Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/09/2024, 07:00
240901-hs2fgsvall 528/08/2024, 19:09
240828-xt1yns1era 1028/08/2024, 19:05
240828-xrz9csshnl 10Analysis
-
max time kernel
44s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 19:05
Static task
static1
Behavioral task
behavioral1
Sample
razspy.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
razspy.exe
Resource
win10v2004-20240802-en
General
-
Target
razspy.exe
-
Size
17KB
-
MD5
c9122b326a11741382964a64acbbb43e
-
SHA1
216bac6bee35ce03407349a23eb6a618bf95082d
-
SHA256
af3b9d5de82a924b2177d69965dff7cb98f5adca28dd4a50e844d96dadd528d1
-
SHA512
1fcc4fd64ca6eaeeee0be91d4bc067bed2f5e6716d05a2a74b90e702b1110d8cb81d32995ffededc0a67fc3ed725df3cad8424ddc17a33c7a040902687ab6102
-
SSDEEP
192:3YQ9IeQOGWJvSdDk9iMeqh6c+e0zigZIkGoskKjgEDkZ5qcL/e3Q5tfuNKA:3YQmeQLWJvlI/DvzAZDg7m39
Malware Config
Extracted
C:\Users\Admin\Pictures\Camera Roll\README.txt
Signatures
-
resource yara_rule behavioral2/files/0x000900000001db64-17.dat RazrRansomware -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4000 bcdedit.exe 3424 bcdedit.exe -
Renames multiple (6864) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation razspy.exe -
Drops startup file 5 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt Razrusheniye.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt.raz Razrusheniye.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt.raz Razrusheniye.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.raz Razrusheniye.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt Razrusheniye.exe -
Executes dropped EXE 2 IoCs
pid Process 3196 Razrusheniye.exe 2572 vss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-21-2392887640-1187051047-2909758433-1000\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini explorer.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.png" razspy.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\ui-strings.js.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fr-fr\README.txt Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sv-se\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ru-ru\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Common Files\System\msadc\fr-FR\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\7px.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-400.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-48.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-gb\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\es-es\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\root\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg.raz Razrusheniye.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\ui-strings.js.raz Razrusheniye.exe File created C:\Program Files\Common Files\System\msadc\en-US\README.txt Razrusheniye.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\3DViewerProductDescription-universal.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\README.txt Razrusheniye.exe File created C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fi-fi\ui-strings.js.raz Razrusheniye.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated_contrast-high.png.raz Razrusheniye.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-right.gif.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-16_altform-unplated_contrast-black.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-30_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\README.txt Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24_altform-unplated.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\README.txt Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f14\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarWideTile.scale-200.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\close.svg.raz Razrusheniye.exe File created C:\Program Files\VideoLAN\VLC\plugins\packetizer\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-125.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\README.txt Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sl-si\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-125.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-250.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\LightGray.png.raz Razrusheniye.exe File created C:\Program Files\7-Zip\Lang\eo.txt.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\images\splashscreen.scale-100.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg.raz Razrusheniye.exe File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.raz Razrusheniye.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\PREVIEW.GIF.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-200.png.raz Razrusheniye.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\README.txt Razrusheniye.exe File created C:\Program Files\Microsoft Office\Updates\Download\README.txt Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-100.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\rhp_world_icon_2x.png.raz Razrusheniye.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubMedTile.scale-200_contrast-black.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\fi-fi\ui-strings.js.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations.png.raz Razrusheniye.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css.raz Razrusheniye.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.Implementation\v4.0_10.0.0.0__b03f5f7f11d50a3a\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.resources\v4.0_4.0.0.0_it_b77a5c561934e089\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Speech.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallSqlStateTemplate.sql.raz Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\README.txt Razrusheniye.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\README.txt Razrusheniye.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\README.txt Razrusheniye.exe File created C:\Windows\Boot\DVD\EFI\README.txt Razrusheniye.exe File created C:\Windows\PolicyDefinitions\README.txt Razrusheniye.exe File created C:\Windows\Boot\Resources\fr-FR\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif.raz Razrusheniye.exe File created C:\Windows\rescache\_merged\4180865456\README.txt Razrusheniye.exe File created C:\Windows\Resources\Themes\aero\it-IT\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Excel\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\PresentationCore.Resources\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.Core.Resources\3.5.0.0_it_b77a5c561934e089\README.txt Razrusheniye.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.Printing.Resources\3.0.0.0_es_31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.resources\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\sysglobl.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\README.txt Razrusheniye.exe File created C:\Windows\IdentityCRL\README.txt Razrusheniye.exe File created C:\Windows\INF\PERFLIB\0407\perfi.dat.raz Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.Linq.Resources\README.txt Razrusheniye.exe File created C:\Windows\diagnostics\index\NetworkDiagnostics_4_NetworkAdapter.xml.raz Razrusheniye.exe File created C:\Windows\diagnostics\system\Bluetooth\fr-FR\README.txt Razrusheniye.exe File created C:\Windows\diagnostics\system\Keyboard\it-IT\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SrpUxSnapIn\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design.resources\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\ja\SqlPersistenceProviderLogic.sql.raz Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe.raz Razrusheniye.exe File created C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\README.txt Razrusheniye.exe File created C:\Windows\Containers\README.txt Razrusheniye.exe File created C:\Windows\Media\Windows Foreground.wav.raz Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.raz Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.RegularExpressions\README.txt Razrusheniye.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P08ac43d5#\28965f332c6eb08558a6f5eb76540d9f\README.txt Razrusheniye.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Services\d9883396e9f4829648858cacb8d30bd7\README.txt Razrusheniye.exe File created C:\Windows\ImmersiveControlPanel\images\TileSmall.scale-100.png.raz Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\en-US\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\it-IT\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\it-IT\README.txt Razrusheniye.exe File created C:\Windows\PLA\Reports\es-ES\Report.System.Performance.xml.raz Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions\README.txt Razrusheniye.exe File created C:\Windows\INF\usbhub\0410\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\MiguiControls\v4.0_1.0.0.0__31bf3856ad364e35\README.txt Razrusheniye.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data.Resources\8.0.0.0_de_b03f5f7f11d50a3a\README.txt Razrusheniye.exe File created C:\Windows\diagnostics\system\WindowsUpdate\es-ES\README.txt Razrusheniye.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql.raz Razrusheniye.exe File created C:\Windows\ImmersiveControlPanel\images\logo.scale-125_altform-unplated.png.raz Razrusheniye.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\README.txt Razrusheniye.exe File created C:\Windows\PLA\Reports\en-US\Report.System.Memory.xml.raz Razrusheniye.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\README.txt Razrusheniye.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.PowerShel#\README.txt Razrusheniye.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4828 vssadmin.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "0" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "129" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4ei SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\MuiCache SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "0" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "3" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\NumberOfSubdomains = "2" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search SearchApp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2500 razspy.exe 2500 razspy.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2500 razspy.exe Token: SeShutdownPrivilege 3368 Process not Found Token: SeCreatePagefilePrivilege 3368 Process not Found Token: SeShutdownPrivilege 3368 Process not Found Token: SeCreatePagefilePrivilege 3368 Process not Found Token: SeBackupPrivilege 4064 vssvc.exe Token: SeRestorePrivilege 4064 vssvc.exe Token: SeAuditPrivilege 4064 vssvc.exe Token: SeShutdownPrivilege 3368 Process not Found Token: SeCreatePagefilePrivilege 3368 Process not Found Token: SeShutdownPrivilege 3368 Process not Found Token: SeCreatePagefilePrivilege 3368 Process not Found Token: SeShutdownPrivilege 3368 Process not Found Token: SeCreatePagefilePrivilege 3368 Process not Found Token: SeShutdownPrivilege 3368 Process not Found Token: SeCreatePagefilePrivilege 3368 Process not Found Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3832 explorer.exe Token: SeCreatePagefilePrivilege 3832 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe Token: SeShutdownPrivilege 3392 explorer.exe Token: SeCreatePagefilePrivilege 3392 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3832 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 3392 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5968 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe 5348 explorer.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2424 StartMenuExperienceHost.exe 4264 StartMenuExperienceHost.exe 3048 SearchApp.exe 5896 StartMenuExperienceHost.exe 4396 StartMenuExperienceHost.exe 5440 SearchApp.exe 2080 StartMenuExperienceHost.exe 1820 SearchApp.exe 5224 StartMenuExperienceHost.exe 5836 StartMenuExperienceHost.exe 3832 SearchApp.exe 7132 StartMenuExperienceHost.exe 1508 StartMenuExperienceHost.exe 6676 SearchApp.exe 736 StartMenuExperienceHost.exe 3048 SearchApp.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2500 wrote to memory of 3196 2500 razspy.exe 90 PID 2500 wrote to memory of 3196 2500 razspy.exe 90 PID 2500 wrote to memory of 2572 2500 razspy.exe 93 PID 2500 wrote to memory of 2572 2500 razspy.exe 93 PID 2572 wrote to memory of 4000 2572 vss.exe 97 PID 2572 wrote to memory of 4000 2572 vss.exe 97 PID 2572 wrote to memory of 3424 2572 vss.exe 98 PID 2572 wrote to memory of 3424 2572 vss.exe 98 PID 2572 wrote to memory of 4828 2572 vss.exe 100 PID 2572 wrote to memory of 4828 2572 vss.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\razspy.exe"C:\Users\Admin\AppData\Local\Temp\razspy.exe"1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\Temp\Razrusheniye.exe"C:\Windows\Temp\Razrusheniye.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3196
-
-
C:\Users\Admin\AppData\Local\Temp\vss.exe"C:\Users\Admin\AppData\Local\Temp\vss.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:4000
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3424
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4828
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3832
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2424
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3392
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4264
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3048
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:5968
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5896
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:5348
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4396
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5440
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:6068
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:2080
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1820
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:4204
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5224
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:4732
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5836
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3832
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:6520
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:7132
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:3400
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1508
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6676
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
PID:5188
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:736
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3048
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6060
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6768
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6840
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6308
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6172
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4524
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5820
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5144
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6968
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1720
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6988
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6100
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:864
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6140
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5036
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1884
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6692
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5592
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6964
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:7036
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:7080
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5396
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6352
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5720
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6860
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:692
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6536
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:492
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6096
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6640
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5464
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3676
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6692
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5728
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:280
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:800
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6356
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5616
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:2428
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6192
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2580
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4584
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6280
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4940
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5308
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1056
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3636
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4180
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5188
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4148
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:6564
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3084
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:7132
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:5088
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6276
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5248
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1956
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:6920
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5a526b9e7c716b3489d8cc062fbce4005
SHA12df502a944ff721241be20a9e449d2acd07e0312
SHA256e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066
SHA512d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.raz
Filesize720B
MD5361ac1290b40dbfbadf3628303cd0f47
SHA1a9e6df77463a0b8778a79b441bc07ca02392d478
SHA256f3f19767457ecf1cee73f91ed3a6c019d8635238e8c981209f2b53f1505457d9
SHA512509b6935ba9224e5be1315abc718d88d13842a30355532e1a9d19fc8e4d75be7782f7a31144c37073b159539f188965119a476e75826741bd02aca0b5251f883
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.raz
Filesize688B
MD55030d5e78df608d8c5d2db02279d1ce5
SHA1acc56cead9a82c3b852bfe6e389f759bbad2f1fc
SHA25619f027109950180e3e75eeaa1fd6be15d0035d0a3f6cb3b6d46306a00d0ac6cd
SHA512f1221502b69e19b076de8668b6af59af34289fbbe17632958bcd820df91c2e4412285baec7950eca85ead068c9868560afac6b2a3a497f7d26989f61ff234e1c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.raz
Filesize1KB
MD5bea350232641da98a320d2e6942a35e0
SHA1f304602890b10de134c6ab591d76546d70939b7d
SHA256c5c231b5e47659d9672ac391f96c004c4e409b2a7eb35bfbab4ca5d5cdb6396d
SHA512ea5d296602303d910f8aaa5ec2529b8a7c9f436b232a12b0009a4b1009328ff94e66f4d4a4187e10205b3159183e752c54ca8bd60485fbe562118ec8389537de
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.raz
Filesize448B
MD5de80e1e0ed3e342b044986ae2a22dd36
SHA1018c5459e36bafda1c6f401bdb06e8e25c5ba28a
SHA256889e72da3d34b623a367186c9718efd44b88f9cb5a44cdee6d5558128126e604
SHA5129a7048218d4eb061b9aae488f29ca89e643128ae4ad2f41d03be16caedd94305b2c06f8bd2e7be3b1f355ec2a59c865506d34fae2cf5c279f04dd28410493315
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.raz
Filesize624B
MD5174271bd7869c7c09325a0adb2aba018
SHA166173c0f8260a4f5b04d5bff2ca70da02add288c
SHA256967633c50126f062a58b1133c07966633b413871b932904f166b838fa2ad5cc1
SHA512b05bc8563e4a1350cd62874f37caba98a2c8334ac994727e5d6eced57fa9f8e2a2186c246d89cda40c6e6021c5b57223009c71caf178db3b04fc64a49d09a84e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.raz
Filesize400B
MD5b610e056e5f38b02e67d89496b3e9021
SHA1a34a46b663241e9bda18b64b4fd54e123ef713f7
SHA256bf7d4cc27cad159fa6ff502e92bdf72249d2eee1c720ea18d00116f44ce335ea
SHA5123d1dff2b6e2f5c8dba6d3b4957d2b4a64900b8e6e01f74a419f388ce820934b614f12310e487fe29a2e1cf8d82b31d3e0d8c183677a9fb15f55fa84c8fba3e60
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.raz
Filesize560B
MD5f83046e80f86fd5bd6fdb816f2ef0b8b
SHA15de84dbf14399f31e3812ce0c014699a45a76306
SHA25683f12a56dca39609541cbe82010ec522fcb4e026a49d27f7cbbc1f315175a270
SHA512b8d0ea9a705be2b2b6f373a3f34a9593b92f9167906f8600285781cdbadd535a6f3ecd05a129732aa4ca8e23bc06cb2ea20ac416c770ecdee213390f4901e6ae
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.raz
Filesize400B
MD59f40aeb02df5acbbba7898433e873205
SHA11f90187c19b49dcf818976244d6b8d340a6b6a3f
SHA256fa64a6b90595717c6b550f89c877649fe014de36275be8a12e5926fabad80a4f
SHA5124bab922217ecbe2b2e097ac545ff4fe209f9b6d5ec8801f8a4c4cf0eabc3f1a637ecf382deffa7c2416546c7a1822bc399ad4bfcffa38d42a6984bd059942c0a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.raz
Filesize560B
MD551340a710e2b54a4b5f4ed5d0a17e62a
SHA16f690a2bc1900f6b16e7705bda5a3602d154a9b9
SHA256beaf1e89296e7ca02e4104ad526a18fd754f18cdaf3301f90ca303809871bd8c
SHA5128b550ee5379e69a15f777660e565feeed4765937901b384c671968b77e58da9bc55582fa8a03ee8786f3c6e8c5f10e694552c75651995ae3adf01e39e2a89404
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.raz
Filesize400B
MD5df92a764bbe46b856f40231ae18385cd
SHA1c4abe9a0ed830c37f78ed4b7488706b1ee6fc82a
SHA2569f3b08c358452b4f52429f9eb14574e86d11b3eab73b3d2712a61aa2ce9fafb6
SHA512f38d406f963bfd9a9fba96391b12f08f5ca014b2784ac02048dcea8892d5b4929d38b72cf1f6dba63c7a1569c4883d068ccc7bf07435ef5525769890028bd589
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.raz
Filesize560B
MD5085480cc1b1b4197a256debd6cd73b6d
SHA114c0a059479d56d0bc394c1a6649ca0a7d69f86b
SHA25693af61a4ca4286cf83ff01a8daee9e152ede36f40f1bbc1ed1cc0132ec37810e
SHA512deb0a828aded0dfe6d82112ab20e7aa7da50a69e180c2c6b9cd55ac0c5c225859413f825c3165273d199a3260cc040e0ccd4e831b96a4c7f5fc1c2c47398067f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.raz
Filesize7KB
MD5a4e42d5a015a3d976213a10c95db5588
SHA175bbb281d85e3d540b0d5646d9e8e6cada9451eb
SHA256a2deb2879b56b0076a0b61313355ab1f45138cbffb300742bd7268382b042f34
SHA51217213cd7683aa6e65aa77f37689df1ea6af3e78ae35d3b27071efb0863ea20912c71721aab943595b8b1672515aa894632dbbcdb5382a621695bc7e54cc034d0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.raz
Filesize7KB
MD51361282f1655bcf26e0b7d05c8e8cfbc
SHA18e1d6b873c5ea36654252d9096e461ace16f572d
SHA25602f54fd2dfecc16e32f7d72a66b9a1c6a33ccbc7980d4e7c1d3744d07760efc0
SHA51250f2061b636e7731178913fa919e572f07e1b69f6c294049797db13fd1ed46c0def932bfc0b2659dfb668300a2bf6dd3464dde5db4a6bc1402dad54d9e14e32b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.raz
Filesize15KB
MD52a533f25e5acff22784b2827436eb5e1
SHA148b80f1f4448c2d8beb0d00a8382012b0f1db8fb
SHA25661c3ffd6211bf46e47763503f48edf99914fc45e48a66809d7766b32c7718c31
SHA5128fa3d0b4da1fca252f25ee2e1027c65bffcc30ca5c782ffdb8a7805a365aeb018b68eb5f32953a658cb514953b9b841a4043cd55666e6bba364e187fe0c0f4b3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.raz
Filesize8KB
MD58af2870b72bc9c69e6989e2b8fa388de
SHA1c76b31d69c81691be5bb5ccb4ae65c2847a40052
SHA256b4db49ec15340a1305c94a873320030c1419f5dbf0b9e86e42a037320990fd94
SHA51256bd60d1b0f425aa10b7efd44eeb1caf403efa7b1382e383294df3f1eb94ed12647996dd7c7564c7797cd7f63392606494a69eb9da2942b1942910ee5f126ae5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.raz
Filesize17KB
MD57fd5a0d11ac5ce27a42e08161fb6d299
SHA17600cbc88360efb32079dcf8d96f50f07f7b4df7
SHA256f4d8750ad8d46fe4ef2ffa0072ab51cfad0768fe3cd48a94835364231bb4797e
SHA5123e16535f9c92ef39acad3ffadc29b4aec56540b0776ac4d3c372d067f5a120f7031587644ea0a356d7a902909d32cb2c996753d87db56b39861c760e7729cb28
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.raz
Filesize192B
MD5a7dcf6737267740474d59b596e4a3b3f
SHA1e03079f9858fda85b962a519b42cfaec74b11bbd
SHA256e62b2fe87d2e170092cfb9ae805de7c718e1493306fe56674b2a64d8eed1236f
SHA51275fd168924bbe237a3a3350c5a75086104310f0a9f6e04da81538b951e14df4257242975293c34bb1821dfa8f030375ae561de7b0fdae1fa0afa6dbe892acce7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.raz
Filesize704B
MD5ef1756f47c0cadd8bdaa836d615965f7
SHA126afecb999f4732491d8486b90de0ffbac8c642f
SHA256332eb901f2c889249a4955884ae7881839cac4bd96988f41abf61f76cda0bbe9
SHA5123732f3efbdb2d8f02fa44fd477523c6467912f283436d1c839509e96eb8d0b948fb60aadf64f1257005811107a1d2cf10d2c173a47cf39f77bd0deea75c377b5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.raz
Filesize8KB
MD5dec27aac58b25bf6502537c5444273a8
SHA12baaee02dd77661732c10bdb31181f7beddfa04e
SHA25619acff990862bfd71c1755a506fcc21ce8d9beda52098247aa36026bd8588945
SHA5128966c3d9bd59f6fa1bdbe60a80627317c1403bc8be069d554218de12c95a61719d8ab1e1b75980913c2186bd7dcbf166b0b6dd7f7d3f6492d774f04c9864b767
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.raz
Filesize19KB
MD5a9c38fda12aa44488f07b5c95005f9c5
SHA1b6aa1034c0a758e20074fbeb2c92c0257ed27e7d
SHA256fc03c3bf522d9d3ecfa9cbb413a97a996163730603553f0f74a8496addb6b983
SHA5124be63cd1f949b4b58ad6cf6d771ca63ea3e19b5a5b8a2305304d37692e8fd36af54fabebb156fe1823ef16fdc89538e4ce0a75b6a84b68a6b20e83e210c5df66
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.raz
Filesize832B
MD5e9ffbbf88c76190697c62f47a7641611
SHA19343091afd15cea52b2a54b8603ce8e95e2eb3a2
SHA256899291f89f48620526ddf54983a972328a5597a75fc42f20beebbca714a4f147
SHA512ce0806a840becd0d8b7927257dc6522afd987740b50419c37d7c8c1c6e23476531e44d1f830cca4c6cbee6066f57dbd972ea990cef2a2335368f44fe81e35acf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.raz
Filesize1KB
MD5e0931c6842e53454ec04545c027c7d65
SHA1fb76e6aaf6ec9d62cf63b06034ead223b5e67a7b
SHA25649f10fe0cd82efdc8d774f1255aea552a469084e202f656b85ea47c236702f94
SHA512ea68f37e5252419ea6b7250d38ddc4b486609d8cf20896a7907989a5e01a99a7b532f0ee77850c38b102c66e267a658145da946bd1301eef481b57d27848a6df
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.raz
Filesize1KB
MD58a94ce0ff4a2ddc1761e2f6ce94ed59e
SHA10c651c03aa30fb857074c256e6d2eb85307fd064
SHA2564f20f0ed87f5db8f215d1eb39f6cf762c7445189b59a8e9a69ec79b91ea62235
SHA512015a8494f61a5038e4d6a0a41c8b5233c5368ada97b539bfe0729ed31807ccf1bd7e5dce177380782dce5b32be7d9db51be97a7ade33476fe97f9bb05cb38426
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.raz
Filesize816B
MD5e0af9064e503de0b847d046f298f1b40
SHA14deb156971c166997a4dc8a58eb3e13b182d95e3
SHA2560711c52b3122f4fe543ea339c02e1c5b786027bdb78bb650735bb33b07163bca
SHA5127ccec19c3ba3d6d07424c22b1ee45c0b7fea2cd97a7c9138a6999e74e2423ec0b5593c60b97060f76ecca775522c41b11ba257a81154ab3c169c765427112a7d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.raz
Filesize2KB
MD5a7f3593b1ca99491c9544422d2d071df
SHA16be56205eb4aece16794075d059d8c409c1fb74a
SHA256936506b822674b10a9e696f1baa1663e4def41d375e65ec61e8dcf78a8f3bd99
SHA512997ce9a9fe49e0e001d12dda4bf462717a07920c1cd0b0077105285c5d6abb7f71b6f76150c5381d85e3f637421f21de5df9601adab0b855275861de7d2a1183
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.raz
Filesize2KB
MD5edc3de17cc11bb51a223a0d3662c0b84
SHA1fa0621a6d52081253813f8e2f9deaed475a903dc
SHA25663d6b61363dee545ba64e0a117b37af70f83023a6169d83db176c299051c9298
SHA512fd68d70f742360e2ab33115d59e63592f886a2c7b5780fe47773090850b0516a7757ac69192f954cebd9a32dd6bcee37e894c401156bb46653faef7ee5d5b23b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.raz
Filesize4KB
MD5c4665a36ed47baa84e8526503d166ba6
SHA13d1c8e70ade7af2751404c6811952c767160a335
SHA2567a7470fd53603853f551f1d63c8cf68b0b9d1a3aa5d46e07223ae80badf8e33e
SHA51287e1d7bb1de287c541fbe06a29b4220820317ea70f47e1e2ab98a0af693e1ad543f88905bc3a063bc91fcf30597e73a82aa50e8b2291167a95522d3de5f35d2f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.raz
Filesize304B
MD5597550bacdd3fd5801fa45c04390c90c
SHA1f2103c9b719959dd173faa741781f900fdfb02c2
SHA256cfb28b8ff02bf333d36a013f051028a24a18abbcf90e9ac9a595939db678ba8f
SHA5120bd654e8bad5c04d39dd984cd88b5d75d5a15f705a46ecb32180bf7f013a7bf281e80db7f08537a53872b6aa7bbcd136000fd4e361c32cbbacad45abaf663dec
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.raz
Filesize400B
MD531c345077c554d0504dde7a32e9ed7d5
SHA1d3d6fc4520ef8c3f75b15cf92bd5fbea80f977d8
SHA25658e3fa0adee722dba0254dc92601368782989b6f776fe5125818add76bd0153e
SHA5123c53d23fc30203d038c519f69be631f44f6167bf6d89488fb680466959762096b3c32994fb85986f807698b340b41963647f613804d81bd0e0a2862b026f068d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.raz
Filesize1008B
MD5ef25e322c14609a90befcec37775cbfa
SHA11ad6cae6de75a30401353050e6309e3a09066078
SHA2566fd126d20eb9871f78787089b3db23d2a59b94368bc724d345f1afa0d5d090ff
SHA5121d8cc733a656c206bb5f40437f3e75064df6dcc4a5e745f25813bc0b1d98f654503f27983a7a467c452799854ab93ef48633d495b4b371963ee64acfe485b209
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.raz
Filesize1KB
MD588a00e3301e69e3aa1b0b91a9318828f
SHA1e493a73196e580de0deb167e0cd00289a0c6c6d0
SHA256bf1c095a036c086855d2f53c141e37777f2ff9d3512dcffd753beeea11ca1e31
SHA512c16f9e3674615dfc93ef3b9e0f40e0bd10dde62b8ab94374e0b06996061ada5030c31145b06c7249c10950b96666ed1a42f19c5e001801c3c94da1869bb1a8d3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.raz
Filesize2KB
MD5497610d85480233f3a29cf2492c3a32e
SHA1313a85b54453a501f45284bf2d01df9cb251dba7
SHA256bdb3dcc6f6159c821dbef1f2448a048a27977d80d2c0f2ba046daea505236b3d
SHA512f6a834e452b7862cc922fb7d0a5833918f49443badeb715fc19a4ebda1738fe71722a7d06205c88bedd55753e9ac73041f40281685573704ea8206aa9d61c92e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.raz
Filesize848B
MD5a35fae20c74cfffd9146fb0a44b8d720
SHA1733219a5af8cc76f3cb70403f57f1aa09aa24b86
SHA256d8c07b3b54f990e61c8da7114ccdc8dbd6dbe4c56537fa5a7ca9cee53b4b68be
SHA5121fed2f06af3d068799679dcb1be6307c207c8fd4ad73c5115e6fd60704b3932417f2b45b9cd6f6431ee9a53c5d73520d6488f7cba9a8c3e87d33bc8bc2faf7f5
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.raz
Filesize32KB
MD59fde0515006accd22f8af7502f0e9953
SHA177bd01f503754d42fae2bef15aa04547778aac69
SHA25628daa4a2a303078eaa5199be1800c7450c26625e20afad654a6b4998adcd6791
SHA512719d401d1901f0bd48142444f3b849886b24604a49e52a6aecdba03c2108705171ff6c1b732f45b8e328785559b65f764669867cd21299a534a6717f87fd0b94
-
Filesize
160B
MD5cb1d1fdaee1f5896d41bef309d8dded7
SHA1351c47607f4f7ece68c11ff3c2fc334a08d98ff4
SHA256f7387ccf02dfb55cd9761847cfa8caadd1cba788ce6bb34eb8e2a02eff623b6d
SHA512fff5bda9baeb27c2eeaf5ebf3b461b8675091d886f2dc6350633afa79feec0f767a45e03c967b5ef03a69c7ebb23e086fbde0c3cf28b599569c3e4edba50c4d1
-
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe.raz
Filesize1014KB
MD5047d5e6c8d9ac7302c9ef4a0d942e2bc
SHA198bc00d3a8c4964f0433c075127acaf3373ffde7
SHA256484f815c6570e3225ac05ce980b19085a291fba61bc2152cf17a3cc5704e67ef
SHA512028cb310a18eb3a96e1490ea5d0972c5b55c2681d31d01849b231b3b475fbf418c56f3efc232edc95f9e633f2b46e6ded476cff0e09dc6d675a2cc59cb6b5410
-
Filesize
17KB
MD5366bbb1429f0f58d08fd04eaed9706c6
SHA16c0990235e9b1ff39098007110f507ba587c8fc4
SHA256ec0db4893e1ba0a5b3e1db77888381c2f16238d27b0fc27f5934e22929114b05
SHA512287ef34f9d64b6efe7b33b23390cbf4274ef19bafce37adfea3b9db12c26d6d43f0fac3df550973864c52d41463ae94fdc8ba4d30fdf3fb7fda3816aad70c8e8
-
Filesize
567KB
MD54ea42e714dfcc642e701282d846570dc
SHA1b779c294dfbbdd5c64bd64ad1e8f8bd03a1d2f42
SHA256bc014ecd6c086a7cc0d3cd9ed0992ee03bee445f4f414f5982d64eb5857b01a6
SHA512ea90467d91f64cb182c339a1c06118fb67df050f1536a41de369e18bf381a1bda9396d196a329e53a99f04cfd3672ede9a54b2ad6558bc8df0b1a061c0b5ae17
-
Filesize
14KB
MD5456f810b0a4098b11589e83c0b952472
SHA17078a6f85e84d5bd651c8dd45497b4e43b51a7cd
SHA256a84ff81f1b8e8bb4b33318615ca3ca8c605617f23f475913eab65862100e1d0e
SHA5124846b3295de753f04a432f6e996ad00298ba62edd1f9f7402e1b01120b150e85da31341382522ba6f95735fbd82cbc73736947be806d84b1c0f298ab39d9ccb0
-
Filesize
547KB
MD5ae3c6ee9a837242c4a442cefcdb957b9
SHA130438763ad31a49583ba0393037142a6b63e0195
SHA256cf2e714cced0a3c9a838a09235d1b4c826e350a36862d3b91fe89be8119e3783
SHA5129339a841021651b0288f21d93851d5e42d4551f292025c85e13dad3e477e18e2a7bcabdc2b64c5419af73e69eca1dc0714eecd888b2b723d03eda26c66ad802d
-
Filesize
919KB
MD5ec6f1c3e8b4ae4065b3a5365155058f8
SHA1c314e5e1ce317988ea1bed5716fa20c32954552f
SHA2560c765abbcbcd40c2147d22033ca84b7fac9dc4c3c2fe22c6c511614a86fc5e4a
SHA51224b0eecae0c3fadf18f71549033bcdd2a3256259896f446f04c5c2c52288742d090aff4a9710e6cb065f32c96bd0c8505932165e0d7337c472c442120991b746
-
Filesize
288B
MD5cd352b2b32e0b8d397bacb9fd96bdde0
SHA150878e1a614501240c60e65bd3250d85e1dd5833
SHA25631a615e22b8767ebabd98ac03cb355f8e78c1d1cd09c55272681c8739fd22645
SHA512fb6e8e256f554d81d5b74be84fa6c65baab93edfa0cacc34bb5884d2cdbe94473a4c094dd1e2669350fbe995751015971ae357c049418508a84147e6b61d4348
-
Filesize
293KB
MD53e8ee1f6d96f2727e7f813198736b86e
SHA13d31d3239944facf65cbcb0dfa77e416c7ec2927
SHA2566484fde9f5a7ef605bc0d499fba635bf9bf7c61747604cfacfe397ef611dcbdd
SHA5125dc887bc4cd217edcad4e0963e47b94cf98705b8dafa5ef99643c59cc8c0af67be8295f7612c1d8918b5374a2f06e8a9dcfc9eed840a69fca6ec9b0853e752e7
-
Filesize
13KB
MD5d846df651c67ee472c3827ec0f26bb96
SHA1469d10714d579b427c5d1a4e92611fb54e29c1b2
SHA256c42d18f9fee7e5482b1d828cf03044f2ce224ec58e8d7648b5076f77162247f8
SHA5126653752d2ed1eba3d83efe50eb03d01bdf5175514f236a3d6c2e392c85c10bd7388f8d7cc9f3086367c09fdd1ce1c4c4d05a815b47722524429a912c2a650976
-
Filesize
488KB
MD54a7a8e7efb3f4e97925ec7d4a4761732
SHA187685bd2e44e1b4322befa5bd6692457141b633b
SHA256406f0bd666a302309ddc4e32b2b3d2765ccb062569ace731d2530a80621c6b17
SHA512cbceac7593b7a86de13ed4e3e36584af72f57f40e76da10e0f824b14b92f35428ca3d409128f151a623e924e142bdf8f077ee431731855163d2185209e1860ac
-
Filesize
410KB
MD51f67a648cbff49ed11696b32251bf036
SHA128ed3ebda1510a8f91739114dd2bbe4ed4876c1d
SHA25604d15758ba97680e0971f343cdbbfe405805c30670fc16633052b9165d2c9be5
SHA512dff392f272bcb64fb3f40e687e2d8a46b9f549d234686039b04e1dc54a37406b467bcbff1b44c8ab7c559df9e5e1c90f96aa5602de74f3c2d776eeb1a4ff3f88
-
Filesize
606KB
MD5f7a2fc434f3e5c78831912e0edeffe38
SHA185032b456e453bfb5379648c72d8fbbf48fc1b6e
SHA256b5b8cda488843c0e6b42706e08582fc87419261ed3b6a3aaea16272262ec8f31
SHA5128daafb55bb6dc23762502554fb00d0c6de56b6dc3d5946dd865fe8143f3aa41c2518e3873e24b7283aeac99bf5624dd2b6b89b81c1e8cec4884154f1cb53e2ee
-
Filesize
16KB
MD53bddfd9a6c8f5ac6705074bc232ffd97
SHA198b5c862d9cf1eea1c763117853512a3b9350a5b
SHA2565551aa77da9f84142f7640be6f5b7e4d7194db30fcac856cc8938db81de35bd1
SHA5120bcc043eb4fe6b2798f3f57be862204bdd6079929a4c1c2089c4f87abe2d4f38ec560114db2c9ff0d06b03e4628ec2c9c60ca83d424c951a6a45db1017daf690
-
Filesize
664KB
MD5e18bcfc63fb27f591436c140fa4db80c
SHA17f5c35447d13c82613a1841b7072eae7769ae186
SHA2567132a00370d3fbe49b8e1a5d2c0b8fa35580860f509263c8a82237aeeb32511a
SHA512b49fdd1ff21340bcd18fe575437afbfd85c1bd07ab7660da9f8ccc0d25a0456228020c301d977fc798818275adb84bfffc7434bd3b9e7c9b3c472902af13d092
-
Filesize
352KB
MD5b72c8a73fc30a577bd82235b43518525
SHA19dc74fde9920aa5b2917e69d092f8508e70bcc65
SHA2561e13034ccd58e20bb0d3bc00ad97a9416bbf13fd85435055742a38abc4316d71
SHA5127cd2faa9272e89d5dc71d3dacd7662bab305ead38557b4865045b8e1267a1e3379366cd7c2d22a4fa97c55db3314fa9e44cc36d77d359e6d5a7936b902f44df2
-
Filesize
391KB
MD58f31c8a311af20826a45fe420d4319b0
SHA121e0477a5fe261ccf43c440fc5a2aac200b5caae
SHA2569900e2657cb6332e5707a34f7a9123f133340944f1804715537bf1d7587d5db4
SHA512a7cea719a1709ebca59ea873297f67a86aaf5bb739a0903f7f9c661f8616822f0404daba65d86eef830a4f7fa888f1c2455ed914ca36a2de12f88b6e3e145d3b
-
Filesize
430KB
MD5b0adae0f882ba8510d22dca0cf1b81ec
SHA18a641bbf858b7891d7653a985adb16cd2b156f99
SHA256d17ccb39243fd5ac919b35296193b9da4c01c73be17eaf5bedf50023d6d9254e
SHA5122aeff18fe9f97fcff3bdbbe1574960722a8f273660bd2e1b045d439fa93b6aa41146d224910b5163eac368debff62ecbcdce02e0452bb53f38c8a3ee4f48317b
-
Filesize
508KB
MD5f10f96d9496564ae7467b1065a1f71a9
SHA11d321c6d2b8f1655b449778fc208168f652709cf
SHA256a50cdee11f395d9e1ad604d2928a27b57c67c2e405191e5afa02b0926f711668
SHA512c360ef9139b5281f8cc15ecc9825465f6403f3f9cf9960b6101db6e42e0dc1441eab9e7b4b04edb343f8b729ed9fdf62eb1ad7ba1133f9353498002315d229f5
-
Filesize
717B
MD5822467b728b7a66b081c91795373789a
SHA1d8f2f02e1eef62485a9feffd59ce837511749865
SHA256af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize471B
MD53f0957868ba488e424e8cacb4add95e9
SHA1dd85da7cafe2c70c5fef8bd7389d7e12cf7ab7c4
SHA2560e2c49bfb4296b7e7459e5b09736928d108815eaf4fdcec0c1f334dd5b59a910
SHA51219f39e9dd38ea3cf0f28af45f079115788672c88c2dcea4174630c21af43cc067668cc71241f42f368b41789aeb076745b65a0cb22c499fb578f4c348941fea5
-
Filesize
345B
MD5e71517dd0274ece967f59da0310fbd25
SHA17038e37c9a9efa7b8588e4b06cbc892b1ca0fe39
SHA256a8b8454ef202082879e7eb0e494a679bbf09d72d04e1ad47d4ccb1e722d68d49
SHA51251ed615c42dfdec98de68e2c19ed43f63285f8eb86008e7e75cf9cc2fc54c32e3ed56378dbd097a6c324d78b5edc4338996e589d8590f94ab0305886b7e99eb8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD51442114fbd86969560f7a7bf6b5d1886
SHA1014ac80605748a76ce0192c1420f61259ed4c1d6
SHA256f868dcb7190953e0da73890a45388ab7451b69160ea9f3e3103649670ac52daa
SHA512e16a20bacc924e290f9367cc72c1e7b770d96fddd2faaea7a37d2cae9e81274872b477c85f8f50352035b7cc9e83e5000b819c3e79d3c8e0fd567a2938e53fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
Filesize420B
MD5a8a7cfc4405aca7fd8fca2bfeccfdb97
SHA134b093b14fec73ad6cba492b2da56db0a0404c50
SHA256e2ca2d86a0c5bf7caab5410c61ffe7b13c66be2d5ed59af951230b2d5d8b7654
SHA5120031a4144f3c5dfd8b0220ff902bbb7646d1389aa1b9fc796a2f2451ca25802d86ac63c6afd00112fc0b4b40bc082fccc8cc8c32a639ba66ed8bc18dbc7c6d5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EADEF8568A75B44CBBCAA5B67562AA64
Filesize540B
MD5420584cdc55ce4d415ccf660741de5b2
SHA1e8ceb4beb75c7863abf66a7b40daa4bcee05cdbc
SHA2569b821563cf5a9325166e7e937c57633fe39b3539bdb453227701a00a2852c34a
SHA5123eca833b5498996a74e9d2c01ad3744602755e472ae422c35036b734f1c0db9de7b90c176735833fe0041ca8eee34b88d01abacbf33ea1aacaea41568a9fe955
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000003.log.raz
Filesize16B
MD5dd5641529967fdf4a9e6d78607f71c32
SHA12905eb1b144b1e023bf3849edbe4893626740630
SHA2562e4ea9a3711827f0e857803ddc42e9975928dd855b547434ca2c6d91f469eaa1
SHA5125b7a3f9ccf8307f06ed75e5099436cb80e8c25e1759281b798f12a0ba5229e693438b71db8f737bad7321a8564b625d1f7ac9100428d687e49eba7ed98422438
-
Filesize
174B
MD5e0fd7e6b4853592ac9ac73df9d83783f
SHA12834e77dfa1269ddad948b87d88887e84179594a
SHA256feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122
SHA512289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.raz
Filesize413KB
MD5718ba10194712f640fcadf48c90b23e6
SHA1d8bada91ce36deda70fd0d0a7694d4cc756fff1b
SHA25606ff2b6f56268ab9827ddfb03aa6f1f19d472d05fad7f670781b1c5da7d238ce
SHA51222e941ff18134fcbeb0caf3bc86d8f75bba0ffeb054ca3f7c9a941071bb4eed8bf7df2fc156f49bc679fdd9335b0dcca000902643439caabfdcf12c6029e3bc4
-
Filesize
24B
MD52dd3f3c33e7100ec0d4dbbca9774b044
SHA1b254d47f2b9769f13b033cae2b0571d68d42e5eb
SHA2565a00cc998e0d0285b729964afd20618cbaecfa7791fecdb843b535491a83ae21
SHA512c719d8c54a3a749a41b8fc430405db7fcde829c150f27c89015793ca06018ad9d6833f20ab7e0cfda99e16322b52a19c080e8c618f996fc8923488819e6e14bb
-
Filesize
1024KB
MD5412253c53effbe606311a2543319af6d
SHA1a603ecc7519b25b5133d7d026f11f1ed6b05c850
SHA256cb9e70a5425dd7b201af050a121b3c0174d5ccc9eccf22956472b873514ddd08
SHA5124d59f6a50d9513f9d084dd7f5605edd8e7261b33c3b7efd44f5fdaa860bb7bbdded2a581f94af333ce9fbf83d813a537b9171b5887e62621d7b802b1f894506e
-
Filesize
24B
MD5635e15cb045ff4cf0e6a31c827225767
SHA1f1eaaa628678441481309261fabc9d155c0dd6cb
SHA25667219e5ad98a31e8fa8593323cd2024c1ca54d65985d895e8830ae356c7bdf1d
SHA51281172ae72153b24391c19556982a316e16e638f5322b11569d76b28e154250d0d2f31e83e9e832180e34add0d63b24d36dd8a0cee80e8b46d96639bff811fa58
-
Filesize
24B
MD5f6b463be7b50f3cc5d911b76002a6b36
SHA1c94920d1e0207b0f53d623a96f48d635314924d2
SHA25616e4d1b41517b48ce562349e3895013c6d6a0df4fcffc2da752498e33c4d9078
SHA5124d155dfedd3d44edfbbe7ac84d3e81141d4bb665399c2a5cf01605c24bd12e6faf87bb5b666ea392e1b246005dfabde2208ed515cd612d34bac7f965fd6cc57e
-
Filesize
24B
MD52d84ad5cfdf57bd4e3656bcfd9a864ea
SHA1b7b82e72891e16d837a54f94960f9b3c83dc5552
SHA256d241584a3fd4a91976fafd5ec427e88f6e60998954dec39e388af88316af3552
SHA5120d9bc1ee51a4fb91b24e37f85afbf88376c88345483d686c6cff84066544287c98534aa701d7d4d52e53f10a3bea73ee8bc38d18425fde6d66352f8b76c0cbb5
-
Filesize
1024KB
MD5f64fae88f266f521a37cfc59460f6161
SHA10e06ea726c82738546678402f5bbc48c63b74b5c
SHA25691eb520a8fc023eab4ac6cb70ab6c74e1a7edcb8898bd0ed35000e1cf6075a52
SHA51273e9c4740893ccd6b4bc3a32746b1985f6fa7b711a57c1eb464e603c7b1d69d59e2fb36291e5ec22e8bef31541d7a3cfa51b25f1cbf44504bdee699ad6bb9d31
-
Filesize
1024KB
MD5777dd969da3dd17026244668b774e058
SHA1e0a066d28dfc6bcca1c13a50bfc4b35a37541b7a
SHA256221f1bd7bad281fe93374736df606e52ce7393ae4fe0bdd4682935b90f184e59
SHA5121f1a19b1a969a62cd8c83622e89077492457dd00f28505f0fe49a600688b18bf0407cae61e0da9f0d23fd0f6d874125fe83a5666ca7975976d612743fda08158
-
Filesize
1024KB
MD5773b2c3a01c73d1dbd3573db4b35654a
SHA1bb440ccebe9d86b61f340bd37e7dc97157630488
SHA256ddcc9f9de1e5565af64d2df58918d2a1e035ba00327c4dee8a10b3c8a9abcc01
SHA512d995cdc9f1acd5eae69dcd7ecd6c1642b475af7cab837d2376b443649fd65f0ca8de3598a40e33c2e728d091bd0e1019143546660a15bf8c0f6fdf91a0a07091
-
Filesize
24B
MD5d192f7c343602d02e3e020807707006e
SHA182259c6cb5b1f31cc2079a083bc93c726bfc4fbf
SHA256bb4d233c90bdbee6ef83e40bff1149ea884efa790b3bef496164df6f90297c48
SHA512aec90cf52646b5b0ef00ceb2a8d739befe456d08551c031e8dec6e1f549a6535c1870adb62eec0a292787ae6a7876388dd1b2c884cba8cc6e2d7993790102f43
-
Filesize
7KB
MD577b65a77cac00fe47b16dd4819c4a4c7
SHA15d174cc05cfc487ee35db8aaa770930a26529bc0
SHA25631aa3f7fa15dc18c49e4e36554fbaed761808284a0fa4a792a48e46d267e0383
SHA512abcc320916161427a5b5683edd9242ad065680eee55f35b770e24c58f3ddb5b77bc1f58bc4c5fb851bec15b441a8de904a10dbb7eeaf6dcdf9460470d3d33d78
-
Filesize
7KB
MD571ae7e9f0f3be5687d5a47a0965df18a
SHA1ae6ec0d7343c7741fdac368e6eb2ab003b2e0a18
SHA256d2e2c743e9c9836730413ee69de30c4df3ee01e8edc47072c56da04531c54c0d
SHA512496540f1a84c8aea2a096b3a95a93109fef3a275e44900aa27a589e0a0cc8a69587110ad93ea1cbb1adddd039699a38e2276f5343b254047b7daf6166f010223
-
Filesize
1024KB
MD55bb2982044b7d8692d4e699a2be35af0
SHA185bc1eae0ef3ded0819d11c426293b2c2fb59e8d
SHA256869db0942dfe0c1e6d76623ee3555869f33140a7b40ab0a113f27cf9b88f3990
SHA512875ece1f231f850b76e26c91c68feb1c2621fed56063c56a82cdc4debf84fb8df2552a64bd73c9f2ff4454730c0d06734a425fd28d144649136a043e54a0d211
-
Filesize
24B
MD5ae6fbded57f9f7d048b95468ddee47ca
SHA1c4473ea845be2fb5d28a61efd72f19d74d5fc82e
SHA256d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
SHA512f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3
-
Filesize
7KB
MD5a6ae6beaae5710d08afd0f11338a687b
SHA1213e9e61a82380cafcb6b75c057875aeccf81209
SHA256692a6b079b6e142e6649830baf4c1dd68fb07b169aa3fc526874a47323e0f99c
SHA5126ca1119af2921262eb38e1445ff2e7e5c88bb1de46bbe78a8583b23f6fe9fbccb6ccfcbc67050e58fd0d2619d54ca47becc51ee280c512fabef060faabf7be58
-
Filesize
7KB
MD53ebf279c12eaa11c86a473e612510c24
SHA12cd75ede3d74b840cce9570dfb4c402fc7f17a46
SHA256d0a4f6d20b72a82a6df0e79a10df297b375bac0f559ac1e025757a71ac5f0f95
SHA5128a692a8e8eb6dad8e1586eb978d1eddf47a800576048d274f97356943ccd11ac604469b9be0831db60eca621be96bc26c09bfc6b11abc406ca4fb30f49555445
-
Filesize
72KB
MD5b2ea0f1cc295405a6010fd3584e8f8b2
SHA16e6bdb854bc829898636fda619ac45540a9f0489
SHA2568b0b65c1653587af34038b002f163c22104ae4239171b3b6c1d75d403eb13953
SHA512a9a76356a065ef6d16833dda80af2c90bd8a8515bb0346c5a6f2bd796da927986e663a8736da2fe1bdfebd475d17640a7e1b313da49a8e4bb9f80502bcb98ba1
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.raz
Filesize8KB
MD5dc99a89656e16308e4b577291a035350
SHA1ff0c5e12edc57b2a19cc4c74cf636b513bea97e4
SHA25699171b0d0592da74a9b4c31bae36b61bbc72893dd0ae0ae1ae7bce38b01a96d3
SHA5128d452aa602daeb44a670ca9d4cc1af2d99982320014cb40f86a1c1abbb1abf33e3b0c6da12958250a9ce797f1d268e11ac427bf703c315e749c2db71dca0a9de
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FGTHCTKU\microsoft.windows[1].xml
Filesize97B
MD5cbfaf7b91f4d49df93cd6fd6ac3e9003
SHA180e61c253ceb2ca7aa8d883af75f028252879b44
SHA256e3b1f8d7e2fe5ad9de75087936f0302378ff03a3442146096fad33bf8cadba47
SHA512e459e86ce0896db48379b45bea4a9dda24b7eb1f372ac76fb13450ce100a7dd52a4a4b877088bc22c45ce048d25ffb1c047e8382561b9caefcc7f382c7867dbb
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GYEY62RN\microsoft.windows[1].xml
Filesize97B
MD53123acf71146c4b194c901ced90e52a1
SHA164cc0c100d6d6f362f341e34fb5b96a80a5aa3bd
SHA25649eb74f2c7972ebfed734c5b2dc1d5ffc62c150d7903b5cd7f48ae9d9eb4e1a4
SHA512ed52e2ca043ec417010e3febb605cfc98bb02c432289ac8cba2893e2df42488464aea30be02c31f3d572bd3cffccedc5c546f7ba6639ac44e5efc2af5109ad21
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
Filesize2KB
MD5f4c77fa33d0b291bfa56aead00e90f28
SHA171055b3eecde35dfa7243627f23ae6d97627efd4
SHA256ae0bdd2649804f0836d82a56cda136b9d94b81fcdcc764caece71820e389c418
SHA512e3e708613bfe48c74cd2db12443fb0f0e485bc1b48af2c72cb2ad42ac621b45775d727b79c98058b8b403aefc2e84292f8fc00b55911fa3699935812c92c48ad
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{df4fc690-2383-44d4-99bc-508335a6b53c}\0.1.filtertrie.intermediate.txt.raz
Filesize16B
MD58d7f2ba3a13bdf3a40f45968c1f4b33f
SHA1b5403abfea15ec1b9c5e74b9dc6a53531215bf4f
SHA256ccf3ee5f996e3910a87450716d81ded33bbbbaa62da6dbc7edabca32e85526b1
SHA512d11f3f216adda7320f0021337641e60f3a41e457ecd96740e3f8c97a403417624855e52b4334c14e1a2027d8cab802f319fe69faf5b1c7b780f2285e7cc33c08
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{df4fc690-2383-44d4-99bc-508335a6b53c}\0.2.filtertrie.intermediate.txt.raz
Filesize16B
MD58051de8d7d0cd39b7f1dc438eb5b554c
SHA1d24ae1a8dd359c6f8f91ba920bc16f89c5fb03f7
SHA256e825e36e3d41eba44710f3e675227cc68355fdbaec13d7d1ee3eef23703b28ae
SHA512f35b13de2ff91759b891ac26307bb6abe0aa88f2813fca7668b9303096aa39cfb8be7ca1c78ddf3228a5c2f9c2e10156ef73162b7af911e5ca68fd385cadab7e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754821347503.txt.raz
Filesize55KB
MD5b058ed8223d13b2cce53faeab58e7694
SHA1bf15ac9828d49c49f88914a243b6413014678f68
SHA2564e82847735e265c23923e55de3df8f34499f1dbfb60c276c358e18128865fa12
SHA512cfe98635463b31440a2f6b507e569aa6b2086461c2e8f30770be249a3679d4d0bacc846fe46d1cfa9e585ecfdc88599e3fbbe0fe223b0c3906e7269b58ba2c0c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762798939774.txt.raz
Filesize65KB
MD5111a17ea4ac4925d858e037e17c96354
SHA1ba8c0dcf4208fe789a417fe47f029fdf7a971827
SHA256120dd25372b6f711002f09f76517ff5996cda9def24d106ecbd9b44ec50502db
SHA5129b94bce1ee99270f173ac5ac04d0093097bc012c962e1493c70cc70236afcdf2771edda0021fa30ff21eb5eca5a56343dade9c019ecb05b799d694203a150b8e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670773120879688.txt.raz
Filesize75KB
MD5ed21c04ad1f09653b42b5c5362d5f7b9
SHA16a5fd863502b6b050beb40db700fc0b14ae7253b
SHA25638a928d49eadfc07a5f5f069f7536e0a0bb9b119428f10d875b3af10ae7e9b92
SHA512954527855fc18d67bb34c88a51c565519692e9899fe557a65554c88a2e2d9776c65b40dcc7b3400cedbcb8ad73335d5a2a709b41eb35c47a6c34b7fe157b2d4c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
Filesize9KB
MD57545724c9e91d647d25c43feadd7ebdf
SHA115d2be512eb1e254e99463d92ef47450ed94aacd
SHA256690c4cf42d3dc2d6e8d175dfa5d2ca6813cda765af724e4e43abdd763ce04612
SHA51252608f5d69a4b014dade7cbf1fc828e6224fe96bc66a90fc5076ebd6e48be2633eac446d6081202e79b7acc334270f23c5a75e1879a6e8d4826ab75fec788d17
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD5c4ea10c85acf2d579ac0f15c6ae48192
SHA10d54b436bf79e9a0067b295f62773264238fb630
SHA256b0338e0d6907546e25653621c4f4ff53f5c7be12f7c24d1095f0cae371ffdb10
SHA512bae34d1d803265dd9e20d4fe062b816b21ce752550b53bf2ca1f04476da6f54e40e646336cc47cc36ac01e359b569377d258b26d0fe0a02ffee0c4c74005adaf
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
Filesize13KB
MD5dcf01ba3a271528f1d9b851e9b0b81f0
SHA1124ea7623f8e41a5f814988f70279c994f87bea4
SHA2564495d4ce0254417a3e4431d0fcec1ee8244df7d54cc1e9425066f5eef87d95b7
SHA512ccd406107f6378879139aa61a707b7aa482bf0a585fb2d51b173c7f0cf6281e667ce01753dbb1b40a19135f33a5d3976c9f862dc74628bc3e09d56c786ae814c
-
Filesize
10KB
MD57be49ca6ef8dc5e37bfde60999f63804
SHA14f913608176459b17b592197d0211517c0d3679f
SHA256a6e1c0ea559c2c176e821161a5db0b3f98e0175e5b27fa3a6d4673821fab561b
SHA51214458d04f4e2f5f8f09901d917e66e8a49c452a0599a74b70b9beda9d3c0baa4f902ea77c8b35207a0f86c613973cdcc0888c13eeb647d31d0c42761779a429e
-
Filesize
5KB
MD500e5fcfd833151f7cbde607e2f7afeb4
SHA155839875c0947aafebff53d22ccc5dad29fe3563
SHA256b80192aaabe007baecd0603e3ce183e9d554b8a6b0411d20716acfa086ae3035
SHA512f056777a1987c3becdc217bdc2d82e6aa41086d38fddaa45c42f1726b6f7b7616a10918081650e825a724464ef148b669bc258d38a62e0de8642e2607a0b0de7
-
Filesize
82KB
MD5328a8e39468c0eb2b64714597cbea694
SHA1167110828c9b9dcb8cea168b229fdf24c1769da4
SHA2561cbec9e36d53ea410211d3956da3fb6e3c3b0ad86f1d80a9bc6b1ee453fcbf5b
SHA512a522d97acb6335a9460a007f0a408f565d2b61cb2650f941cb29b38623a6bd97441e49d4b3d5dfd89cddf68d87b1f9c999d287061fbb14b4db9f1f2984140e25
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\illkw0pr.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.raz
Filesize48KB
MD545b23b6b1abc8ddfcccfa678c8575cfb
SHA160755fe6a4f60d934a85b3aedddbdddee413ec61
SHA2566a5089d421fdd1b1c36b209e3b4cf77f1b079cabdc87cd1e8d9b035b66dd5aea
SHA51250a35ab97f15ac530d0383049e41a94945ce96cbe7b5395f69104cbd4f1edb8b4c3096ab0177c75da93d9d781fd48367b489b9b83575fbd65ad2e0458d224230
-
Filesize
1KB
MD5c7f4226726cf354e621738d486cd4f60
SHA155df1148d7d2e89cfc49eec6fdabf8ba6f10af63
SHA256575eb0f1bbb0f27951792cc9bc774a133585e1893d167d2c674792225c5784fa
SHA512960717145526009c7b092ed037cf8c335d0dfb8023cf13a6d5b828ca75a101fa175ad2c2fb63d042a5cbc00f92ba865f67d4928a143064103ecdcf721e01bc89
-
Filesize
1KB
MD53ff9ee1d3ede5969245652226eaaf12c
SHA152ae2c35e5ffaad52cc273911935f38a3ae1addd
SHA25637a1d53026c9949505d3ee9dcf3e1b2fb0343aa0c369c7334ea9a0717ce371f4
SHA512f594b532d39750a36e5cee0230ee804cc6196385860b8e56e6cc2e34d47794d1a0c1174d14622d13245c856cf0330708110484c97f3ef78d9eb69984a607cbbd
-
Filesize
48B
MD56ce61d9f0a012212a6d56ba4a047c298
SHA1681097796164da8f36694b2b3e404347fbab9a8e
SHA256c909ccaac9a245f4c297cdbd850824e2219bde8a615780a377d8439c9863d7b4
SHA512996b0d227776cfad9dedc3623bccfcf647b67d1c202c82e4eb5e0241746f5fc747232e5a75f640249c1dd9bac02083f90cf48a355391fa2609728ad7709df0f3
-
Filesize
48B
MD5638d343f9f0e9971911db6cc9bca2346
SHA1b058e410acc80470763591ba84fc4b04bd73aabf
SHA2563fb55c9e1dacbf6ff9e36528bebbf6a3cb8d8cecf907d0e31fba19039ec16283
SHA5122162b84008cc82bc4b8a7aa7ce04b96d3a7a53f73169b69a3a63022a97dacc7f56457814d1a1129fbf82dafb92d11ba418051bded562514051bfd9ea82a966e7
-
Filesize
48B
MD506568e59e2ed1f0d13bb97fcc8c83efb
SHA127a2bd19aabc2adfc7877ff4b135a74f1004331d
SHA25653e69276341fbdacf36b450612d2dc89a5e3f4f35ec93a6365752bc58528520d
SHA512fd75ebeb106ce051cc637c6f94172ed17d5a8e89ccc84e6bf576a0cea9f7d05e73d38943af4954a2038d903e337a20de0f452287da484a44a82d45fc2877c94f
-
C:\Windows\INF\.NET Data Provider for Oracle\0411\_DataOracleClientPerfCounters_shared12_neutral_d.ini.raz
Filesize80B
MD5f96be790fc5fb16258b524b7f91c292d
SHA15ca961955de9ee9fbf9a62ce33754dc08f15a13f
SHA25626fb7744c20f4ff2c647054db982061df4588a91c6efd09782747c446dfc2b1b
SHA51290964fe7e2c07e0d635211730d812f3b5950c915002409548be096e92f21102af435d05c91a64becbc156b1d5ba9131a3ab9d9be0a0f3a9ac8794a62268c3bfe
-
Filesize
64B
MD5568d2c9e5457cce5ca64d7604a7dba27
SHA11bf27db08d1dda7554cf435ffd9f2df18743cbb2
SHA256ae570c33d1db2caa8476a9acf14a4c710866b262cc174bb75fc531b985ae8ba8
SHA5121a5c342fe88a060c98ffb7b92291cb8553cf5f5dd1040d58480ce5c62c07899c90bc36b9ee7bf9709a97078a2bd354c96192376ae42e634fd9720b4e378f466c
-
Filesize
48B
MD570720f371b11c15bda9913f58ed2ec2a
SHA1fe1fcc85e8980e884c549bfe600627405ecba1fc
SHA256c0ff8b86a6d7d88047eb136846089ebcf808facda3497e03f09af3cad21444a2
SHA512b69ff3e78030ca5d9b1d75fe5943d8f43422d61973b392659f3d75979864ecc07b859c7098b13006703dd6aa7b16f812c8056a7726b12d9c89388f46a6487417
-
Filesize
48B
MD53fc236136eda6656c2c022d5b83cb033
SHA19e2c4fe4024a660ce71f7456d98d1f58fcdb16f0
SHA256a37744c1834d17ff7799e70f45371b11f1039518fe3b721d933231398f2f5467
SHA512e3655c5bb07a11bf42b6551c26f60a2291b63407b7926b5ead3373b8b3f0593f5a7ad40db1af3d4d391c4e8e572433055de80a1a338b2c4fee0b6d25ece32440
-
Filesize
64B
MD5c376cb5ade1b57b9e3760d0ee8a3d66b
SHA18b9d5e9e5685a25d2a59479287a6983cb20b8128
SHA2564af6ced1f124d3aa862008295c6d6daf2baaf8e45d7182f3e88b5dbd1e13143c
SHA512b6a30826231afe5767b1cd5470291d2da8b4f2dea103b218ede29c49dfaa8d73254a842dfc63d8e704bcdfcbb072721af49863aa5af863fb8a2cd16d8b728c82
-
Filesize
48B
MD5378809b7fbbe700503b1767abd94dcac
SHA1ff22435f61bffa26fa0990fb40bf1967d6415b00
SHA25629c2a0163eb96347c52d2b072a75f602a4cd12dc7714b27cd160799fbbc3cf7a
SHA51210a8dbbfbd1302ba88febe7452f6a0c6b0fc42433587912dd75759cecd62f3e04df5479c848bbafaf9cfb9dbe54ca2147d4dfdbc547ad32a332a87afb8e1947d
-
Filesize
32KB
MD56b1c3c457f91995b2ba9eae6c9e061a5
SHA1b6cd825fc1b93a768a61cae966989df31472e49d
SHA25608fc74246d8b2e91121e53132de13595809e87cd05c562c24f0b83481b3023fa
SHA5127aad756d0d9dd2ec5915f8944619b2088761ac4756c034d93505df3d87fd2591b9f6788bcdca7e9003d518e31ee2200d860c5424e88143aa0c1646880c14b496
-
Filesize
48B
MD53db94a425248e394d05d9909dac2a581
SHA155d4f8b122d4fa2be114f86f17c3a6a34eb35e15
SHA2561704ca80063e322854f7a89064ca64b30b48498d362d145350577c41fcb1dfac
SHA512ae750a0651eb3861ff7cdd2f15661c2864139acccad48ebd0922f17eba80f36ed2812239d9aef815e49010eec733fd88da2cc882785c08af87c4e459fecbb37c
-
Filesize
48B
MD5f15d79a1e8ec9166128e5468c055b072
SHA161b4b2b8b96230f41b61161d3e12379c34e5cb38
SHA256be44b40e27a267e5cae3c7a6e4ead532ffb32197bd272ecf8da82ce9c79fced9
SHA5127188eb446bbb9476bd8fb8f124ae54c71120b6dae262c893ddd64515f35b160b016908d06caa4cdfc45c3f35a2138dfaf58150a39a361c9cf945823bd2575dc4
-
Filesize
64B
MD5a7049d925463252cf44ce63a152703b4
SHA11848bdb5b0f614c2fb04d55dc5ab51f17d57e827
SHA256da9bd38156e35a12154ffc1c35bb6d0466ba2ab7038f532171e896e9bec4e3d4
SHA51221a5eaae681adfe7213ad77cde50e2bddb804fd4014a0a71cbe3a6b80d2f0e480ec6a8f5f9293a636e5db5575eea1fdbbda1769448969469d5c9ecbd6dddc865
-
Filesize
64B
MD5fe2e42ca858f0c88511f3fb9a570fa50
SHA11fe3f1d5fef903714f0b1fae63122feb1114a038
SHA256354c296a4407e6d42c69ee78dc9e313849542f0f8de02fe01198f9f6e5173b14
SHA512a73a8aafd3adb242e2e81f21be4300a04a749d29c441bcbbab721d93a70e140f6a5c5f096071e0d9c0c11f8226cac54274873b1d6317cd5d6af46c06bf8be157
-
Filesize
64B
MD5e8040f15363428542cff84f99d06c1ce
SHA18bc52854a5db61e67cd4c80ef7ab4f2190bb22f4
SHA256d3166623efe9be98f8ec100113b57f0db7fffbedde1cd3a389f276edb32e27b3
SHA51208b9d2c7fa5867bd84c419f5add1f1af4f8919ab7cdabe9b1565bf5c51987314bc8220ad2d1004d80f5fa56bae15014cc68125e0f545f0157f1f9dfa1d0fdae1
-
Filesize
32B
MD5028b9681f54f731cb53ccb16dc24b59d
SHA15325f46fea829bcf2f50a1a6c00341379c2ee001
SHA256b53bcd7c7a0c8ea325214ee50bbe5dc3fa557efc6a49fca8e22388f5be0c21bb
SHA512a5a51f8d8a4056310fd659966d0cd773747539176996f23639441959ca3a057027b363e35267b92c17975b2b03cf5c33b2d600ec01beb3a8dcb1a2c71111d255
-
Filesize
992B
MD5fcd31d2c3458ce979b082b6b3de5a996
SHA1d35f6855894b2dfec60e5a78fcfeed8209705bd0
SHA2562f5ffed7479833f57c4c9efb0cab8c1c34bd9bdeca3666c241276c2762d8dfcb
SHA512e63310f99b25dd5aa00f0ff689fcc7e267feb0589b99d9d17014cd482ad43ef593a4d81c0096c307f94848395f244540e1c740440b9bb451773fb6fe6c5a5406
-
Filesize
576B
MD57b921c9716561c3d9e9c5d414b2f33f6
SHA1f465cfeb7d763066a8000ee91c1c031279457a42
SHA256c705f6ad4e3c5e74a8a591ccb8d415c6fe88de6385e455396146a29216e318b2
SHA51231be5be04787a93f0e49b10bc7b5d263b0ef6326ab45df14881a9da30ba765d5da98dbcc543614bb31e1c2bab8fc831bc4b5f469e23a5dda932f394f2ecb3630
-
Filesize
368B
MD526923cead1e8f31bae6052619aab5faf
SHA1d44db7693f6193ab56ec8b8553c808d06a7db118
SHA256e724155cfb42e1a1175e1adc54b66ef22e3ce4d3a5997e3435214684245ee0f0
SHA51275a6b935c02250ab07ae9681add129d45dca76b7f1757aa9dbe26a1d6a075f5264e74ff574ee79e11dd33ade18353d9dae7472f3704783e5641417c93ca4b23e
-
Filesize
64B
MD5d927f583c174d1bb853434ca9dd40341
SHA1f01d495efaa1028d270ba72f2334671090ea6512
SHA256bf6e60627b278009d8adbaccd13de619e98ada8253e4f010cd79a9d61ad629b5
SHA5124576759936de6bc3b421b21977a3a3da923c3d5b76b768b0003c999e4e5da58063ce254357273d0ce0fd43f12961d4b19ee3fae4fb7a2a11e408fbc7d6700589
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.raz
Filesize80B
MD58b7a6f4b392f7407dea58dc618b0a1f2
SHA115afc2a68338f0e702c9156069855c4af844631a
SHA25621a0fe5a0eb6ff3726926ef7c7227b1338f88adac50df02bf03789943d6dda1c
SHA512f6d56fc1946bff5870af45c831d50469b44ff20c90b2b6fe5238ebb81b20044e7ab631fcebc1c9eedcd566f2a8579b2c789f8d3362f861f1baeb15a04ea5cc04
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.raz
Filesize80B
MD5ca3bcff75b41407ad797a38f7e0b96cf
SHA17ea1ba3eeac65e9d0fb127164d2880e0faff8bdf
SHA2568fc3de652e2d2bd007b88ee32fa249e866b6a0bb5b09d494836d5fce3baef495
SHA51242e6620130f28e7d78af6e19dd2452c46b3eb11ef8f099ec644730c7d6adc12b96ed484c5bc6d06cd83a40948fcdad3bd018760f06446e763b4eedc15b35d134
-
Filesize
2KB
MD52905523f922ded9843688bb9427154f8
SHA12a95d3b7ea0998625d18507ca052428ebfab7d5f
SHA2565f6f060bdc8e742c6b5bb9255b46b6a4af8db87fe7d100b6524102bc49f594c0
SHA512109565940ad6030ae9f6ffb6700d7faa975105f9ee8fe72274afb18cd32af303b34b082459e02c011e3a60b8849eba3708a01b3626a30ab1fca67c1cb574ba2c
-
Filesize
13KB
MD5fb5e34856456b7928964f8fd270deb8a
SHA1b7804344d869ca80be762edc1c9684fdbfe5e7cc
SHA2563ca97e9c6b636b83aeba18b4723e6e4e592cda21e5e3c0bae9d5e1c3bca1c207
SHA512445cd45de5d06f2495fb337c89701fa242abb325b2c6907cf8d7132031dbdfeee5582305aee77a4dbfbc834e7689e756d84d95604013192cdb8d341c542892ec
-
Filesize
1KB
MD50b6dbe7ab6b50b5b436d36e5a30a8d2b
SHA116ad2d00b673f4ef5fbf88272a6d716134e02995
SHA256d2aa217ee8c4b496e0c02baf7118db96e7448564b0d02d33b349e497ca77e752
SHA512a416307b7ccbd29c690a570eab7fd39d52cb0a6f0985cb47d294d7852ad5185150fe1fa673447eb1d4fd058d0464b9a873bb0d3b909fa3645d5e4c15cfd785b8
-
Filesize
1KB
MD58df89c63caf6fc1b1b7835cbd7694d0f
SHA16181636009ad94c7b6c6effc831a5d1969806e54
SHA25696fbd3d31322d43b782652b898c3125228e038e54d7842cd3d835bcedaebdce4
SHA5128674d6ef1ae3f47610da11f6b625d3ee1c854364d89eb40bf88c164c279c62cea01ef45e95b65703aee652c45f7db2e0f66fbec40196175292c021b68a9807ae
-
Filesize
5KB
MD5c51fd6af73031054abce83f3e5690db1
SHA126e61500dae5ba31da64e4d3e890b89b59b0b309
SHA2564d450357cfd1f280e57e654c2843a9afd527d7522830b71a03e6177ccf730de0
SHA512d8db522946ba40302b9f793f0e78bc00471977c61d2f7b26617a46f528c32ee7904727379d93ab812c8ea7a2be3115d63db6bb89e6e3caab7eb514b0a13b3886
-
Filesize
3KB
MD587a5b6895c1e1ca3dda1bcbedaf9c85c
SHA14bdf834228264dc7311371736f7f36ff266d822f
SHA25619eebf24293447f82b2c02699e2e962bd0d8953085f08d0a3d278a4a9bf81e25
SHA5127af2e85115e8408e2f831a417cea7eef64d3065ac550a10bd2b94d778a5c57b35b1db3341a3cf8ea0fd338e7e61328787b2e11ade40a56f84ea4fec0da0291d7
-
Filesize
6KB
MD51ca2d4658bc112222c35a80d24fd5622
SHA1edefc496831b8101d51cc1041723dd32e6e1680f
SHA25695b786a7445fee86c732c09c69ed63d06624e70c199ecd622b19631cbe5f3e21
SHA512b7da7df9aeafbe750c4c32ba9541a12fd49eaa1a12e8d6ffe1d22fb0d63568d8830e5996aced15b51ecff5ee38e4d11a09d88a4dcd4fc056d1b9fcfdb8d1c84d
-
Filesize
62KB
MD5dd54b2c62df34c449352651172b1438a
SHA1a011ff4f98711f12cda668292117843fb5ff89bb
SHA2569020038a7a9584d095b41816c45a5614d6634b7038f07fabd854660628807047
SHA5121db7cc87c14d1e05f88089053cb03d4562d163cac7680e700b756eff0b800a846e5fc27f88272ef930ed14944ef620fd09e0358aa608eb177884ecddfb18d084
-
Filesize
28KB
MD5015baef3074c5c263b686dff232a2cb0
SHA156350e56cd0eba6aab9970d618f094b6b80c408b
SHA25620556b6adf784066a15b3e893fb7df45ba254b4470f281a6148c57d186f06219
SHA5120880d999e8c39aa5324b1e4d14994c94a37c93cbf66529a39983de209cd807b9e87e32ea3b22443a3bfbd14f3d237d7b9e8ec5ab538c6e2d75409b885f381b93
-
Filesize
88KB
MD5bd4b913aea84f3650378e5a056d84e90
SHA180ea1d0538b46e5c80c867320a714847e0994932
SHA256e8ea1f49bbdc2ae1b5e08426f7e63c8f8415a9eb12293d9427f566b758185f8a
SHA512ac27e4ba481dc4cf42ea9b9b71e24346d6de0ed385d1f9054eca854ed8321e0f7290d051280adb66231761d10187e3d4b5a9eac987bcb8bca923e719681c8d60
-
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.raz
Filesize176B
MD5ec3ab4e8edb9f9bf0c9df38220b9058a
SHA17edd39f9cdd1f1491d86ace4994a61a44947b8ad
SHA256b71bca7f3d9727a03827b2a710b78d6aa21186d528878ab77eb84f900672bcd4
SHA512742c4763bd592069dca12fd0a23bb48b5ab4fa2893fe5494ea374765fdb8de5aa865ef7fe949274d6efaa3db405f7cb51bbef40b5f1ba482dd248a2110dde655
-
Filesize
113KB
MD59ca0b5218218588ca12fa70599ca0d98
SHA1b629aad4e52e63430f04d0030320dad2483a9ef7
SHA256fd64f750505b28b0c1ba1f526f2eb7c9389a134d43f5725b98c2279a32cfe9d9
SHA5123a22eef51632ef34058cb0976ece49e7beb499b18424256920c8f854bef4defe26da710a230cc28fc7b29cd2c0b7c228d63ab51f5ad2b5adc36d6ce898f0fdf0
-
Filesize
236KB
MD563b70911aaf2988d26211b122b45ccaa
SHA16694803a0c86a8b6aed4991bb33fe1bd4a67dc58
SHA25611a07f08d411e9c8c4475b7f850f12e73274c39e88463ab428013ea4437c447d
SHA51201471dba612699bd657382ac762b087e1d18de4c10da5e07dd06178d0a984043e038ae33909985ab41db5a2dd2b824c00973b6cd052fbf5363533f759df73d1e
-
Filesize
992B
MD56aeef24da93d3b82a8b6d5effc1570cb
SHA1ae863109228f6090fdfd6d7182953d353b23c7c0
SHA25645986779d203d16f91d5c212cf382700174c24266ddf07068827c03361e570df
SHA512e25639c1f1e585a94d1e808670b8799f307032c4273b1090d211fe2bed27dbea129cbf4a4927b55acfe8ce38c7830709be0a3f8ba1c6b983d8f52361cc82fd54
-
Filesize
693KB
MD516b17126386a558c63bb109a833bd777
SHA18ebd6d39b1692bc51fa8b3d528b9a63791108dd2
SHA25601d7714442f09706fcba3953b7540f1c2649589192c7c8814167b02ed808b7b3
SHA51290c1bbc41d43bab62cd3d957d25a0d65da579649d03f086e5af9ee23dc619ebf72c3a4f67efa7154489a5952e73f6374ac59fb53d8b55ac5a7420de632f19d6a
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\ja-JP\assets\ErrorPages\PhishSiteEdge.htm.raz
Filesize112B
MD5a471df9479b853fd0a977ce75daaaaf4
SHA1e4c8c1292d649f35a6a8c4588b85756edaf4b6a0
SHA2567b03adb0edbf10c9cab1f26ada597f0325dd3859225491a7149b12d800d2b362
SHA51252de10181c55c60606ef58a2e3bd84b95bd221a4226349907ac89704b00999946e07e7f6e129ad022952c448b2e36036bdca97116c39c8b7e85c483ceb0009b3
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\ErrorPageStyles.css.raz
Filesize57KB
MD5fb81733d55eb52021809d61f343a7f5a
SHA1c3df820947960dab152d50c2f6de89dff6d6c47c
SHA256a1a448302fe21417bbb3a25eae002ed166e7c23fb8f23122f5237c8228e2b892
SHA51225a8b15e8e0a32a48085062baa098ee9933cb9accaf3e5d9a2f0162f5b2648841d16e5c6e33c28da6cb48171cb14b421ab1e2d5d91a8ce32c80d48040895aa95
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\PhishSiteStyles.css.raz
Filesize5KB
MD5e4a107fd26439aa0c807f7d5146043eb
SHA11c252a01104611953d41ac6a365d239c8b9b290a
SHA2568b2d88c1d6a00bb619c6c9688c429520f8edfc5dc62fa93fe551cf0c0dcd83d2
SHA512ec5ccf376101e1f9724e91a6668a3e7976fd193e80777e2f29b8af7aebfb4431c9031cb53012783c8c3f62beea6a2821e80a40fca7b0ca02a5c78d707651b472
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\uk-UA\assets\ErrorPages\TridentErrorPageStyles.css.raz
Filesize4KB
MD5943308d04da2e4ac4321677feaf3edd6
SHA1e80c376d96a423809c6a7e1eebe5c748417fafec
SHA256c9e5e76665c7925548aa591f3d9346b90219ebb84744171def86bf3e66c2a79f
SHA512b20756948efaf9f3dfa8dd51d052963b656786823a44363f1bcbe118c0eb9458bd992a421e2f32cabc9c790cd6e4e665543039110b39520814aa60322fa30cf0
-
Filesize
19KB
MD5abf16b5adb1ffb819ca4b15ea39a117e
SHA19418292412c9983f5a3cb5f78f8bf6309d20b41c
SHA25603a38ec75bd25367b3d9c1f28da27681de9fefd4185cdd6deb3d777e49ae7882
SHA5121bb3a80ebd858500cb4046ecc57083c75d1613c87e2cd442c828ddff59984dfb4f67efab39df2db4e996f3437e56dbd87b419f184dc8625606859ea92a8a2a52
-
Filesize
30KB
MD5ffeab9a29f283a0494850e24553feef0
SHA168ceac1b526d07878796e5bc8d5d1eedc65a835c
SHA256db11a50f0f8d2ac838d864f9706096336930a6596421a6b62d3542fe3b14401c
SHA5125bda4380eaaaed02a5b0795b846ef277bcd22bfd84f0a51f32238604b4bea3a2419ff27d9819cae51cc0dbc3bdbbf56fd77a808d7efcf50d268c25083c4fe832