7c1a1513ae242ece2f964779e1aca19db05d2d9804a1e1e61980ece32401ca89

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6A19P_razrusheniye.exe
Size

20KB
MD5

0989843627697f68330485e08033bc3d
SHA1

c313d0d0476e85b4013436d34641be930c29f394
SHA256

7c1a1513ae242ece2f964779e1aca19db05d2d9804a1e1e61980ece32401ca89
SHA512

48afa380d0726b6660a47857af65668117f363762ad231d0ae120d7d5c37478a0276114002f7a51f99fe8dbf8b26066d1c4be498a4abe042c0358bc6269aab84
SSDEEP

384:ThepVQkCBbX1V/IxzJjWigeY6doSiKkU+aon3TcoUURdT:wpwfIzlgjyriKkdo1U7

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Videos\README.txt

Ransom Note

~~~ You became victim of the razrusheniye ransomware! ~~~. Using AES-256-CBC encryption, your databases, documents, photos and other important files have been encrypted! This means you will not be able to access them unless you decrypt them. See for yourself! Look at any file with the .raz extension and its content! You cannot recover these files yourself. That's not how cryptography works. Do not waste your time. Nobody can recover your files besides us! If you fulfil the following, you are eligible for a 50% discount! - You do NOT contact ANYONE about this incident. - You contact us in UNDER than 6 hours. We can decrypt these files, we can guarantee that your system will be just as new! Payment for the restoration of your system is $70 (with the 50% discount it's $35) We can restore your systems in less than 6 hours if you pay now. However, we will not decrypt your system if; - You go to police and report us. >>> If you report us AFTER restoration, we WILL attack you again!!! <<< Do not delete or modify encrypted files, it will cause problems when restoring your system! Send the personal ID to [email protected] via email. We will provide payment information, once payment is done, we will sent you a decryptor! If you do not pay, you will NEVER get your data back and sensitive information will be leaked online! By sensitive information we mean passwords, and similar! Q: How can i be sure you won't scam me? A: You can send us 3 files (not bigger than 3MB) and we will decrypt it, and send it back to you. You can then decide if you want to restore the rest by paying $70 (with the 50% discount its $35) >>> Your personal ID is: XXO2-0OVR-DV9B-LOOG-RAW6-EMVL-GGKY-90FO <<<

Emails

[email protected]

Signatures

Renames multiple (4311) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 31 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\UMDF\ja-JP\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\en-US\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\fr-FR\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\gmreadme.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\en-US\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\ja-JP\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\es-ES\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\fr-FR\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\it-IT\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\it-IT\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\en-US\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\es-ES\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\drivers\etc\README.txt	6A19P_razrusheniye.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 7 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File created	C:\Windows\System32\spool\prtprocs\x64\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\en-US\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\es-ES\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\fr-FR\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\it-IT\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\ja-JP\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\README.txt	6A19P_razrusheniye.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt	6A19P_razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.raz	6A19P_razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt	6A19P_razrusheniye.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\ja-JP\Licenses\eval\EnterpriseN\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_join.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterN\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\ieapfltr.dat.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dot4.inf_amd64_neutral_b89cfac15ccb2fba\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasic\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_neutral_12aaf5742a9969da\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\it-IT\Licenses\_Default\HomePremium\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_remote_troubleshooting.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\AdapterTroubleshooter.exe.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremium\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced_methods.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudss.inf_amd64_neutral_330a593eb888237c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\OEM\HomePremium\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_If.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Automatic_Variables.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cxraptor_fm1216mk5_ibv64.inf_amd64_neutral_3eaae75b591bd148\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\OEM\EnterpriseN\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\IME\IMETC10\IMTCPROP.exe.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_debuggers.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\it-IT\erofflps.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\where.exe.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scripts.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_neutral_a9cb77fe1985cd2c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_For.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_pssession_details.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateE\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Session_Configurations.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC5201F.XML.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpD5400t.xml.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\OEM\Ultimate\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicN\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\sdchange.exe.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseE\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_eventlogs.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPC3052F.XML.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5060t.xml.