0af088e71cd40a89584020f9cb5080c85b6e859bafd866710dadda6438d1cb74

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

razrusheniye.exe
Size

21KB
MD5

916b310031e147c6258f89b8727cdac8
SHA1

a16f36eccd471ce2c4cee9388949b7a648e3bacd
SHA256

0af088e71cd40a89584020f9cb5080c85b6e859bafd866710dadda6438d1cb74
SHA512

1197774e65e0e7251692395c5a58f466f5aa1eac6c908ba368622e73263172b2896f2575368499aad445ab0fc2129c43ae1385a5ee3adee1c4dd243d90d3d911
SSDEEP

384:m7EBb05b+XJoQgyksqKIHgwiKU+aouAGV9Rq2d:mzBQgHFiK3Gvg

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Videos\README.txt

Ransom Note

~~~ You became victim of the razrusheniye ransomware! ~~~. Using AES-256-CBC encryption, your databases, documents, photos and other important files have been encrypted! This means you will not be able to access them unless you decrypt them. See for yourself! Look at any file with the .raz extension and its content! You cannot recover these files yourself. That's not how cryptography works. Do not waste your time. Nobody can recover your files besides us! If you fulfil the following, you are eligible for a 50% discount! - You do NOT contact ANYONE about this incident. - You contact us in UNDER than 6 hours. We can decrypt these files, we can guarantee that your system will be just as new! Payment for the restoration of your system is $70 (with the 50% discount it's $35) We can restore your systems in less than 6 hours if you pay now. However, we will not decrypt your system if; - You go to police and report us. >>> If you report us AFTER restoration, we WILL attack you again!!! <<< Do not delete or modify encrypted files, it will cause problems when restoring your system! Send the personal ID to [email protected] via email. We will provide payment information, once payment is done, we will sent you a decryptor! If you do not pay, you will NEVER get your data back and sensitive information will be leaked online! By sensitive information we mean passwords, and similar! Q: How can i be sure you won't scam me? A: You can send us 3 files (not bigger than 3MB) and we will decrypt it, and send it back to you. You can then decide if you want to restore the rest by paying $70 (with the 50% discount its $35) >>> Your personal ID is: 4V8O-5AW2-T9Y3-M76Q-M9BC-4Z4Z-K7ZT-O2RX <<<

Emails

[email protected]

Signatures

Renames multiple (4325) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 31 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\fr-FR\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\ja-JP\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\es-ES\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\en-US\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\es-ES\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\en-US\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\it-IT\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\de-DE\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\gmreadme.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\de-DE\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\fr-FR\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\UMDF\ja-JP\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\etc\README.txt	razrusheniye.exe
File created	C:\Windows\System32\drivers\it-IT\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\drivers\en-US\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\README.txt	razrusheniye.exe

Boot or Logon Autostart Execution: Print Processors 1 TTPs 7 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
File created	C:\Windows\System32\spool\prtprocs\x64\de-DE\README.txt	razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\en-US\README.txt	razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\es-ES\README.txt	razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\fr-FR\README.txt	razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\it-IT\README.txt	razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\ja-JP\README.txt	razrusheniye.exe
File created	C:\Windows\System32\spool\prtprocs\x64\README.txt	razrusheniye.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\README.txt	razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.raz	razrusheniye.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt	razrusheniye.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_neutral_857ff0fa9c73850a\README.txt	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Continue.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremium\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\migwiz\en-US\README.txt	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\README.txt	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_neutral_c86d6d5c3810fc04\README.txt	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_neutral_77b02fd738dca150\README.txt	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HPF0450T.XML.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle002.inf_amd64_neutral_c7564163ba063094\Amd64\README.txt	razrusheniye.exe
File created	C:\Windows\System32\it-IT\Licenses\_Default\HomePremium\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_try_catch_finally.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\README.txt	razrusheniye.exe
File created	C:\Windows\System32\catroot2\edb006C8.log.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\README.txt	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumE\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_try_catch_finally.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\README.txt	razrusheniye.exe
File created	C:\Windows\System32\es-ES\lipeula.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\IME\shared\IMCCPHR.exe.raz	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_Language_Keywords.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\perfmon.exe.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\README.txt	razrusheniye.exe
File created	C:\Windows\System32\Setup\ja-JP\README.txt	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Switch.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremium\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\StarterE\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_jobs.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\Tasks\Microsoft\Windows\Media Center\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\migwiz\migfiles.dat.raz	razrusheniye.exe
File created	C:\Windows\System32\catroot2\edb006D0.log.raz	razrusheniye.exe
File created	C:\Windows\System32\cmdl32.exe.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\README.txt	razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\eval\HomeBasicN\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\_Default\StarterE\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\eval\Professional\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\en-US\Licenses\OEM\HomeBasic\README.txt	razrusheniye.exe
File created	C:\Windows\System32\fr-FR\Licenses\_Default\StarterN\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\ja-JP\Licenses\_Default\UltimateE\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\slmgr\0409\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_preference_variables.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\oobe\es-ES\privacy.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\it-IT\about_format.ps1xml.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_jobs.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\de-DE\Licenses\eval\Ultimate\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\Amd64\README.txt	razrusheniye.exe
File created	C:\Windows\System32\ftp.exe.raz	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_script_internationalization.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\label.exe.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-International-Core-DL\README.txt	razrusheniye.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\EnterpriseE\README.txt	razrusheniye.exe
File created	C:\Windows\System32\he-IL\README.txt	razrusheniye.exe
File created	C:\Windows\System32\ja-JP\Licenses\OEM\Enterprise\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\System32\wbem\xml\README.txt	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_If.help.txt.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicE\license.rtf.raz	razrusheniye.exe
File created	C:\Windows\SysWOW64\hu-HU\README.txt	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\ja-JP\about_CommonParameters.help.txt.raz	razrusheniye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dot4prt.inf_amd64_neutral_e7d3f62d0d4411db\README.txt	razrusheniye.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\README.txt	razrusheniye.exe
File created	C:\Program Files\Common Files\README.txt	razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\Bibliography\README.txt	razrusheniye.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\README.txt	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS.raz	razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.raz	razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml.raz	razrusheniye.exe
File created	C:\Program Files\7-Zip\Lang\ka.txt.raz	razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\gadget.xml.raz	razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.raz	razrusheniye.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\README.txt	razrusheniye.exe
File created	C:\Program Files\Windows Defender\MpCmdRun.exe.raz	razrusheniye.exe
File created	C:\Program Files\Windows Media Player\wmprph.exe.raz	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner.png.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\InactiveTabImageMask.bmp.raz	razrusheniye.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\PREVIEW.GIF.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png.raz	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\System\es-ES\README.txt	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6F.GIF.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_OFF.GIF.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WHITEBOX.JPG.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\README.txt	razrusheniye.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\HEADER.GIF.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_ON.GIF.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg.raz	razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\README.txt	razrusheniye.exe
File created	C:\Program Files\Java\jre7\bin\javaws.exe.raz	razrusheniye.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.raz	razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\README.txt	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\README.txt	razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\README.txt	razrusheniye.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml.raz	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\gadget.xml.raz	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css.raz	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\README.txt	razrusheniye.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\TAB_ON.GIF.raz	razrusheniye.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.raz	razrusheniye.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\README.txt	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_rest.png.raz	razrusheniye.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-3.png.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02074U.BMP.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21548_.GIF.raz	razrusheniye.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.raz	razrusheniye.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.raz	razrusheniye.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\README.txt	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME09.CSS.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageMask.bmp.raz	razrusheniye.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\0.png.raz	razrusheniye.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.raz	razrusheniye.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..es-drprov.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c05c459140be92bb\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-dims_31bf3856ad364e35_6.1.7600.16385_none_a95929d67c483764\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\44.png.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_dbe4b2e8beb29c0a\DropSqlPersistenceProviderLogic.sql.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-speechengine.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1877cd4137aea61d\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_933696535248bc29\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_6.1.7601.17514_none_b6cddd21f1df8715\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..datastore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e2f2f7914e6cda26\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_taskschedulersettings_31bf3856ad364e35_6.1.7600.16385_none_a6dff5711e0deb2d\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-wpd-busenumservice_31bf3856ad364e35_6.1.7600.16385_none_de47cc4f1a142cbc\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..eprovider.resources_31bf3856ad364e35_6.1.7600.16385_es-es_62efa0b0722e3ad0\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rasbase-rassstp_31bf3856ad364e35_6.1.7601.17514_none_f7f7b561fe8c0735\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-festival_31bf3856ad364e35_6.1.7600.16385_none_121f20b55f0bde68\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ieinstal.resources_31bf3856ad364e35_8.0.7600.16385_de-de_c79c5197f461fd45\README.txt	razrusheniye.exe
File created	C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1cdc1875b4725b23\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8618f8f77422454f\README.txt	razrusheniye.exe
File created	C:\Windows\inf\rdyboost\0411\ReadyBoostPerfCounters.ini.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-coreos_31bf3856ad364e35_6.1.7601.17514_none_83784bb654f0d178\system.ini.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..o-multi-dimensional_31bf3856ad364e35_6.1.7601.17514_none_7cccf04ebc91a1ac\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_job_details.help.txt.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft.grouppoli..mpleditor.resources_31bf3856ad364e35_6.1.7601.17514_es-es_eac4c02f4cc9dbe1\README.txt	razrusheniye.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe.raz	razrusheniye.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1049\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\msil_microsoft.windows.d..gprogress.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_d4c75fc727b5b229\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_6.1.7600.16385_none_2958d4a31d2ec64f\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_msbuild_b03f5f7f11d50a3a_6.1.7601.17514_none_558f74866ddb8017\README.txt	razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\README.txt	razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack.Resources\6.1.0.0_ja_31bf3856ad364e35\README.txt	razrusheniye.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Channels\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wcfcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_de-de_55ff8d63613ab435\_ServiceModelServicePerfCounters_D.ini.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_prnnr003.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_db4b76d11d3bef18\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-f..ger-utils.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1ef36752eab76554\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..peeradmin.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_444f9d0b0c1a6ce4\README.txt	razrusheniye.exe
File created	C:\Windows\Web\Wallpaper\Characters\img24.jpg.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9e5b45457e71d50c\Rules.System.Performance.xml.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ado15-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5cb1f9d3eae4d4aa\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_pt-pt_5a9ad8afc4494b64\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-w3svc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_58d860520ac16b37\w3ctrs.ini.raz	razrusheniye.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_8.0.7601.17514_none_96780994e42bbfd5\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wab-core.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b02e6588f8dfd610\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_circlass.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b4ec6091a219beae\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-soundrecorder_31bf3856ad364e35_6.1.7601.17514_none_fd2f4b124982e400\SoundRecorder.exe.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-win32k.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4bdc81fb6ae8749d\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\msil_loadmxf_31bf3856ad364e35_6.1.7600.16385_none_388de5065074b62c\loadmxf.exe.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\flower_m.png.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..executionprevention_31bf3856ad364e35_6.1.7600.16385_none_c9b9bfc685ed05d3\SystemPropertiesDataExecutionPrevention.exe.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-x..achviewer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_11eb49d7192aa595\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..n-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c2efa950f74ceb7b\README.txt	razrusheniye.exe
File created	C:\Windows\assembly\GAC_MSIL\System.WorkflowServices\3.5.0.0__31bf3856ad364e35\README.txt	razrusheniye.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Workflow.Com#\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_cpu.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f5ca3df851e52dbb\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..mostfiles.resources_31bf3856ad364e35_8.0.7600.16385_de-de_e46461da0fb83666\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\Windows User Account Control.wav.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_wiasa002.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_499baeb321ffb611\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mydocs.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6b9f9f9f704074f9\README.txt	razrusheniye.exe
File created	C:\Windows\Media\Landscape\Windows User Account Control.wav.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..tx-xinput.resources_31bf3856ad364e35_6.1.7600.16385_it-it_eaece8e561d0e46b\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-855_31bf3856ad364e35_6.1.7600.16385_none_2adcbc7eb4e3273f\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-packager.resources_31bf3856ad364e35_6.1.7600.16385_es-es_411aa9f4b09eb749\README.txt	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows User Account Control.wav.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-driververifier_31bf3856ad364e35_6.1.7600.16385_none_ba42313afe0efbbb\verifier.exe.raz	razrusheniye.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d158ae10876efd6d\library.js.raz	razrusheniye.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..anagement.resources_31bf3856ad364e35_6.1.7600.16385_it-it_af0bc6f7bc557aab\README.txt	razrusheniye.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	razrusheniye.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	razrusheniye.exe

C:\Users\Admin\AppData\Local\Temp\razrusheniye.exe
"C:\Users\Admin\AppData\Local\Temp\razrusheniye.exe"
1⤵
- Drops file in Drivers directory
- Boot or Logon Autostart Execution: Print Processors
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies system certificate store
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Print Processors

T1547.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.raz

Filesize
27KB

MD5
5718c7ad8af99eb8f6af62f7f6168aec

SHA1
97e9399828655078e2f83bc324eb69c331273276

SHA256
e64f0417326a9db6bc568bbbbc751ec733da178f773b036678961fa65a41b89c

SHA512
0e1539980760ecbd9528f8b02f4acefcf48a4585a0caed7f31f9ec266b992726047d786d8494998caed8a099b8c460f8f7eac28a0b3cad1387383dfb18112072

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.raz

Filesize
352B

MD5
f2bffc8cfe91c078e02d52453320e00a

SHA1
0f4a5f6fca31d3960250a9fb81b4f142f804ebaf

SHA256
8828678a8c456ff199c605a155e31463ac33ef2b0d4d32e38e02553fd857f240

SHA512
02cea77fcb0b44454b4d56bf48f0a9c8390877fc61ecd19199e5273a03cbfe4eb4c8822f7057d1fde8f39e1c5b8cc1e86b7b3242a80f2af79aa4b807f3d0da88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.raz

Filesize
224B

MD5
5f1d389f46c7c9788e65641483d94612

SHA1
f42fd271311af72a9ae2ac883cd5a7360c33c984

SHA256
9ed8482b85899bc88e25c856530e2a74f9ea06cdfec108f693027ff01e969d9d

SHA512
802492a27686d0ecc608f70a1976c4877ae0f9ac99970aedbda04c493a203a1230a6e53160d2e690e139bab30321ec546a71da8d269a2c19dc74d7694ae04c8a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.raz

Filesize
192B

MD5
23edd27dc35cc0a93d5d241654421b4b

SHA1
8097f77468b24222852d2d643b5f8900471baae0

SHA256
ebb92f6043a4299a8c6e5c31d52c7100799133e5e097f9049a7597814ca34c7b

SHA512
fb0aaa58e825eda9ed46dd733f775e9b22e28cdbe5175f5bb2e32d68a8807785a5caa74584e85f78d3fb45097ed3c8b2dd7a2a1457818154cc5d358c73019ab7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.raz

Filesize
512B

MD5
1bc0e53724b97a69d246746396bf180c

SHA1
4d2083e4d5c089e70715c5541d986a783256a95b

SHA256
a57b8630968b5f99e67eba893c6b15dd5d0f07c1930c3bb58931f26fbe791dbd

SHA512
5a2722a92faf51c879af27aa0c021f894760aa760a69bcbf229615cae8e07d08911f3b19f4044eeff164185aacd1aa4b75e15947c3a9e675cd8906690a11d286

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.raz

Filesize
1KB

MD5
0db749a379fa3d702da334f1c133f46f

SHA1
9cb96ae04a3a8a9e8925419677555daeaf5d1efb

SHA256
0928894c95de3d072879956bcf3dec799d4f3a8f4200d15a91f51a25b34a96e6

SHA512
edc43e4e30c4207f7e2adb03e3170cd419fa940b6ce241b1b217b1839fd825a22f3535d876e80648058b5f43bdafd5a1e02f559097920eee86d799d6423d8767

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.raz

Filesize
816B

MD5
dc91a3b79cecd967261be74a34ebeafa

SHA1
7366779e8896f985f0da889c9eeb2b4995e800e8

SHA256
e443da2b8d723e8bf9d11a68bcc31251cd18c93e299e959b98c2d3e19f133d71

SHA512
926b8e1766ee722cf5596168ac5630a9654338e181a975fea4e30e97203e95e5ca3197df63066ef22e37daefb46443d72dfe5cf383c5739c355ace6b226c993c

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css.raz

Filesize
19KB

MD5
0058a3ee6ab97f3a444207b2621bbc2f

SHA1
8cccc75f343c4ac57d09c25ca13b3b021aa52ae6

SHA256
af4a5cef858c1f06255dec22b8484890161f07e7789f65fe04278384c310e7a1

SHA512
287fcdc06980256ba54d1cc01fe33068ff8effe2c4ef18388eac6a2ea31dff4cd25c8897fb82363cf20eecc25f703d6c48497b9f63572b5ba18b25d90b4c3961

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.raz

Filesize
5KB

MD5
492477bd225baeff127af5730db8ad64

SHA1
108c2868e56023cd26cf9c554b3627c6828ec77c

SHA256
94145fbf96dd037511c1b7c58c4249fe2194ec4bda56cec4c9cc6060fea1f047

SHA512
f9e3a4bc3a542c0fc593f0dd48c0a7d8dabc978687009556513096241744dd064fda221c525935737ac70328b861e95af5abd81cfe494ba3a3ca6332d6c0f998

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.raz

Filesize
5KB

MD5
5208b296d16cab4f0346f3ff543ebb9d

SHA1
7b6f4e586246db61930f2246b6c9305578b946b9

SHA256
5dc020aa83e19366fe400bb8c028601b7a241feb2d14463326c0b0ad7290ea30

SHA512
6309e9c3c74c7c10ea7240db3d9d3df182f61fab2320c7a3520ef30441909db8b01fe1d9edcfbdc6ccd3cd5c40768cdfb0f4d43bbb43a4a74f486fb12cd33fae

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.raz

Filesize
4KB

MD5
3192b484753c91f251df14ef5bda1861

SHA1
f6fb517bb288917c7ce26d1753cea1f73af8015e

SHA256
dec3ba18e384a49e5c269c479a3241f53988569355ee544797077d3bf95e550f

SHA512
c980c8021979d5581641606387e4e0dc4dfe80dcb830d050feb8678523e94a86cccbfd16cfd9390e7379d34081519cbd9844d09d88246cc820bdfb03c70c678a

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.raz

Filesize
4KB

MD5
f1b2385713e4da5eeff32eee52bff7aa

SHA1
eb3108c8c4acefb82adbc1ac6e26fca99d6f3faf

SHA256
5d3dce06f2b6239b440607761c43b0cac3e761ba57885d396231a7d4dac5c8bf

SHA512
c300c8b0d81c8b6229d9073b31fbb0ed1313c7719f2945f9825ca5f20419dd1058d7f2d36356128059f660a71b458d1a4f678155ba89894efb01397106ff013b

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.raz

Filesize
5KB

MD5
a6d9b18991aaaf3aa5edde89fd89f859

SHA1
b52384384d927b5979bd9a50050f4a72fdee8879

SHA256
9eff833c1a8858a9afc0f3db145a18d24b6e1906b2f71039f5fcf1cfbb0d7dec

SHA512
24432a2074c3b911538b345d55bce1e7f890612fd68bc8f7332953b143ac24c15fb91616a773a2bc8e3f989da8e1d3313e8175b4ae9d10e9df04860e85bc4477

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.raz

Filesize
5KB

MD5
ac6ca1f45aa3f85baff563659790aa42

SHA1
883898fe54a05f51592d81305d332f44876c29db

SHA256
b8430455774e80e3b61b3aebb36242626b5dad9e46b8272ae4b6c1a5b015a6fe

SHA512
3552566ec1376ca87a15449d06d7e77211dd65df8e9f97e18c346bfaa8fc61226f75bda47dbedad5ddcbd8c837e4c98c9b9e9c845e41fa451930cb125990eb69

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.raz

Filesize
4KB

MD5
17bf3db186068a33333dea6fc92d6f99

SHA1
1d5d6554dd3449a86ed732ca2048741fc008e858

SHA256
ee026f8f92fcc41b74130552083524e80f975df27971403f72b658913e095963

SHA512
8cfb58ad4165cd4ae4f8b67265f61ab4bc4771776af7a8c374e4e54ba1eee5ef8761c6a40d2d8b959f0f590203d351b4f78b14c28d32336baac8e48c685cdb9d

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.raz

Filesize
3KB

MD5
b562c7f21b9d99324d8944d6726a528a

SHA1
c0e8daec24869ef2a260120c998649f87452b87f

SHA256
b2e3ce78e9379794f0ea736ef98da48fd20217cd63c87f854dcdc2227f1d48f9

SHA512
1a98169566c40ae0d8a34c028838da5123ca3fb2c811a1a2a33af1a58b73275d7bea017a5196cafae3902240e483386a097171b1ba3f5cf41882c886963f7e4a

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.raz

Filesize
4KB

MD5
4f54fb71cee627caa121f359a2eb5fe0

SHA1
44d7d5418bbd6beb421ce27851b697623ba04aca

SHA256
4249f1413f88f3c69a85ed97496f5a065d6e8bd91bb666b17c1fde41169d5bfd

SHA512
f64ab475025ef4b38d37979277e0254aba07383e68612878a575c49d52744f8d55581b2e5d2365625a0ae7eb7ec43831200a255719f2ffd4ffc688d96a62bb1f

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.raz

Filesize
3KB

MD5
d1aa50bbc3035657654d019c47828c47

SHA1
048b82168172bf731ef85a6d0b570c4628e10d28

SHA256
214ef93fb16c2e8921aee831b180273549a19addbd7b377eb7a19308a986a9d1

SHA512
b02216bc3631c05a573d782c293d056ed48ae0700d3336d3861f6b596d5ac6960b372319ef57abc3b15c1a9a1103a72528b3b0b28a88d6f771553ff9e3df686d

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.raz

Filesize
4KB

MD5
cbc556e91f2fcd0bae8c8a1e4954a425

SHA1
e895f7a9f732c6af0619599346cd911249338b26

SHA256
20c6a4973c9d9919ce0a0a41fec0ede4b5c7d09a0d87b450936238586699e213

SHA512
115bcefc88157d317176070d3af0d353ed84a39b1451c422923c91d7b4ecf9111daf5d2c1520821818cad43315b8f5346242c0e47de5493eeea7a4d297c1ede7

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.raz

Filesize
3KB

MD5
67095ca0517e6ed56beb291d87b30c5f

SHA1
50c44649705317db563bbc74f139d7dfe0ca9ee0

SHA256
45ac1a8bcac321ad69014cb9e1ef16579f7413d48841d48815894972064c45ef

SHA512
45f7a3c8fdf431e68b6ff628e43addf1b1bcb995b48294ed9ec0cc148d662e101b5db4cb598eaa1d157fba7c97bb76ccae0f1de35cc3d7901c3209541c5210f7

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.raz

Filesize
4KB

MD5
a46d2b508f978fac934e1bf2d9ffad69

SHA1
35e086f09cc592cc65d6527312258545a440949a

SHA256
0af0c468bf24dd1c7984b1bcc67896dc1f0363bafa49503baa100eaf31186c47

SHA512
021b053c281efe10832ff6d8718945637b6a79e5dfcf15cea68717603af0e62860fbd60996962a6b0b7f733168f99422835e3d02f4e4bd83be6c7a2b6e6c85bb

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.raz

Filesize
2KB

MD5
5b66c01fcbff9290a3badeb6639bfc9a

SHA1
b8f9bdb72efb779324925fbd56d3dd6c89d1d958

SHA256
e21acfdd9ebe8a54b20bd1b5ee2978fdbb8a217cf34b10a3178ab4583668ba2f

SHA512
67c9e1d350734c71f045f6b1801786caca005146c53e415c6302436bcd17952a158e288e454222bcb1ad7397a955e86a79a5e8c666e8ce72ae46d1a52f05db4c

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.raz

Filesize
2KB

MD5
d25e9a2d0df588c4be2b8d4b54a275cc

SHA1
3b5842f4b5153492a94e6adf90b71aac2799b822

SHA256
036695975dd139230886924806ff8796a43b7cc1cceaffab543fe16632f0fbe8

SHA512
c102a8e7b61c6012ab4ea2009901e111a0418e513a78abbb5ff2ae324ef9be6d828c62e1854e404e828b8c2f439314ec7bd80eecbb80c088d37014573f03671a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.raz

Filesize
12KB

MD5
f2aca1ce8f41c7e3c9e5523e59b720d4

SHA1
0d1ff7f72ac0d45352fb574707d979cb4a201d6d

SHA256
518f5a94a4dc3d7f048331e060e5e93ff0968dcddf82421fe50c68bd756cf24a

SHA512
6c6f6f3e20c12749815837d7b1021042a88a087c7dc014ca1ddbec1f33cb8a77ad1af412cff95f9acbe39756d11cc4ba139b2ad206a77fe2b85d2983dbdcaeac

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.raz

Filesize
8KB

MD5
b0efc7224135fca7208f431ab75e2bb7

SHA1
c462743ce893012b7f0b871d6b563910da970814

SHA256
3d8c5540780869936ecb2143524888ee4833c1719f691e90a25f0c0261ea585b

SHA512
bf2f09790156563d052162a5d4b8d7aaa803064ca2e6e704908c7dc8646dffc77e4d044cb156297e49043b4eba64e99b994bf89b77f7ab79388b00387d13688f

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.raz

Filesize
160B

MD5
47c674a109b02729b8f2387153068948

SHA1
3a060a9a1e103e195d59d941706a66e59de1976f

SHA256
5f0eb6e9fba4cb9ef5050597be9894410baa77269463a018ca4c5dfa71ff24f0

SHA512
10180c42ffeff549b561d82b84523af9bf1e0c809daabcc96bd9c3c6bbe3ffb46d7aae2a0f43ba6c4ec84a69e5f2c912f8e8fe2f2d75dc23d7e6b8f5407d6519

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.raz

Filesize
1KB

MD5
2c6be1301a4d41662781c4f8abb738d5

SHA1
c537082e08fa3acdf19b1c5a7b10acc89790a190

SHA256
f067eb4200bcfeaa1809837c493c62aa25a2605f96c1e299d21fd7b85057c5a8

SHA512
1e6ce7c73911b59fcef2573947acbe0b231d07854306af684245786c91f8f2953227d29bd5b286155f87fcced049f40f583e00e713c3b586c0360c8e7c88cf38

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.raz

Filesize
4KB

MD5
9a521e8c2d15d80a83c7d843cd6358f0

SHA1
bf1814646bef85fe5a5893b182111359687096fa

SHA256
a440dacb0a0eb549564950b04ea59780baf8bbf3cdb21a0b4ab9ebc6b0aa30b5

SHA512
0f7c42607990ca3df5684731f74a2a899f4581dd366351305e9867615e379544c6a0c53d01c1bb6a7e05467d567869f30017a28fb0ea346a8dfbf73310e522f1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.raz

Filesize
4KB

MD5
fdc236c29576f967b9f9690d36579640

SHA1
0c9852d328bc01f7870d95f006cf299ec2eb8726

SHA256
f201271abed3d67ee66267fea87da3854e5535b4d7e66287bb608b7bd0c241ee

SHA512
48b019d1787287f6635f9c33aca5e87ddeab8135f5a7c0cfe77d6220d3c525ec356f01689fbbe738fcdf296f8e95ae50d448ae21d49456db23f96983d38ce217

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.raz

Filesize
688B

MD5
7508654c7407f2532ceff704d8ea7b74

SHA1
a774479fe967c9b2e6f3ee07cc5ceba84d4d8108

SHA256
ace756b830af28ba1a323418ef3f900dfafe5b5689856f2e8a5cb6e6215b834c

SHA512
152bbfbf384048174eb5b6b46438ebef255a7bb1837eb425525e94518d7b3bd5a81359ecbf38e5a6f33d89527ebf662eb62a891b0e6e32d5bf40534e2faadb89

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
7ec9d2935f68fae883aeee7e5ef507d6

SHA1
c0c6314e99245eca1ba631f090b10136f78df662

SHA256
feb688c97a33fe4b130961165257efdb49da8c38daaea0eca3cfa432d3477b27

SHA512
0379b57684ce5e4ac355b5d971b45f90b5a1e374d3068b2a3c50b7d1e0ab1535c1ede17819d60c8234a37a8065cc3f25a15013ab0e179b5df04c153d504fa38d

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.raz

Filesize
17KB

MD5
82258b2ef3a6771b866545f153820ad3

SHA1
c5852d3791ac1d3168f7009bcc5998585502ced6

SHA256
76fe90c0343ba846f02e004d1e7da189ceca76c6e78f3c0e946e3ff164ba7f09

SHA512
c63556a9bdbbc92e189a8cea1de80f146a892bf9413b34e968360ad538d020f7462c806d211a4c4be598c5389c9fbf0e75e21f8b65ccbb10c743765202344cfc

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js.raz

Filesize
9KB

MD5
adba49b30e04d28e09557fc21a37899c

SHA1
cf5833c0397aa5b7539dd1a0af6f3c822a81fefd

SHA256
96f2e65399adc0852c41dbd2d2cbea9c9178ebc9237ae24cd6f18b5f81cf05eb

SHA512
a086b9e7d0b1ec6ed6f16ddcc377cbbcd37202ce3994a1f157ad2509315311d81f4f380478e464dc40610ce9aef5fbbe7aef952ac793e81f8956c040f0624a62

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.raz

Filesize
5KB

MD5
f0f36ad6b65894d8fe5f9195f63f5b8c

SHA1
57724748aacc32e13adf0c2f5e357cca56a2cd83

SHA256
f58d7a7c6fc22fb4e6d9af674592b08fd7517bbef58ad05a1fe38aa505af794e

SHA512
35682429e7dc567d7cf8c57ac0d15690c8aa8e493c683230e478316fe208f0b673a1069aff840813434ae3f85cbd405ef2a66d90b2655aa58a5396e1401dc546

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.raz

Filesize
65KB

MD5
7b1a824c9d80c25973028bbb8089f174

SHA1
da2e8d923bd8dcc5a8cf6c4df79a327d7e47c418

SHA256
818e759be619a26582c481315651657a1612abee1b142b06f8d8323302e719c0

SHA512
7e31b29321a541194847bf4965118b2fa3ab19d951f0076b18eda073f12e0bc3c051d159a98d8a6d02cd58ef02e97816e3becbe6127c3e2ea3712170344c9f55

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js.raz

Filesize
736B

MD5
40375851ece674f2685b1620484fb0c8

SHA1
01aaedb27b2a45e8d4f87c0461639096e3f3d0d5

SHA256
5e8f0f9178a03fa905acca38abe1d342189b516c3fbfd5359ed17a0fce59764d

SHA512
1689fe85c91018007e833fc59dcfe7b11537287ca453dba986b25a96d13cd545480a84f90b4362cab7d109ba58e39d14725a61365a96ebab58e470f83c03ec2b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.raz

Filesize
5KB

MD5
9e848d811f6b0ae922def23decec2f05

SHA1
f193cf0cf7113d504470d21d85e9c3de523747d1

SHA256
27bb5f8bb461c5d78424d05ba1515f582a76e26505d55f8fe5d6a2df7ee16481

SHA512
1e4ee656f8be33d4b38d8ac66b94d0b464a7c9163ee0a5b1825002535c15e2129f5f14094f3be080c57f1706eb26044377440f448393a32b4e5fb9b52222aa97

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.raz

Filesize
7KB

MD5
feaa5c7e093c65cb359858c047d9c6ae

SHA1
117951b3431784b218a0a5b778ccc32bab6521ae

SHA256
6a2fde062b4f1544a290c7a461a16441b5292d2f8808e2482d3cb178f7310098

SHA512
880f52779872eb80524701205ca6c79f4e3b5b9bf3b9b21e692823801229d603b604bf3482e9d315f1adc4c89e429816cfcbcc481dfcbb7fe0b1a7d9f5cf8073

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.raz

Filesize
4KB

MD5
3149b6cb3e9101a9703f2fe612064498

SHA1
3010678642616e43a13a4ee5dbbe5c5e72bc32c6

SHA256
eac13eeaba22cc39fa862fd50b91887aef9a68665c62a05ab176682de8eb9524

SHA512
d9b293298910b0fe6f5f53a162c64160f1f9f38bb91f3a4f169da0a60a10a49c0cab513781ce98188564df8a45797eae23330ec190f73192461f7126ec27c15d

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.raz

Filesize
5KB

MD5
9555ec5e773c8d08d4a167aa222aa7e5

SHA1
b7d489585baf6a4859675a9954b5dfb36991f789

SHA256
4af08d8972ce182cfbb996840b9b87ce74107e16eafad51b67c9fef4b4a022f3

SHA512
cb7f2921a39ec4e4664cad3baa0948e7fd7bd0419e4b5868c68c0971a7bcdf372ba90f9b524a24f692dd126291db71e21c96638cda86c652d2a6c489727cc855

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.raz

Filesize
2KB

MD5
dd89760cc3aafc867ecc6464c08d9890

SHA1
8ed615be49eee7268ab9a3d5bcda050c68b9afeb

SHA256
94c1896a4f5eb67e65eab61b4aad47215a5acad689fd9ebc99c6734f261bd6b7

SHA512
7c13d4bc399b00f97acd5799f09057f0cf7eb9c49e5ca935e9f944f7864b9ef67ad5e2bb84a59248863bcb03ae317c9df100ffe3997a4afba0b4b9230d99696e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.raz

Filesize
2KB

MD5
66a0ba0a31ed01f731af35253bc3dd0b

SHA1
ef6556badfb43d016e9a59f15ffdb5424fd392f3

SHA256
ac4f829537fe95fa818708bbb2879dcc2c06053ff70d751089cd7b31698445fd

SHA512
6948325f6aa3949979ff56780a82fa363e20f90c037c7339694a67c141599bf03ab54241ab89b3b7795dabaf733967041922f2d84e4efd4d3db4be094ae5f4de

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
c7b0379d1f5b0de357cf6bd8e40d2351

SHA1
7d25177400b0cdf28fccc105d9690a1c26c43cde

SHA256
2e9933ec3128389aa8c89d67606117fbc16152a025d9d9469df7926542682ded

SHA512
ae22815a2ba1a036ad5ae668c53a53a9f09b929c3e3aef6f1dcd7dcc7bcc72309ecce33e17097c4b8b381524b46e6696f86b2fb28c3d5843c3bd8a45ad20376b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.raz

Filesize
5KB

MD5
19679a15bd0ac6de7effd10a7fb9ab9e

SHA1
13b795111c4ae7e003434eaa3f3677fc819dc592

SHA256
f055e1e5932bf858cd01f358a8d706effed766031c23fd987359b5542903507b

SHA512
4397a2be78c2f27371377b927aa976d67d282fd00148f3306f6a817a7f04cef910a69987cf31bf42193fbabf85c97aae05925b56941be1114438f60584cafd6a

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.raz

Filesize
6KB

MD5
59a152701b0557deff375f4b65cb703a

SHA1
e34640712430d4127967def10ebc818912a161bb

SHA256
20d1c50f3ccff88dd6eedd89704e480d3f69d1de240934ad325a110a1b297311

SHA512
5e9f0e2b6fe2b853b204dc294f06f20067dfd81a87fda103f771fb65c0f414d41c582e39379b3d0e6247fc4f213c0a52d4210384c374aba6f804ddeb7870da38

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.raz

Filesize
1KB

MD5
802023af583819d87b89191456c8acdc

SHA1
7fba2cb34e7f4a14b38aadcdf6d9eba6730e5a78

SHA256
d863ebf9be4a6c0fd39f93b56a1c64d458a865c74013cddd2845e5c2691d1944

SHA512
bbab1c609fca08e55f79a7e42f389e859e4657d7a2769e3167dc864044fe7423053bf8aab7dd7255444fd9a9df08288e0c411e3e7e9025fd97f4ed2cd72d2755

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.raz

Filesize
4KB

MD5
67d3dd4f124d8802ae62a18134187ee5

SHA1
ebe9c996eac326403b63a483e2e1906c0c7da38b

SHA256
8986209b574fbd8fffc5bfe8ac4e3a9ab9d412746065824779bbc751bc2aacef

SHA512
8072ade3afb76cae11a3f7eeeff18dc428deb164d8f1154018a453a4fe0ae2167ee50461db0f4fb5547c061ed037ecbd1ff1cbf8d037f61ad6eba14903c94905

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.raz

Filesize
5KB

MD5
8f840fe9905942d99afeb68a68a66431

SHA1
0bf5ccd9cdca64c0aa039c53442e49db44293e5f

SHA256
f17af9a953a42a2d03c76d69126f82a293a77302493eef4ed0bd078773db543b

SHA512
2e6c29f8daa59c0d239407b016f68a5b6d41e3337c958721ade12b1d26a8626d83d895b9b186256933f2fdb5f34ce1c833770a38c8cf7465f85294c08fa04cbb

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.raz

Filesize
5KB

MD5
22bee38733cc29369b1f1a4e93bb0384

SHA1
39b335c7b829b19dfb77d68e3c8d6a36c5d0a85a

SHA256
5c0c3dbe6d82e4ecd58b87bca7a197907b48fcc22a090679254fa33bf39f3205

SHA512
2fd1046d9e326f9b8a36296e97275439566d1bbfdc730eba8aa5aa2dd8e68a277a50396f717c6a597f049ed08626d56a7200e6d480a9657ca6c396f151430bbf

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.raz

Filesize
3KB

MD5
461edb3ce4334d4303db2a95bb986115

SHA1
c1a9918a26ca636a58e9ea339a87f27a2d46b344

SHA256
cf2d2010244794ff779d5b7d64dc5487d089c6d1a327f55059a9bada94cd9f63

SHA512
671ce41ae43321eb525ba37a5f9aaf51b8557456f59add17f6a42ce7caf4d339401afbd24fcb9447743d567771f360400f8cb96b4061519a1a0ef2937020b70e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.raz

Filesize
976B

MD5
f5c4d6e33d2ad2bffa801934bc109c3d

SHA1
7e52f2311b7b4d0e65bd5a1372a13fc2f1ae5f2c

SHA256
1750dfae2b5e567ba0d854e9645970cde76d9f0769e1e65b9a2a166ce4384af9

SHA512
82f92fa75f41b8552f48e8454e21d20977eb70782bda4694f4d0a4f554730df031b3fac703de95bab7322681c5a6f1b1632422d2f5aa564ef8495aca541126ba

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.raz

Filesize
9KB

MD5
2f2a925491ff15decdbecd88f1a1a6d2

SHA1
36a6faf4e7dec455a6da605771737b7049a60d8b

SHA256
443f74732e6fe99276e290c8797dd9258f9f0de2e2ee08f735946b3bbf8f50ad

SHA512
07a6a3cd4bd9c5cea64f552d96c55dcb0ce4e9edd41416f20b718936d2d8a30d6924703e466fcf3d80e9e8b290ad03291828200cd18fa6563e709715a768a73c

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.raz

Filesize
24KB

MD5
e118eb01ee0ea847cd104e642e08aab3

SHA1
777dd6f8c080a59369cbec30ca65727f63c086d6

SHA256
3299ead84ae7155488b8dd259d8b0fa5683ab256360c8fe1bcc79665ed050fba

SHA512
43d41a923e0b5190398abcbf2e68a5959501c8541f3137cf7d1f920d4fe3e77fae26bd52a600507cd0ed3a16b5f45426a34c2813586a0aad44891f30262196cb

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.raz

Filesize
1KB

MD5
2efb37ada68011c9b8074c63f5f4ecbf

SHA1
32e4f90a7de3009f6ca2698fef190e7c3e181cb1

SHA256
d64f3664dcaf0e1fb9ae8e47577dd0795e2bb112c5137ac538045957d2eb810f

SHA512
3d237ec4bcf18208e045499ad9999ff71b333773aca857650245a09df507d871f26c9a0c8489c5262e86392b77cd919f7385d599698ef5d3d4fd86dd99d83588

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.raz

Filesize
42KB

MD5
eb77fcada65f0859b9f14dec0e502252

SHA1
c6e278ba00717e03dd0fc59d1d79d8ef8f751f51

SHA256
06bed827fb3e920a9daa8244bdd8144e2659fa35569878f158a39358264e256d

SHA512
e6b068ddd383490426229c495c48c9a6d9fede315df955bac0df264f0987f4b453daeb448e3375b57a88a746efb44aa02ea9f5abf5bf64b9db1fa8e7db8b1e6b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.raz

Filesize
14KB

MD5
4071de94d8ec0e2a59cec473cb4e7d64

SHA1
afd37409b9d1d57046e5a721e69766a681733035

SHA256
6c8ebfcd447da3e58463ced038db8e663edc507d60a2b51cf42e8176c0ab859a

SHA512
c0840cc38027fc9e34ec656e6d957b0c59950c245fc5663f361a3501428a0b9d571903846735e76b0bc6b7a3e46cd2468758cf3a5e74262e9b38428c99a902dc

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.raz

Filesize
56KB

MD5
3dc7caa55c8529a690a239a73c6f9e33

SHA1
ee62ae02fe9d394b587ef766eeb2f80626b745f4

SHA256
32e157428b790cb2bc8b907666cc8cf0f2ede39fddc791b5d3c417f8f6503a16

SHA512
04639064f45667614e2487b33f9f21f3af91188a6568a36cf1d4f93e6ee0d768c8ae615ededc8abe6b8fc4768f953d91c868e424ac6932a032e2a338c29cce06

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.raz

Filesize
132KB

MD5
715f3445fddf9c171d738e87d9bafb77

SHA1
39b509d324904a96ec6ab915494b30899fd616a9

SHA256
65651dd7be8585c139f63679a3946d40b82f1ca1f60f2e7d432c9db6ce8fcb62

SHA512
3f26b161e07fcd99a307b9cab0117fdcae3e50b6af36470d00085fa9573545535c1f37f6c579a08f71c79f14d96ca45f5580209f29352587c0c308af8d4b661e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.raz

Filesize
8KB

MD5
261ba840082678e4429325d48195bd81

SHA1
b82f4932f854fbbcf8f8ebb7ec7fceadfd392216

SHA256
2c12328a84b757bec08ce4eed4938a5cc24189baa7c5fb1d4cdab99b63c88a58

SHA512
e249b5c02e6f2cb9cf9456da2c4d2aea4f3c8171cb0cec2abb1f6883aaed9d16afeba152bc6613af426eb365d1d5de03e809fdb55f152530a33249201f176dd4

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.raz

Filesize
15KB

MD5
f4ef5d2adfbdad87fe5b94dc73aae937

SHA1
6d244d93cb916f9f36523ab8df01ba6676f16f10

SHA256
b0099e26545ca7f5805d3c4bf3f93263cf085938b46eecdccbbab586abc752c9

SHA512
1ae85e864432b9965d303cbba099248ba8397be07e000d0d4b9769f8f655e827314a878b568677f7d07159c7f6ad41542d10ed0658dcbdcbe9ec33a1fef29e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YPLB435F\desktop.ini.raz

Filesize
80B

MD5
f9f117ec1beee29d42bed3430d169995

SHA1
303463ece1f8d3fa51fe603beb0639e8bc2c4986

SHA256
7235de732012006884199e2067a56b39faefb9d412374e79c3d8797487eff794

SHA512
66f2f09c830604a95a6753519f790e4e10813422914179c8a4afff9f7821f4b4c37960bf5eb96f5bd753bb88efc2a076b4795afa852c542cfb1dba17980efd3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.raz

Filesize
5KB

MD5
208fb03ddbe9cba262e840448f83bba6

SHA1
2d286830ca5c5fa825b21c8ce2385ff393b8fc09

SHA256
69483e7c19a602d611e1a0e9ccf9da9f01910c23b0562197e0825a35d799e1ff

SHA512
af94040db0c4255689b3d895bafb72ad4da98561dd63a921b7ee169b5a4e993a3bd195d2feff33a612c6d24a26b171af6691331617cfee633e70f18b8607a218

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1bogwdvw.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.raz

Filesize
48KB

MD5
f3676c3bdb21b29be1c20ac26059801b

SHA1
bdc8b2f9c42dce5bd1543175fb3d0c491cf718c0

SHA256
802c75c8e94195642cf7a263d77b92e39af6d3b0b7f0677a0ecb599dd0275932

SHA512
52ffbc6b464b800c2494d1fe472f51e0449a05142a07e3b085794b5f5c8035ab6da159db368014516b25fa5f1030f08363651c3e4887b8ecce9547bca43be2c5

Download Submit
C:\Users\Admin\Documents\SelectTrace.xlsx.raz

Filesize
10KB

MD5
beb8f906403894058fc3fc82fea931ae

SHA1
7fc0cf504d6508b236589d9f32a7979f9dafd661

SHA256
77d2074987b61221575c0d55eb4c78d3085d6c14121d4dd0443199e9f4612ee0

SHA512
40684e8c32acc0a2f8b8bef30c449d25672a98a3f77a613f2abf43c749e812ed7d17e84ce33ee7488ec9db91f329804a0d4232331aa8a3ee4988798a012e0ef0

Download Submit
C:\Users\Admin\Pictures\README.txt.raz

Filesize
1KB

MD5
e8bce72a8c641f8ceabf45e2d1882692

SHA1
33fe9a245829d33b4007d053c6a3ee077e638730

SHA256
1aa0f588084be7f7187e881809b16138bbdbe67031898677646518922e99a666

SHA512
32562b8849ef1834b9aecdb8fc41d9b1af6a04f8d76fc43244c43ee16e1dc66c21cf27b7b30d777738e64653403f1b423966cd1bd480e4e0fd70a72b73ec3ee3

Download Submit
C:\Users\Admin\Videos\README.txt

Filesize
1KB

MD5
53e1105952b674127fb4e34ac4a353b7

SHA1
4ed44709482ccb5c7a5547e06491333748444c54

SHA256
4d7572dcd1a5b7b6c77a0cc8f345345cc4b43770063eb570ab73439322e5b2c7

SHA512
13ea036853c18317e306f2b165fa42fc20300196aa95892ec1ec6fc3f7bb8f4d06a931cb85af193ad9c4d8b918a1a80fa79da560b0c82355ec14387592a00d8c

Download Submit
C:\Windows\Media\Delta\Desktop.ini.raz

Filesize
1KB

MD5
84c65ecbac7471558c5d1a729e27859e

SHA1
a8a37c1700cda1c16eb30aa5c471e0859e1b2a4d

SHA256
6fbd6f6baa58323286ede0cc8b6c30643ba3dde12088d0f5cd16995f3c3bd299

SHA512
e726963eff8a0af5c4eeae28f086d39740c71c255a00505c9b33c0ac2570ebe81001629f9e11325faf73f01b5e8dc733566ae59f7e5d48fd38418f0984d0b603

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif.raz

Filesize
64B

MD5
bad31c146c7efcd53b859071f2be1422

SHA1
5d8fca18a8e26ce43906e931f41e3a57a0cdf233

SHA256
2cc288fe2dbf54a06a3e3b7cc8f0e45120e16a85f3c8cf14aafca9a007aa3e11

SHA512
0b59e78112069e02d8fc6fe1833753579853a724a144ce8b6b85877f797e40993087e91af28b6df510250089f5cc6c0ee8cdcf05e845d1c7c4392b2fd9c0da75

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.raz

Filesize
80B

MD5
13ac5de99c9eb725ce43f70aa8720b3d

SHA1
9c16aaed8f7276a3501f1bc234dff45d3be95738

SHA256
e9bf81c384cb0b73cfebd84a4b4d34fdeb94f404e1231e697d3bbce09cd5b949

SHA512
6764bb01dab1d83cc3c07423032df6082374585f8f143335a48e899aab853dd0fd9a513116e90f7c76d717d0fddf4c5c050e6e5073350101a336d27d05e12b09

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.raz

Filesize
80B

MD5
2525d815642bf85421829feb9a8d726c

SHA1
f735e185dad0747e7a39682ea1f04c65c05c962d

SHA256
28dd6612e9998afb1f2d7257546972a00be31dcb0be65fac61b3d223066ecd91

SHA512
0cff9976be1cfe9b6929081cb97ad2c3ceeebeaa53840f1f8762a69146959e3ea312664989809a421a4ad59df686805f7b5ee678af87bab2000ca4b21cb89ed5

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\DropSqlPersistenceProviderLogic.sql.raz

Filesize
2KB

MD5
0ea2f2f631485f1a12b994f55f70c6ea

SHA1
0c43a3ecd9091d35470ded830d0d681fff68a172

SHA256
eef1b457e2ae008ecce58107d19f8b1ee3a56433035c1da6b55042fe4d476134

SHA512
275214574868b70ae145c102e8d837e3e5074b469c76dd35edc4cc97e415e2cd3d92d72dc7e172fa20a777fd489bf1c668a2a7249f1a6a55f23975b856439de8

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderLogic.sql.raz

Filesize
13KB

MD5
e6e9123b7f8d8a5a07bcc406cd8ffece

SHA1
bb6acc24b9ef6b99b2d3f3d86f751b6be897f330

SHA256
66aa468fd0b2a7ad409d83336ee09f4fd87973380d9ceedf008eca26127115c1

SHA512
6d84a7a05b0712779d27abe9db7243c02a01bd85c6181b5723cd5cb7e72c82b3319a17bf11a66ee54782e15e2bd5c70e0077c164a181ce502b84b099079b00b6

Download Submit
C:\Windows\PLA\Reports\it-IT\Report.System.NetTrace.xml.raz

Filesize
80B

MD5
6208afa3f1f05a6dc6edc3f9f6445c8d

SHA1
9880c8e87ca21ccb444ba9ee1509b6ba4e66db95

SHA256
de28d9de3a210b55375cbae16f05385d27fb32f2504fc1497ada9aa1ab5215c3

SHA512
a3136b05a2d5c507d9ce2a57eb1524a56665315f23f9605af803263ae065301f6b72819f9a5611362d7520cf12f2d53903b2f341fe47c35283390a2f9228bd73

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini.raz

Filesize
160B

MD5
97aaf8a2b2a25a03d0b9637dfed0b630

SHA1
9c6f4cd44f1e3df73efe189f12006a609a003881

SHA256
9ae3ff667a6a950f91d86a41500ac8834769843018e608c7327b68ec87a1653a

SHA512
306e0f595d0e144887928a6af81dbb279ca7ef83872dec225f8a2019717269a0f82dd48efc7f212881fe5cab3aa66e1989918e1335cf3202d38ec405cba9c943

Download Submit
C:\Windows\System32\perfh009.dat.raz

Filesize
646KB

MD5
f5074a3e4d3e48692dc4c52537e804d1

SHA1
6157a81a7c0ea56d66f9da5918ab2f69f59fb79c

SHA256
b896c136f25b1e5a3095f520cc2258f694d3a2e9c5db8a219cd5325992d347c0

SHA512
4b2e1d6b2bb68a1d03801b718521a5298bd5c28c19055977154318f2c35c5d4f7698a027bd30b0eea733a930c2067123b647ba6ecf3ac27ec4f508215543606e

Download Submit
C:\Windows\inf\.NET CLR Data\0410\_DataPerfCounters_D.ini.raz

Filesize
48B

MD5
b8911496f3c0d3c922109402434856b2

SHA1
c504ba465fdd693775c70d625d3171dc393be8b2

SHA256
ea7b5ce171c2a31a9e6be164b5ba0b384fbfa00f3756c22648562f7ef1d6aef6

SHA512
4598f32aef1ebacda2a8936b7443eaa683df81f611b3e09c323624fb2153f96efc1e1f11066e48c8adeb9a5c96c034303709104fbb1a8ec633d59b14d5946b88

Download Submit
C:\Windows\inf\.NET CLR Networking 4.0.0.0\0008\_Networkingperfcounters.ini.raz

Filesize
162KB

MD5
d50924e494213388faf48f4512f42949

SHA1
d23587fbd958ba316793d8cd34eb932596a207d6

SHA256
979b74a66a0384375009dc40df5fa7a1a369237e66166a603935034a24310c8a

SHA512
35920293cfbd7e894f1fe890c5c2cf0c1ca56dd996d0f76f3ca5aaa05f3ba1adbee8d23cdae562487776e5f9ad6febdce7e7a622fa7f07718e8ed570abe839ad

Download Submit
C:\Windows\inf\.NET CLR Networking\0410\_Networkingperfcounters_D.ini.raz

Filesize
48B

MD5
55b087462b9510acdc340f8352b99dfd

SHA1
5b5681b8068376a361096aaccb10bfce9cb643db

SHA256
a81ca91c32b19a851ada6d72455d88bd81ded980cc12fd4c8a65c58fb9c1cb9f

SHA512
b74d38ee990605d6b065991af3fa7a790b0d912a06d27475848fa18571e069bfd2a6a7f0a589ab4da746df024e3ebab84884b51b6d45bff041aae221c75773b8

Download Submit
C:\Windows\inf\.NET Data Provider for Oracle\0410\_DataOracleClientPerfCounters_shared12_neutral_D.ini.raz

Filesize
80B

MD5
f6fa4acb08a865573e4f501518a9b8ac

SHA1
239eb29e37f8fb89193c098ad8e004827356fef8

SHA256
31556be2d00389118a45de159f2da4a7134fe0fd9e8e9cc3748c2d3049898bf6

SHA512
7373b437e88f079bc488abeca2d87ddb7e476f4652117bfac10d0074a4253027b9f0bd8e46b5f99512ac9690eeea35f40ec46740f6b0626cb2888dc2bef422dd

Download Submit
C:\Windows\inf\.NET Data Provider for SqlServer\0410\_dataperfcounters_shared12_neutral_D.ini.raz

Filesize
64B

MD5
d88c9b757c0f6d381670023e1f49794b

SHA1
cd871e5bbefbdfa68150293386ec87563e6c7c72

SHA256
4d7075011a3def47d3f466daffdb0b7e643ffe91c1046245dfe79320d42fecc1

SHA512
bf140457c987878dbd8c25e9e021a3b225cced009ed39126563e6d9b5c25f4fcf97934b2470338588bdcfbfb7d4e06f244e9c05195d173013ba3378b0f322817

Download Submit
C:\Windows\inf\.NETFramework\0410\corperfmonsymbols_D.ini.raz

Filesize
48B

MD5
2fa4080bb3c240e56c9a8e6117e4a744

SHA1
328fe1f9df4bf949ac5e5faf91effd7863c9ffcc

SHA256
56a319067bd7172db081ea5040780805494a2de232d6abb7e0f7dfc716ca79b4

SHA512
f27558082d3ad26b0fc41a408dec86d86c9e9712cf934650f75335b0681012736a71dbab8ee65eb8ed6b2751f272015367a5e789b2e52fc0ed8ed875c3cad3fd

Download Submit
C:\Windows\inf\ASP.NET\0007\aspnet_perf2.ini.raz

Filesize
972KB

MD5
7ec7d6b897c1fd497fc6b470f99050db

SHA1
2a0a404f81380acfe4ea5265eb24312bd58f0898

SHA256
b26705cdc5b04a24023214822803b940e265c2cd64cfc9e46c5273370933edf7

SHA512
47035f258409eb628b7106b76eae947cf98b6ba29c1c74d892f06bd38ea7ba458b82963f76cef52afc231e344d95bbf4d245374a303896a3a3ed3dd6fbff59ba

Download Submit
C:\Windows\inf\ASP.NET_4.0.30319\0007\aspnet_perf.ini.raz

Filesize
974KB

MD5
055e5375050ed23dbafd42ed42b4bed9

SHA1
4ddee32f2f3e05ca1baa4c4f5ce724a932d7303c

SHA256
41c18a9c9f9199c125446b5b76283410cd5ea8fdaf9c610723a77013f02e9348

SHA512
a1cc516365d8d324618718abdf5515bc2ae95826bedef8ce7ac1dad887ee01b0cb96b594757099395165a511891dd3bd0e5f61f970eac71f6def488f0bf1c618

Download Submit
C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\_TransactionBridgePerfCounters_D.ini.raz

Filesize
64B

MD5
648e25f279e0fd7fccace53620a22cd6

SHA1
0e6026b17e428c26a456b7548b3fa26e7eb8890f

SHA256
ca51e6a7210363a496a8ad06c280f927b3f02088754ffe7a58eec5eb0395f709

SHA512
d99eba4685e2ee9cefdb3680ce15f44f6e1d8316115c2160c4ae91c8186f3a181ee7ad6484817cdaade0c2f0757897194287e2367bc48fffa2fad2f3bb734a73

Download Submit
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\_TransactionBridgePerfCounters.ini.raz

Filesize
132KB

MD5
3e053e22cb364f8f70f5860f1f597a38

SHA1
ba1f1df52dc9a29a09981cd568da41046ae9cf95

SHA256
548d850bb60d14b650abbeaac59c97ca294726a680aa015ffa07bc1accd0a729

SHA512
a9c27afbffd515ac01877444a037a1d3430cb172b0bb4154ba165b90a82bf522140b17cba643db69a6d8382a0370bf9f32bdfabdabbe9ff3182bad1cc504bbdd

Download Submit
C:\Windows\inf\PERFLIB\0411\perfc.dat.raz

Filesize
30KB

MD5
caba96a133384374c3e1217c3f37aa03

SHA1
85f945109609042833042f6cf3a93f6850aef7c3

SHA256
f8d572a31bd9458916e3a4c8e21ff615bb0336f0625358929a1f45c50b3c48c9

SHA512
5beac568994d28d5f5731891164d9a33f9716daa1489c6995a9cc5d7b834a5d4ddf211b6aedb897977c4be7c2c6ee7e3db22035f99d01a84852e9457119937c2

Download Submit
C:\Windows\inf\SMSvcHost 3.0.0.0\0410\_SMSvcHostPerfCounters_D.ini.raz

Filesize
48B

MD5
ec1acec1862e47d43a2ff2ddf42286bf

SHA1
f3e490639f77f316c1d1438a2c73d79422a076d5

SHA256
ceae54d16d8682863e66c0e8b6de90b10b6e2ea34ed8298caefa345ddcbca70b

SHA512
ec216dc6fa070ae88822e69aa70dd1f7e9ca5498ca256c6198b438ef39bb3a3b52963bc7d1704ca8faa413b64068728851a553ba5e4e5f8f389459e7a85bbb48

Download Submit
C:\Windows\inf\SMSvcHost 4.0.0.0\0008\_SMSvcHostPerfCounters.ini.raz

Filesize
130KB

MD5
b8d59b3b5fdf612541d744a144349b7a

SHA1
782d8a0d0b0f5b255e24ccace65725fd5bdec14d

SHA256
0c071728fe1f758fd89f5425fb88d7bd7434be03aecdf95d1f74b3ff75cc8038

SHA512
f8f16421aa22a141787f167c5f91676ef674a8ef2ddd51ed57a38486aa537445eaa12b5343b2189424ec5cdd1514ead9686621ad727bccbfe99543c05620a109

Download Submit
C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\_ServiceModelEndpointPerfCounters_D.ini.raz

Filesize
64B

MD5
587908df79ba1b6ebe017045766e9be5

SHA1
f4b4926c04ba829296e5c469e546659e3b1902ce

SHA256
3bdc310087b0357b5f921277d7e9310144924e3091d1f1d71acb96e55841fa07

SHA512
53bd64c739ec090ab6d17f6ad5bbedb2206e8b3d626d792c3f916a59293dd97cfe3a9c8341f5f8d21af9db3a263529df018051736c113872608cfb75c6cddcf6

Download Submit
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\_ServiceModelOperationPerfCounters_D.ini.raz

Filesize
64B

MD5
7b5cef90b470a8aa73e7f6ae2333f954

SHA1
8f3372883b03f47c2069ca0aba4fe6fed11d159b

SHA256
d82c1596d7c635f1e6840415969bb0ab5010d32296070f1a6754c7a5087b0f69

SHA512
12d16e445e8491db13127aaf152d4aa10a90754ddf6e12257d2bd5d71425d43eff576dfa1322a63b3ca292b82c8f04e64596de58ceb0ed9844e6a547712802bb

Download Submit
C:\Windows\inf\ServiceModelService 3.0.0.0\0410\_ServiceModelServicePerfCounters_D.ini.raz

Filesize
64B

MD5
39630078b27d57130c4b625ad2bcba9f

SHA1
85a51b5a2d8a4cc6abc9a29a6c11520e10acff71

SHA256
d033c1fc90a71766ccc0ca8de8d7f271828ad74659794ed923ba1ee1c0572c31

SHA512
e3574057b496a1c1fb27c0be0d4178f1a91b425723ad9cf6d52adde9b7cc71de95e9171836170b7ac7fa1133b9caed97ff5eb883ad1aa72041d124873c91e0b4

Download Submit
C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\PerfCounters_D.ini.raz

Filesize
32B

MD5
25f1ea6613dd00ac8730e1f3208bac29

SHA1
ddaa076b3615e5741d01d3b2f5811b54e67012ad

SHA256
2e4720d85064fb614c73507d1d8564b735fbc280e5ce17aee1a7e45e2c4344e2

SHA512
13e10b449b77fbe376ad5fee68d4f7b33dc973aa697b52ae5a5ea6e0ba2238d0ed0739af68f61f35435d5e0cdc1d380a8b2aa513a5e52788b7a9a1c0e6d54ee4

Download Submit
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0008\PerfCounters.ini.raz

Filesize
150KB

MD5
bcd7ec42ddfb228c08154c112a1549cf

SHA1
01e8ca9841dfc2e73ca31db9385336d72097ecf0

SHA256
a235ca9cf3225be3a9252356798beb007f362de9b2bdcdb3a756b37b7298bea4

SHA512
468bd49640fa7d375d704a2b4b821bbb4665cf6e343eb1a71c9e2c9f5a402a0c600a2e37b2c2f6d05ce745bcdfdbbb6472ee3b17657173c25b7bd6502d1fd2b3

Download Submit
C:\Windows\inf\aspnet_state\0007\aspnet_state_perf.ini.raz

Filesize
42KB

MD5
96770ba82189910d60a03fdfbcf56f8c

SHA1
5cf46b72ccb0228c56612dd9be606e6bb8c9fad6

SHA256
001b605bd250d51682142a5c9a565867b35bd4678bd4aa34ee9a77d6d74be200

SHA512
7104de4774cb8c1ff47eae130a13ec9ab86f9d7ae3d6a484e4985f54e61f8a6300ec93c5b8ea38c277a3f2d9aad0c5bb54dbbfa84fb246967d14ab14ec53de63

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads