1a6e214290fd92ce7a9cf6d11d996bc0aa594ebbeb2fa8b66ec6935a3fe27c628bc345d1d71f01bdad3cf2ac8bbf22a58573a88
-
Filesize
64B
MD5fcd61fbc8c9e4b98b7569db772c695be
SHA1213ef244b5a2a3a83b5935fa1ea930c0aa002fb2
SHA25663f6b9d838324a81e8da212ce8820277f73bc06f1384d27e700c48fc758df0b2
SHA5123d985fa9e9ef92acff1c223a9a0c3f7c09ad4630ffe525094572f31df1be38d291a6fc288a6d3deed5502a991c00f06a97bbbc1dcbb648e2c65506234f24aca2
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.raz
Filesize80B
MD5e9c9db4b48f733f7d4df8e3ff9b14ac7
SHA1b186cf5294ea2636eb21b7df1097d6d9ed71ae79
SHA256c77ce628eb703e4da78bcb8f5afeb3a86c471bae325b1e3d27d6969554452150
SHA512e4d49373d9be5a5e6185be8b5fedc70a7f621a96f80f9ae4d7d838d6607b7ae4d2d00a8820f5be54083ca312ee1bedfa3a55773476a0cbf92b9c5ff07e914168
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.raz
Filesize80B
MD51ee5147e0e4fdd33c6da2c3d9c819581
SHA186603d8897fe800ce41050b9564658c2641a2167
SHA2564dc890f70b490c142df28e24496204b3b4920fd26ae1aa4b3b0817fd409cfc3c
SHA512681055a44a69d574ab727d933f13fc76030d932d2c69eca12badcee63bd0319ac4afc88fce3250fad05d214c85ee3c61868c66ff8dbcd3cd688c77cd66bc7e55
-
Filesize
2KB
MD5bd339f7a8befae0d927816ad3e28be7d
SHA18c2541ddbc8845af333476dd614ab4c0a13e506e
SHA256d68c192649026bf5b0061f6114ce92101370bf73471bf6bfccd8374db0553999
SHA51250b21432260998e34e1352b76e3bbc39827ece402219b5fd7dfd39842c3d795896edcec809c77b6719f5d6f0a2aeb81390d9398badfbe4eaab91024048de8942
-
Filesize
13KB
MD56310b431d9e82684b52e9fb839cf2a4b
SHA15823e8deb87905c7aa7347cb60a686489f3b2b0e
SHA25620bcf7d9afffd6c247c4f262579f90204ce27a7fad6099868c8573d0aa229f78
SHA51223e544af9de53b6adc3b843302115281a4a8b474af8b59a604bbdf1daef8ab39238022286e9135c6db3d1555caf68216125505abbb7215584036037a2a9fa038
-
Filesize
1KB
MD57c804b45423ecfa6b10aea5588a87384
SHA1efafd92861caea998ef8bf679eb833aff6175fc3
SHA256074640b7bdf4fcad1dc5a024841c61bf29758e100742e8b98fbb4def348a6689
SHA512b5f33f543a1397b10c0dac4d10544856917957024998187ee6759794041b2cf2a45458e707196762c9303e78772af6d60e5f901e1da5526fcc62be3b8317b391
-
Filesize
1KB
MD57644c192e70f47ce8dc0f6e5094f42b5
SHA1f4b29d907da316683a6cc0ad6bd9e222371f4136
SHA256fd74c4775be9d3750fe3edb7fbab6182d6f5048da7d4a989c96da041280f6387
SHA512875db769f117d6f7ee59a8ca37bf637a2229181daaa32b1fe8cf3182a08e0d5377d4996b0eef0eb705bb2b3f21cac5d382bcb008920f20632df944de3b17f854
-
Filesize
5KB
MD538adbab27c4309faffc209e7c1221885
SHA1256adf671016b96e7626fb5ffbc1fe1af05ed4eb
SHA256b4d719ee48a30b4420524994c2c8c5e5a2ffc6db5d61ebcafc6fd80b932db785
SHA512aa5321236d807ad55fe9669707bfc327a5eb42195c1613db6f5a4eb2e99df5c11a0d56e461f812abfcb304b3ddb9dbaf2c2f6c2a1e26b3fa0dd61e5c8413f833
-
Filesize
3KB
MD583781ad8f5c53b5a2dd963b4b6572c50
SHA1fafa78ce1f8161aca9c56fd0d01ffa8dd0b8c09f
SHA2569cdf97a63292a885223b01bf7592281074df321f297075a9c34b63ad99947ac2
SHA51260bda05f05d731212e3a89486ee05d7e1627db602494c3f082b9502dd1c660328ec96f84400440f9e0390da111bed0c49a64322edc2126bc1c958df2902e39ba
-
Filesize
6KB
MD5cd9d7fc254442cfff1e907794c1e262b
SHA1841055d18d55e11fad05813c84f8c87b1a828a4a
SHA25680a88e60b94f46f932ab9a9b6595b10d64b7e48ed915f7e2e723a7ffeaae9a3a
SHA512f2c2079ef819e0dff9639336968ee7edb8c79fdef2d5271d02dfdd3aaf172f6e039be92134e1fc6575aedd3ca62eb4d072b798c27d167083ca668f13137fe7b1
-
Filesize
62KB
MD5e3aca63378cdd1e12e34418167ed8e9e
SHA172f137565202c935d90af42c828c30ec248a4b9c
SHA256c2749680a756b5044a664eefe96a01cd5551c0dd75db8d7eafd34d3d37ca1ca0
SHA512db58540d7b4746e445a01d3646332f91bc742029ec89b832319e1e625a34dbd5bd6bd03e44d8b7cec36d7e2e70f58ae690693e8bfa67b2fc08125a1a33c057bf
-
Filesize
28KB
MD5027f8397f85f15f011d16913342522de
SHA16ddf7bfd664bed8135051e6b58d84c4152992b49
SHA2562ada566810fb3ca2dd07a8f17c435637b8f3efc05c2ab624a66c31851fc9a95f
SHA5121b08498e20742be0c25a65bc32941e7160be26b079bd200e98b174be2d5ef55e589b9efc7f2f87034ca4ec6b2f364beeccb7a11dce5a36b81b7939fac17b8639
-
Filesize
88KB
MD512e7968eec54a7e4c41b644c5b776b1c
SHA166a0700eea4545b39e9a3e61e4f326cad444cb95
SHA25616450ba55b3fed3a9e6a3a796c7f23c0fef90353cf01997c5d5591910515f522
SHA512102c3866e79839b795cbc368f798cf4bd1a27c780a55f5aafa8a4b5771c98ee8a4dc50ded7227c86fc7b9d2b787afe144f0aa697cc85608afde48a85a31fa208
-
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.raz
Filesize176B
MD536d4e3759412c77dcdf24a162a776eed
SHA167b99b4912c0ec27a06c413ef4887fe269f72439
SHA2565f8cdb425a5367ede4d9f91ea036a9990299350b402f9cd4effa135ba6e5e198
SHA5124069ff6600b9b4e4ed0d2fdf60e559f865ef9dc5176adf96a2fd1409bc57d49281c1ed9fdbc6260ddcc0474ea04c9530dc9dfcedcd01a0dd583cb9da20cf5150
-
Filesize
113KB
MD5a29513600aae1e0f0eeae2f028ff939a
SHA132b55398b10aa5d85321994ee94bbca68f408d64
SHA256346148c1ecc04769a8fbc9099d2c167a1c72ac332d0b66f975d425b9b253b450
SHA512476b009088b7784213646966736f84a5fda7479de40b96f596a4daf46cec6ee2c66d7f4e292270fe157f4b1732892474328266121974513ab8081410f58a970e
-
Filesize
236KB
MD58e91b73784b333bc9407d6441665b5e5
SHA102609a249549091950d340869bc804a7764504bf
SHA256961dc8011f62b58951a34746af42dded7e1f76d67af19e31731b6973414f8b4b
SHA512188d78f640f57b80d1e36851bc01f56a83b88597d4e8be89ff1ed83ca448747cfa9b6948401936ed26be229fc0bb2bf7b4fa4797905416bdac89b9a013760511
-
Filesize
992B
MD585f0cc957297aa8c6668994948f235be
SHA1b21b7e75c3be5fdfea310bfe93742ed9781c4ff0
SHA256e5174bdbcd63bf4ec73cd67de1fce23bf6d57123f277becdd633702aebb57128
SHA512df55d6fb8fe406c62b1300ea420093cc8b8ae2aa6981536b7034a0fdeab57cfd6a73bbb75979c44e103c816f98a5cdc85ecd937e17220c15afd9efc0c484d43d
-
Filesize
693KB
MD50e05ed7296f4d53700136cb399e6628e
SHA1881fecf27164e6ce2701fb16584a61487e7062ea
SHA2561c1f3c02536d0622a207e2aae7ddfed314702210367f06d7f6934f05476679c7
SHA51283d4d0362b4d0198bef4fbcd80b32c9c92345f73ae1bbde16927e58d6a1c25dc3d31b9bf457f6e6b15c9bdaad66eb9881cbea34d63812105b05b227630009601
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\PhishSiteEdge.htm.raz
Filesize112B
MD5ec8f9c19d9330f1a345f3f1724b4fd8e
SHA1915fef0bc11173a6feaeb5532b5d692cdafacc7f
SHA2566f4ea40114557f2abc262ee06295e6f9a2af04925a3cf39a692a4eaaf0a3de4e
SHA5129fdb2765d3ca2342fef1d4d941735a1ae3700b177c29014df165bfb2ba3294101b74bbc1a681219c4646648fc285db95fd1dad506feb5aa8ba0c95a75917d651
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\ErrorPageStyles.css.raz
Filesize57KB
MD5eb859d9b64127a38070df3b111cdc274
SHA1c45376441936d8ee71947080d7fc1c586c644a40
SHA256cf4d66803dbc2300390dab192b07d4868e9285926c59954a6086f38db1f64db2
SHA512c15f74bb27ac99bc8ebcee076bec24be0d2e6222d5da0920085d481047f2f3d875a6a61d8032fa54824325941404185703ef519144319e032f28315fe4c670b5
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSiteStyles.css.raz
Filesize5KB
MD55b21fee6f53d28e3ae0ee59a91543a0b
SHA116dc2930a199bdc37965ca184007e9d00fbe744c
SHA2560a7b42d8e81312e6581de228774eb4d48f7545ae3e92bade0066f9878c72eed5
SHA512f0ff92e2db543a68ac6f8549f5b57246b366366cf4c806dc975a7eb0374c348e620d203aaeac340caf0306a10c647099618bd73e73094bbe40ac349ffe8864b7
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\TridentErrorPageStyles.css.raz
Filesize4KB
MD5ff7bab77cced161410ded43a49e3fc41
SHA17495d6413301b79d036f7d4f92bf3b2ef036ddf8
SHA256a69e7e4e87e524619e43daaf09e905f6f68e466dba65df2bbc327165464852ec
SHA5120b99cb1e7455bb77c6d28940d457bbb0e977927d4166f87dbce5e6916d6e137743f004a1eb45d1aa2c1cba840c27e6cfb6be2b6ff731278dc9772f6e469598d5
-
Filesize
19KB
MD515ac26d3ece330815baf9863bc1c6bd8
SHA194319625c68247f69f8551a749f9a8f1378dfc65
SHA256ba9702eba6870e51391a20a31b8a6f5742459babfbe8146ef248794202ab328f
SHA512f3b443e1fe3b3a16b38be1e18940dbe8bf555d7febbcd802a6de993a62e5f89f1b221976d875279fe7a1baf6d9c09dfab1cde484efe2f767075a91c39a6fe6c0
-
Filesize
30KB
MD5aefee08e68fb9c8687c2bdcf4925ffa2
SHA1c86148fedd0acbbbdcd0b8592ae89c2b3b67a0f2
SHA256fc620b51e3e891a1f11e4156863774d4577f11e85b243d6cb5a007b111bd4a9c
SHA512ad8bcf6d87ce9dc6d9731cc47ad091f756c7049b43cf5ccfe8d8f6e4811f75b596b5a6d88baff776721bcb1a1ad1d2e5ebcea8d98ee2aeb22fd5ed94351eab34