ouroboros | 33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3

Analysis

max time kernel
178s
max time network
218s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2023 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
Size

994KB
MD5

bfed6debcd8c3dbf8ea21655247ed3f0
SHA1

2b05bc9c9a14e3f9db8e758b2f5fa060857499bf
SHA256

33894a6f9df34bfdd9408bf6771ddc3ce32a315287b228a3bef4753e699fd1d3
SHA512

73a033937bc55f24a9089e493b3c8c3c6c058a77905ca1c09b73288ac5932328668d588add546a51779e36da6408c1aeab52af290a6bfae15391ac2d8faf9a28
SSDEEP

24576:+Vk0mL0+1snLNM6Z8gQbHDGq3ixHsWyiFhv/C:+VBvLO6KXGFZRyiFh3C

Score

10^/10

ouroboros evasion ransomware

Malware Config

Signatures

Ouroboros/Zeropadypt
Ransomware family based on open-source CryptoWire.
ransomware ouroboros
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

668 netsh.exe
2828 netsh.exe

pid	process
668	netsh.exe
2828	netsh.exe

Drops desktop.ini file(s) 4 IoCs

Processes:

VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

description	ioc	process
File created	C:\Program Files\desktop.ini	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2548970870-3691742953-3895070203-1000\desktop.ini	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\desktop.ini	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File created	C:\$Recycle.Bin\S-1-5-21-2548970870-3691742953-3895070203-1000\desktop.ini	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

Drops file in Program Files directory 64 IoCs

Processes:

VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

description	ioc	process
File created	C:\Program Files\ExportConvertFrom.ppsm.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-GB\tipresx.dll.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\README.txt	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssv.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmid.exe	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\attach.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\nashorn.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\java-rmi.exe	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\UnpublishRead.ico.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.diagnostic_5.5.0.165303.jar	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\resources.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\localedata.jar	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\UseSplit.mov	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\System\ado\msado15.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\msadce.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\hprof.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.uk-ua.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveDrop32x32.gif	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\StartRedo.wdp	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\UnlockConfirm.tmp	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmiregistry.exe	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File created	C:\Program Files\7-Zip\7z.sfx.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\iexplore.exe.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\glib-lite.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\ReadCopy.M2T	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\t2k.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer.bat	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\sunec.dll	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt.[[email protected]][EDRFL1H4KVGJW8O].Spade	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

NTFS ADS 1 IoCs

Processes:

VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

description	ioc	process
File opened for modification	C:\Documents and Settings\S-1-5-21-2548970870-3691742953-3895070203-1000\ \:쀀㌊癮轐Ő輸ŐȂ熒睘豻睘߂齙	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

pid	process
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 5064 wrote to memory of 2616	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2616	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2616	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 2616 wrote to memory of 2684	2616	cmd.exe	net.exe
PID 2616 wrote to memory of 2684	2616	cmd.exe	net.exe
PID 2616 wrote to memory of 2684	2616	cmd.exe	net.exe
PID 2684 wrote to memory of 1568	2684	net.exe	net1.exe
PID 2684 wrote to memory of 1568	2684	net.exe	net1.exe
PID 2684 wrote to memory of 1568	2684	net.exe	net1.exe
PID 5064 wrote to memory of 2752	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2752	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2752	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 2752 wrote to memory of 3828	2752	cmd.exe	net.exe
PID 2752 wrote to memory of 3828	2752	cmd.exe	net.exe
PID 2752 wrote to memory of 3828	2752	cmd.exe	net.exe
PID 3828 wrote to memory of 448	3828	net.exe	net1.exe
PID 3828 wrote to memory of 448	3828	net.exe	net1.exe
PID 3828 wrote to memory of 448	3828	net.exe	net1.exe
PID 5064 wrote to memory of 1404	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 1404	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 1404	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 1404 wrote to memory of 208	1404	cmd.exe	net.exe
PID 1404 wrote to memory of 208	1404	cmd.exe	net.exe
PID 1404 wrote to memory of 208	1404	cmd.exe	net.exe
PID 208 wrote to memory of 212	208	net.exe	net1.exe
PID 208 wrote to memory of 212	208	net.exe	net1.exe
PID 208 wrote to memory of 212	208	net.exe	net1.exe
PID 5064 wrote to memory of 4556	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 4556	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 4556	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 4556 wrote to memory of 4204	4556	cmd.exe	net.exe
PID 4556 wrote to memory of 4204	4556	cmd.exe	net.exe
PID 4556 wrote to memory of 4204	4556	cmd.exe	net.exe
PID 4204 wrote to memory of 4652	4204	net.exe	net1.exe
PID 4204 wrote to memory of 4652	4204	net.exe	net1.exe
PID 4204 wrote to memory of 4652	4204	net.exe	net1.exe
PID 5064 wrote to memory of 2208	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2208	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2208	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 2208 wrote to memory of 2260	2208	cmd.exe	net.exe
PID 2208 wrote to memory of 2260	2208	cmd.exe	net.exe
PID 2208 wrote to memory of 2260	2208	cmd.exe	net.exe
PID 2260 wrote to memory of 4368	2260	net.exe	net1.exe
PID 2260 wrote to memory of 4368	2260	net.exe	net1.exe
PID 2260 wrote to memory of 4368	2260	net.exe	net1.exe
PID 5064 wrote to memory of 1484	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 1484	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 1484	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 5104	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 5104	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 5104	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 3404	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 3404	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 3404	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2084	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2084	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 5064 wrote to memory of 2084	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe
PID 2084 wrote to memory of 1772	2084	cmd.exe	net.exe
PID 2084 wrote to memory of 1772	2084	cmd.exe	net.exe
PID 2084 wrote to memory of 1772	2084	cmd.exe	net.exe
PID 1772 wrote to memory of 3816	1772	net.exe	net1.exe
PID 1772 wrote to memory of 3816	1772	net.exe	net1.exe
PID 1772 wrote to memory of 3816	1772	net.exe	net1.exe
PID 5064 wrote to memory of 2316	5064	VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_bfed6debcd8c3dbf8ea21655247ed3f0.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLWriter
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\net.exe
    net stop SQLWriter
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLWriter
      4⤵
      PID:1568
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLBrowser
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\net.exe
    net stop SQLBrowser
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLBrowser
      4⤵
      PID:448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQL$CONTOSO1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQL$CONTOSO1
      4⤵
      PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSDTC
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\net.exe
    net stop MSDTC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSDTC
      4⤵
      PID:4368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
  2⤵
  PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
  2⤵
  PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\net.exe
    net stop SQLSERVERAGENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SQLSERVERAGENT
      4⤵
      PID:3816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
  2⤵
  PID:2316
- - C:\Windows\SysWOW64\net.exe
    net stop MSSQLSERVER
    3⤵
    PID:636
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MSSQLSERVER
      4⤵
      PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop vds
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\net.exe
    net stop vds
    3⤵
    PID:872
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop vds
      4⤵
      PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
  2⤵
  PID:2464
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    PID:2828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DumpStack.log.tmp.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
8KB

MD5
deb41d9e4d7e9d6a8388f5e438db7553

SHA1
eebd2f77cbd0d6dcb90e1489ae2eace3b1e87111

SHA256
d5466d671fb8b11b6dfabda443a23ab65a2eb471ac5f4ede86d18e643fdeb425

SHA512
6a72118ab147795ccc7545be521cf86ec617f746e285ff00ac4152f60ef4aac75caad262c8c36ffd07d55056effa3bd373126cbc984c57504f6e3508335c8505

Download Submit
C:\Program Files\7-Zip\7-zip.chm.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
105KB

MD5
7b249431795f3f2332ecb99af66d1033

SHA1
714bfac7eb0e7c62c80401edc8885ab1ecfd0037

SHA256
4add067c7c48d8600e1efe56232dce14b4a848d84b8a722b223e9e38af39f55d

SHA512
c7e7bf839a342c735c2da4aa90b2ab11be9b9a5220b52855b6b51399f43fc2e7276eef1dc10caed5d3c714ba32f8548ffdb1402d430aaf58743c1986d9664704

Download Submit
C:\Program Files\7-Zip\7-zip.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
76KB

MD5
b0a8ba7734bc4b92a45f49b5ab4b02a1

SHA1
9f9288e73b4bd8e59980239dbf9e899f9819f90c

SHA256
133485f2fc50c9ed5a49622be7f1aaea0bcd355e24cfdcb73d22f080f5624b0d

SHA512
1eab0278dff31d90622cb6a9e8c91a4df927c64824129ff372031e9ac8546da27fd0781372a4de82a946e218cdc4e86ec57cb090c2a387423e3cf1de82dcd941

Download Submit
C:\Program Files\7-Zip\7-zip32.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
49KB

MD5
73ae3f7ddc209ae1575acb0c0d02f4aa

SHA1
3aa8fa7f984a46040dd03178af29635322ddb4f7

SHA256
f9c8597c09b839ae5f400a90c799c783076d3a10fa39a14cdcbcc03cad56af70

SHA512
e55c861391416aba188b2c189d993f35c6f2a66dc545c4be4df0c053e07ada952b416502dd6672f672b0673d49e3095102cb125b526a86d4969e14e58381cc10

Download Submit
C:\Program Files\7-Zip\7z.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.6MB

MD5
b4d495f6f51807072b7cbdf8ed70d7a1

SHA1
f0b220ae817abc5b162e7413a5059af175dd93fd

SHA256
d402d4a02d4825a41205b1fb3c29c2c39748162c4ed05cf5fd4c3bbc3a69a0f8

SHA512
992f15deaa71509bef23c8b8c699e4b6061a1a1f06e30ddd78a795c606ae15001cb9e748b295da56a866d509ae1a89fc090c8cb5c1ecb966d7476627320008f2

Download Submit
C:\Program Files\7-Zip\7z.sfx.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
201KB

MD5
06d47f9893730560fcd43ebcd4a6788c

SHA1
c2f25dfa86ce4f8ad7d24ae95c18a08125b769ed

SHA256
6a04120821f7fb375503e05ca072a23644549b4740b1ae125ea1b8c0c23eed28

SHA512
0276e4a76f79f672ce2a62eb6411bdc3679f1ebcaec014c079f397f9a489497d2b9b57c9620870396e326a22d03cf2de560b45dac0481b195e1ac057d6772f1e

Download Submit
C:\Program Files\7-Zip\7zCon.sfx.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
182KB

MD5
c5654c73b41c15fc7520a453fb2416ff

SHA1
282260d9a0740f638547ee5e0241944e38a8dee1

SHA256
d6f4794b98632368074b9c8ff8cdd41a6340231ebbdb86bbcb7c3a330f3a173e

SHA512
26b82bc7b225307c3a44941d0cf69ae1c8eec685f5f95d379bbefb893fdf85d41c89b846287ec2b407c7918ab7c17f23e63c247b261cc1a70363a94eba891d60

Download Submit
C:\Program Files\7-Zip\7zFM.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
847KB

MD5
8252e69441bd3d2c6ac5b2104e8facef

SHA1
fe5aa10ab48b37a1907ef579d7067b3e3cf9fe32

SHA256
4a739a53275980ca71046b99a489cfe5ae5c612235c76dcd060b8a55ab319b37

SHA512
dd2b226838c94cc0c9a95b1e3a3fde426e3a677fdf3f5a3893d1f9e085ffd38126faf0b3f95a8baa28d76a603139df2a4ecd081d2c0efb45597b01a32b32db68

Download Submit
C:\Program Files\7-Zip\descript.ion.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
641B

MD5
6bf1f52f27e8827b3bb3edf7bdc4be2d

SHA1
d86fbafece26499eb08545729617b70f413535c6

SHA256
7f783179bf409c1275821da2e9fd58f8f71eb8b18056ce642405d2790ce79774

SHA512
c77fb38a20958a8e43e223e1538ecf4be4152d18c439530798d0b1020474606ae25e1c2371b1aeb4aefdd2e1a95ecd9bdb15df35d45eb57170aa4e1763e7ff89

Download Submit
C:\Program Files\AssertUnlock.dwfx.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
390KB

MD5
d65b7c6b7d27fc8c60a856b951255b75

SHA1
21b35d065ec2c2b83e6a4d8c5aa3cabd5a6127e8

SHA256
0e7b6dce0d9b6b7acb6aa4e2bd0720aa55882b6e003994d7870e2a33d4031e78

SHA512
27edd223711a61aa1106ae49ead8d5b73f4c8e1b506ab40e1a96528665c2a237ab38768cd85e751a92988cc7e2bf7bfd3e036bec81d9175dbd6b0ab384ea190c

Download Submit
C:\Program Files\BackupRemove.dxf.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
582KB

MD5
237c9c58edf9a1e205114f432f69442c

SHA1
542afcaf881f92975a579969326b16edc5eb200d

SHA256
da5f804125942f698ba021101b6f0ecd320dff12071b0c61e6b502ca6b4d16a0

SHA512
b7a0992ad62d908de1dab9dd069fe7e8228b37942e131485731f4e1dae98b50ce9d074e052fbe0c4c03dba2532e929e23aefcaf937681f35736b780f4cc5464b

Download Submit
C:\Program Files\CheckpointInitialize.rar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
326KB

MD5
a7c44944233b1b8389c55ec705522966

SHA1
7a8321c043b9825e3bc063f2748c15b39f2b10ac

SHA256
447990f5f6a35a9c2c94f5da9c3b7f78bcfb3b6b73a8f3ba11d73dc00bbecc67

SHA512
b18ea3e502778f2165e7f20b2959fa438039d661ae1b5d80aa91a7acefe8ea0e8c71e788bea78582d8a82ca9cecb47834b6f8de5eee10f64bada5f79dc35bc0d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
192KB

MD5
7257414401b7e2755a54544a9302425e

SHA1
5f9d4169f72c580c98cd96eeffe0722f9a90baa9

SHA256
60d22644964ecc9b8120d3be1ddd2b6f9de77c90aef4589d4d3819b9473cb141

SHA512
5665b78d1b1fd9cd3cf023e58920779065a62c89d2681047b2ced2d0c28abcae7a5d4f721e92d4b8ed72106cef2ed958d32df8a1e2abf76828fb8f978e1cbe3b

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
183KB

MD5
5d91b282ba0bf680049b1ac21997ad74

SHA1
9d75859cb7e28a5f17b5c5af27b6d4a9fe84cca8

SHA256
a02f5edc468c4b6fe4ee657c610b0cc2d78c875452aece3d3519ad02fc2e97b4

SHA512
4a6c35f5924d5313e6b034139b824183f522802bd15193626be0c32ddaf38c404eb25c242a04d7535217f0c14b56acfedc8aa649a5759759f4a487383e14726d

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
518KB

MD5
b2e0f3e8f18d7f9b5098fe966a934b6b

SHA1
713d7396d4beb7cf153a3b1d4366530a6e8f0ba0

SHA256
e3d915dc5884c3758cd8ea84343fd229c93b9bbb6c84dc73f6fa444525495d48

SHA512
1d513076f4cbeceb5ed5dd46102a379f6f916af824c99bc447a0a21a20453a6156ef4162b4bbc174862fd3e8ace2a72b3f3120c1a34a203249a4139974687898

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
282KB

MD5
c97343ed17241d37c9dc8265f8b0855a

SHA1
7d160ed6d938690cf2f008fc0ff84616da420f6e

SHA256
dbdad85eb8f9855df0f150f54fe136e70f79e30d14f74a19e3aaa2c6c2ba24da

SHA512
e0bd6feb8e106ef5240a2122a8fcf249911feed934a516ff17b3ecdf537d9f8c8ddd19fbf492c5c7f28a78e2bb9a09c0788fec2a2cf8cf9b1b10fca055f58bcc

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.9MB

MD5
48d7cf4938c533273115c6dcfe9a0950

SHA1
7b912f85af18319c07a984f25e1257aafd0d3d33

SHA256
cbadfda316a9ba5128f7d8974024ea6b18ef4a3bf40d2a601435beecbf74b378

SHA512
e7f9059528604ba973c6bfcb517201bb872951826cb4b12922956d5687380e5533884d905c6ab8c2d9372dfcdb63262caa8e018269de43d1364a3a51dafd4a82

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll

Filesize
2.5MB

MD5
f45fa5a500d2ec044aaecc52188a8b2a

SHA1
2028a5d3e5930aaab9a6e67ee13a4b1660c99ace

SHA256
a24d55f318a2135cd5d7442c7df434f678125a00039147321de53c9330beb4eb

SHA512
b1944109b720130e33c95be40b9c3f8071bc703db7bf9840755c020d9057c823a7f10985ac5cd82bbca81ea5be123c80825064a1cf283f60b2edffaf8ed46c6f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.9MB

MD5
4967fe647fddc1bc4eb4d863effbf4d4

SHA1
df530c433253ec5130d0d938bac9e4f54db70cde

SHA256
f86f74b9d6f4fca3470edc2586021008d33f4386474226fadc6275b40b6db30a

SHA512
ac6821eb930537abc6f6ff19e50f78916db39f679947f84f73c1590c39d495b63ede2ab887bc769d4b8f0e3c27de0ed5ebc31aae276d86b6515aea2bf31339d7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
2.8MB

MD5
ae07e4ef400f68c2504e49b15d9319cc

SHA1
cbee90d3c1aa809b7f0d6dd6dd216b5c232922a2

SHA256
0a8d6e7766e7c44f4b1e135c3ef4bfb6fbf39d0de1b0583f9f5896a25e9123b4

SHA512
1d50b8135c2372ed388b6eb13b222d2d213e7ec6a18ca5f1adbf91a115de9b045aaba8885e75c64df5aa9d81d7ae89ffb40c98d2553ffdd9025a2a042d201000

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
3.1MB

MD5
26a83b2273f6201bd55e6195ba994b71

SHA1
548d936a17836b9c888eeb8431b613ac6cefc400

SHA256
607a35d7dd9e959ffd74f21cab71429801e0601b4764972b2fa5a8b9ae3d1338

SHA512
ea912b9227b6ab9a4fc0a737943b01dd033b8abce0569568aa6dca0db7480ce76cc08c02b50f64a0249ceca65b9c654112311563a038c76d83a21c8e8295eb82

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
4.1MB

MD5
ad7942a4aa71a6c5dc47e4cf8ab3d33c

SHA1
40c0f9a24956d685a2be5343a148a5cbc14993b5

SHA256
849fc788447fa88c21e157ca6dfa4470fd823a790331895c501dc2e4b44f9c85

SHA512
45f7e77313a7893abfb964548ffb7bae424600226a9bd3aa5e3654a7551a99ed1773a9197859d111b2a109ac2abcb85607b3ba668014dbb4bfa75b9e5e046bc6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
19.5MB

MD5
f1b3b48614be787974f0314d62d91c3b

SHA1
8c45f05cd43c32f38b84618d32e7be1806d59078

SHA256
3bed59135f19306078009d73f840f7d692589b07c173404ee5d0b301847f7a9a

SHA512
7189e4ba93ff20dbbdf44d327eaa671f02d26ac93a3ca39a76bf798130f7b8fbb71290a73237d937b81b3153e80ac52f84712f111bb4ebbb8776f628148664c6

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RCom.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
2.6MB

MD5
94cae416ae835c7c571eb3028a74f0c0

SHA1
fcee7272af2e8cfad8390756f6dedcb7dad28c0f

SHA256
43cd32454d54a38c5a601107ca6a01b198e3712cb38982356e54658070f6f93e

SHA512
ee88402bf75adaee63b11868120693dde6f6f3f21682de8286763b04e513a4fc55ccd26bca05e5a3f556f5c04b564b9afeb40ece99b81b2692d49c5ecc4184d7

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
525KB

MD5
f5ddbe477902e003a8305f829f82edf7

SHA1
3d72982203078a7fdd2e5c711d554559fdfcf6cc

SHA256
c62ad62cff9cf8e645e3c1c727bc44520816c6ba5078a5be9ee5a8a02e1b3ac1

SHA512
dcfdac1f1b2ef6dda571c7f3674ef476744632ed99e67c28ee340d06450544626f12a1f5ec01adfbcefdf73461ade1e5ea25cfd77c3fdf3f9395bd88b77cb494

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
2.1MB

MD5
22dbf96d1de650ee043047d7b53e03f9

SHA1
069e48d35039a6f45052e0e9cf90708bdff736bb

SHA256
531c27fb05862fc166ed524c0f2953011957321d795d4669a07986be4190bca8

SHA512
2d5b5dea4e67eeb05464e834c36a705cb766fbcfe8d46549f0fba772fbb784576b44e0ab5ad31e27e781f10dfc0b7e65e6e0ba257b26e40b4059fe334852c36f

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\cpprestsdk.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
2.8MB

MD5
6ba918db77208bea034b63e903108f56

SHA1
5c49b6184f81f4c807ee2809bbbe60fb919f39d6

SHA256
5ff1c3d907ea884cbf777f4b26be63b3292cb3e39f4ee119711e29c85453304f

SHA512
157f921159815d5852f3eb479b4eccdd1dbbd27d9e987cdfdc46990fe87e1fb6a225e652a008be4381d9465c0a51caae7b221e42fa0d0745f07e9883a46d6c6e

Download Submit
C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
960KB

MD5
55d40da573b5c98257b81463edd7bcfc

SHA1
28bd5eda54d771b58da0c55ae961c5a27f1e2315

SHA256
9c305f8ddcd040a3e50a567afb616a76f5febf8ab09514c17b4fe87e7831c988

SHA512
d673ce0f93c1a0310b3210ce91323ba95549c561a6bbb34054342476bb72e0b0ad271a8a20d6444d49cd41f725952e73ec31038e6ea332d8a8ac639fa033d273

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
580KB

MD5
03c4bcdb848b019227467c67d8d0f4c6

SHA1
1e8a0bd4b6082dd93fadf3ea6f6d16470de3359c

SHA256
e77781db66d961009ce0683f736ab0c85267d301dd7f03cf940bae248f6a967b

SHA512
920238c2686e1406bb50019cc57eb1aa20d949d83cb7f77c7e5649dc1129004c88a4cb1117192ad7f0516152630ac9a009d53f485476338f84ca1563b5ed2609

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pidgenx.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.4MB

MD5
61b9c675ae0eac2ec53d12ad3e05f690

SHA1
0d6d0ac86fe35186063de3e282a99143521080b1

SHA256
c170256d4d7b9ce58dfacad057dd78a18fdb773ce92ad34a23dd75e6c5ad4371

SHA512
06cd49432d6b6be31eb6e9b05d4d83f189000d07956fd72bda7869bce1566fdc987d67f04febdeb5753e4a9aa742f6dd23cd0501bc5c9ce32b575ec90c3fd640

Download Submit
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
904KB

MD5
09bb97330c565565f854305f57d70f72

SHA1
265bf73b26433f467589e1ed5959808210200a22

SHA256
5ee843e36701ffdec2da8770ff0770b9397a7f695d7b46ca90d181c30d145381

SHA512
6d6bc201b4ba2360cbfe9b8abe06244d7b196d6ce84c77c40a9278c71c81223bd7da95ddd3a8e06c1a64ae84882fe0f6478e5cea7eb79a88daebb13a1fb2a79e

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
257KB

MD5
8c5403032af735c0c552d950fd3ed18d

SHA1
c65c78423d8fe064841712f4934895cd4aee1e93

SHA256
4ea2c22057fcc6378b739cd39c13bff220425afdb5cc49eea902269ef00f5ca5

SHA512
c60630b7d26e91e169763c738c1b7596b912a36540b795c23a55ef5f9ce20a18609122f361f4454a7aa23899c718719ca4ec0c6847f664a038d11a13887da816

Download Submit
C:\Program Files\Common Files\microsoft shared\VSTO\vstoee.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
162KB

MD5
08aa2f3dabde2bb146c6ec41569f437b

SHA1
05de3b64754e3064b79aad76459308dc7b5b0165

SHA256
52f89298f0bbf28bb875eedaaad7a05d54ba239701a697aefb5e4a0dedb070ea

SHA512
4b1596ae8e2978022953843fbd06a5b2e2a9e8eca26a9cd471391f062f1a19103b2ebaebc78102ba45f6e94ec1183584b525dfffae1f52613fb669003df061aa

Download Submit
C:\Program Files\CompressExit.ttc.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
479KB

MD5
568d1e389e7d2a457155529be49cb4d7

SHA1
7344940dd15f14fdb25ea76e629437f34c6da131

SHA256
0a27eec5b8a4a24aac71691b3f0b430bcdfbd6ff80b6d898248221d10e99b119

SHA512
21c25e6eb4c0474c71eabde51a0e70b8a95dc44f73457953b32a9fb89daea60e0b9c17ad0bdc0472cd17d56e9df5c6bbdd084db03e186e84a93e80cd9d14708e

Download Submit
C:\Program Files\ConfirmCompare.xla.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
428KB

MD5
d238acbcbc16148e66a59718c3b6d8fd

SHA1
f3db70f9d43c344fa193a74402cd6535f4e4d852

SHA256
716e64fc6cb41704e5f0911bcce749edcdd5301bc9b94855292dde928c4906b7

SHA512
16ea53150a22f1a032e5b0aedae76b2ff79eec228320e1df64a235d0af908545edfb0f60ff4a353b09230b4097f4ca0914b99f7aa85a774f2e089a2a724a531c

Download Submit
C:\Program Files\ConvertFromRead.csv.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
531KB

MD5
12b7b4363d62019f1852d89abd6f668e

SHA1
bcd9b299a037990973b93fa1b9427b9faf2cbe38

SHA256
11f51f7a2c53300b6599c7707b575e502d7568e928d28fe26236b94888f1a391

SHA512
61372def8d2972d5259383ea189802107215bfdb8a139d612df08ee3e8bd1233b81f6bd493dfa9b61396fc6d01f3bbacbbbe3e5b1e5ae2c2be1a1e5676eb6b5a

Download Submit
C:\Program Files\DebugExpand.wav.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
403KB

MD5
7dd47bc103cee8a7a9eb5eae30f636c5

SHA1
5a4e3a300f1fd7297dea83a5e6c12ec7e3de6244

SHA256
ceb7aab88cc1c771d475523773a78ab4151917c7a45b9e3fcbe78cd8d51e4f51

SHA512
975b4f4beddfaf7631f140d68801ccd8912acc1bfa48436f4557c20d4e8a679f8bc624b0b6c0a2bb8597e3cc2bfff57eaf1ecec3e842824c5be9e5c4ea5f6a17

Download Submit
C:\Program Files\DisconnectBlock.css.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
454KB

MD5
33f978ee0c5c9e118a5a958d1b8a26e2

SHA1
679a6981ae67aca53eabaaadd861608a3f439865

SHA256
ecf222cff46a3ad4978fb2ce32648299508ee76ed014a7d67b3a7d57c1b7223f

SHA512
627eba48f009b0d3853ce7b005d7b549f6f0bc911286597037157498b6d843ff2c45ea7dc996dd1ef4248cb4189a01fade81a9b18f214afe46d6fcf2dd7589c6

Download Submit
C:\Program Files\DisconnectGroup.dib.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
659KB

MD5
60941f0c3081113ca3b3f3d4ed213d2a

SHA1
d958f72dec109b025342c59678bf8a2db4b5e37d

SHA256
0198b5c456015b7c911c2a8dbf607a221c89abd7f8a5a8ccbb4e0331cc6e4c32

SHA512
dfb1c89b85b08390ef7867a73372afeefb53b65256102ecf998c7dfa4b121c98b2f7b79851cab6ffe18732ff6de5bed608342992859ea4a88e6b10cb36d9ed54

Download Submit
C:\Program Files\EditExport.fon.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
339KB

MD5
c5f179ae0bd894b1c52b6fdce758e604

SHA1
0863fc4421b57998fc7b51410bd7ff29de44db9a

SHA256
bab1387ca54cff8f4fdfe51397250985164b938cc57dae24ea3e4b293cb4445e

SHA512
3d0f5531dec19d5ac0c17664e990d37129cd0971ff8bd46efaf7d21d7fcd1b3e80d475b5fbce66c4a7f3052e93501610e59e94518b22388c3cc472835678ef7c

Download Submit
C:\Program Files\ExportConvertFrom.ppsm.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
364KB

MD5
e0b4d0335c1226f26544fb61478b4644

SHA1
4778f7edb43d28b7b62a2ae940411d963673945f

SHA256
67c55875c00e9cebe067b16c9ae400950b320a60990404d4835d97c36e89b221

SHA512
817dd5769be9e7f4cda586d00b616466b7a7de688d722acaa464bbd0c6eab3dd4f381b9e054b363dba5f1be653618da229c21c7ea16ae7f639ab1ac8607f2a26

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrome.7z.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
8.6MB

MD5
bebe4fe392e829677e1aabf946dff1af

SHA1
ff67ce225704986dc063185b9f92a14d26959860

SHA256
9a8486090f791e2c653eb918811cb426fe74b3e7d6c31b8e6414924864139034

SHA512
1258bd7415bcb6af73605dd22636c3f0ba02ebfb822f698bd2d238f7f34619c4d423d82d11eb0d60bad5b89bdbc254d6750b1d2de6af931d8fd6b6c57fcf6dde

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
326KB

MD5
4b5d20737ae08ee1316f1b2469174548

SHA1
1c780085953c3a4348e3f67a2bf7a71bd3abfaa2

SHA256
a8e03a97b30361087b88e2613b3e63a84792cd96328bea05d7ea18aa2f7a1bb6

SHA512
275dbd48b11a734d587253a4f4c606c0f3596abd154f6f32ae1cb81c413f43da98147954334c0e0be00e9e47695ed140c4252089c4a6302735b3db0f8ac4f31a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\am.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
526KB

MD5
a21aa33825086fae2b3cc24e602634c2

SHA1
565ab61510d602f453ee0b086614183e56fb88b1

SHA256
d57d70343f50745b3de2cfefb1f9d69b4223551d3776cdbd8148b7375849378f

SHA512
cd0e00bfdfe7d72866f1cc3a16ff23ada39b7fe5c80903ddc67b135374cf7a35ebe52a7c0cc5dc1ce664f9407c18c33c768d185d480b85c23a617a2de9558159

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
571KB

MD5
9182ff81daefdfa0d71a919514cfdc1b

SHA1
abf93902820d73a5cbc814a94049377e05575f2a

SHA256
c88416bba4c7b5ac2e06117b68037d5c72cc621602f1b25732113c067a806f2c

SHA512
90acee7bffc73489efcdbb5719776afb198f884db0634540ff3160c020f676975cc5d7e1681cb1f5b663473e5ef8a5c5942d8d0152c708fbca243a61bd400bc9

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bg.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
600KB

MD5
4cb0288b19fe58794b7b83a19349444a

SHA1
a051843f49018f627b88123ce6a7d62d6198d5e0

SHA256
e36c403d967268344930198075e8e736934914cda7f8608706d4b07d8654fb1a

SHA512
95ce9e706c2799e4978b62b54de18f3bae89b57ecac8d2c2f6ab0fb967700241caf5abe7b2ffe1737feacf23aec4fa2b4bb1a2f4846c0c5dd059ceaf84be5e4e

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
772KB

MD5
cf1e375df94da0171ed0a0f46fa0df0d

SHA1
e22c3dd23dd4b946950acaf81cb45106d46cbe80

SHA256
6a4e5ef13cae00db8cd1114ca029cde006286121e0d42e725e9bdc746a5c3e27

SHA512
a614adfe5f34d0d4ea16104c9497cab7885d7bf63292dff5ca6d1cbd539f7e913f924864118e51ec430bd336adf0a438a9aad15496a7cabfe8d31f0da06ffac6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
366KB

MD5
d8298fea90c0bb16d5987a930ce287fa

SHA1
928673f627e919070b24f724c0c8b4ff20cee5d7

SHA256
0ad540cd87b8a3983817a7b436b78a1c1182c10c7cb9f7a3e86acab91d1fddcf

SHA512
22b0b4a0f518956b1fa30a6f2f955ace1f19a8684cbd16b2b8d718a31e03a17bf6779755121f2afb5cd5da63de9e6ca501b34cfd707112eab69047b824407fe1

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\cs.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
374KB

MD5
82558c6385a8951fe8620c98734505d2

SHA1
3187f32d2599a41f09cc2bc08c84fd400e7a23e4

SHA256
6364b4d8cd55f3fa37e30ea1a1a6d7433ef06b84939693a6bea708ecbfaacd6c

SHA512
064b1ea30da7d4fa254dd3b7055f21743550efd2642e9abfb9e2ddde3e818daa2aa192e509b15f1f5e2665536c4e7f54aa3bfc10be5ea73a4c1631563e53a8e6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\da.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
341KB

MD5
4c3ed97d44e67143989df3651c8e9974

SHA1
6355527ad5ff925bc933390de47e72814e0f41ce

SHA256
2078e27c158d92f841d56a82e651e0ce89bd364954e4867fb1dad35dc323eefa

SHA512
fe0b80235b0bbbc2a57ab787cd73ec519f7c0fbf0c6b6efd1f01dc274272d698d8a23a4c07699d65be64c23a4d91f2fd4452f5d045940c7b2138f49bf7785f1c

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
370KB

MD5
0ffa4dffd2315f18939d3bbd3734de0e

SHA1
06a4b7eaaab15df31189e607b94ce2272c9c6ba8

SHA256
07941f044e259ee231a19434141c8145a79015795873d0422ea0d93711f74051

SHA512
fc2996667a0cfe4d070ffa2eede717fce816dc26a9669610710028fe9024e11509903ed400f90715f1a253831054359dc1b4179d561337c36e4b5a51a8aafe30

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fa.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
532KB

MD5
bbb97274166d7157d0fb7a501c46ec25

SHA1
cedb5a406b67d7bed4a94f3d969346598430b0be

SHA256
e7f73cdb54945180764b54f9585c15e36f97f986a3c2f3766c140c97130b47bb

SHA512
1d26af0a3ce964391b6dbe3f3a5caf03bd5cfdef23cfbda289c04f9e128579080776a4d18bc6b873c7876540fc01a03fe0f6e8dcab8d5d7148f2653018942c72

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
465KB

MD5
d8d741c12189aa744d637ccfd3a106f6

SHA1
ba032425b098a91ca432ea19ae67b147a03be9cd

SHA256
c84450800a0c504f47703207c03c6d479b069ed0353a6014729465d70b0a3b25

SHA512
e792de57b3d6894882000d7eb6d53036cc76dc80e088a14ddc3ca217052009b98663ac1953aef273be8ab5167e98e1b52974debbbf33c09c94a97e5d3b4b8fa6

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
903KB

MD5
c7a07f6ef06fd814f719260ed16f639a

SHA1
c1855032826692fa0502ef6e891252f71f3c64d4

SHA256
addff3d07d49148320ce3e4af9671f608f8d1ffee6f75b0238033f0d32d5e2be

SHA512
3e33f9fa31f7156323bd7845c1ae30c66900381cf1846c2da4113f982c6ca445b1a5e6ace473727da3137628360e97ff0c8d38e82398d443ce6c950039ad0c44

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
739KB

MD5
1d930c792a88497c4130eedc77a0bc8c

SHA1
cceca6dd8484bda2aae17230fdf2e40b77edb649

SHA256
8da2410e72679391d80d690b5b38a145f8f7dac7e57b6ae03ef53310f3debed7

SHA512
cd3b18370d6051e08bd15de1d48dfd747ef4a94f9fddb1c67009c9540efb2974f5be9ba4910a59f55591b3b6c9c8e408a257dcd5c5138684c36d9ef1b8b90ed2

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
3.7MB

MD5
1e6404c3b9f06a8306e3c8fa78c9bb84

SHA1
1332bd62ff96e27e9790c809f5dd1229fef5432b

SHA256
047036e52e87d842d90518d6ca0366be195a8a3bc4f8e87f1cbaba6e02d10e46

SHA512
ecadbd0dd05351afe8be84c9e6a778723482d4f26dc15649076367e715c8a9bae58dba0cbc9253b790d9f10b3d209233e82ea25c22e5d7c03841203a30a47af2

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
8.4MB

MD5
2d3a95e7ce6686fe27ec7ab18f0a46d4

SHA1
0de38cfc52810ed1fb3f6dd6433038f132cce0cf

SHA256
bfdc25847b4973969ed84449956ab05d10874ab565cafae4fdfe769c8af4098e

SHA512
819a59b7268f4eea4cb72ec00d98aaf544f2210a04c76fc9602a440924d139e8c28bac2396ca8ef036b78e3a069f5345b8e28fa37af7b6b802293df2cb3570de

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_100_percent.pak

Filesize
646KB

MD5
2c4e93eb855004ff8ec8441c96b0f243

SHA1
e5cfee889ae57a007421754bd567439da73dbd9d

SHA256
a096723980bd119f8bc421debf116369a95d052c551fa964191fbb811a36f872

SHA512
bc6e6451d3486c30de52913783362cc139ef162e21a7e3bd3133e673b90a305ead4d7699b8e9cde33e5a1d61fd3b4c7ae9697c0eaee89f0ca7c0aca5d369a811

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1009KB

MD5
040daab0cc5a2d92ac50538e5a7f92fb

SHA1
9d214709fb962374f06b04229ade75878a41b5c4

SHA256
f42f71476d5cfbe6907b02d12ee828cbd6f254307c2ec24d185cda7b6af322cd

SHA512
b020c5f75d5a5b76fb815c6bc3bf66d6c19b49a84d61d25eeb0e1d542961f18e1b9e22074138f71762db5f721ddb29445a5e9429194c3fef374b9e61023991b7

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\icudtl.dat

Filesize
10.0MB

MD5
0b8fb5cd865f4414db3986e332fb3fd8

SHA1
03a18d783ccafc1cd3a0a566c20ce8a27ab0ce0b

SHA256
f918bf6540df6d06d113155be567a3c83586a2b1d7ba605d53a306e7f00b2af6

SHA512
317a9178e8293e0150bc2f0f7458b3be7fc3f981ffc906b0463965b2e9bb172c20034760d48fefa3a0c6b189b20d69793243d07f942d4a601a29e2edaffddd71

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
464KB

MD5
c34f997854c973f15536af3891570777

SHA1
53660166f7cf3c32beacec28ae9871c6d190d90d

SHA256
0c8a1b6b275e0bb057f7e9204beb912c12280a7a20650bec32ed3c3b0245ba4b

SHA512
e239d66008a15a3aae5f25617598eb19c6ab506acd600ec02ce450498fab74ff559de82f1eb8555f8268c0dcabefe94ee1df9e1ece53e75b4b8b848ae895eece

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.8MB

MD5
462326ffcc38ee7221a09ee3971bac68

SHA1
04578a335b20522da836bee5e990ae11de7c26b5

SHA256
8a9178137ae523fd2f91ae7267b81a083d0a05d05ae1ff538c7c124d149e383a

SHA512
95e3473624c4aaf4af1cc1910c8071d7de5384cea5042c4d1b7ded78103eec7f22e939a7a7959148dae4fc5a703af9e2f115c7beb200b2e197c965c85abc67ee

Download Submit
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1020KB

MD5
9fc131a138b0b38834f42febb7bed769

SHA1
6dbf74415eaa1cbfe381534bc46cc04e10c63d96

SHA256
272d2d9fafe9bc7405d2ec84cab8d8afd35f640d7a5138fb8449564ef4ec0b1c

SHA512
325c88565d86abb7f89f9a76e2a431bb17f28141392e73bd3958750fd6fbc66fb3bc93b89ca17373a895fdebe4ba5f7082f5f0f0fdedf62102d36e96bbfabdeb

Download Submit
C:\Program Files\GrantDismount.avi.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
377KB

MD5
f99bf7d2cc00e8e76e1a22e5ee0a777e

SHA1
6e9134849662b8ea29280bf6f7d9f283aa946f8e

SHA256
98ce4e84ff190856d6ded54155fe491fb729ad02433e0f31bc31800b06f55431

SHA512
5fccbb1104435d15b14aebedffdbb0a3825ec072881d33bc0cbb4c8aa03d98fd434258c3f7ac12dd3666ca6d4fffc6c85e63897b90a4de4a8e11192fc2b98c4f

Download Submit
C:\Program Files\GrantResume.zip.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
710KB

MD5
a2275927426d566e86bd24dca9c374e9

SHA1
fa824ccc434b97247f5226a91e6a0db789b1e20b

SHA256
64f910623a7e9e8c32597f8765feeac57f633aa691f66ec646c51c220fb92369

SHA512
042c185ef225df9456c311363c64a583b54187d19142b22e00db573da858c80c29977d1f7adef8dc67a7891d59539e8440e6a94150e3403ecc40a45d8ecff614

Download Submit
C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
173KB

MD5
34a60303e7cb9974725999842f910769

SHA1
c165d2500319b011ad14241464d6a0310fb3a005

SHA256
8e54f6eb03b600a7bf6f177ee686344e5a567187516c3039dc2de9b46338739f

SHA512
1cd7f8d758635919269579d0876d8fb90f45748f32ba2df2e47bc974efce6c1518f7c61d1a109f4d0bc12f9ed36bde843e9930262bd7ea9b01246763fb73d42b

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\java.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
202KB

MD5
29bdf4503e5a66ac3c95b21f4975dcae

SHA1
bb6a0b918eaa7c5e40543a4f4878a374a9c67866

SHA256
256b92d0c1dcf208751bb53b3019a9281b3dc9ed44dd5899eb7e503be3b5ff4f

SHA512
6fccfa1acd43241a3a04cc4854105cf48c17260341f80fcd535a8c3ce5c8ceccf97f2037dc41274e45ca06287f447700d5368950f3d85595e0f28a3f3a89c930

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
202KB

MD5
3c4c038313f7f88b34c8e25bf0bc8093

SHA1
93570348d3d0b24e2afd2d980509b851ae04d26d

SHA256
dcf9f629de543664ba2ab0ad2bd7c4ea70a22fe72d0f9e71cf4bf6b364339cdd

SHA512
35cd78787d0d8e72ca1bf43501ffdde70418b6342efc49d807b50a207f4733a60509360ed7a3d3c64eb602a2592c91ed78ea97e75a41c27407474d1a6f5973a0

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jli.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
170KB

MD5
0e08be384ceec0302bccf85ea24898e7

SHA1
eafdbb3f4675c730dbf4cca199b0a34c6ca719e5

SHA256
692e7d156c7bda496c9777d0d25a8e0de610c5335aa0f7af9b6f5f6528ac5665

SHA512
a45e6a0cd8fb189ad5d2641dc728c1404b7c379a513a7b104c6b4d53a3f3aac16b3fda1744d32c30e4a13d83865898c30c3083683f495f9a10ccdab9b3c52b5f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
192KB

MD5
cb1035d04ca0b2eb5e16c00b23de145f

SHA1
82f709a95530788f1a517477224603cad1afa703

SHA256
a20dabfd0d9f2e8d6b0bf54d405b60b09a801146198fd08df01340545ae8d3a7

SHA512
89f04dfc5c179d32366b39e45bbfd147f7dbd3682c92136b348eebc456628e37ffcb7d58208b10937490d92312b22427b150883111f95075dd35927adb02a8a9

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
192KB

MD5
95aeedd50b03c824565c921f2f622882

SHA1
4319a876c779f6d1f83d2d52a4b941488c728790

SHA256
9f14e962222d868ca40dd01bdf6eb0ef4e231058fe4efe3e537e89a72d3f83af

SHA512
75dc3bde8745e83230e1b80ab40416d0796210e27b27f78bbad71fc61d5314682ae601a194840aed19c7080bf9aee366049d915d513ab1212ad14c7428e9e15a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
3.0MB

MD5
000e02e7b49ab1547f8b69c6a3bbc344

SHA1
1f987614464143014db2032a933f6b3e53dd8459

SHA256
252aa27a4bfb2de3ad3b9f4f6dfa3c1f2085bcc3ba1863284e79a67bab7c689d

SHA512
f77e35b8d24e8dd8e48d8617cd5a15e3bb8d97f3f213b00c101be1f68a737369ad4f850433d4e3a947c0336729602ba9f60abe164b9580fb4b9053adfac5422c

Download Submit
C:\Program Files\Java\jdk1.8.0_66\db\lib\derbynet.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
260KB

MD5
59987d883d87c1fca822ba2192768ac6

SHA1
4f3050751ab17623446f389fb1bccb0039f866c9

SHA256
ed2aa4e7df371d55afa47f8b2f54316aa03f2b48440809d9da2e0fefd581c35a

SHA512
54b719711c04801f0f73cf553b1bab9bb25b1467c2368aa2b630f5da39f22b2774fe873395c8bf171455c10985e1a28a1f66a355fa2824dffdc533dea98bf647

Download Submit
C:\Program Files\Java\jdk1.8.0_66\javafx-src.zip.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
4.9MB

MD5
01d0d35fd6a48920eef4f62a2e8b0d85

SHA1
cfd220ef94404e495ff7e3b621e0339304649f73

SHA256
f3a4105283694438e886c602b2eab5c45772fd72f524dee7e08082865b796f16

SHA512
14556ee0e863ba46bdb3e908a254114ef7d7d251b359402c97d5b7ea7896752cd54477511a8f436e2ea396368b970d0d6d21db088dcf5634697805631643a363

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME.txt.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
173KB

MD5
e5a90a11bdbc849d9ef028ba0de0c69d

SHA1
9483d08559b1af4e1bf7624d8b0d7edb82b24871

SHA256
64351fe603383872d84ebb97cd4326f00c1a04730aa397704ae0e9dcb23df3a9

SHA512
534ad31909ad556fbdccb891ad2bbe6d467cd33647da886a3027e4b4ac0cece911468f7e9dfb6fd9a87d6d5f44dd87b4e788c1c578997931d345b08437c37df6

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\awt.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.4MB

MD5
9407d06e7607b3465c478c78308cd3a6

SHA1
ca851f2987121221e0dfe27b38dfb49efef5b455

SHA256
2950be22b12bc8c712f0061a9e1ff447dd57e8f396b1bfa98093c3d3c0184356

SHA512
eebada8fa9f27175a5ff2d9880c09c8d25003749dd3cc76df5061bd15510ae3e8c48f3b11ad9fb042e95226ea4e33334550daa65dc4731196ca472a2a3786d4b

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\deployJava1.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
bc67dfdca8b1869d77a0f81898e330c2

SHA1
83a079c122b293fe2233ce55f2370b1c2a640fc6

SHA256
fc76d441130440647b624c814c030de6cef848b2bf13dd7c4a39f7a9837ae7ca

SHA512
b5008d1a7e74e1c41f05e0595c3a83f4b064e1af7bb7c8881436b3fff6368de7233f3ef2f703d16341738b155af4ba351a3ac9c98b6b5ab0fc8ea84ba8c4e574

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\npdeployJava1.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
9ee7e27fd1a9b6d565380f0326438857

SHA1
5dfd82f6f72411da103a69ba0939062731cdbc49

SHA256
ced2b98f962345e6cf0d510d8f59b3612f9078fd7e714662b2f755cc1b9bc99e

SHA512
378fa5cbcc6fdb2ff64e12cd1bdbbab86592d5f6d9f2d5fd1f55ce7af337db7ebab4480971c7ce5a51a5bd7f11c8444c88a2d07365a266a58df5d2a7930bf7f2

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\gstreamer-lite.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
576KB

MD5
59550e97e2e84ab7aa65d2b21340351b

SHA1
87d4b74ffee406a361f42dc8c2d814c58244d89d

SHA256
b2a135f78a29c287440599166bfcd5226f639641af2d7b9ca1a56e080d37c5b3

SHA512
f7c3ad31885116081436ffe1579d7d3f71156f44e1cba76a32c171004ff5e44df89ca4c9719644d64a97b778336b0ba1bb5facdf95278d1c4689d173bbce287f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\jfxwebkit.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
6257bcb93f5953c03f15680d29eff589

SHA1
e8788bde21eede81f7beee9a7e0f78fe973ecc43

SHA256
16d5c2464d65e292712547cf4f7dfa904fe6a2063590603cc4fff816e86fac53

SHA512
2183bfa515b6abf5c601f75053d59ea8365bc6c94fac4671aaae4767c0a45ffd38cb573cdbc1490d85c304c9c63930786be5b10e91920333d13713ae55b28401

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\jvm.dll.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.4MB

MD5
452804d0b4fcf83fcab5daaaed33b91f

SHA1
c5250c37ab4434219d86d39f61934a5426501bda

SHA256
a4a824bbf98a4fdbc1a1eaf183849470d251d169a8be914fd42ed15511824107

SHA512
b1756a9579fe0bb6c85cd17dc933ac5b7612ffaa0e8b34447bbbcac8b399e8a66c32856960e85c45486c4d9c7ca5da0e736af07ed134dddb9a99332885c83a8f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\charsets.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
49ba0336778a6f457aa892a4e4bfe1d1

SHA1
91ea969130f6896019e7ff55dc6c08f8dc0c2f11

SHA256
419c1da019ac30281a14fd1de48a0eed1035cffac4439fe506c972701233d206

SHA512
baf4047bf4c74d169c24747c4dec7254adcd222074016a433a1062570e290415e0ccb6be282343626417dee4a5b7ee4c927da25b20ee3047bcbf83fbd2fc534f

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
e4e4056973584e58ccf62e09f062f194

SHA1
18ab9bf151cd6209f15729b39af863d093a15a60

SHA256
558fb504c88b2c0d03d692066c4515dc1eef1688951103652fdbe5ca34c6dc91

SHA512
74819b26672005d0aa25bbe67d5b66e5f9aaf1901a9d6519bc61ab1f9adefc847151aba768dcecbc82651c29be44f393720ead9ee6af3706aaf61ca5ef201c15

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\jfxrt.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
960KB

MD5
72bdbb939d4d7edab414b729920f5648

SHA1
4096a45a89606595b6a76b0fe4bb2daec65e4e05

SHA256
1417bc05a9b1eb3159970beb1b48b43a8f8e319e61ed1b766906fc7a5c4e8cd7

SHA512
6e2c234c088a9ebb828f2487b5fa2a09521478a3dc3185adfdcf1c83b8b4f37d368e2d8a01f2a3ed654955fba0850bdce8cdd49052e41e8c46df4b202b44014b

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
512KB

MD5
362b2b8244ebe9681401af2325c58637

SHA1
928b907d9cf6ced43be052b9d4d8c242703f4707

SHA256
d3057f50e9c8a1c67ffee34551eb1def50d5bab8b93bdcc5e3afbad02f9b8d76

SHA512
29e313677d464b3e830bb037bb27bae512067a812ae4cde401ffc81323c30b7260c5dbe547d64cb9c28fd5d61b8af0dc4790dc34a83a4a0d1ad6b5b93e54f1fb

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
8ea31d224b471a0131d369afb7185d2f

SHA1
c9733f03ebc6cfb84167bd52cd00150989e61ff5

SHA256
20842d6c24166062e3ad36ff42000876802b84533bc2d54f445f500a63052050

SHA512
9d9a949f55da6d35dcf8fe1621e49afc8e32e0492bec006f65ee843830ae66ab466f7cb31403fdeaa9ae1feb46ae9ba9cb29485c4d817c7935fa6865105a5047

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\rt.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
1.1MB

MD5
a153085dc4a18b280cf722a3e998e593

SHA1
cac0ea9f846a59e781935e14d0f6a67e58c0d8fa

SHA256
22be246ad3fb6c6308a7b9426aafd14e96ec4d9a61d3f95456897b8716b3cbcb

SHA512
8caf9fad1dc249a9b05c41eeb0843d8578d3ce6f13f55f6a2e07ccd2036aea8b84684844b6dfb8ce83d2b385c8bc9be15bf4b62bd567cb02a3250621bae1dd0a

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\ct.sym.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
512KB

MD5
45392d279e807ded1276e13815e98f26

SHA1
4a5864f86488756a9ae270c1818217d4e8bf780a

SHA256
a518008d28e0de474de8599e3bfda32567355277c64fc8c79b586c177b747a52

SHA512
3a262ee957952e08770c03597ae56087446b1bbf1229f9bf24ef5eee9a9324ff16d09caa937e475e32d675bf2742079d22afd6361bd18ce0eadc6a93e0d410c5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\jvm.lib.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
a713608c969348814f2b5c188bfa272c

SHA1
cf0ca68df0b93701dfc7753679e84d7ba714f49f

SHA256
519cab26646ff7c55988d6d2d5a2f594f4d47715587bc857feaaf130d48ed76a

SHA512
8cbb0a4bc5e128196734442e564e10e30fffd5a97b87d8aaf95df6b7f3bbfa323c04b205a3227afdb72d62c649ce8c8a4dbcef659bc90d7de0507c20a0237cef

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\tools.jar.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
384KB

MD5
4d5df76e175ecc5113c454e03540c62c

SHA1
8933989725b53a7899998e9f3fb588d851f16ca2

SHA256
db0b4b32209390a3ef303f892968a0ec5594f9ce1d0437266861dcec521a4bb1

SHA512
04aed2ffce4fb2f168d393e352c08623ea2161df13ab83c723a144a19935b4c395e0fba47162bef2be5027f9220a441173a4fb0dc691e703e81449da341accf5

Download Submit
C:\Program Files\OutPing.vsw.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
416KB

MD5
afe0b6745b92133218d4920b8eb5dd96

SHA1
903c42ca86758f5e3b74e98f1f989f216352abc4

SHA256
eb9e6d6d240159970aa809b834c2a7fcfb10de139b010f1b0236ccbb07c4b528

SHA512
02db8bc973bb4054033c7ca174c68b16aa2ebf6483f777e26eb31985964b98e35904c7084230d421de9bc5de09fe2ae0d17b1aaa4da20c32d5fa14dca838f0ad

Download Submit
C:\Program Files\OutSave.bmp.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
684KB

MD5
f590c470a92ce14d922a08c5ac597ba0

SHA1
1e1ff8921e3eaf0577222a73cc7fd6b1bfb23947

SHA256
735b3604450ed2b0d7438a04c75ca02818977203861ee79381b8403b924a01f9

SHA512
97c4beffb28082a121a1dfdefc13aac3fbad0c25b28273a6c62691f5205b5d6e9893176c0c02fce9158d1b13d0413bd5981b0dcb02279312c671423d63109e17

Download Submit
C:\Program Files\RequestConvertTo.vsdm.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
984KB

MD5
60a07bb1002e9b638b6ffdc840eacb59

SHA1
dd7dfee7a3ac5804d096e240265b874e8b869a4d

SHA256
4ee68b6eab9e4a503d21ecc2156bcc5a6d56daf84875ce2d768b6f8562d64eda

SHA512
e05027f3eb26a848f91d2aa424637e86848cd85d4080e4134cb1e00868af3488fa5f7b8ffc37dbab4d09598655746dfe6b2b72ca10d760cf1d410cd3acc149e0

Download Submit
C:\Program Files\ResetAdd.xltx.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
262KB

MD5
6066a9e3de458289c1eb535778121599

SHA1
804c717dd52c0c9468f71d1b5cc5b2f538455f7a

SHA256
a63121c5bee09fbe14c3226ca58bf9e28d5dffda0a911b5bf4f2f58bc47384d3

SHA512
4aa44286335fa3f6bd067705590af30c2a137ad7313e4e5e84a6244307c53433eaf31758f0cfaa3caa9cbb089092c790c23993b08b735059f96053e8b24215ef

Download Submit
C:\Program Files\ResolveInvoke.odt.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
313KB

MD5
26612eba4c75c74245ce0b45c529ec9d

SHA1
726aaf0f0ef88043067622fce849e46a87322b2e

SHA256
c15e8514fe2ec8f7ebd5962b8677b22b15dede6419fdc30ad158d99f864a3ff5

SHA512
97666813602cd0da7589ff481e791b3e8693f62cf6690d87e56231e74439baaed6a7d4f5e3df2f0586acede261e22e584d36bb64185c8b1a5710fb9c954ba402

Download Submit
C:\Program Files\UninstallSubmit.docx.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
275KB

MD5
a4fccb7f38dbbb6f650b923e60d7e36d

SHA1
daafa026b185e4826804b1535771ad5b5ce4f9e2

SHA256
b80dc1ee880045f147a0bddd905a439732d35e930be387878eda6ace19f255fa

SHA512
87f89a9b5b0a9d6dcf4c18f12f5e3b16a0eaff81d279c86e1bc1b62b60aabd9588744acbbdbf87464cc7786b7a0a65287fcaa4cb859b5ff78e9ba5388edfcca6

Download Submit
C:\Program Files\UnlockConfirm.tmp.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
288KB

MD5
1602798f4f82682887ece693a1ba2b74

SHA1
3657ea0ce0077acc086887cbf2c43cd9a1840286

SHA256
3e85bc09c9162a3cde55e27558205eb901bf143cd9c3a6b806f13e76c9b1c5c6

SHA512
c36fa0548014e14be84e58d880a61cb16085d85e09bda05cf395e0d1fa2b7c2cb84030d21a210913e017df62b78e05e9b798543cfb78e524efaf8c98f5a984e2

Download Submit
C:\Program Files\UpdateGroup.search-ms.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
249KB

MD5
4a12f1a0269691c96b5a35b48fa61009

SHA1
4e6ec2c33476e9244c67430cdaa68f9b41fe4b4b

SHA256
113a1d69ff08808331ef6bdb587d1f0c457e69f0769c62a4b6b3f901efcee8ae

SHA512
97af7e9dfcae3b83ecb11c76b5abde91ddc2fc88875203ea030e742b17ab7bca0c26764ed6e461a8b98d734a3d3390233a3e7569ff42f4464c1f9ae797f280c7

Download Submit
C:\odt\office2016setup.exe.[[email protected]][EDRFL1H4KVGJW8O].Spade

Filesize
5.0MB

MD5
a3c636f5d572790e440e235cfb82b777

SHA1
e22a1565b3ff54739b2afdfae49e8c9ff589639e

SHA256
1a24dd0c6064d2de1bb8bd0909f82804bdf277addf43d33c06ed41782e9e70f5

SHA512
127b557f19124768ae475ab8b1ebcee53da36e09157548a3ff63c03ba6ba06830687e2c58b687b73744aa537b6bcb0bbce2e4cf23caf0f53fd0ea09f5ac3c85b

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit