cerber | 078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7

Resubmissions

25-06-2024 05:57

240625-gnlc2atdra 10

24-06-2024 11:05

240624-m7azasyemd 10

Analysis

max time kernel
53s
max time network
39s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
Size

754KB
MD5

1663e8b6180030793b432b0829222536
SHA1

9751d0f4df34bdfa97b380dbf2f082d8171bb0d4
SHA256

078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7
SHA512

a328fcce7fae3a187b1b6e0ba6cd3cc7e18c587d7b6cfbaa75540c69879fb5cdfa591b979cebdc64e91cff294f67a770eb19d596f6efde0e232b050877084c6a
SSDEEP

12288:7tG9VAdkXKy900ZW9Fiwv+OeO+OeNhBBhhBBNaJqE6/Ix0fpL0qZ+WJEglNsTVZF:c9unCaJq5AafpL9+JsWF

Score

10^/10

cerber ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\__$$RECOVERY_README$$__.html

Family

cerber

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>CERBER RANSOMWARE: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: left; word-wrap: break-word; word-break: break-all; } .updating { color: red; display: none; padding-left: 35px; background: url('data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=') left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">☑ English</a> <h1>CERBER RANSOMWARE</h1> Instructions </div> <div id="languages"> ☑ Select your language <ul> <li><a href="#" title="English" onclick="return showBlock('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return showBlock('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return showBlock('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return showBlock('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return showBlock('fr');">Français</a></li> <li><a href="#" title="German" onclick="return showBlock('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return showBlock('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return showBlock('ja');">日本語</a></li> <li><a href="#" title="Portuguese" onclick="return showBlock('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return showBlock('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return showBlock('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> Can't you find the necessary files? Is the content of your files not readable? It is normal because the files' names and the data in your files have been encrypted by "Cerber Ransomware". It means your files are NOT damaged! Your files are modified only. This modification is reversible. From now it is not possible to use your files until they will be decrypted. The only way to decrypt your files safely is to buy the special decryption software "Cerber Decryptor". Any attempts to restore your files with the third-party software will be fatal for your files! <hr> You can proceed with purchasing of the decryption software at your personal page: Please wait...<a id="megaurl" class="url" href="http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/" target="_blank">http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/</a> At this page you will receive the complete instructions how to buy the decryption software for restoring all your files. Also at this page you will be able to restore any one file for free to be sure "Cerber Decryptor" will help you. <hr> If your personal page is not available for a long period there is another way to open your personal page - installation and use of Tor Browser: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/ in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the search bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use. <hr> Additional information: You will find the instructions ("*README*.hta") for restoring your files in any folder with your encrypted files. The instructions ("*README*.hta") in the folders with your encrypted files are not viruses! The instructions ("*README*.hta") will help you to decrypt your files. Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions. </div> <div id="ar" style="direction: rtl;"> لا يمكنك العثور على الملفات الضرورية؟ هل محتوى الملفات غير قابل للقراءة؟ هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cerber Ransomware". وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا. ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها. الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cerber Decryptor". إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك! <hr> يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية: أرجو الإنتظار...<a class="url" href="http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/" target="_blank">http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/</a> في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك. في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cerber Decryptor" سوف يساعدك. <hr> إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor: <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/ في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه. <hr> معلومات إضافية: سوف تجد إرشادات استعادة الملفات الخاصة بك ("*README*") في أي مجلد مع ملفاتك المشفرة. الإرشادات ("*README*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*README*") سوف تساعدك على فك تشفير الملفات الخاصة بك. تذكر أن أسوأ موقف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك. </div> <div id="zh"> 您无法打开所需的文件？ 您文件的内容无法阅读？ 这是正常的，因为您文件的文件名和数据已经被“Cerber Ransomware”加密了。 这意味着您的文件并没有损坏！您的文件只是被修改了，这个修改是可逆的，解密之前您无法使用您的文件。 安全解密您文件的唯一方式是购买特别的解密软件“Cerber Decryptor”。 任何使用第三方软件恢复您文件的方式对您的文件来说都将是致命的！ <hr> 您可以在您的个人页面上购买解密软件： 请稍候...<a class="url" href="http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/" target="_blank">http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion/bt01adb68c76a250e7f1d8cc74e92f62f5d4183b9ad97ab9b8b43721ac0ef61a2385e3849256668275da615402993d16f0f1712af3624dd9a870c44d01ae9517258c3b6c66b92ce0dbaca3fa129c8c18dde484b3961fb5df8931249ca2f17905453355b903dbff74fd273b6d1330a54796652541bc3e75b9171a6261f194c179959f/</a> 您将在这个页面上看到怎样购买解密软件以恢复您的文件的详细介绍。 您也可以在这个页面上免费解密任意一份文件以确认“Cerber Decryptor”能够恢复您的任何文件。 <hr> 如果您的浏览器无法打开您的个人页面，您需要安装并使用 Tor 浏览器来打开您的个人页面： <ol> <li>使用您的上网浏览器（如果您不知道使用 Internet Explorer 的话）；</li> <li>在浏览器的地址栏输入或复制地址 <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> 并按 ENTER 键；</li> <li>等待站点加载；</li> <li>您将在站点上下载 Tor 浏览器；下载并运行它，按照安装指南进行操作，等待直至安装完成；</li> <li>运行 Tor 浏览器；</li> <li>使用“Connect”按钮进行连接（如果您使用英文版）；</li> <li>初始化之后将打开正常��

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Renames multiple (9316) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 41 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\SZUP0XFR\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IS6UL1FQ\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SK0QRJKA\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\1PJQWC5P\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4I7XWM59\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\Hearts\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\Chess\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\N2LZJYLW\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	F:\$RECYCLE.BIN\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Ringtones\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YK6DYF6H\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0251301.WMF.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.TW.XML.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\ShapeCollector.exe.mui.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\PST8PDT.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\THMBNAIL.PNG.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeLetter.Dotx	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Web.Entity.Resources.dll	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0089945.WMF	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_es.dub	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_fr.properties.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\System\msadc\handsafe.reg.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\SEAMARBL.HTM	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\gadget.xml.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TR00178_.WMF.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\OrielMergeFax.Dotx.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\slideShow.js	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Defender\MsMpLics.dll.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SAFRI_01.MID.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Java\jre7\lib\tzmappings.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239079.WMF	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\TAB_OFF.GIF	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_zh_4.4.0.v20140623020002.jar.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01474_.WMF	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\rtscom.dll.mui.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Internet Explorer\perf_nt.dll	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Currie	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\__$$RECOVERY_README$$__.html	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.resources.dll.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00346_.WMF.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Services.resources.dll.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152688.WMF.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\msitss55.dll	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105336.WMF	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\deployJava1.dll	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Lindeman	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\__$$RECOVERY_README$$__.html	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif.locked	078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe

C:\Users\Admin\AppData\Local\Temp\078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe
"C:\Users\Admin\AppData\Local\Temp\078de7d019f5f1e546aa29af7123643bd250341af71506e6256dfee8f245a2a7.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:2024

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\__$$RECOVERY_README$$__.html

Filesize
56KB

MD5
8d443b2853b7b51dcfd443cdd5cc850a

SHA1
3e447020cb49802a5e8bdaf9196804d6f3e7d624

SHA256
be482735d367bcc1bde21192d0efbf38a2e6f27117b812db609f1f1351f26201

SHA512
bc86102b1e3a2bc8920e419bb837857be4666508a33c8bece02ddf53ebc453b3d15d33f52432701a8114240afa3ccd6504deb6bfb147582da63468e9f258f756

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.locked

Filesize
352B

MD5
e9171607d3826f4a0974c814ac9b78b6

SHA1
2a2cac9d414f596efaabd202e797eebb8f796f1b

SHA256
2674196cfe3faa573bfa310f56ed569d7b192c184e295fa4a5105cfeebb619a4

SHA512
50617a85ec1374bc2f7ad2961ee061824bdad50da5ffb7ec804b13bc7a7f831bb4bcd267c58fb584320999bad5764f978fce2fba79baa24eaec2f772ec48b036

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.locked

Filesize
224B

MD5
039b2ec73c2dc8aa5706e2530726c7e4

SHA1
2ccd9b23dca914d4d4bc131a5e00eea8b8b6b319

SHA256
781107632742a182e583096d8246d53be73c209f7a393cea8b8b4eca6c369acc

SHA512
2f622f0ce80e868f1a88080dc55a8916ba7a21c3ad8d05a651745c5b291ddd34202dca85cb8d14a73ed2d368c84f1a65d354547b1a8c2f3193980bfec765f52c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.locked

Filesize
128B

MD5
4ebc922258bfe1c7e82e306e1b370ef8

SHA1
7901b01b181ee3cdcf7b055b2ac859eb21df4bd3

SHA256
04ee6ae2acda0ee68901bc250aed21eabfc888220212d2dac67f6516dcd635c0

SHA512
3b17a30b178f20df41af043c6c9c79efe83560f1f36f02d57ead572e5f9a7381f5bc8271853bb290a046fb51479bc3ce9a896f2a6d97f7e04e251d9355acdb2a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.locked

Filesize
128B

MD5
f92af7147ef2522d9334c7651e4719a1

SHA1
d515e59529ca02dd547ad6e99b2f4f0381537480

SHA256
273847c0ade0785e4879dd44ac512e797e1dca4a49008fa73c868c172449b4c5

SHA512
963042b711cdc483038d2539ec898fdd47e07afb12a1eca02778666744b1603f083c3c0df59377b8315a2c9d77ed2a4e80f953859180a521ecb61bebb176ec35

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.locked

Filesize
192B

MD5
54c2116d24ea7969dff01d89cc6c0275

SHA1
3bbbbfa45bb0c2a1973b3932b46ea649674b15b2

SHA256
a8d92b13dd1fd17b90277790a006a4e04d942fcec9ea09c600da6c1f89dbc34a

SHA512
bc0fe77a93c8fdf7389a6629c955668c389391ba8abdae6019166cca725e0bf7ae7e10bc92468f412251e4ffb63d938b7241ac23e8854f78a584c3719921a9e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.locked

Filesize
512B

MD5
4fac33998243af5a6b818084db3a5dc4

SHA1
4f7e374a51588dd70f76d017ef683cca31f88706

SHA256
ff004bf59effad343db84f8017f9e0347a02119cd7e02d7e3dd385894f08c485

SHA512
9a4461bc930f526c6d0670fd2d58c9dc85365552bf8307e3bb47cd738dd9cd323b7fb8be93f2e723234ff77a08971084806425e46a739037e7cc4768243c9305

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.locked

Filesize
1KB

MD5
41f530f80e992cbab96cc1d3383f127d

SHA1
fafcc8120f7c8880f6db6f723030c1513f4d0d39

SHA256
7925aa30eae6a9be656bf7b00f7d6e8f8dcc559429838bd3e0aaaedcd0ef6e16

SHA512
82811e2c5ca83590b86cbaca6c05eca43eaa9c25e4faefd2b815883cf9e6fea9050ac270fc09184100ec5e106f7579e11537de4213d46cb2f7c1479a7e20450e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.locked

Filesize
816B

MD5
9a3fbedd7c0e4bfe5131f5d6f92a5807

SHA1
434adcc8f5da59f4a7d9d12f2fd72b6ec2206b4b

SHA256
af9a9a99f22f30b827a56fad951309c74147a7530a9ff0892765e1917fae30c7

SHA512
83810b518accb1fde0b5641217149360679cc05d8f407ff6bf43bf5dd2d0c09b51f71a4089ab05f302c49610b77513da465dd4fdb5d4aba0544722912c241242

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css.locked

Filesize
19KB

MD5
357f3e89398935d20065bc3e90cac51b

SHA1
ba5a929a2b60478b53b0b7f31f5f224a35968c44

SHA256
6ca69d0adc9797564a36ee30520aba5448d8b2ed41a5a1fb76d8c6025e879019

SHA512
0b89a2af443eada97065df776a0e6eb413408680e472caec1c6eacfa291713c601d5fdd6858e839b9888c808dd6ccd3d3ba8650174bdd5cd11629341f6ee081e

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.locked

Filesize
5KB

MD5
9e3c286fb48e41b398d83c762b66efb7

SHA1
4997f97a051e7493553c4add78674cc65f1264f9

SHA256
4799b6c06de546178b6383dcff31feb55eeae08f985f6da7402206b6bf3368cf

SHA512
d6f3a9577fb3ec788101eb9837d458f59838f672cc54696a8143895a27ab4dfb79b33094aa291cafaaab9e27da6c1b8c059118f438bc3f6ea93dd87e7728fadf

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.locked

Filesize
5KB

MD5
6025a0e069f039802ddd1e96be97657c

SHA1
54c2456893676e70cbe1190b7d0f883bae394fb5

SHA256
655c080d983b125003862d90ec5a2428a0cd91e719c3642577818a230c385599

SHA512
daf9b68adfb39c1a7afadc1215cb816078c200585290d26ed7664dad18d9dbc6f6aa10a9c1929b36771191c0902599bd8410a875e2969f2f64718f2d602bdd70

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.locked

Filesize
4KB

MD5
fbfa66fa613765631bb1e8c8477458a6

SHA1
1657f4463f5b3ab7924f3c4105f9a7497dc3f231

SHA256
cd9cff81a246a44b9edffb5c91cfa77c43aa9144424ac48d44fc705e0e3f10f1

SHA512
89541487cb011d7f60325b06cf328130ff43ec8c003ada18e5e9918c88549958c6d95a0577025a120a2227d0d2d0ba9531b70ef49a21bf4cc2ef843df0434264

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.locked

Filesize
4KB

MD5
f0af7f0ecca321588e3122787ac65f3a

SHA1
1ac8db43dc4084b35057bf37ecf3b1be0f907267

SHA256
6042c80d881d596cce0dae6f638ba601895aebf3d300fd240aaeab451ccd3348

SHA512
231e94209af4582273da499d32575960edc2c709e15963f44db16c45fafc8d8c3682eded703ac4c57147c098a3521877e53bfaa29a8e6e6fe054e72891fae50b

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.locked

Filesize
5KB

MD5
aeaa40681a119f9a239242c6ca16d8b4

SHA1
4df7fb794ecaa30af33a99f45661072fdf6d8da3

SHA256
dedaa53e564239e1642d4e089172ec63cb96afd84cce20d16413a90d16d642bf

SHA512
61c996819f1ce107efbb4370536549451c265beb5a39c4e881c8943b4504b32c8cedc5a5573e577006456b2f7635b6b79f696e9be26e6784bf9dce93035f4311

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.locked

Filesize
5KB

MD5
037c84181b42370b68e9ea5d7a160795

SHA1
573e26cdf17795a8456342e25560e7097b3573d6

SHA256
55cb9bc52effe03dcd83b20dc100ef5b9306fb1d44b2b9f334e6d709137eb801

SHA512
acc31ed72d3a3b6ed2fbb702df5dddc8b9659de455df8260d42a51731fa0465f10759cabbe4cb2f8ee811d656568026358811af0bcc2ad6dec7ac58a0b9edfc7

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.locked

Filesize
4KB

MD5
f6413ee6a09008b4929317e51c92c00f

SHA1
0c2e67f9a51afe61e98219658221a9c97f5fad70

SHA256
b1916b817b818811b1bd26d4f641497930d5198574f4d25c05070d5e5a67793b

SHA512
9ecbd31335a34d152769c3cf40998803b13dab25df57581c84f30019e207cc14c398f0828590aa2cc79fd6ab726aaac3b40db873a0f47ae74a21ccb1ba2f527c

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.locked

Filesize
3KB

MD5
9dcfeb16c9c7b78650054ae459e218cc

SHA1
eca76e37b0b0066bb878f6bba5fb6c052323b3cb

SHA256
920aad40914a52540540b4e089c0ee3ce3dfca43ec687e637f2e1ac4a394348b

SHA512
3790ddce48e573d68b114304dff7fd35e1eae8b57dac2a536ac316fd0300318be41cd93cf310c79afe70314c02632f373374b575263cd19e859263d1b03b7723

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.locked

Filesize
4KB

MD5
71556685babbd4084f3195389acab092

SHA1
7faaaadd12ab53d99e1c3304a3a3c15cd9bec2b5

SHA256
b3656dacc93a6241bc36b7a0f8e61e0f90813b288ed9aedf72c6051f66c3f78c

SHA512
85e83be8d10ce44f6eb349185842ffbe6e9a4d7c517b576b4faf281cc79606a64c73533ee01f43e4921bfeeb3cb4d3da778192d014eb9bf40d84e8b5e475e565

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.locked

Filesize
3KB

MD5
2f67d9bafb6a5e260d9431b7dc289652

SHA1
b7be977cb086d945cf5ee060658c2abf6b7ad735

SHA256
8ed7edbc57fd60d05211154b5f4ec8b203fb90143c3efc7f76ce53a26b05369b

SHA512
b77c1e647d3604512fa3b1cbdd2f2309bf985e8e85bf697693ebe57a1d86158c05d75025f442c6091780e6deb81d54237b9d6bf273e5ae422490bc3fe2e0bb1e

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.locked

Filesize
4KB

MD5
8f3583f4cb5ccdd128da01f3c11ed324

SHA1
6a5791abe60ae0556e29afadeed37864f38df84f

SHA256
bb5a3e561075d5cb11150d7fe142b9772e16ebd6ba752dc53e2e9fc42f053fd5

SHA512
9b55ce4a2bcd4048b2f5b49fbad7999a0c25fd8ae4fc8b2572f0e9fc0a1470fdc287f3ed6b71df5a8ac1b6b400f7be91e549f7be21a0280f9054bc5a02356471

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.locked

Filesize
3KB

MD5
8394e7394a2ecbb3daf9fd0cecb6985a

SHA1
b9e14fa2a1cb65a9012cb065376b733a3b73775f

SHA256
e0d656c4583b25ec96598e769263ce39720a10e6e65a6b85d45ee5839cec604a

SHA512
94df89fe63ffdb49c234b9a33cd905893aecf37439d63c00960d6626cbd1603e68347b20ccc1416a0b2a8f4565e3c1f3fd0e648598792f9cade85445e3d15c1d

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.locked

Filesize
4KB

MD5
579a43ebb86a562a2b82caf77099d4a3

SHA1
45885618a54bf8cc64b067cbff37f5ee774cf993

SHA256
0e83bb0d1da522568e72a54469fa3ae701bad7223a12d3b04caee0ef2bbf2008

SHA512
d4ca2c4a378d4872ffbeedc3f4c2228ab269ab0eb8c5c14ca4d63e5cf574fcb0b0557d54a9c4275bbbec94ad118d96754c15e2155fced6e0c2ad8fea0a438825

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.locked

Filesize
2KB

MD5
64cf1519dbf45937df0adae775e1d399

SHA1
e2bb3cfaf7a8f5b5693eab1aecf46a5507ef4b52

SHA256
6c0c8f194f037fe34211cdf117f6cdf8dce733d15929ce618560655121912023

SHA512
4b0ad03acf2819cfce82c5649ab8d00d372ea71575b278bf26ed2fe378f957308ca6b717417105de6ff396502ae4f52a8589cc2e14b5a07b2a7bcee02b464e38

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.locked

Filesize
2KB

MD5
f7b7f2ca3142c82dd0c2b7456671f2d6

SHA1
9c5f8c903e6ff4c1ce080fdd833b8350e28845b0

SHA256
379bd082ac4d6433ebd3a885b5d9bd0e59db91e083867930ee3e300f16ca1210

SHA512
bc482d3d12371a5d1c12f5acf66ef15648901108e73185be75110284ba6686302af90206ca9b344a14ba4b492497f168b86b73d7103d44cefa6ff2dee76e9421

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.locked

Filesize
5KB

MD5
d3f61a1bb66e73a1197e15254402c053

SHA1
253e25c6d687c5f9c62405b3bad968dec6ad384b

SHA256
0370be566982650e5378407aab2ba4e34133efe39e97f2afee10bbc5dbce9b5d

SHA512
8da3b4bda917eaa92a53997f6b6db351fcc1ee5ae0f92969dc2a7ceecc8ab0bf89d222cb57f9d9b1c3d8051ca1c9004bac85dc031d50b686bd77a0b1283fccf4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.locked

Filesize
12KB

MD5
5dac9d035fce935a6b9e5fa4b8986e2a

SHA1
74215ceab51d4dd1a3931c0397946ef0a996f275

SHA256
73c9e55ff16f8d4677888694f4c82735e82a09bc3dec96e951e6d43a19ec22c4

SHA512
b161ea279cd36e51af5d3d25c7f684c44c902d9c2d881f4a0a3e50aec8d5207c445df4592855c42c260278fa8a03e5ee3fd6ecdab1f63731d57d777d0e4825d9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.locked

Filesize
8KB

MD5
401db631dca39c64d877313f6e86d719

SHA1
e2cfd366adb2e75efa529eb964c871aef327045b

SHA256
105dbb471e6072a27b123aebc254d8b8e053bbe310b305b0a7c6caf210607820

SHA512
77a1752e613d54dd1d6440e0f3c72f2e0cbefa1c2979d293479a175e5df55d4f8d0c342c64aad4d03ba5d1c88dfc561aefa07d396acfc702ab3e14fedfdfe438

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.locked

Filesize
64B

MD5
4c97fca730e2919478be9c8ef0f06382

SHA1
9966e744678f67f4c738155ec64eca3964fae9d8

SHA256
f69436fb7a7bf2e428a3d8dfb373d9cbd50479c659168f45cc2232ffa5b6de00

SHA512
3f0c38e210552e7a772ec2092882e97c49a67f15e7628d97b031913a139f0bf681a8e006917842d0e179e880af149b9e734db7431f155e008679b273a689d801

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.locked

Filesize
7KB

MD5
cfad1cd06d5c37ce9f3311d272a0e4c9

SHA1
232822c9dcd3086919dcca79bbb424aee9900abe

SHA256
248957bf26c53993e4274dfe1a9d5a6cd31bdb1c84aec6e5deca513837afcc2d

SHA512
a8e28924b62bba4e7c3868ca4ed68c47fe730112f1949cd95cc82798ea1127b0c7af444f653d40ff6fe43790fa5277b19a4afcf7332db984f0be4e441962d5a9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\.lastModified.locked

Filesize
16B

MD5
7b53062e7265f5d4a35fd1e1efe1e8f5

SHA1
9b5b289b659a4700615206c02993e066015b69fc

SHA256
16d081c326ec351eda9b404971cefb10a17af35d90485917ae1dc35579fed5bf

SHA512
4247f41314c1596565332f599407bd0bf249a8a2159a7c9b3fb81e2143a016f3413b401979aced4241a3ee191b5f17be703cf16bcc5c4c8f7b9e5528ab6499c5

Download Submit
C:\Program Files\Java\jre7\bin\plugin2\msvcr100.dll.locked

Filesize
809KB

MD5
adde9f854a57de1f7be7afb70c4f4f3c

SHA1
14ce41f4a9a145e2a2f8c6c91299014f80c0d419

SHA256
78a1d899e31ee986fce92f0c68745c93ce71c64ae2667b75fed99bba1ba3e9e1

SHA512
1b5ea31b7881a619f5ea15a711b5587c53543e9f8b6d48232c5e3554684d84323198c58801af2d7d9897e7485857b151aafba44165862fb011b30f1de382cce5

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.locked

Filesize
160B

MD5
1ab6dea3637f4ad2772249bdb5c24f9f

SHA1
f7b7a86f9e2f3f7a5934022c1b2293ae38b4d6e4

SHA256
5f1dd9c014eccdfa0a94f6383f97499c66767bb57d744244e2e2fe3cdd21ca95

SHA512
9232ac420d7ac4c328ba60437afe07d77e1b17b268bc94ecb29358f5f3864c8a325651fa0a348c7270ac2e90d3e1acd9e4fb10f34b3946384dacb6765f8a361d

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5.locked

Filesize
32B

MD5
be42db5582991727548c883c88c9ad76

SHA1
fb49c0a2a6e1020c4edd8de39b9699a909b3cea0

SHA256
afeade1ceec2c0697e4e22cbb41864ba08bc52700cbb88930900a520d6f8fa14

SHA512
a5cbba7ba26d5dcce13d138d50e86ef1b4c0b6f3504ac51ca9a6baf7199837cca98f5e98fd4a0ba385c7bc10bb76882d884235ab5e5ff769ce9c48427d616f40

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT.locked

Filesize
32B

MD5
cb124e5b4c7412c612aa679e74900489

SHA1
d272c4a37a2897d5c7cc784dbf13d4d9238edfb4

SHA256
595f9badcd6da88d819b22871b25aa15a5a2b12a63b430f64bf9e8e16cda0d0a

SHA512
0697e33a005c4c275e68616ae6b0af0663a3402dbb69bc58b713bdbb9d9e2bf7c189272b72e86155eedcd84169842ac0ad0f8ce036a0150d4cda8f855245517b

Download Submit
C:\Program Files\Java\jre7\lib\zi\HST.locked

Filesize
32B

MD5
7587f442926e5c580e5c8667210bf5c3

SHA1
e837e0eedd7771e8bcdca71a19b61cb9870ab0b3

SHA256
40e5bdc39f9f64dd4e1278d2ac757459ea45a7ebaf52397608773df61e564d40

SHA512
4670407f824eb81836e4697e0bcddb1df88c20a93fbe6e93b62b5a5f99cdee4a4fd899ddedc3f68b613cd763051d6f75900f99ee40f7ae53df50a5af123165ab

Download Submit
C:\Program Files\Java\jre7\lib\zi\MST.locked

Filesize
32B

MD5
1998115a534779ca4c36e64e7c78b33b

SHA1
4546c210d869220e5f2d571bc666835356ecaaec

SHA256
cf9f99b317dbf8398dacb1846cb4d50eb2205f1f966ade1027a10aaaac58e407

SHA512
be8dddf8cc13205d9aa9e48da06847dd89837b15a9053747010755e76ee327ffe6fab3c26211c23cd1a0dff49cf824cb3be62f809fc630fba1daeca47899c50a

Download Submit
C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.locked

Filesize
831KB

MD5
a1a3340cd6d7020aff4d017acf92e69e

SHA1
2e25e22b3126d131e88863a0f7ca452adce3a902

SHA256
314653b8ac56241609020cb48cc316f6e08c8a0a0ba6207010ad16ad6497c0d4

SHA512
971de73a58bbef1796c273cdc1d2d8a540570408f157ae58dca7e4f5d20ddf301093ae5179059f99110a4686e988b1faff59c1ca3d2760b293e1e67fd465d5bb

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.locked

Filesize
1KB

MD5
57406c1c4b213caef67657c9eef3d97a

SHA1
a6f177961a5c4db78c527a5eedd275cf35840c78

SHA256
16c6e65482b89f86ca09d6c5165daad34c294b0dbbaf60e25963ea683ed69dd3

SHA512
25d40d7f3aa29648a78e9910b4fc9e6fa4e64dc3a12d74faec497a98be2e29b3cdf7132fda822450359101e8edb80d95dd2ca0d9ccb014f1fe051bf656b5c40e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.locked

Filesize
4KB

MD5
23366a074a34cfdcc264937c58d8e4fa

SHA1
da20235e8ae419e5f5998c53dcd0a1e111e40e4d

SHA256
21f058c2a335477bce72c9a00e06d3d984353ae60854527f1d59f4c28328191e

SHA512
5c4d809c30a22af5140b8984cce7b5f878a906bf4667da7b2e764c0d032ed58f9549106876062f4cf34a6977686c8198343c7eb282826e02ec783e661083e036

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.locked

Filesize
4KB

MD5
dea5050096554f691e856de5bf7b6901

SHA1
e91a1d3e48e6fff1c5eaf4db83c20b19ca2fc78f

SHA256
da0016c2b971c43dda227fa5bcb9a48d7ee04accf0981ff06c134a2985118b0b

SHA512
f28be4a76da3f04db6d6bdd72d047d61c8604c94a469f781bbe55f0793955751df1cfff1a0b6eb56b94e92d5993b380d0379d064648e628c4f775223770a0f86

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.locked

Filesize
688B

MD5
00158c0f4f9470a3a2ea5d03855fa5bd

SHA1
60a9c77334e6a64ca482e9d961ce80cf87d8dbd4

SHA256
61e6f03f8d93e96f8606119763aa6e62d6b1f586ae6e2dd1075fb3bfcedf5666

SHA512
899eed2afa9a2a70bcf5cc288c2157ae4f0ef29e9eaf7b68969ef5458e0e338fe7da0ef04b6888799abdf082dbb2253d35113ae8eb699ddf12850869c98965c3

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.locked

Filesize
1KB

MD5
c59ca2380e25bd36d0a474d39391e543

SHA1
85ea5fbd27aab090719c2dae9501c8fd39ff2a4f

SHA256
6a455bcb859745963ef20ecf8f2c3fd803344138b4ceee41d25c4e6fb7b4ffeb

SHA512
86ba87864273beb63d461ad27850993dbda67493c9984edc672e290391362ef7bb5729659659cb142d58610257da73245c0b5a6639a5c2a52c184cffd18fccd0

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.locked

Filesize
17KB

MD5
a4bab82a21b3b5560167bbef5096dcc1

SHA1
2190666720aea6a4a277b3403c9bf1305b474792

SHA256
8a2bb44d1e1f253afcffb8ce72d0634d8ab3e1f671e50b9eb59ef67d3a8b7630

SHA512
af2cd5bbe6422ba07a60c32a9f687d9db3dbd09816b1fe8001494873b2d453876811c96fcb5c9d190322d3592992aa72298d65c2e3a7b96b53eba143b547c49a

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js.locked

Filesize
9KB

MD5
13112acc5b92d99d955860fdf96c96da

SHA1
3f9a6b4d34faf1544a225b47852b34e2e16c4417

SHA256
337db9f0bfa91a40a4cd2af724992fd7f8d72ea8a345373d266247054345f6fc

SHA512
d736f756efa16ee124f9f0cb2c41e04e51e0221bd0a0c66fa2f0f699b20b1451b9ca139fdab1404f20ce8bd5f52783788aa7caa88feeb45a0152af0cd2299404

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.locked

Filesize
5KB

MD5
6f5f46a2c8d8f61bcbb70ca6c954a8fe

SHA1
e494a7d262b4f772b4e24837dbc7e84599e9f2af

SHA256
b39c6ae203276ac63c38b03e89b7f8590c9f43aa62917acdd8a9a86593af60c9

SHA512
8d100b92f64aba7fc94b15c0246b7e7aa934a04fe6516ea68720afa363b8a6504202d64e56e68896c8fc57356386f1330b62a7f716d39293c3b7c923e8dfb266

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.locked

Filesize
65KB

MD5
441536a2ac251a0cd0832a24411a1ec1

SHA1
807105fa5e3adf7f1710e7486904e361ad8a06f0

SHA256
8627bdbd0937ca8998cb96d83cb7de56615bcd55254405462de620ebc89b411d

SHA512
19655e7013e8eb6f306e662d7788806c82e785cda9fa2920c1260268b8485ca56183fda4df2e295ab52557d3ada100a38abbba4ae3acdd79aa2c0da77632490e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js.locked

Filesize
736B

MD5
f2e15494055b8d2a487452712b6f5dde

SHA1
5fe0b4e1d0e1f51eec4b1d1c8c3697f5149f1eea

SHA256
d5c1f2055c80fc8cb582277d65b2a9d487d094d63918511e83c1b50b229340ac

SHA512
1121bc7a13fc3d9a343886284f2597668dd5091318041efd170bdf751c150fdcc1f61de8e4f0de010fb9377d598bc8b6f6ba5c9dbdeda2a96f94b1885d231038

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.locked

Filesize
5KB

MD5
fb324bbc93f9baf2cf659312eb7e32c2

SHA1
7238aee7069da555cbb7ed53044ddcb352de99d8

SHA256
2e1507371617c84fe12da639ffe786aedb0ce9fd92f998e686fb06bfd2fc3beb

SHA512
8978838863104ecd470c0ca592b0674a7dff66522983a470dd7787fdfb0b9508050bebafa42c37ab45be96c0eaf658a262753451d6b41f225ec914c40c5af51f

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.locked

Filesize
7KB

MD5
58326a67e7e41ae04a9decd967c288c9

SHA1
5ae8f87c4cd70beacaffb9a63004bb5db40658ef

SHA256
ce007e2dbfdc07b080f64d555fa0defb24b6b04b5a59877d65bc223e7e7fa6ce

SHA512
e0515b1c3c4a9e2cd7ca0bd3f2dcc2a29aa2e5a9bda29592182b76632c72d6818de76d0306bc06584071689161774e5ef772d80349fa68a2b2f89736ab5f7193

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.locked

Filesize
4KB

MD5
069f48e627a058bfc2ecb16cceba3f72

SHA1
81771a276b1067d7e97b1a0c3209e59333edde9a

SHA256
0f429cd5a122c1b795d4a243af8fec07c1226bedb1756812882161f1b74686d9

SHA512
0c8d05ce51979e66b74f74e16d0dd1683cba5c478dccab19d60e4a8699b8c5accb01b87762bb23a32f88eb3e3c3dfd5efd95dd585f077605f9c84f0ca4ec8f38

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.locked

Filesize
5KB

MD5
c5aaf4f076f0197d88ef086e47c9bacd

SHA1
048e5af5127a2d9d06541e3cb91c5649b9ae5ecf

SHA256
9924bff8407aac2af3372d27cd7722e228bd40f3e864f6160320fa232bdede88

SHA512
1ad1322df732745db21eff6f1b66b81288f6c43404c59eedf16878abcb49f064c049dddbd0edf6576764597a4bf939b04230ea805b071286e375bdfe330be1d2

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.locked

Filesize
2KB

MD5
205bfc26275b42ec18dfb3c9eefe4c03

SHA1
7d42fee56cd69bf7229d87cbccbf0c689c5391d8

SHA256
a5fd827a1480d8009ed8122228d9b41e2135d43080df24ddf4a74835dd727420

SHA512
5f0f47378431eff046cde657eded6047eaf3e3ef7dc5f0c1f2fb4ce3fcdd51ee08496c167ed9fe81399c16a62a0ebf2230891e0df796ef0dc31e6017e2a21278

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.locked

Filesize
2KB

MD5
bdf0a7d74a04bdc2e95cf679b33892d4

SHA1
7469e82dda7c0114e79c412b19b5d7ec5ee04e14

SHA256
6e8326cafa77e45e583c9edf3b3cf670c8f97f6637159b87f9cf2363a1e56523

SHA512
c87cfe8637edbdc6003e9d9922e6a0bc2fcabbfe21468ee07e9f811f08fb23579fa3960aac05b2e974c435cb3f425180d02d0114530c7a8e107d45355df650a0

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.locked

Filesize
1KB

MD5
4c0e0bced5e4f3c2093fe0fa7e4c30c5

SHA1
aead7b999316e866f3aa871126dcbe45283e8508

SHA256
7fdc7be471749de07affb93c4a161299060e11feca377eeb04f99dcfcc9fa52d

SHA512
f211ed616409c469eb7630cdb75c270c2a120c166aaac561a61d5c36c864149fb72c1704382e7c833c2dfbb141b12ff4e7055fb14b1eced2fe16bc48e4484a34

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.locked

Filesize
5KB

MD5
a441a32c17677cfad852018cbcfd0990

SHA1
7ed35ffa97e06561d8b17d332652b3de8472e885

SHA256
9a588e4db930c7e52de9e05fba675f6625ad04330fa34334c978249961005efb

SHA512
08432d8e5a6c886180c66af655ef55eb7122413f039053705d38907ab4bb28acfc7191067dbda2f500c1087127c2e17efbbae1daf553cbc6241e7153ab97674f

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.locked

Filesize
6KB

MD5
798130ecb336964fded8a2a7fa3f9c6d

SHA1
766109413405838e276a6464cc910f1d7c3bad36

SHA256
5b0a5fadc564a8dd2326fbf1e53eebefa0d0291c90cc4a468c462134778ed830

SHA512
7cf22c5e6a7c605f245fdc18f0cafd3956226bf3a8b4221fc44d760d4e8ba6006d837d742e40a1372d4cdec6818c3a600e7d4bdcc52517dc9337a2dd46dde0e1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.locked

Filesize
1KB

MD5
d1f02ad2f9e950a14d6fbe95e42a8299

SHA1
28a06a11970c0d032231b92e1ebb64b85a3cd103

SHA256
75c51eb2aea93cee6de96f7e2257db946aec3467bf4d4be468ae41df2125c1c4

SHA512
62dd2486c2145964b7196afda16a292d9aacac80f8c3e71364ca09162a2d9a100da12eff555658bfb6335ad2a09c4df0408af3c271318b8987ae064a3ac158f2

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.locked

Filesize
4KB

MD5
d12043f9df8cca78ddd1ee27d0aff546

SHA1
60bfec42ffcca5c4d043b60d0c45f242ad0102cf

SHA256
137d2d88a46220b60767ba2781d0f2b4b37fb8b6225019159384689dc0ef77be

SHA512
7bd65cce0909ea61cb33e2be454f5aa3c17560d515f90ec989f342bc9a76f8f2f0f76c3bbac01d4d5b38cf51779340807153f728e4ac7c0c2d5f3944c5cbb727

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.locked

Filesize
5KB

MD5
973ccde84645615e1ffcf21b67890ba1

SHA1
7d9139c414ea4303900b66edd0bd629f1c7c7d39

SHA256
a0f1313d619f8324a467f61092e862b360b38b800f84576fedb58f3a4955b476

SHA512
9d38068fdc9c5e8117a864613010eeda7aba302c286756ca553ca4410c5d7428b0a0e3f1e3119388bffd093652672c9bc53d3b8ec50d238e95c4ab7f9ce510ac

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.locked

Filesize
5KB

MD5
fe120e56d8529e15d1f2d9e919906f84

SHA1
0981ebf478f7d0e2719d27114688bac117f2b151

SHA256
e7ffcd84b96925b230cc696c61aa0fa9949a7b2cdd1e5f0a561bde55c1193a2a

SHA512
bba736cbe652ede2e82d8e1a30d5db7fef28704fa7bd508d13431717243cc2b3f1d254a13921b0d1f82bf4fe06956211bc4fe435646c9c04b092f22a02d6519e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.locked

Filesize
3KB

MD5
0a01e285b1972599215cac83c527b961

SHA1
e5e61d510e70558017a63656f88fc35c9018ad66

SHA256
0e1df791974d9a53d7f2da0e8bdc372e69afc658d0e8a92d5e33d8211a7257c2

SHA512
55893942fbfd134922552b03e5cdf1ce55e494fe30615bb2f3c46232f1d747740e8f5f63e63cdc06017c0c1375f6ed0a08f57646b045f95da026ac1bb3a1ef65

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.locked

Filesize
976B

MD5
78e5966777a89482262308064a4b5a87

SHA1
e32708ace07950124c3ac3e23fe556036bf3ab26

SHA256
b298902a94482674c256c1b51190a0cfde578ea97113f5386b905217e550876d

SHA512
552dcbc1b459857d67dd20d9a21f40323832e2dccd82328e2be66a9e8a2f35958d3eee10026418301812100dc240d5ff7713847511b70211633fc06b7a6bd88e

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.locked

Filesize
9KB

MD5
e26e2b9a55f562d91743e746254116fa

SHA1
34522c1632358232a56a0b0085cfaa9d9fe77157

SHA256
fd94fd9a8af4773304ce4226c0ebf4c5ba456ca212c14e9fb1d3ee1640644052

SHA512
cbc1c882f799d23d27b44c4a4d136373a5026de1d7428923880e126b6dc9d2c47aa027c600e9e5e41e1eb7f74d75a914e21e2b8ce224496a1a52c5ac65cc3f33

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.locked

Filesize
24KB

MD5
a0230320bb2530dcb1f8571a35a5c95e

SHA1
f6b1dabedf19d6be132937384b000a91793b6b97

SHA256
8a4700898b04df63470ff0a3ba447454fbcefd15a12bee4d56de9ced19788a1f

SHA512
abfa31d1c8b0bd13abf7e3adb912e5b3e1e8d0bb3c577000fe507ab261a5adb7ff9cdcbf28a95d8ac8559bd36e0a63c8281d21b6ed17a7ff0fc0173c57d78dcb

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.locked

Filesize
1KB

MD5
ad0bba7ca0d05db6560a1a81b2b36f69

SHA1
06813875e956ae5c32441ff6d08dd2362f6a7ed0

SHA256
88fa0cc7e344870df9f044cdf36d68d96ee151c8a3cc24d984eb971a1355684d

SHA512
4f58e99e3f96933c085a920bdf43b9313d16dde8628188c41f537e34a84c63bbc72b19443c51f4c3176954a914047f92862e491120e0a18735cbee4bd288f14f

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.locked

Filesize
42KB

MD5
9b5c5c0c20b3fa2f6989d964c3f24f6e

SHA1
f07dd8fcb46f46ce4633eedb39969bde3d0c598e

SHA256
42b37c19e26f299778548e8a5a504a084cd46454129caa60c5c64c5e0ca082eb

SHA512
3b34ffde955ad575c3592a757aad1cf3e92e31a645fe07bac0841b5e208a0f7544d7ff7a43b2226e3dc118a982bacab931d0160810c5e45934f52a6317d72d6f

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.locked

Filesize
14KB

MD5
1cfb482518acb8c1923e4a4da8b24e55

SHA1
2dd19e2aa453a027710692c7af65ce77dbfda2de

SHA256
d9a2d5bf396169f1b203866ab8f3a68a5e7752bae1809c83b8cb500d14e33786

SHA512
74dce5cda4093f7b0c540eece74b9e33a37616d119d9ac3b7cfd69b221693bdbc4c0ae6022f54415e180b2b3c70fbd4223e8f7689ec6dcf0fb9c942372decb93

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.locked

Filesize
56KB

MD5
b0651ab45a32c8493b54130d1aaa4c94

SHA1
3e71a6668b88a751707880ed18a50ee495e3a94d

SHA256
980765507423669c6d745bb7d9083aa8ffc063dd877a0c6f5a816d213c7866b0

SHA512
c8c75caebcb974461401c51d2c579eedff0a6bd3ff8ac38647989b5dbb44a101058658ac590110a59930952c5cd69a69995bf7da8bdf143a2df8eb76dc8cbf62

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.locked

Filesize
132KB

MD5
ed4f8dbfa4c3741faaddaff6b2d04215

SHA1
0d823f974518981f7f079999399a6142203dc6b2

SHA256
8d88fa00cc95ea00c1e0a65fd05053410a1d56bbe719941f3d25da5aedee0a35

SHA512
5bbca2af0a7d9c1686db36091dc7e6f60a68722ac1172e0e2d213737fb4722d438bb67f236de53fb19fbaaf8833a3386cf48230a047e3ec5456e58f1f39c2a2b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.locked

Filesize
8KB

MD5
3ddba76c5449d68d2a7c7a85118c128b

SHA1
b8678219083901c81baa13ac98cc022a00a41175

SHA256
65099763ef88caef82986cff1da16e6c9d372b1c832c68737e80aaa2bada4b3f

SHA512
8f02b009eb3fff2190e527f5617ac9a4c39705a0e2d1feb4c0beb0595468c94119ce2e161b8beceb394b064e2d2c4fa47fb40a1b3ffebb2ff849a86e4d9323f8

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.locked

Filesize
15KB

MD5
c78a07394b53641a35bdbf2bbd4d66d4

SHA1
7756ce136a3d62873d6a0e288b180f5b7769e6f8

SHA256
03385a2834a02b3646fac92b9a63f995b8c00011fbe75a13e101dadf90da13f4

SHA512
c0717f5159b5a89b36c9c8d9ffabba1cdc721d2c408c965882db0d2739130fa64b53839d95525456267716c8366d66be622b9ddfc3b5d92c3d336845e3113c77

Download Submit
C:\ProgramData\Microsoft\Assistance\Client\1.0\it-IT\Help_MValidator.Lck.locked

Filesize
16B

MD5
284a60f56678f668275ef81034071eb1

SHA1
23d0b371663a692612f5c95fa3bb6142ef9f09c2

SHA256
ae9e3cf6dc81c65516e3d642e9a04df9feaa192687eefa0ddc4bd11c02a497b6

SHA512
cf5215b32b65c0b5f0627e9364a9944b5ed012956abe3b5749e956bd04f57e809350d66c8560551a73483838c0ab7794442e5c59d6839bfeb1f7b32563eeea73

Download Submit
C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.locked

Filesize
140KB

MD5
59d26981e0f07b98a488eaac68babfee

SHA1
69a9e2cb5b10dd90787919e12b8987b5a680f863

SHA256
98fab410959890a848acd2b7adfb047e62663e7ee6c4d02d317632ddeec20712

SHA512
21f746a506c7a777493ddbed7837c25e6e25704333ea74f2d7b420f41750b6f2246fa5154b14945c7940000908ddf8f142113726ab3beed4878f567b7c6649e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\CURRENT.locked

Filesize
32B

MD5
b59cbc44883ae375b59a66c1ebd03ebc

SHA1
6f71a308bd26a41e32adc37de0f6576062343874

SHA256
907e40bed2f7e541ec636a0387339a073dd16277c269f82aedc77a576962a7e6

SHA512
fe527d2a748397b959e5239b40b2ae377a713065e5d4a3eee529ba68207068305bb2ce656622bbd1d84d7d1bc3be759e7dda46bf8a88289533e0a9d530cb263e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.locked

Filesize
8KB

MD5
e477caf6eed93679a069e8b2d1036f15

SHA1
3ae5902af4c055ca667cc0899cd827ca2e7826be

SHA256
a284ccfc7d6aed21735df687573950eaedabfa23f61c1d10c1a0b6be7957dee8

SHA512
97176e39087fc7af35c6dde99f9853c234e543e70efdcd603bd72e5114cb5da3ae6a61621d0a86438ffe1952077a0e0762589cda6457595e5e4ca2931628fb49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\YR1SPOMQ\desktop.ini.locked

Filesize
80B

MD5
e63dd3d3898e1aebf7e35d0011f9babd

SHA1
de4c0cbd3f6748afe66d1da62e3a56d403409a4b

SHA256
d2b276691be0e7a1ef45f08719a01d68e279bf28f7997b5f7aa92b456187ee7a

SHA512
3380ca63f4d39b57e7d1d3657417241b83093fd220acf58159449835e171a28c0fa256b9283c1872a3224dc45d60ae61b205927fbd8ffc9a83b07297e04304dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms.locked

Filesize
28KB

MD5
94a94de61703d5a6133a47f8d6da52e4

SHA1
783fe1c914455d3736c5bab74714329238079696

SHA256
32d5a6b15e99867433fbcb3fe755df0728488393fbfc9ab942b0f66eaa37317d

SHA512
43baf822c960fe7baa9b701d5efa0a9a7a5cc0ac3e9383ea9c762148bd325eb20f888d19e84fa890870484d3072559c22bbced10f7be66d43580d4def2b36586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00001.jrs.locked

Filesize
2.0MB

MD5
a37ddb2959121d60eaa7d96fd3d13a50

SHA1
bcfbf010f8c27f2977cc5c4623281976b786dfff

SHA256
dc90bc1891a4f196654ec39ffa8ea7a8cb1c4db53ad84734075b30d4e646efeb

SHA512
f02663b64b91207b3022dabf265f8a577226876810ecba0066abd4ec111ca80ebaeb8a58f8d6907276d3ed923213ceaa937f041c1ae96af08bddc50ec9de3cbc

Download Submit