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\_Default\ProfessionalN\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_objects.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF4BK3L.XML.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\eval\ProfessionalE\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\ja-JP\Licenses\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_providers.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_scripts.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\OEM\UltimateN\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\oobe\ja-JP\OOBE_HELP_What_is_HomeGroup.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasic\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\es-ES\lipeula.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_preference_variables.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumN\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\catroot2\edb006CB.log.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\it-IT\Licenses\eval\Enterprise\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_methods.help.txt.raz	6A19P_razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_remote_FAQ.help.txt.raz	6A19P_razrusheniye.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_m.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\PREVIEW.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AR.XML.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Defender\en-US\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CHECKBOX.JPG.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\picturePuzzle.js.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Windows Mail\wab.exe.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21329_.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50B.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\settings.css.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\DVD Maker\es-ES\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\RSSFeeds.css.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\BIBFORM.XML.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-uisupport.xml.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.CN.XML.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_rest.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OMSSMS.CFG.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-spi-actions.xml.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\ehshellLogo.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL044.XML.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382954.JPG.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CA.XML.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\timeZones.js.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\drag.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\README.txt	6A19P_razrusheniye.exe
File created	C:\Program Files\Java\jre7\bin\pack200.exe.raz	6A19P_razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png.raz	6A19P_razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_ButtonGraphic.png.raz	6A19P_razrusheniye.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ostic-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c558cd1625f73a48\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-whoami.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cb28c86f28d65ec7\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_netfx-microsoft_vsa_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_e65fcc6ca26c50f7\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-kernelbase.resources_31bf3856ad364e35_6.1.7600.16385_it-it_60bc75809a6422c1\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_5d0f22c9e44cb6ed\license.rtf.raz	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-bits-client.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7acb58804e5fab3d\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ipconfig.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6a3657f25205902c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cipher.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fc07d4010b6cd619\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_lv-lv_809ad1b1fd87a64c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_prnky007.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4a664c178ed9dcc8\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\diagnostics\system\HomeGroup\ja-JP\CL_LocalizationData.psd1.raz	6A19P_razrusheniye.exe
File created	C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_sbp2.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b2157f504244a378\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..figwizard.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1e320ebf94cd98cb\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\Resources\Themes\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..component.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_63d7fc41687f31e0\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mmres.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f7cb1696661d8059\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..rolspanel.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1e2ec9b1e4be8d48\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\msil_mscorlib.resources_b77a5c561934e089_6.1.7600.16385_ja-jp_49d98ea50b16ca4a\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8734fb86705288a7\RSSFeeds.css.raz	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..server-provider-rll_31bf3856ad364e35_6.1.7600.16385_none_c0ece8809faba47d\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4c87c53cabac759d\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7fcfaf551f6cc541\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_41ae913e62031c5c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-trkwks.resources_31bf3856ad364e35_6.1.7600.16385_es-es_415f89d89c575287\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_prnlx00x.inf_31bf3856ad364e35_6.1.7600.16385_none_6d1e0664a45b53b4\Amd64\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-user32.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_d548efc2336385a9\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-optionaltsps.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7145f845adfd99f0\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rpc-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a213eead672f722a\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..revention.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c80b734bdadc6581\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_avmx64c.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b3b5201f217348fb\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..gement-winproviders_31bf3856ad364e35_6.1.7601.17514_none_1573bf06bb8baa0c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..tance-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_010febe7e692b906\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..tymanager.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9154e37335885ed3\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ytools-ex.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_042c094993a50f70\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-charmap_31bf3856ad364e35_6.1.7600.16385_none_f230138205aebc59\charmap.exe.raz	6A19P_razrusheniye.exe
File created	C:\Windows\assembly\GAC_64\Mcx2Dvcs\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\inf\.NETFramework\0410\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-findstr.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ac95f58a2a8581c5\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll001e_31bf3856ad364e35_6.1.7600.16385_none_486d1e38cb3fe9d8\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-efsadu.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_efc29b62b3b11ba8\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..show-core.resources_31bf3856ad364e35_6.1.7600.16385_it-it_37989fb821afc047\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lddmcore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f6c59b862fe268d3\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-setup_31bf3856ad364e35_8.0.7601.17514_none_b6010cc91d0c5ec6\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-onlineidcpl_31bf3856ad364e35_6.1.7601.17514_none_adf2ffadfa4ec7bc\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ity-vault.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f2317dde6bc00bc4\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\Media\Sonata\Windows Default.wav.raz	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..l-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_it-it_603f5692664da8c3\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_scrawpdo.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1b1933bc3ec5fa0e\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-autofmt.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b6e4abd54d6f16e2\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-docprop.resources_31bf3856ad364e35_6.1.7600.16385_es-es_66fbf2868ba4b42c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..erbox-isv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7a9473b9bce80a18\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..olicy-snapin-native_31bf3856ad364e35_6.1.7600.16385_none_9b6078314990d8e8\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-onlineidcpl.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6ab30227b2ec5996\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Annotations\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_netmyk00.inf_31bf3856ad364e35_6.1.7600.16385_none_18eefc05dfc312ee\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\msil_microsoft.security...t.cmdlets.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cbde052b5e31472c\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_nl-nl_1b5e2635a93a1e16\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-docprop.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_09b368857e76ca8e\README.txt	6A19P_razrusheniye.exe
File created	C:\Windows\inf\ASP.NET\000B\aspnet_perf2.ini.raz	6A19P_razrusheniye.exe
File created	C:\Windows\inf\BITS\040C\bitsctrs.ini.raz	6A19P_razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..tcard-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_72f9e1a3ef988c92\README.txt	6A19P_razrusheniye.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	6A19P_razrusheniye.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	6A19P_razrusheniye.exe

C:\Users\Admin\AppData\Local\Temp\6A19P_razrusheniye.exe
"C:\Users\Admin\AppData\Local\Temp\6A19P_razrusheniye.exe"
1⤵
- Drops file in Drivers directory
- Boot or Logon Autostart Execution: Print Processors
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.raz

Filesize
27KB

MD5
8ba195efcd7a77dcd3b9562b3d23c176

SHA1
5a346fcfc6702936536445ebbf593b35096fe71b

SHA256
c812c7f82d1f3b78aa6c2c4fe65e6b0bf52afa14650388a36ab72c3e01eae248

SHA512
d4ec1ed114163773119f29db6d9b693f32c993962dba97894257b55f9a239bf812c41d0e35efdd894954337e0b8bfaed97b70d6548a398b37786a943bb380122

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.raz

Filesize
352B

MD5
234984e38f22c9bab168fc75b75c0300

SHA1
08f87794191437f13fd512a9941d1a91dd2dc7fe

SHA256
dc0559f5ccdc1aa86566f56a8c30d3cc9ca9186c4dd9c1b80efc9cbc6874bd6f

SHA512
0cad7ec73443bc2f5da45546f322eb363572377ee64100001f4041cb52d09e6b46d3efbc0dbf1acc8f0a9870bc34465c71ae0b6d95e30c895ce25a12d3f43877

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.raz

Filesize
224B

MD5
4f130d985cdda3db84f8b49f59491219

SHA1
acc7a871fe5ac361beca4f09bca49dd9edee254f

SHA256
e80993c964f739bc31993193eaf5f6d13418012ad7ebc4e59a37a013e1a5962d

SHA512
2e7741c4f21c3a572ba9b89b5813a9da6894eb094c830ef24082187471d81470030034666d06317673f86c33aa76decdc755a781c8ac4a1c84d68548aee03b09

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.raz

Filesize
192B

MD5
27da65c71220d28ce7190934d1a1cec6

SHA1
fb7285bf841171fc7541acb48a68c1b59183027b

SHA256
27c9daebae69407fa8da6e9120457c1afcd5f6a8c9b335b8fe1d17485a486e77

SHA512
4b61ed649bba2dfe298adbc90d322fe9381d7532cc5cd37a5a21568cf0301ee8a20efb47b97f5b0f930e583258e73502efaf80f54517db65ced053e8d001850e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.raz

Filesize
512B

MD5
71e6e356136526d39a7a0bd5d6e640a0

SHA1
ba6cc7566b811444ab10af7301c1914495488652

SHA256
044911e1fd9427fe5f2d0dbe44f9d8153a080af549d3c4ecbe31079c41e0bb12

SHA512
ae1b24f2cd9b55a740741560c7546126c2710a0ec97d8cb878169bb78a5cbc2b4aca9ab0f9b650cb649f3b3079b36fd11d5b089c613c7aea842151f3711b2eb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.raz

Filesize
1KB

MD5
7c1870a4ebc480714b4f3151a1c0b40a

SHA1
6f7524ff42da147e41dbd94f184191613f9e1f43

SHA256
2f5ee78902a07a2537832d6429bc1be8b4f42c801119783012426f1850c6febd

SHA512
e981323f9a7a64aaf90ebffc18751a3b18988a0356df3163401f15e3f1fe9320e409e29fd61451e0cb9f7efe6f90d3cbd0ffae6f6624f29a26062ef6a3ea50f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.raz

Filesize
816B

MD5
da691208ea57b89ef59b7af7cd06c5de

SHA1
d40fb1290a6fb145052ec8183f47e98ba866c018

SHA256
e480432b79dfaf9b15cc57339b325f88c035d7b3d1f046133fb8418f6f900fa3

SHA512
ca48083da7b0e56a5e34c259d44acf71754d1bea84cbeb3f8b48bcb2b1a78f5ff30d1746d678261c9d07b77a7df56d7d8a3a02e49fa27f5dcfcb145bf8cd23c3

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css.raz

Filesize
19KB

MD5
ff5d8c2ff6dea015c6540796c6bbd5a2

SHA1
98b9e14f0cff0193952ffd3a5fe3b9666600b6a8

SHA256
dffa66a7e717a4eed2ad758a272f9a7b1b685a3c549271ca1a42c0334c7134da

SHA512
7b044828cba93c1b1fa2e0e7655ef11d54f010166bfbe3de8e62e6ca013509a06dc032a09c684e97a9a278ad8b2a60ae650fe73c6589fcbf049c0e282671386a

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.raz

Filesize
5KB

MD5
6a484c8d83315c1f2cf550daa74ba1e6

SHA1
aa6c12a71cb665c3d10167ab027af4f7d706286f

SHA256
0fc1e089f27b6a1e787cc9d78a5b4636d1821df4298f83c6e468e991823add87

SHA512
c4eda63f27b48897b9a20348aa21a21f012feadeda9fc386114b01709c3997f197b9970cbe7384cc00a630952336d2126cb805ebbd80afc4e9a870189a4931f2

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.raz

Filesize
5KB

MD5
2ad277e1a0d6c67e0da022d07ecaa312

SHA1
07905b220a3ae15f8fe3be4be7b8179c9d064fca

SHA256
978732b05c0180c64ed6ca6c4527515e5781cf5a2a187bbc059b5a2f8b4618c2

SHA512
5101a29c57b929cbab7cb9e54f7096df934914f222631877a4ed8ea82ed01c315e6c020a6e01225c6a60db32e27ca52aa10c36ac2b969f1c1237fd9cbaaa7c57

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.raz

Filesize
4KB

MD5
0b46b040c3021dc87552ffb400ad8318

SHA1
0fd6c2794924472ca3e6259bc9e4d047bb8155fd

SHA256
67853d846289da2ace752cd8b7eb5f83b91d8f5fa4469694b597798786bb04b8

SHA512
6e38a3c4f4d2c5e08b1ff3bd9ec82f645c95f417a26601f1919b3600889842c4ae1b379452e8ca1ab7abf0e39f97cea90c0b97c712760d7f81221a04535304fc

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.raz

Filesize
4KB

MD5
85ca156bd931c545bdcb6d7a51c05115

SHA1
a531e6b4b55b746454187606178aa1f93fd8f648

SHA256
2152738abaa0ee6064595e8a048ab99794cbaef26c70ce3818b16b2e87e3b5e3

SHA512
34d875dde81dc14306c9bf0f3b303c54d321f67c664a18684d0b8f117a9dc0e9a041fc642cf4758f241fb825c24ee43d183150d6d1487293270cfaee066c9db3

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.raz

Filesize
5KB

MD5
10bab37db515790e8bb3ad93eeb095e6

SHA1
39ff817057484ab26d7fad9601dd44ce507a82fa

SHA256
45d8fd7d0cc08be0b9dfad8711a46811ae8379f424deee558c84d9c05748022f

SHA512
0973699a634422e0477c6a62248aaebe507eb51ad291515653f61f4611a84364c8c438cf46d7bdba38b28126001dd95cfdc631110bf0a2e3a0d7d29e5bedccdf

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.raz

Filesize
5KB

MD5
512894cdeca69f71a5a8f453ca1cc239

SHA1
6900e6e182d5ae06cbb9a243fbf122eb8cc898a2

SHA256
6ad0a720ca16c9ae144d41732d6f7a4381a8e380ac57702eaea839d6755eb020

SHA512
4728b070fc5fcb3890b3eb615fefae4be074886279989309fa058c3299b36ce35f5b2596d88dd6b7f758775a4c5ffa2baf550a6595a7e7dbf9117adb5979d1ab

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.raz

Filesize
4KB

MD5
3d52f48c1ed0b586d29286f9c5b4c4d9

SHA1
452a7aef90dca987737d9ce99874cb4e6cf99946

SHA256
4af4394843aa9524aff9723e419621b25b9fe97e8af87b76f1919b4b12efa450

SHA512
f3f31e2f4761e12ec5f773df032dd87e4eeb178f3201f08480c44e69022863f5959cb09ef9766e1697824d910534c7ca66958413d572e5b4ffe43205def5b307

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.raz

Filesize
3KB

MD5
7b754d057cc183d7160316b2fc6d2a59

SHA1
b33b0d5bfcf234adedc1644a54d5b296c789bd67

SHA256
75e6eb65819edeef1670e625b415849877738b63067bacf35b5396fe989b81de

SHA512
1db262429a6bb5423ce76add7193697442f74703c12206889fb45d115011cd9f17750ebf72f8681ecd766c0ffd29ebe5a4a46c48086a6e090b48815b32533abf

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.raz

Filesize
4KB

MD5
612331e1245604aeb89f9fb9d2504d0e

SHA1
2feecc38a22e0884b9961bcb1765e42fddd6d593

SHA256
77528c2d65559f41f8c3d7e223542e22e10a43d9822417e66037bbe0f1db389f

SHA512
d33fda63d17fbaaf107cca3bd07137dc0f3fca3d069c15c30cf74781ace9c20eb1fe6a7a90613bb535341bcd43db94ecb613799c10de5683fc4b4ecaec27d346

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.raz

Filesize
3KB

MD5
2f890dc6dc78311c4acad57970791abf

SHA1
6fc69d2f2d4058cea48ae227a6c929e6b61f94f6

SHA256
9035975905bd3eb78f56109c32a1afeb65f1efe50f6711f43a5ad5bb187dbfd9

SHA512
901bf4367e22a729bd37160435894c124f81926b195196eef963549e0991e05324b9469d46127b23aa933eefad35367b9836409f3d4d918b63ba496b49437d3b

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.raz

Filesize
4KB

MD5
39a7f62971570457f248a1f8c6acddaa

SHA1
74ec55c9138c46c2b1a07be8675ccbd7cbf8239a

SHA256
50085d94e2ce0b30099a357d3da2870541d245e256d3cfbf00d03621ea7c45e5

SHA512
9e5fc628fe4c3ebf150c3adc0e64577f2df6a99848bcf8685c8a4c0dea744c80b31adbbb38ff5fe7a71b9b1f3dabcc33379344d7cae4f02307452ce23c5894d8

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.raz

Filesize
3KB

MD5
019e5fd2333a2c99f2b00ac07464dbce

SHA1
ea7ddbb2ae474124c6c865114f7f5dd7656f9622

SHA256
4dad7b86435365ad0b7bcc6b5d87b8d4954639cb31768340374f5edfe5689507

SHA512
257b987dc49b017e92ee09e788e49f5bd8573f6001edad0597bd021b66c4ac32fb9533badfac4dbe4e679bc27cb3cb651d1fb0287bc8d561edbd3119db9aaabf

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.raz

Filesize
4KB

MD5
e4f58976bb0e5c80d13c1bf811180c36

SHA1
4c9bca9b49856b0b33cce7162749320d953318fd

SHA256
7548ae82c022f6d2c1516646684a092924a67cdea20ecd51d4f6e87f407646d1

SHA512
fce730927e17e06219cff75c084b49545d63b223e3db64f82817490c483668c0aa11da23d054d5fad951dca79250bb9631188d6c9f4daf8c7d1211799b382c87

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.raz

Filesize
2KB

MD5
70f87f0696111e33ac449fe95de4b564

SHA1
d4e85a38cdc8d23522d0420096f0adb1f8d6c9b8

SHA256
e51a6f0038ad1eb419228be9fda4a2d3dd7ccb8817fad79cb64fe5ecceaa390e

SHA512
b0dc8f2c9866d7a7b9735ad9a6f5b0026e898f52bc18267e6898cec3aceba901ff8ab16a86a83facdcb11279ed89344618aa63257f9f0a89a770ec8bf0fc59b2

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.raz

Filesize
2KB

MD5
9aaa1aa99ff91ebbd6876775714cebcf

SHA1
da20c84959094a0afea7197bbf8b37f2e8ff7e42

SHA256
6e3382e1857ac02e9546ee53c2d46fad348560a5cc02518df8d606e7cb43fbc9

SHA512
f67028d43b0e9ed30b0b7dfccd7c9c8429f1b2da6d4e37ad37231f42f97a3913621164b1585ed739b415fec22e75f7e3790302ed0cf3a057aa47a5e523e5690a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.raz

Filesize
12KB

MD5
a7ac3cbd1d00aa2aad96aa9926a6f1ae

SHA1
001721de7956207208e08b2a8bee9cf501908f05

SHA256
0de26de907fd952b132a7fdd017a44b557405c645a25d3ef64f99ea160ecd362

SHA512
249043aad9b270d4ce31ec1ae4c2a40e5721daf1ed751d10e5aa9e654c86255338368048fb2d461d0dbe2ac14aa4c1146711ab4eb2e006ced7757586cedbb1b8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.raz

Filesize
8KB

MD5
d1c37a58854863efba7453464b6a9e2c

SHA1
c748926e83942d2f3a6e6f8bd977107e4f299529

SHA256
650549da91b8cfa748d2c1891cbadb96a199a7aafd069e3d6946ac7bd0ac761d

SHA512
449afe07ca921b4048cc5b29c597f59763aa72b508a6f7464735eb8299fc31ca43bdbfa86d1b95ca1251094844574e9920861b290e9c71f2e252b9dd1ea0ff6d

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.raz

Filesize
160B

MD5
1f6a07259a031aafd4102d14f5541f9b

SHA1
adcaa940a43b73d22e7cb1d334d7cf0f58dd20ab

SHA256
abf29ad94b88a6f59e8284e7c9fde8b45199e70178e98d85275b9ea45e31d451

SHA512
97d4696f54a6f3ff44af22d9f972087421f072acbea9722b9273f6f21f12f2f9068bc26e8d5b0ecee28701b919279657ec6c859c62ad19e1b74d3d4c583c36ec

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.raz

Filesize
1KB

MD5
8f26dc8de45e27ff9596a7ec52b2c929

SHA1
3cc74bf5c5820b326cca1fbcc749c106abb081e5

SHA256
98f3858f2c9f45b6d5e6a4f1f95047a581f9a71595621d349807008008bf0b49

SHA512
4c1b6f152007c6af9838226b517540897a8cbbbe369c91fbbda91fe02294b6719bb809b9db1550f780a07543f4aa1a143d6e440056bfa2eeeffa7f820a8ae64d

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.raz

Filesize
4KB

MD5
099aab3c41cef41c95b7f15278956334

SHA1
01df1a999d6c64935abd64037fab775b3a114429

SHA256
1d3eb25dac27677549655392b1cdf1f9bb80423806bfd57d8d562dbe6f560b59

SHA512
803311ec763b4be29c056fa2fcc1cc360d9872ecafcf831286386b8a7909457f4e849aae36dfa0bcc08d7d0c09c6a57f3c5473e25102edeca1934da5763e408c

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.raz

Filesize
4KB

MD5
846586c1689056fcddc320b726fba7e9

SHA1
4b67fff820ae5fae370542bb25a708e4d6cb9aff

SHA256
7a0df83d9995f540d9a664f2c739b80dae212a1df3c904a9c1a47d26377d019f

SHA512
d32e2b67d6331d8e8d92a92d54114cc72d3975f723db47b948f62d0f40f49e80733343a5962ce7e0672493404f1f82ab41cfb8722e67b0ecd354c38ade0fce1d

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.raz

Filesize
688B

MD5
521ceab084a4f49fdc6fe74021a0fc70

SHA1
b41817368c0dfe33fde2cdcee5fe0bc74fa5c08b

SHA256
4cec3fdafdb102deefd46f106cbc53a716225367a221706b2c12151dc02afcf7

SHA512
3cb150e97672110f76c820125efaebccfac160fedac5cf320f4030e6561f1696217ba82ef58c81000039f92382e0d3cf5cd4d026af17a1759d80a93146a705e0

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
b8ad559181b4cf9f8b2bf9bca1ba9073

SHA1
5ad1150fb2256d917add4daec835d60df7cbebb3

SHA256
e953c70b768355e0905abe0d4e2d6a34aa8e1d710c68d5ac2e9d9c99d2ceaab0

SHA512
96e63505e775e09ce6b61f81776fccbff8c566420f2b4391cbab118fb96965b6223b21420f34b20d40675bb3fa02b79dfd8e3217ef201ed856232355f687a2bf

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.raz

Filesize
17KB

MD5
158b356fc9a58f189e73251e80f47d80

SHA1
132c7ced5e96cbe9ae4c4dc5cd1bc9cdf7ef2ac8

SHA256
2f5c5966c9133509ef62c6ec05b4de37c9e15075be4ed4219917b9cc33fbc86e

SHA512
87aeb7533aa2b372d5cccdbba36b9efccaa193c7105f414576b2a921cedc536579720734a27ca0fde50bcf7d01e191d4bf52a8e7f8a6981b462c9225a7adba15

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js.raz

Filesize
9KB

MD5
9b7eeaf559fe51af310b4e3c04efacbd

SHA1
88b23143d21a4ed9388a5fbc2efeaa3dd9cc00c9

SHA256
b9ba181d6325e901bef2e863872675682856cafbe898e9d011a446fc0cf4f97b

SHA512
08fd6e0b76c5af8472d18ab0f804030d27100c6a62c32522239070b332481fb7abea1582eb542c4336ae6a4d5d7bdeebcb318c066fed0dd10d58281ad2a5ea38

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.raz

Filesize
5KB

MD5
3c6ab844b6cf83d2ca6a8fe7b38b6784

SHA1
c8aba2583aa3a6f957f039b8c420aac30e589931

SHA256
2a1fd81e01cf06c972daa4d296f0da0d298dd74ea1960f565216fa6cc3de3271

SHA512
89b3c9edf2d5ff341d5b6ee5b97030f98a05f860afdfa8927a9981a9ac14e9e7d592bf3a3e5373043fa931a95605eebb816c55d3d6be115810a4636b4ee86337

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.raz

Filesize
65KB

MD5
8ac7c87b89abf70c5c331277acee8c52

SHA1
b0e83133a8b5f1e0d12a469cad5f49e3f3ae7443

SHA256
15a3e7e578ab6ae123afb34c5cff0a4f78087f57e9490de5168b3951701b312b

SHA512
396cdd4595e3e4f136faee147b8889e60536509736d67db3da16845c5aab4dc7c3d3db0bad4297cefb3c688bc23aabfafeddea8de6ab0ba5ea4c7a00405a2697

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js.raz

Filesize
736B

MD5
faf5ab2ee03b02d4f1a8830a891a7e95

SHA1
7d6c7fe5df0434d503424d26e8511cee16640f91

SHA256
cd641142d33b0a8c3c93aab91cf45e68ddbf2bd60b722692393702bc925e28c2

SHA512
2745c3a28c3d273e057dfc79192395ee8517acb876fe5dd896fe7f90bf159786bbb8ebf9dc715cbbbb157afb05073c39097a0abb49499c83532237378070ffb3

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.raz

Filesize
5KB

MD5
282e13deef6e7cfc9998d9601df1c396

SHA1
7f16da7d79f2d52abddc704b0b701200584a1001

SHA256
138fa30704a0fb4fe8f9eb40f0497cbd566a5da59134818bef65b890f7cf81c4

SHA512
45053b66f15ab885362be10f60002668cc651b023445a34e46b486f075302a9f8488df108a14bb338bef902b64f5b730283fb1aa4dbc5c4acb08a5884129dbe0

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.raz

Filesize
7KB

MD5
bc2e3d1866cf1d395caa075427e1af39

SHA1
538ce5ada9289654bef5da8f2c32afbc4942bcbb

SHA256
66872c8c77ff7dcea8f8d4ad232fa3cb98f071bcb8edf2958eea72eacd3890fd

SHA512
9844f3e7787ebfa8f3d62051c1a8f43da2cef138f71b522351746f2c1b727b8efa9b7fe9ba943092441bb2c660136141dadf1afb4ef96af8949584c457f857a7

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.raz

Filesize
4KB

MD5
24e712dfd2666d2b8bbfa2a934764f65

SHA1
6aac088565b6cd9cbc0dc3fb44c361b9b1be4dc6

SHA256
830c941893243a6b9d22a07a8dca42c722525de007992574f21a31b857eb6f99

SHA512
21e800eab93c96f1796684669d3d1cc3e8f23c8eb7c0b3fa5ba544a7cbf53f11c65aa72c114cfed3081a378c201ff60b9f511b9cd90a78ec983a632c031f65be

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.raz

Filesize
5KB

MD5
e7788abe2568037c4400c2bce68d7280

SHA1
1bff88b4b01990972e4f21aadc7341f35acb2778

SHA256
5e5492a272786945a2d9a9d5912ace6b7c64a2cc0fb0f55abe6ec37a69baa972

SHA512
d6fb3bcc59bbeed662a3d115130e5c4f546af0f260e59ff9b5f639db16e05c6ead11d2cba50553e8b58a8f46906b17ec03099d287a024290c5f01f0eb58e18f6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.raz

Filesize
2KB

MD5
69a1d5e6ed914a11c369ede3b6d8166b

SHA1
00206bc3052a2a75247d40ee15e79b0977111047

SHA256
fbd859ff0f205f4242f70bbda8c9a2efd917f714458809f847439fec694a75e3

SHA512
12c768e050b80e5aa13fa23ab7dcd5588476bd97abbdf54978b95c0799b20cbe0c40d82a2009f7c01fffcdbe2da16b5f49081c66bbf4e17484c5d754e2c7b577

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.raz

Filesize
2KB

MD5
dc52a5c7112039b587e27f002ad66ec2

SHA1
65d06829e6ee9e85caa3a67afbab643f6e02e505

SHA256
d140149b931a7228bbf4ad3c6facd28a75c30730cfc74806fdd0bc3f1da2daec

SHA512
88c834cf320b3c7402db177e84aadef5b17bb31f483546f2be4f00408206afe8e4071968a0db7d53cdad7ab77f24948a33411cd350d8c25a8502ccd4cbf56f95

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
c92567c0344f9169aeda709585ff79c7

SHA1
59e98f3f0d7f3f8eb2903834194a657d724eddcd

SHA256
12d4d2996edc0ffc74fed46480261752a4b853f750cfc46896439a8ff1e24d83

SHA512
4e943f4143bf83d62c12e9fb63bae70a74fa815dc0aa9121b3ba29752b06167fbac1ffe9a20abc3e180f2e165a35144555bbca361a719de75223ed5bb0aa1361

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.raz

Filesize
5KB

MD5
bd34293ad5183edcd7097963b5430aa6

SHA1
e663cf81ac007a943939ffa5fbad54f52ef18604

SHA256
621d95ec0980999dbbb37e2dcf098460e5de6a60e81d93776dd839ddcedcb647

SHA512
653de567d7df5d9943638ad576ffbf44c660c3dcf65d56f9f1d9d3a31290867c5e8321ca64636135c502b26ba97848ff4ef07360d42b6f08ca556a287c4878b6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.raz

Filesize
6KB

MD5
2f1aa7d2a228942b6b866e3724491f3a

SHA1
268459dcf771276b78f7ebf18dc51079e8e7cb83

SHA256
f608904427e77d58ec51c39a6504dbcc2ae997a790d48bfcffda2e5a2667ab78

SHA512
5d70c03cb85c4d324493b326b913f5b94a68c5559a25536a3c00587ebdc83a4c4e724c1ddc692399b4314e717a612ab8672ca5ceb2347de129f0442d38c98bc2

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
98a89c3770988fe05c2da0e921d4090a

SHA1
f102ebad65c48dbf751308b97f7358f847d1a894

SHA256
f82740ad397a8c0928b6dca39dd63b2d76d96e33b1a0b0eae7d4c15f11a506a5

SHA512
25fd34594a6ca7b44ca85b1efc4986e8d0d9b5b849688d5c6958ec66a88a5a28b0a614c281d22666cbe573b4b0659b7101e971f97f5cd610bae84d7c361515c1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.raz

Filesize
4KB

MD5
997d019bb9efec3acf98bf3a0cf6e6b1

SHA1
824d3555ceb8984d69f450e858af146255ed86e5

SHA256
3d588799a6110737a2f9e3df4ecbaf2021eeaa7cbf464eb809d39631ae61599c

SHA512
3555c2776e3e1e220760ec6ac2d871a5bd51a394c713d53f36308fa241d2f9be771bb97547cf41bfc64271214855022b9147227ea5e11c7009d6bdc2a108f59a

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.raz

Filesize
5KB

MD5
4fff18dc5dafbcf324d8267c0864e37e

SHA1
cbcfd06aa5969e35f89fe307abc328fedd841954

SHA256
ecafe398f4421236d4b58d80ac528a5ca540f153615f394dedd075a7653db00e

SHA512
6a689ffbba98c1ce3281b777fe49075a7398bc5af1cab5ab33481dab0dd7948a72ee6968500596291849a742ed10b3b6a34a06f2649ca57778270ac3c783f429

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.raz

Filesize
5KB

MD5
68c48bbd5d7aca6148f879cee3901844

SHA1
143abf2fa6d41f853e8d4067531f82dd6b4c9f52

SHA256
ac77d0c29a98191e7eba31198f73e1432030aa3392fd789e6dc081074b58d00b

SHA512
883b92bac63ddab6dabc57710ddfd1b33aa237f958ae7ef29878752ea95510c6edd523a4d9023fd92016551ac304071c98b74fa51eda5a9cac4daee9bd868c1b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.raz

Filesize
3KB

MD5
356c5a473d16d290ee447965860156df

SHA1
aa2fb8d40007a71d3a7d103873c88fb9aa68b020

SHA256
689b9ae355c4cdb6bf266502a5bfca38b63f30e4de393b5044f6349bc9a286be

SHA512
bc1669573397deedf5e803f95846ccfbbc38846c082c2726c6f079bae5f687cfda77f4cfb715a647650b24173bee2900d361dbd62b0bf12932a0323678cc9e77

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.raz

Filesize
976B

MD5
0bdde5f95d5c3fe4f10e0ad1d8f86402

SHA1
cd2dcaf82ca2fcbdfda258ede89dc37b0a664349

SHA256
6758e2b2429e64728cefe0a567cb40ad76d55b69a2fd442b77135558dbe0f3d9

SHA512
b50818d21a125ccb4c11aa3f7f5fc23084f221f6951773297c47a348cdb09dfa7b2fe16676d5a201b49f6292277ed0b3e51f6447d5e5f6cae07156fc508f6a78

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.raz

Filesize
9KB

MD5
f31233a528695bcfe11b22431bb71d63

SHA1
cf7780c7163cde34a1db373af6fc6a066be3e95c

SHA256
f4d167161e4dc0e38740e90267f00bc811a9d27bd58ac39b9d2c18f314bcb049

SHA512
7127463e1fc701cf863a47c65ab6806da2bf5c1eaceb72c785e8e442e593acd49ed06c710b16a421c0edb4c41aa31e39bfbd11e649f1f616b534db7056054681

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.raz

Filesize
24KB

MD5
785a67823c18f12b83cc211c9c025ddb

SHA1
647af0caa04ad93704a0c3e6ac6b03bdb59be1ca

SHA256
1076d587f5d5133c81087c96f2d9a88401d66e99dc90367455c0a1c293c053bd

SHA512
7438ed4b73afe78c69f438c64b39895a01db0dfb813b294cf8faf3f0dc2ecebd51b4794ccef60c5c964e7fb5cff8fd3a95644aa06855a17a0c059f5734b9e5c6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.raz

Filesize
1KB

MD5
638d3a1bbbadcbe9c714989b125a879e

SHA1
e2bc4b797ecba92a7999dbae9172b43360583def

SHA256
3310625ec2dd5aaeeaf7417b8cb03dacdb7eff5f11048a05fcdb034d8dca68c4

SHA512
aa06ff0254d485eb5bed13cd5a2f13b8ccf0e62fb37f677d7bdfc71d9fa35cf9cff76c7ff5c5ca6878efededf9d5a63f77165d1b36798364b918842ad88530af

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.raz

Filesize
42KB

MD5
dcf5d6ca5f48cb8b746720af1b782c36

SHA1
7e811f346a6f9639375bf290448eedbaaa5f1116

SHA256
b204723edb0a43d8703e9a4123c9338e4ad3204a1cdb0d3ecca7b1067e26c16a

SHA512
b33f51ed4673d631f4eefb5872cfad3ab350e3cabfa7a29179becf5de76793800968fc80dcbff3891c8252182b63877368e49d8580f2e4424cd4c277c812956a

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.raz

Filesize
14KB

MD5
4f40f5fc28a732c6dae608ed3f6826a2

SHA1
9c02a99bf71d386dade8dea10fba3d43ad79513c

SHA256
5904f6aa9b4377537cd354f23e94a61e7ceb084c5056f52c22a6801f22aacfa8

SHA512
820dc2b830b6c6f353cbb9bcce0972a1efe76e1cc079060bb04720f376ad2c0152be5281daf7dd025dc73639d7f0bbdcec774e9e22c9af1c78872090e1fc782c

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.raz

Filesize
56KB

MD5
03ba94910c8a0231bcc496cc04e62ecb

SHA1
1ba50bbdafff33018b9b3b9a8f2045a6414c75bf

SHA256
0470c2fba5f253143220a782b7e0726e16b4ce288ea718cc8a07ea725238b060

SHA512
c95973d7c100992106f08ef0287e6ddded45a08a5922ede1cca6cd9c4e763b50189a59eabf80e05d5c29a80c2ed5a891c41eb7476700a8e74d75c1c080f94af1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.raz

Filesize
132KB

MD5
4caa6ee65e5d91c173ba48f029ab166f

SHA1
76309900192997b0cf9590e5e70494ad10c55d7c

SHA256
051eff7661c551ebaa07688f12db0a56425d742e093b0414b917f1dc3b84e914

SHA512
8a95968ebdf79d7d5e3fa474be9abb02eff41397bc756f0e990135c5dcf6e10603d6fbde0bd1618a6f2c5626ecfd8ac875edeb053748339e21b6672276d811f9

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.raz

Filesize
8KB

MD5
ef37e285214816240e593f95f7686bbf

SHA1
122dfba65d1387776cdbe257cb8e75558cb8b32d

SHA256
c352b04efce937bf0561f7138e65c99985e0bee0f5d038c13c3b0a89ce761b0f

SHA512
7dd4481a80e70995b397e6f064cbd58d684bfb07eaffbdc25396b385f60186d65085338f32cccc9c0a7a80027de44b1685ef534ba3121c9a6225b1013f5c3461

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.raz

Filesize
15KB

MD5
97fd3fbc73774938cf10ff01e3f77996

SHA1
f401afd1edb840a46e20c258ec4406c014e57a73

SHA256
b6e84ad17e843cf4107921d2dbbd2989eb949d0194236289425216d133680942

SHA512
f5ed258561fcb5e656405e70ce46c41afca05efc8edd0d6248333a8acbd7d95a5b6e04be73603a149d050fc7f0123680fa7a5cf38ad2900bddf5720cbafd6857

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000005.log.raz

Filesize
16B

MD5
7eeda0833700fa0bf910718f255907ec

SHA1
04c0148f93242e2c6a5ceaf3227a07c1addcbcb2

SHA256
1238eaf1b606f96ba3eb836ad80e529090cdc91cd6bf5661cd0ef40604d8613c

SHA512
e4c860c81eb101c5e19d38b358a7188c1a55a2514a9a4e170e42820bb6ded40eb25bd90c9f782661b2f12f0a282fc9ecbe9366db8427486861c908cccc71684e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YQ90JXIE\desktop.ini.raz

Filesize
80B

MD5
bf197ece5bd954cd2824c94e622d2c9a

SHA1
18898775eb11fe75405c3642a4126c4cb062a8a5

SHA256
1ade1646b99a5c516d2bdea29ca59d08de02eb09117e8cbfcc1a938a8b52ec73

SHA512
345b07d141628b493a5ff9867fc0efb7e49049d8e2a293af9a40f1bbe1c05040e09e83aee8649b4ba9f7a084c313467ad59e6e685d2331a6cece1fc706bef829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.raz

Filesize
5KB

MD5
f1d2bf1f1ed163e63ea4c920185aa6f0

SHA1
0e03253134cde5062122a3105bc1e41f6bce8648

SHA256
b4119f7a9bc52187771f2f446b51fa33d3ed1391543c73bcffdb23195212c4dc

SHA512
01391ea12120b22188c1c5e7d7ce630d73192434b8b62e35f0707bbafc67b59dba408f8650a7205c93725109e8a71fd3f6e622d70f13984907c3a6add8271764

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.raz

Filesize
48KB

MD5
a326c3aafa8f9d4915cd28b00ba815f8

SHA1
0ec21d83caea6be96c3956715243fa7debdfd301

SHA256
be52256508fe51a027bd92b84ff31ba2491874f0e051ba865c20557cc86633f4

SHA512
41c7b1062fcca99d948623d102ef8153b35a0717d9055c17e73a81cc51e89e1cea11f6504ce9b13916624fc1944f20eba65661643445fedfbe8c7e5d51387b6b

Download Submit
C:\Users\Admin\Pictures\README.txt.raz

Filesize
1KB

MD5
7fbe394129a8ac61140ee4716ea2aecc

SHA1
0848ce346758ffb2efaa58515ac15bb23207384d

SHA256
b7addcde4e299e13e04bd51ac40b96ee9033ff473239404724104e7f9bc6c5b0

SHA512
3cf9d156ba4ebb9cb157e641ae915a93069d7502d7254ea22a8c4b7585e581e0ab81cd8e1b2027a099b0e60dadabbcb43e692f171c1642d4e049b57ae4f5c7a8

Download Submit
C:\Users\Admin\Videos\README.txt

Filesize
1KB

MD5
20af4f9fe77c9ebbc2c7f3ac10f04aaa

SHA1
cd1f12174fdc9de2d2a7808c9f661009d1a13d3d

SHA256
35158fd61ef5aabbf00aa2396f67679a5e2f83090794b2e9937f4ac1d0afe475

SHA512
e6b65a9b021d42ad011a6ec663cbf5a04a2bdf3726b61e3a5b547a2400b426d9e8f59034f997d699f896134f7995e10fc42f79c3b1fdac56d5db94bbd9341d36

Download Submit
C:\Windows\Media\Delta\Desktop.ini.raz

Filesize
1KB

MD5
7abf54541ab833a97af790ce5c6c3559

SHA1
03c3fcc65dd5579d07fd049974d2f1f8c1a223eb

SHA256
d6be6255819212eddba43f1d28e1adfe154470c879fd82ee0ab263d5609337a9

SHA512
03a4b66c88414992f1eed3a3b88fbbecb552ed3a6fb0afe9ee5177e3eef3d1c8ad65a01e03e6f62a941d5bd89be437807a805531604ee4264bc31ec159d4ec2b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif.raz

Filesize
64B

MD5
ad4d112bc6c368cfeee8df170594f55c

SHA1
9fcddddabfc0e5f2159ee55c80645af1841ee40b

SHA256
002f7855805b012a80c55a9dcbdff822b0d6c4dad09b3e7566218be2ee675b04

SHA512
99b3309d94f2988aea215dac3abe609e27aa4f0e990ffe1f36d15cf4dae65e6fe21119f942d6014c1297f29dcdc40fe1d8c98122be2f737f60f94bb233b5ca12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.raz

Filesize
80B

MD5
53a865be267dfd912edd0c5d09f480ea

SHA1
0cd1e5424fd28b4b67083d30b94814cfbb0faab6

SHA256
7fc78fc5412926c0734a0e220e76e2c86eae5165c1b17df4b9441e80e37e0c83

SHA512
6ecf39cc2725b9d371bd750a4333d2204b3b7b93f767461ab36dae50c3d7ff8fb1aece575fd1f548c52ab75ea78cb31e78f3b2cb4a921436fa1b006cc7ff5e9d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.raz

Filesize
80B

MD5
7a21cebf950ae63f6f385d31ea4d63af

SHA1
68a1fd704cfbe0285a1f5ce388684b0e454c55de

SHA256
7ac3f0f9325409fdbe8aee28b9fcd7ca44173f15d9d4d7aaf8e921f7003943a2

SHA512
92027a53e65afd7b8029d3d58613265e2090fc6ffff45f4783f423f71bc1d25c86a2e7e93e24eb13e3985f7597def5ad4884d99acca9f61b9e13f7c69ea7d53c

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\DropSqlPersistenceProviderLogic.sql.raz

Filesize
2KB

MD5
fcf20b025076ceb4c1b49be26d95e0fc

SHA1
b5a534b891218e0d0755d265cd79553c7e9e7d7a

SHA256
b0fcda3485ae659fd27f75dde51d31ad269c2ab482ecdda572b5d1d68e077c4c

SHA512
8b4bbf9455bc9180ca11bf83331b4b28541278a72f794032efe26ffb4efc9a6c9dcd2f8f05382f6d19611339d65b66f853cf29b5a3aa280ff39713f271669fdf

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderLogic.sql.raz

Filesize
13KB

MD5
5f81798c9ce0f5d5aa40eda244700848

SHA1
56b416d8894cc5757ebd354974ad2ca76bd5cc76

SHA256
1de9393190c5098e534908c4d90e890d15078693b76ba512e16b17d7da7a67d2

SHA512
bd245bf8ad4e169661239c665cbe1996df6090c06f9cb8a9443b8461e7a0ddc89da34354993099894794455f7a3cd4ffc9dc04e418f57cb54c03ab5be4f09987

Download Submit
C:\Windows\PLA\Reports\it-IT\Report.System.NetTrace.xml.raz

Filesize
80B

MD5
1c7fe43498d50303987f0d5789fe88ab

SHA1
86e3bf9ec87a73b0f4b9fca9f94fe7264ed6ba2f

SHA256
eb23afa2dee82394af92f585fd453c2d8882bf399b33cc6cd0a79a5ff2db0596

SHA512
67ab1a9d70cd132604fe0a9f1f578ffaf5b35cd171626d7067ff410841af2032d3ad9731817dec88985556f5c21daacc53250fd2c6ea4c6fe43a550269966c60

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini.raz

Filesize
160B

MD5
54f8ec70f59c99a6137330d4f49cd6c4

SHA1
0987a99f5cb1d9b334490ff6fa41876ceeff21d7

SHA256
db0b85bd39da1dd05c8508a9b30aaf90dab8f0f86f45e3b8e352e4f7bafdb894

SHA512
4e48dc43a5d16c35390325ea0fbf4089d0cf87db6124c19439be71ecf1291ed1212c378eb973354e05ea158a8615dd2ccb17201658b2ae0ca5d6dbb16cdc2907

Download Submit
C:\Windows\System32\perfh009.dat.raz

Filesize
646KB

MD5
037846a9be991e21a9aba1292133ea0f

SHA1
d2b058bafddd6f81d2b14c167641d20d42bcd9ad

SHA256
d8b67956efef5bd10f15df0b93ebf09f288898db7f4a7ab372ff7d5e74f8b3b8

SHA512
d623bcf26eb7b1af04265996e5cf100d204dc34d27f2d957cc4c901da5b549566426144d1021e20df01c90aa26192f27281c4ec588b423df0d3b6c23aa189fb7

Download Submit
C:\Windows\inf\.NET CLR Data\0410\_DataPerfCounters_D.ini.raz

Filesize
48B

MD5
d456724416a3e8ad24ac83de35cbcc68

SHA1
14edd6ca92e5d9ddb4a169f51608dab7b9568fd3

SHA256
1c9419bb39e1761076415aa04a80736f88ae49c594f78d3a9f3a7470280e10d6

SHA512
e74ae3a3520e324e19a69850747b1b5847f024fb363e64a2b1cfeede756ca7ec4912fa2fa48d1d769a41ed5b1e99756963fbc218e52c7c7a76b2f34f5635eec0

Download Submit
C:\Windows\inf\.NET CLR Networking 4.0.0.0\0008\_Networkingperfcounters.ini.raz

Filesize
162KB

MD5
21e574f5ef6c58ad614c64ed317ee8ff

SHA1
3eae8fcb8811e93c345178419e4e3a5feefcec0d

SHA256
57cbf4ea02e112d35116fb78adc0a6044455a20d5df7da5b544b8c9a0261b1d8

SHA512
0984cde282b01cabbfca03657333c78b350bc01ea4c8705115244fbe2b54bdb14e2248a44cd4018c2a43418febc52ac55d05a250905ac68cb370e2dae592c42a

Download Submit
C:\Windows\inf\.NET CLR Networking\0410\_Networkingperfcounters_D.ini.raz

Filesize
48B

MD5
3b77a6fc468c1b00260300a4945eed67

SHA1
6a46c786c8292f83263c452ad347910d59f11da6

SHA256
0e8728372204bcef99d09b657503b825b575a1c6ac690769de4944e7d59fc5b2

SHA512
3495d5c196607e0fd2a50b327344e0a8f7cb12c98697be18a768bd2df32a2a37b28410bb029bae9f8cfbea65f5265e3a11d4f7e77beb7dc3546672dd6acf16a0

Download Submit
C:\Windows\inf\.NET Data Provider for Oracle\0410\_DataOracleClientPerfCounters_shared12_neutral_D.ini.raz

Filesize
80B

MD5
624e1e75e99df2f21d3c10bfcc9df9b4

SHA1
2b09d802bcf069fa0fa02e484416aea78f106594

SHA256
09e3be56b724dca554b69cb0962bb1d13b940336adebc68ca19d8b72077b6f7a

SHA512
0bb659d9972c5c40330cb0a8b66d5bdfd564bb477e2e8c7b7e32ad24a3cf7e47544c3ce8ea10d0968c291e614e7f6a986dd01136f90050bb62688a012a164e43

Download Submit
C:\Windows\inf\.NET Data Provider for SqlServer\0410\_dataperfcounters_shared12_neutral_D.ini.raz

Filesize
64B

MD5
62957fd7a6b540444706c2e9f3bc7fe1

SHA1
8025feec680834c45ab42eab8c6b405ccb8cfc9a

SHA256
1c73bfd421c83468f07114d3fbfcc7d15a94cb9deba8a1bd091d529ed11a3ab4

SHA512
65a594277e0a4873c6233d96e1d504b71cf288c01290adf11b178e2e97ecba6b5260eb2d41fe531fde2e6e0e646cbd840aedc502b66d7b1ec16889064a07201e

Download Submit
C:\Windows\inf\.NETFramework\0410\corperfmonsymbols_D.ini.raz

Filesize
48B

MD5
d93661036f12094db9407a12639d233f

SHA1
eb1a40ce38f186705f38c56ccbdf6542a94c187a

SHA256
942d3b34f49dcab4a60e8e59ee269e6eee9eb95d93649f4d08f2703eccd3b7a4

SHA512
812d99c0d1153db3410ca81ee30011821fd3c8ef4b0ae91d36e00ee2e0d3fceef4dc7dd9809de83029794bcf3d399240bf247144becebb6cbf7b75c3a9f63573

Download Submit
C:\Windows\inf\ASP.NET\0007\aspnet_perf2.ini.raz

Filesize
972KB

MD5
62de0c34ce30fca8640d9ceb9d7f1d12

SHA1
071a3693078144b5f9cd2917283aac713868e4f0

SHA256
48cb51f6da9ccac772f494f24354df429097e4212b21f0c47477a571f2570715

SHA512
869d18ad1dcdfc6b80777c50febc5cde8cc0635ee5c5bbe812e5fd43cc46c301045930733146391888488225d4c4fa0adebca602d6176decec149aec1a5d5557

Download Submit
C:\Windows\inf\ASP.NET_4.0.30319\0007\aspnet_perf.ini.raz

Filesize
974KB

MD5
444b1e3bef768a052836aba024c203e1

SHA1
ac59a5136da8071d5ce6df76e48caca0e05a0d2f

SHA256
d1bb34a7158dae95eb1c419b4b1623f0d4b54e70a5d0e0de638a9592b071aadb

SHA512
a51a30a4673fb20f85c25d2d003580660692eaeaa6a533f08207755a811905a2b8c8f3649cb3ca745b663bb66da3ff5bb040e03dfe3a62f9f510dfcf301cf4e9

Download Submit
C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\_TransactionBridgePerfCounters_D.ini.raz

Filesize
64B

MD5
2b61cc61a9e4f0b94d0dcbe8a4497a6b

SHA1
d338fc4150010b03ae52e69abc87927d9fd6d754

SHA256
8f8aa36ed4f28e068c1a145ce61e51e2cb35992f017c3592db2617dc338c9818

SHA512
0be7110a44c168f2c4d1672b906afc58f3c02c7f0618f651112316821c448ffb8181435c09c30901a0ae79ecc8b3a95da2dec086ed298daddad1014c978229ee

Download Submit
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\_TransactionBridgePerfCounters.ini.raz

Filesize
132KB

MD5
b789c2c56ebd852fb83e687e5b8e4708

SHA1
2dd51171586ff1be83cb43804b6882658aba1b0d

SHA256
af6b405496922dcb41f5c472d1676c49554796569b204f61bb37a7b1a20a16ca

SHA512
4d000d5f3485717bc55cc89c91ad0677ef626427812818223d3d390af23ac4ad4dff33e718696edcf3cc9c428d70db83fa88d37b92c4c0797cf580292d725cf8

Download Submit
C:\Windows\inf\PERFLIB\0411\perfc.dat.raz

Filesize
30KB

MD5
a301aedbe57c86e914dc7356ca851f9d

SHA1
2d7ccba79ae6111ace0c90eabef0407278312ce1

SHA256
51f81501591aa8938ef1581992bdefb2273bd156c2fc0e707f251ded48cc9b6c

SHA512
d8566b416e13437b22ce4d4ad006f54509ddc13d9c8c7ec819fd4006f2fd3f36042841940aea7d924020fc9888597cfb416d464d081f2224b1533466c33dbe4a

Download Submit
C:\Windows\inf\SMSvcHost 3.0.0.0\0410\_SMSvcHostPerfCounters_D.ini.raz

Filesize
48B

MD5
5d1b060ef9d796d32f213d69915082b1

SHA1
5118cdd906e57e9255a115d9ae2da316c6827997

SHA256
0ea9266ddbc2c228fd8b939cc3a57c99ad7ae46f9d6b36d11b0128e9cfb1cdb9

SHA512
c03aca6ba1dbfba548490d7ba98b86d58f874f426fc4e0da85c5f469a0f5ce88d751844a427bdaac23b3342e733d7b6b305b72288d947825843b946c4bd1f1de

Download Submit
C:\Windows\inf\SMSvcHost 4.0.0.0\0008\_SMSvcHostPerfCounters.ini.raz

Filesize
130KB

MD5
7149ccef33e825a78ce99e6f693cc25d

SHA1
308429483d4d852da3673151102d9d5ef0a61a15

SHA256
eb27f446c55f5d41f59c54da094d995cbfd4f98146a2f494339b31db943369e5

SHA512
6eb8d93c860b411abe6f3509c18b8be059ef2f3ba150ba343dd90b3e27176cebcd801cb556a1bc6b9e244d06d6537e371396fa7bf810b56e98a8e87657f2854f

Download Submit
C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\_ServiceModelEndpointPerfCounters_D.ini.raz

Filesize
64B

MD5
f6b1fd2ce100138b2a5df425ffc27a91

SHA1
00c707baf83f8bd1c8808b2d128fdd0ca6a80c08

SHA256
35299e1eb78d5b00afc789fd696ea61b06537d66835b326a777d58619f663d17

SHA512
dbcbb958cab13ca1cf873b38f22880aba5d6c9d1f554bab646f974ceeee15c74a608e8edd6143a9713740178f3669c4f52c9098875f202eb5b05f901313f20fc

Download Submit
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\_ServiceModelOperationPerfCounters_D.ini.raz

Filesize
64B

MD5
5fb715a20eb1b40fac31b1a422146200

SHA1
828a0c4e35a83d21f69dbac5447afe08e573c537

SHA256
5686b77f5a4beb29d4ef961c61fc01018ab811ca22e71dbfb7c710b9fe27f7e9

SHA512
7f7c5ccb4cfbe07cef70b423f054b2305ad544272c818cd48f480e87936068e87f3255cd852fc05e4546f2788353ab53e8fa4c979a8b7d0bd8d512cef86ea860

Download Submit
C:\Windows\inf\ServiceModelService 3.0.0.0\0410\_ServiceModelServicePerfCounters_D.ini.raz

Filesize
64B

MD5
d3e5ff30960ca10dc1edbe1c34e0c5fb

SHA1
c67bd1a67689a920d24a32d3137dd0711d320732

SHA256
dd75804a540984b11459e79bdeeac23bb3b98d91f417bef1baa501f6666e7c5f

SHA512
504d7e296bce28b045be124e9b3ef5be09df5fb36e3e8aa40bf8cd35c76c49b3165e75b6e67fcc313fdf50f4b3d467e8a5d9f2a2731748def9ee792e88defeec

Download Submit
C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\PerfCounters_D.ini.raz

Filesize
32B

MD5
4bb45da9de53ccc33b9fa694a389589e

SHA1
8ad1d506131995634b2e4767968221152c4f561e

SHA256
614dffce2bae8b2494f43d59749fd662759d4f61ed966e3f82fbd9107f5a736e

SHA512
b54ace9ec028c149af600701111b55a602598a2bc6293573570fbb61c9c8f513390d1da996443682b4e2709ebb5aea5173520f55715d94456dede537fc448a09

Download Submit
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0008\PerfCounters.ini.raz

Filesize
150KB

MD5
5683cf723e34ed9de9878b03dfb546d0

SHA1
eb52908031bea9db6ea3a1e4bff1502a2652e65e

SHA256
baa9c19172dec73ec70be8f0d7bed1ee7dfc1b516bb7b48d9f56c41711102325

SHA512
cab92dec509a25e65bdf1a4385b1a512bc39b93f14ae6494c805f694e244830907fd8f7be36e0eb510c44be5a5e36a868fef6fd44311bf1ebc1988ca21845bf1

Download Submit
C:\Windows\inf\aspnet_state\0007\aspnet_state_perf.ini.raz

Filesize
42KB

MD5
aa3a65bef6f9252400fc2475bd28916e

SHA1
1442ea1bd77a345f009ca2e3925f5ab3dffc6d1a

SHA256
e37ef23e0e9c8f08bf3dc194c84a723fc10115ae5b77e0cb3199553946b11096

SHA512
91a8290e19977263b1de1d0260c4cda0a41eda711e1fea44c0ec033e63d098d5bfd1b757a06620e1b32f0543ab33f6905c494bd1193d723b405c8245fd4c774e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads