41b93a574bb612aa155054a537fe86be308ece7c10764a1f57ce01f894848f7c

Analysis

max time kernel
55s
max time network
55s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10-08-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

konets.exe
Size

17KB
MD5

6a178845e4b33de30efcdcf7b4e128be
SHA1

2f144879ef702ce6fe75515240c9add67b5945ea
SHA256

41b93a574bb612aa155054a537fe86be308ece7c10764a1f57ce01f894848f7c
SHA512

c1e6db9afb21263b47466636d23775a6aaa88a43903fdfa26952b831bc369cef59ae9200ee0466c7869e748192756d19ed6c717403a05622cc3a0ef0104574a8
SSDEEP

192:v6e44RTHEdAppUxevrtachyQpYtXz3usVccmDesQ5tf3XNGlraivR5uQpI:v6eFZLpuABbyQCRq6sW2amNp

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\README.txt

Ransom Note

~~~ Your files have been encrypted! ~~~ Using advanced AES256 encryption technique your databases, documents, photos and other important files have been encrypted. See for yourself! look at any file with .kon extension. You cannot recover these files yourself. Do not waste your time. Nobody can recover your files. Only we can! We can decrypt these files, we can guarantee that your files can be decrypted, but you have little time. Payment for the decryption is ~$70 We can restore your systems in less than 6 hours if you pay now. However, we will not decrypt your system if: - You go to police and report us. >>> If you report us AFTER decryption, we WILL attack you again!!! <<< Do not delete or modify encrypted files, it will cause problems when recovery! Send the personal ID to [email protected] We will provide payment information, once payment is done, we will send you a decryptor! >>> Your personal ID: 5ZY4-HSUI-YKHT-PFPN <<<

Emails

[email protected]

Signatures

Renames multiple (4956) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\gmreadme.txt.kon	konets.exe
File created	C:\Windows\System32\drivers\README.txt	konets.exe
File created	C:\Windows\System32\drivers\README.txt.kon	konets.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt.kon	konets.exe
File created	C:\Windows\SysWOW64\drivers\README.txt	konets.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.kon	konets.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\README.txt	konets.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\en-US\EventCreate.exe.mui.kon	konets.exe
File created	C:\Windows\System32\en-US\Licenses\OEM\Professional\README.txt	konets.exe
File created	C:\Windows\System32\es-ES\mspaint.exe.mui.kon	konets.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\es-ES\about_try_catch_finally.help.txt.kon	konets.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\EnterpriseE\README.txt	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ClipsInTheLibrary-Package~31bf3856ad364e35~amd64~it-IT~6.1.7601.17514.cat.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Help-CoreClientUAUE-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385.cat.kon	konets.exe
File created	C:\Windows\System32\en-US\chgport.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pipelines.help.txt.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\Microsoft.PowerShell.Commands.Utility.dll-Help.xml.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe.kon	konets.exe
File created	C:\Windows\System32\oobe\ja-JP\README.txt	konets.exe
File created	C:\Windows\SysWOW64\de-DE\fsutil.exe.mui.kon	konets.exe
File created	C:\Windows\System32\it-IT\comp.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\en-US\at.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\it-IT\tcmsetup.exe.mui.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-UIAnimation-WinIP-Package~31bf3856ad364e35~amd64~sl-SI~7.1.7601.16492.cat.kon	konets.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\README.txt	konets.exe
File created	C:\Windows\System32\en-US\alg.exe.mui.kon	konets.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\fr-FR\about_eventlogs.help.txt.kon	konets.exe
File created	C:\Windows\SysWOW64\en-US\wextract.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Windows_PowerShell_ISE.help.txt.kon	konets.exe
File created	C:\Windows\System32\en-US\README.txt.kon	konets.exe
File created	C:\Windows\System32\fr-FR\w32tm.exe.mui.kon	konets.exe
File created	C:\Windows\System32\smss.exe.kon	konets.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasic\license.rtf.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt.kon	konets.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\prnlx005.cat.kon	konets.exe
File created	C:\Windows\System32\en-US\Licenses\eval\Ultimate\license.rtf.kon	konets.exe
File created	C:\Windows\System32\it-IT\tracert.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\fr-FR\timeout.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\ja-JP\WPDShextAutoplay.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_format.ps1xml.help.txt.kon	konets.exe
File created	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JY31BULR\desktop.ini.kon	konets.exe
File created	C:\Windows\System32\ja-JP\timedate.cpl.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\de-DE\sc.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\es-ES\wusa.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\fr-FR\ui0detect.exe.mui.kon	konets.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\README.txt	konets.exe
File created	C:\Windows\SysWOW64\de-DE\wecutil.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\es-ES\diskraid.exe.mui.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-MobilePC-Client-LocationBasic-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat.kon	konets.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_Special_Characters.help.txt.kon	konets.exe
File created	C:\Windows\System32\WindowsPowerShell\v1.0\de-DE\about_arrays.help.txt.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~ro-RO~7.1.7601.16492.cat.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShareMedia-ControlPanel-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat.kon	konets.exe
File created	C:\Windows\System32\es-ES\ping.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\Microsoft.PowerShell.Security.dll-Help.xml.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Win8IP-Microsoft-Windows-Graphics-Package~31bf3856ad364e35~amd64~ar-SA~7.1.7601.16492.cat.kon	konets.exe
File created	C:\Windows\System32\de-DE\Licenses\_Default\UltimateE\README.txt	konets.exe
File created	C:\Windows\System32\es-ES\Licenses\eval\StarterE\README.txt	konets.exe
File created	C:\Windows\SysWOW64\en-US\Magnify.exe.mui.kon	konets.exe
File created	C:\Windows\System32\oobe\en-US\HELP_What_is_Activation.rtf.kon	konets.exe
File created	C:\Windows\System32\wbem\WmiApSrv.exe.kon	konets.exe
File created	C:\Windows\SysWOW64\de-DE\systeminfo.exe.mui.kon	konets.exe
File created	C:\Windows\System32\en-US\Licenses\_Default\HomePremiumN\license.rtf.kon	konets.exe
File created	C:\Windows\System32\en-US\rekeywiz.exe.mui.kon	konets.exe
File created	C:\Windows\System32\fr-FR\hwrreg.exe.mui.kon	konets.exe
File created	C:\Windows\SysWOW64\DevicePairingWizard.exe.kon	konets.exe
File created	C:\Windows\SysWOW64\fr-FR\joy.cpl.mui.kon	konets.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~6.1.7600.16385.cat.kon	konets.exe
File created	C:\Windows\System32\control.exe.kon	konets.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\README.txt	konets.exe
File created	C:\Windows\SysWOW64\fr-FR\taskmgr.exe.mui.kon	konets.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Mail\wab.exe.kon	konets.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\README.txt	konets.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_rest.png.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\localizedSettings.css.kon	konets.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\README.txt	konets.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.kon	konets.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv.kon	konets.exe
File created	C:\Program Files\Java\jre7\bin\server\README.txt	konets.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\README.txt	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\README.txt	konets.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif.kon	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Earthy.gif.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\gadget.xml.kon	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImages.jpg.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_up.png.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml.kon	konets.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\README.txt	konets.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\README.txt	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsOutgoingImageSmall.jpg.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png.kon	konets.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\README.txt	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\README.txt	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-uihandler.xml.kon	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg.kon	konets.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml.kon	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Aspect.xml.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\flyout.css.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-enumerations.xml.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js.kon	konets.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\README.txt	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Austin.xml.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\gadget.xml.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\settings.css.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\README.txt.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-visual.xml.kon	konets.exe
File created	C:\Program Files\Windows Mail\es-ES\README.txt	konets.exe
File created	C:\Program Files\Windows Media Player\fr-FR\wmpnetwk.exe.mui.kon	konets.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\README.txt	konets.exe
File created	C:\Program Files (x86)\Windows Media Player\fr-FR\wmlaunch.exe.mui.kon	konets.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif.kon	konets.exe
File created	C:\Program Files\Microsoft Games\Chess\it-IT\README.txt	konets.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\README.txt	konets.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\README.txt	konets.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif.kon	konets.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\README.txt	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar.kon	konets.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\README.txt	konets.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.kon	konets.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodicon.gif.kon	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png.kon	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg.kon	konets.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml.kon	konets.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\README.txt	konets.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\README.txt	konets.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.kon	konets.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.kon	konets.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Media\Festival\Windows Logon Sound.wav.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-usbperf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_35af86373a5ba75b\usbperf.ini.kon	konets.exe
File created	C:\Windows\winsxs\Catalogs\b20688df2fb1fe537b5aea36d5d7281c5489797fab835e983d84ebc152694541.cat.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_es-es_85220a7a551ef91e\README.txt	konets.exe
File created	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\README.txt	konets.exe
File created	C:\Windows\servicing\Packages\Microsoft-Windows-Personalization-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..g-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b1f3571064438086\Defrag.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..acysnapin.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_42449c1669880ecc\README.txt	konets.exe
File created	C:\Windows\winsxs\FileMaps\program_files_windows_sidebar_gadgets_picturepuzzle.gadget_it-it_js_f99b1f9c304bccc7.cdf-ms.kon	konets.exe
File created	C:\Windows\servicing\Sessions\31117022_2393517488.xml.kon	konets.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\System.Management.Automation.dll-Help.xml.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_moon-waning-gibbous_partly-cloudy.png.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ackgammon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c2618715ea4ed58f\README.txt	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..minsnapin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_07d77250f8efd9e1\TpmInit.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-metabase.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e4a1aee24508c4a2\infoctrs.ini.kon	konets.exe
File created	C:\Windows\winsxs\amd64_prnky009.inf_31bf3856ad364e35_6.1.7600.16385_none_4082e69c83f69105\Amd64\kyw7qur8.xml.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_6.1.7600.16385_none_81d82fe9c216eb89\README.txt	konets.exe
File created	C:\Windows\servicing\Packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-TopLevel~31bf3856ad364e35~amd64~~7.1.7601.16492.cat.kon	konets.exe
File created	C:\Windows\winsxs\Catalogs\495a6a435d7686562d2f809d9c73215792481692c687959b768bf17786a4be66.cat.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..n-cmdline.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d8c7b30a201b05fd\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-verclsid_31bf3856ad364e35_6.1.7600.16385_none_17dbc2dd2d2552c7\verclsid.exe.kon	konets.exe
File created	C:\Windows\winsxs\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_cs-cz_14c68763712b818b.manifest.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9c4da920e2047ffc\slideShow.css.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\trad_s.png.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..revention.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3b60aa2210b177fc\README.txt	konets.exe
File created	C:\Windows\winsxs\Backup\amd64_microsoft-windows-security-spp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4fcc12c061ad9631_sppsvc.exe.mui_40875a72.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-restartmanager_31bf3856ad364e35_6.1.7600.16385_none_800bbdee85723191\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..erinboxgames-spades_31bf3856ad364e35_6.1.7600.16385_none_6fa6d7361acba514\shvlzm.exe.kon	konets.exe
File created	C:\Windows\inf\ESENT\0000\README.txt	konets.exe
File created	C:\Windows\servicing\Packages\Microsoft-Windows-Branding-Ultimate-Client-Package~31bf3856ad364e35~amd64~es-ES~6.1.7601.17514.cat.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-bootconfig.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ad841445a75b5b07\bootcfg.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-newdev.resources_31bf3856ad364e35_6.1.7600.16385_es-es_72ad61937e044eba\ndadmin.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\amd64_windowssearchengine.resources_31bf3856ad364e35_7.0.7600.16385_de-de_6b6ac41c3ef125b7\idxcntrs.ini.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\settings_box_divider_left.png.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ff7f10aee17cc0f7\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_23268e5d5ff07ea1\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wusa.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c6208a3e6353f33a\README.txt	konets.exe
File created	C:\Windows\winsxs\FileMaps\program_files_x86_common_files_microsoft_shared_ink_fr-fr_f22645fff02877d6.cdf-ms.kon	konets.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\Circle_SelectionSubpictureB.png.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7932579674fc8207\README.txt	konets.exe
File created	C:\Windows\winsxs\FileMaps\$$_diagnostics_system_device_es-es_3d9803aeee3cc710.cdf-ms.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dc65d79d6619fbb4\doskey.exe.mui.kon	konets.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1031\LocalizedData.xml.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..serverbox.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f9708bcbb99878c0\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_prnbr004.inf_31bf3856ad364e35_6.1.7600.16385_none_4adb5f0cf66cc770\prnbr004.cat.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-irprops.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1c622e88915b630e\README.txt	konets.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\SMSvcHost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..sc-wizard.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ff5739a990c6154\DVDMaker.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_objects.help.txt.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ng-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_adea57ca9eae168f\wpnpinst.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\Catalogs\71c2193201c82ab632fbf3e7c70737c188017fa5ef3824fa31b2a86c32a1fb74.cat.kon	konets.exe
File created	C:\Windows\winsxs\FileMaps\$$_media_festival_d2aa354bee3f11cc.cdf-ms.kon	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wordpad.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dbb048727ddfb323\README.txt	konets.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_it-it_83af6cfe9dc7084e\README.txt	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b426f5cd123e06d9\doskey.exe.mui.kon	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d67ae197822a6ba5\README.txt	konets.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..riventextservice-yi_31bf3856ad364e35_6.1.7600.16385_none_9d726564d8585442\TableTextServiceYi.txt.kon	konets.exe
File created	C:\Windows\winsxs\Manifests\amd64_microsoft-windows-s..clientext.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c203844d07b501fe.manifest.kon	konets.exe
File created	C:\Windows\winsxs\Manifests\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_bg-bg_13a3b6b1c4998439.manifest.kon	konets.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_8.0.7601.17514_none_1beb53526fc80c8d\README.txt	konets.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-vssadmin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3e433354696d3f38\README.txt	konets.exe
File created	C:\Windows\Media\Raga\Windows Print complete.wav.kon	konets.exe

C:\Users\Admin\AppData\Local\Temp\konets.exe
"C:\Users\Admin\AppData\Local\Temp\konets.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\README.txt

Filesize
962B

MD5
3deaf39e93c057e2b63762cfc2709c19

SHA1
fed15842e3a9af48bb1a70a83353e15319bbc2ab

SHA256
a242de598278604b7b45056022721b79bce70c426ab81970249253ccfee35e16

SHA512
885a2c4cbafa7f0d79c01b89e26e5e31d473ce97830abb3fc325712d38e0c30a8771aba3080aa7991c0608ea419904dd84d289384adb0697907d6a7bd536f523

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.kon

Filesize
27KB

MD5
f667f9b68aab0c86c060ec80c70739b5

SHA1
8da929febec8a3a24c22161caa49d3e20571c70b

SHA256
1aa4cdbf74b7ac85b689f36711d6d904493a31ba404ffc3fba3683e55937de72

SHA512
4dc25faad8d4979e6e4e560af3eea254f8c562ddb868a510474f9e694281e624058344efc43ddd264e4cc8ad7b1f7ce656a5c1d5731ad17a1ae38a6c49d8434b

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\currency.css.kon

Filesize
19KB

MD5
972564f496a401b6c0d5711775532d40

SHA1
25e6636f7eefda4f2aa25f89a04c624703faca08

SHA256
5313a1aa94019b7a5a380f817bad9f9dc33f936b27096cad956ecc8346e67b0b

SHA512
9beb996ec769ae1ed509ca7556522823c4ca17456f29917a0f2dd92471a1ae153be7ff78d754628776ed7c61cdb99702b3048c1e0afcbc13d2adb25932cd9d83

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png.kon

Filesize
5KB

MD5
4ef29b92304eb237e3766ea91382dc51

SHA1
6a5b1a9a4b68ae05a75ece2e486d8e9dcb97b158

SHA256
aa7c5c0fa120fe11334c8c12788501e54c7ba25283a518a86e7517def4700a72

SHA512
3cea8657e90a91624db75b17e9109b8e61ab8f5c2aa9a075df876e0637622c73b0ebade41debc812044deaf1d3d3b75976a947fae8b8cdf3686f22471190975f

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png.kon

Filesize
5KB

MD5
5fc1391559d2b8ac9d26b3ba5b8937d0

SHA1
960a4ae72301f13f618f8f8e7cf3b7ab55f03d06

SHA256
4d343978d892bed70718e008a90736043160f6e23737cc45410ea3a48c31b597

SHA512
fda2e6706ad2a1e5b2d3ac0eef40a1fa4a4fd70a2af6ba6511a19efedf5b2f13db88e650125bb56de0895b3eded17d94689be2aefa9dacb875f4ff81f91e28e9

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.kon

Filesize
4KB

MD5
bd026d057bf6edc086ceab199820b4af

SHA1
fd4d1597426e0a801b3229695d0054fbd21fa227

SHA256
374c4f4dcb51b8ab5fa00188df67a75007084b64ede762c2659e1d48393c3164

SHA512
0861b799ef8439d7b3b5a982482db09a3d9cba6e40bb556938bfeb92d1f26ff61a0e63f414e90732cd60792119cca982d7203447b0da2748a567cd53e4bf6e5e

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png.kon

Filesize
4KB

MD5
539fa06e4d6c0522f1ec0656b8432cff

SHA1
e44630c9564e147ce686af1fa8eacdaf98d290c4

SHA256
e8d8b0cb07356865dd90f0236c3b0ad51b16edf488abe24a38ecda5ecab56082

SHA512
550ada37b1da4b00d7a2310a4ccb34b9c3d5817d3d84344ea28bfa9d3332f2032f8729601dd0ff78dcb5de8ed1a4b096efb42512c0af7e7161cb226d65a0aa2c

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png.kon

Filesize
5KB

MD5
896e1b1b78e32ab5edada80c6cc55423

SHA1
37e4d65169a4f8aea601f68e739aa3f324379204

SHA256
74e79677cd8ca62d1cc4872f7cd0469d3e8a136f406802960ed199296327cf16

SHA512
fc689af3234083c79c725e33d43c03eb78ff67ead61d45396285ae416b36e0be6342df0714b07fb373a8f112f7e21045f0a5e3b66451b25f3b033bf5f664a38e

Download Submit
C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png.kon

Filesize
5KB

MD5
363e32dc9bb841b5e15e3263b757d404

SHA1
660ecffd8fe260dc2147929817f3cfc2abefb060

SHA256
241aa554ccaa572fca39d9e88795d39a6a1df931973040df74dd2471bb08cf14

SHA512
d65dbb7a939b006d469997b5eb54759b4e0f47dd77d1826b159aa3318fec5504e73abd0b206e87a6651a62449a7725d8c1d5ba33dbb7593e0bdcaea85db84a65

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.kon

Filesize
4KB

MD5
315dd94e5616731c368f8f01ebe3713a

SHA1
9ba1de9d30ac6e91f19157cb2bc66205d259304e

SHA256
271cf8bff0e4ce6d804fc28b8647c6dd604d02e983b356d77bd91d220a4007f5

SHA512
804110c6aaf137a009cda6306966f56849639b5d3feb12a4127eb2bc0e8d063f4dbe984fa1abc81e2272cedf125cbb8e7723500c0020dcce5f4109f9b2287a35

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.kon

Filesize
3KB

MD5
f9352d77fd8aa235732c1a122941b348

SHA1
25126ab010bb92987f6307e5466ea3f878a4ee65

SHA256
d194f408e4b5cafae4c60c7eabbfce121141c3c9377c9407740e0874fcc23495

SHA512
dc66ef2bf75b52d04d910539f103a682e0e7edd8fa565d5371ffd7387a18e8c9fb61fb310efa502677db58aade756474a3af7c850370529e071a37583c441d3f

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png.kon

Filesize
4KB

MD5
84eb88aa64970c60c9d8a83cca7319ed

SHA1
4861fdd4415d858e2cbcdb297c09f5cfa1b5f66d

SHA256
d834c363c062196b70173d01fef85ea54ceb27332e093250dddc5585341e99a5

SHA512
d49e4d09ef04a2e719aea92b1d3a62f1c756add340daf6826970e7ccf651a6d874b47229b0c4db9447945d2ce50288c32668c46f519792676b5cbdf0323a8434

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.kon

Filesize
3KB

MD5
a3e0976d634e02c7a60df893324aa231

SHA1
d9a2751bb6a6e30c9cd31c334ab418655b6970f8

SHA256
4511b3c827eca9114c043fc0ac759273f1e639e572d51dad458d77d3c7f68da7

SHA512
1d8dcc14ee1c710f70bd8cacbb804007e2051cbc4746995f9bbc0128d76b899b14da2414a33a9e9bb08ec2f79074beccd058eaf1ada1f18618c5d4c8974ab481

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.kon

Filesize
4KB

MD5
8437365b6b705590601a1dd60ec07d3d

SHA1
4d3b388f8e919c97c3779d4274ee30b54ef7450b

SHA256
f4257a2db7525374e19e00226bbe2da80cf4b73a741fa9ccb6b237b9ba4d7465

SHA512
10d736c36466284286da30b83acdc44a45191c9b135e011be75aeb53e257a1ac2094171a701f5d82df4e56486d6e430684c5b3a5aa886c7f879182736253f808

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png.kon

Filesize
3KB

MD5
b06e6d3d47db4b49d632eb9eb24c32e6

SHA1
40585cf1f584035df6f30b3484a257bfd9ab8d37

SHA256
af0e907060c03af770071e16c2c2c08c4bc82b25d3d39c7c973ccda2bd0c746d

SHA512
7dbd8dd748824600f58e02176caa9c1c6400db2d8a12682bac8edbc94d67f70279b024b412fb68b20fa360417e65a2e7463f52007a194da58f1782793ba64a8c

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.kon

Filesize
4KB

MD5
f2c5bf2c6b703c59ba769481edf806da

SHA1
c71e6dff626fd3f2c140829afce97109a9b7580d

SHA256
05d23434b875de6dc2cecde91610139e5fb68b6cb7dc817e3cb7966c0f1b38b4

SHA512
2b83a33acb29cda122c23b5df7c4748ff8314e75219f75d36ea07aca56fcdae85e2efa0b414a8fa186f191f8a449b58ba3c0e94ad7e54a1261e8e0ccc5729c58

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png.kon

Filesize
2KB

MD5
cce859c74dc93a2e0edf5e3661a0e52d

SHA1
cc65edf35a31eac00d2a5f8c501ced22fac51331

SHA256
4985012be1353a54029673b164869f8de9a3d16f90bfe89b9c411013cb03aaad

SHA512
c7c56784e6d6096d91e54ead7139b4e1f9878ec7f2f4895621fe31822a58f598b80b0014e09bb156ab1074ad5470dc1f08390726a0d0838561c4ed96cfdef301

Download Submit
C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.kon

Filesize
2KB

MD5
67efeed289a3162941214368026e54fb

SHA1
9d74db40a26d5a20a2aa420205d044241e341aab

SHA256
951d4c6cd652d55f38b2db0b7b0370fac47cbc5490e9269994a835c0f02e39f5

SHA512
8832191c0c92fe5e15ec72ba390e54c9a5ecf398a4f66bc792b39098f90bba0bf9b864417c033e6ead2605e852b66596d7c701610b49bf38e18c3f4a2a8a59a6

Download Submit
C:\Program Files\Internet Explorer\README.txt.kon

Filesize
976B

MD5
9a75159aac1f7b9d95026dd3182ea00e

SHA1
3fc9f946683e42c543fc7975a233a298e1f3a027

SHA256
48ddb46de62ae04cdc0a4be966e4f010639d3a2891875fd5e4299f4d60ae6935

SHA512
fbbfa99eb8aa22d9afc737ccff8649439bf5232c43a62f4d605f23609261642f1bad6613c9bc0b4501f0e7ac1b5d6e043b54d9f49bad6a9d251bc76718aa8e29

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html.kon

Filesize
12KB

MD5
77c5e4112feff9ac21c3c9c8e18c3aac

SHA1
98aaf83df0e02f2f408a0bfda883d57092dd8b88

SHA256
3501bb769b6391b714a4c212f1757b1a5729ec2e868e6edd79445deae27bb89e

SHA512
aaed6afb37ad480e3033844002c9480bf6a9a3de43d29b02ace446f6ec97eaf8b68953e60e58f9cb62df128c5c96f1f13e8fc02d2e15737c653fd418a8e5dd83

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.kon

Filesize
8KB

MD5
115d9ad2851e172c9707680dffd61aee

SHA1
bbdb66667a026b79cbacc2f22fa465bcb1efdea7

SHA256
bc9eeeacc98ccfcec514856dc07ecbbd39ad7b3e8958e7f7b72d7959ce8055ed

SHA512
ef9cf12b467f9dc013589bc4075225fd8ea061f0e379c25ec5395b80f42fb6bf3567ec91ed568106fbb8692ac43bd8b96a524376726d3016d9db817ba6a7aafa

Download Submit
C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif.kon

Filesize
160B

MD5
a96efe4ee878d9e322e4de8594378867

SHA1
5b32e5ccc4459c50b60b2deae63a1a456142250b

SHA256
c5565774c0129a575cc00d7535738e1a3e560b3f284fc2420c76c01bb1bd6658

SHA512
42b7112b3f0963c6b57e0baf6ede80f6e72eb6d5fcd7e3783e18aef198302c469ba400444fac5e6a0d989e69a55a4463ee392f8e328973d1a095f77db86908ec

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\cpu.css.kon

Filesize
1KB

MD5
a520448ef6f055ce77e0c13b5c9e65d5

SHA1
bc5865b89d55faaf2ad018c5c3fc0a605e0cc233

SHA256
0a73c6864394348544aa1aca97b1185cec0464a47b841ab0351277376797e6e2

SHA512
30963b091c56f60456cb58a0bc8243da8a0a59c57a52dd502f7d177958f16c1b2f205d64f4fe43c9c7edcbe56e7403cf04b620fe888f7d60b416a2ff09e20964

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html.kon

Filesize
4KB

MD5
9b3f91aca76849ff16ccab115b551bdf

SHA1
f207aa353a8682b9e862536b9850d751035358af

SHA256
7911829430f48f0a01535020af46404f4cd319a935b76bd7ac4980e9eeca099a

SHA512
3591979e5ec5cba41809cfba2e31cfb49e8f78b69b994d9f944ebd79c125d4d949e62aaa7c0dd9895422a0b73ceb9bf77f5ccdccf13b1c9b0a0d0b09ac3e6db4

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css.kon

Filesize
4KB

MD5
5df7c4716c230a3c8aa59ba7ac31ee01

SHA1
75ed0d37060d6bfa9a296a71f723aa227de9feef

SHA256
2d97c602684faeed916536ab33573284d9b6af5e55a421ad9ad0b5fa2f12cc76

SHA512
7e6726e458de676b62acd846c70b74538ad7363c7692da9fd056d2c3f11c7a3ef063059264fcc5a2aaaf7c39d58b47b575d49d993fdcd107fbabd656f63fc367

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\clock.css.kon

Filesize
688B

MD5
dd9743e336f2d71ec17ca609255c9bf2

SHA1
45f30faefcd5051d3a3599d657141b095ff504fc

SHA256
b50d7078a5ea4bac9465e0677c7db40de7000fe3e916a02f992c9658ccb9c32b

SHA512
65c7ee580d76418afb1d1dfd34f8fe1ec74440ceb566767c520581aa9091c7d71446597e569dd7ec254c5078949113afd85d34aa86d447f695cd9ea1203775be

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\settings.css.kon

Filesize
1KB

MD5
cdd86739bc26a5cdcb9d090185d2c75e

SHA1
7ffce85c3170e742f578520f21a6e61eecb8eaab

SHA256
58138078323f4c7d5bc4f4a6b8b3547a36949ae12c0059b38e2d0cdc165f8ebf

SHA512
ce3ea2e5aad93b2b94ca614ff20d60eacc88f88d1ba9763b5f4d601aeebc9bfa36a04a02f9bfa6cd7e73776a9f185ea7e7d026388ae16e1f85f4494a6502beb2

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\clock.js.kon

Filesize
17KB

MD5
ca0c4c83ad34fc07fd2d5e025f5fa9ee

SHA1
f82d3836629cf42826978a90cf982526e83db3fa

SHA256
ea357cbb0817193c24a76428b9925c7a59e33bca36110365807abed9fb5d4baf

SHA512
fdac5ac242c8a164276eb3a1c544b76ee1086149df3d08a1df2371ffc514af390013132801a594ccbbece72f8eb9c465b78b47ccbcea563830db26cb1b14b25d

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\timeZones.js.kon

Filesize
9KB

MD5
5f890299cd32efa064d2f94ca0afa9d1

SHA1
fb3f86a0ff45b5608cec39ca4b8dc65443346f68

SHA256
a82927b04df9890f8ffee4265d3cdf34a1ebd597d6f86f0b58da9db5bf5656d7

SHA512
aea970c28d7774e5ee2bb0356dfba09cb70d4e7fa3485efebb2aee9ca789a32c3e908d51d6122bfa57a97448ded94ce40f8cdbeb6f306ba76026e9e382d95230

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html.kon

Filesize
5KB

MD5
7261019324b745e420ba026f59e6a9d4

SHA1
3402114c17e494f0c23c7f158eea22d46f409594

SHA256
97bf343f80af50a0f89e9471073116292c48e7dfffce0649beaeeb4063760dfa

SHA512
c4ff8f8a02eca76b032927f10f7445f1b0014557887e2cfebb1753d794cd409bc656e8c0744c925564d4b39e8910ed47127d4335b697496fc9dc895984f55d7b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js.kon

Filesize
65KB

MD5
1356991bc5be90b3d2fe6ec3ac5f3376

SHA1
dca39ce996c28ed2b9cbeaa065bd44edd574399b

SHA256
0fe1842dd585e407ad68b6c2e57a6119f2849f4f3dd4c88917a1226543d97cee

SHA512
899b53d11e272881e2ac9dbf73e2ac949a689dc5c0143af7bcd137f59022470f13a5759c9ac07d22e1eedee81de17658b960871c3ebd393dadfc5f08fea4552b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\init.js.kon

Filesize
736B

MD5
6dc8c18d9b9a683e4e8e050e43ad0444

SHA1
9b45c3d8921690b405718eaf88bdab117fb5c23e

SHA256
582b12bdead58b1c131558d89ad782a5909ec27260be8831a19450a5e1d860bf

SHA512
9193ea7cd11d46d7396316a0ae938118d9f3fc665711ac99ab0befd1b9464ca6e9c52d0967ba8dc255274ec17a73c303421618f3c754976e625892c3f7ed4166

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\library.js.kon

Filesize
5KB

MD5
772e4fd65ea42bbaa683ed09f8bd81d8

SHA1
39d00414d5ae0e346c3983208b05b4b358af04fc

SHA256
f3029fe4a5ac7f7035a276777df07289d931e8fec3c2aaf4e509f4a8a9eb09f9

SHA512
28f82e8124ac104e1156bf450c2d7290a906981e260e25c40402fb53016edfff66778a89ebbab3a28b42c2ea9853ce7baf1122ab0c5b43cd1eef08f7815a09ac

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\service.js.kon

Filesize
7KB

MD5
815e3f2bc3c2d40ca694ab7b6051b7be

SHA1
0a0c41a5f754823add353892bcfbc9b8c6167431

SHA256
eade26d7a434ca8f9d34e0fe91d7ac31536d860ced7ea1ddd61b54c6e0c6fe76

SHA512
044fc42c394e11f0a840458388e0be5f1aab403aff87fbf85e70266f854bcbe2ecc5d6d74a7439326145d1b345f9558905989815f98389ee593c3555545cd3f4

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css.kon

Filesize
4KB

MD5
3679e2094fe100cfeed46a87c5cf5635

SHA1
00e1616a3cec2552709b3808351fd8ffb55b2614

SHA256
36c21e1857048caa3c455cc6aa502fd687307a98a7c30b36bd303540c5c755c1

SHA512
efc25c3b5e50d73ac0f862987174b2335c594ab02920185530c061defc480c7b99d97e417899a2f210a056c7d62d0ca2a6eab44ccbb40580ca682c4c281a5d11

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\css\settings.css.kon

Filesize
5KB

MD5
2b2d501e04f44ad22d698fdf50d42edb

SHA1
20cb814b9b74e19bfdc8a26306b4ecbf9e7ed990

SHA256
753baef65d2cef42cc6c8ebc652a4d9f296252aff893e14198398c82fa20485d

SHA512
d7e0fd67c3a1dc2f64beda82116569908ff877f255ecac5544f8b9d508f1e6b5d6ac2f1acc63063ccd56a93cad25ec2509fc7506c8e4d43f22ac4579bb78f8fe

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\RSSFeeds.css.kon

Filesize
2KB

MD5
2d1021ec5f1d8858d1e7427dd13df146

SHA1
fd830df7cac30b544f8274bce7082d18ad3b6e48

SHA256
ecfdaaffbf2f99acd91e781edf590f97910d9bf4f3632d041187382a3e6b3211

SHA512
71ae5fe0f1e3165a280682e37bf41361988ce10fb5b34e623c0e545a72fdc5424015da404631d0e4f8d1ff3067ac6f07c6078a1aea30863425bf0cf72afb42dc

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.kon

Filesize
2KB

MD5
587d892ac60a9f6cdbead468d8915cf1

SHA1
c58faaf394a43392fa482159c2440416da749aa2

SHA256
fb164a21903fb69d19bb6133f108beb7ddbb40ffa0ee6907917a2b4a0b27de29

SHA512
1c24a40d85edc38a8b83dcf4ce11b7dbd032583a943a93c30c3f8e1ef3425867037cded4ebeaf6aa2d98b4abfb28fd3891eda69fe2cce333b11135a089dcacae

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\settings.css.kon

Filesize
1KB

MD5
5f50bbfdb3f379734fad2f1b369f72a5

SHA1
d0c756bc919708b33976e653f701f1472df1b073

SHA256
08c35c5d0743ac816f9fd8fc9eddc590845877a5b4f1ebeea6b798f4f5dd626f

SHA512
f1d1eb6b6e7bfefe14098d41a55e1e97dae7e0b74130ac75da817fdc27df4ef18f765c1452fb7526da2e807ec8e181195a1cfdff01c75bbb942d6f11a6db2b03

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.kon

Filesize
5KB

MD5
70b1ce7eb0aed47e194b426abf522b8a

SHA1
77012a1dcc7726aa873dec0a20d08acf64fa4d7b

SHA256
bf75e9c2e904c76493b5fbc55b5625e2b74f33fc124522d0b6d1606ce7c2fa44

SHA512
0f2cf7ebf73d91334d7c9cfefe26e93bd0b3520ffc96cf6305970ece47491649bfbc97b4f60e3cccc321cab1d6f4359ef197f024365d45c3ea7779ccef1d799b

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png.kon

Filesize
6KB

MD5
786297223dfb073f4942092511e2cbd7

SHA1
fe82049fc9fdd535bc90f78b54da90491ee31d0c

SHA256
88d7c5fd32718ad834082c3d8c93aa77ec541da565788770e3bc82b52b0f993e

SHA512
53038de06d85da7b5e4af9b47b778e3b1bf8f9ff94c6c5d210b106d861d92e6303ca513919ee2b7eb47bb9dcf7b300430c16e067eacb143d4af91d590fa6264f

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.kon

Filesize
1KB

MD5
462f9e661fcd168e502c0ac28975ae62

SHA1
5bf9610652d8842c2903a363dc762a6b350c59d3

SHA256
4bdb81cef9000d5ae43c78e2cae8e0d4021a73f4549763480df7277f1599b813

SHA512
3afe711ca0d869cd0d5505abab27530b29ad1a95cf1b11f1ed6afbad0bc802efa8c56ca20ee3f76a79cd09b98d00d2f0e7443a65cae65906aa07e702cd537aaa

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\slideShow.css.kon

Filesize
4KB

MD5
9153a9b179c81f84e4be469966854e8f

SHA1
39653cf3c5513859300e734a0c6e4ea267ac0594

SHA256
a5a006197194f180524182898970e3e838b5f18cf407337b1164fd09a59fdaaf

SHA512
78b623eb5b9044d73c263191d39c71ff627f253ee169ad6a38b1c14742b0505308044f1b32877251549e0a28b3da2ff37fbf3d2438092c280ba49455714a7ac2

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png.kon

Filesize
5KB

MD5
b96a8af11de765d49d1b3d8c67a55435

SHA1
f3fcc8861e91e4339b2d1191a8913530d8077a06

SHA256
828f8d10482ae4c2f4016339f6be9a0f217e497379866796dbbc22b65f806372

SHA512
7edb7215486de3db0fb0a7500d8a83525d8bfb1d0723c217a36a7e01c5e991d4f0490662401e085927dbdf0f9cf3d375883b809f916744cb7ea90d16d51fdb90

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png.kon

Filesize
5KB

MD5
c4c88674f6c5fa1aaa644e3a3a5ed22d

SHA1
7c8c299bb79136fa4e7bc04e92fed66322f468d9

SHA256
203ec21f0467cbe851a3d286cd3996107252eec32b0442d59396ec2bb166c253

SHA512
683660ba0eae5d385c972d5eba57ca7c8b5c977d63465c1bdee550b015e699218c2caddf700fbf2d40e202817a5cad7d585792f002bebcefa909f7a22df5bfc1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png.kon

Filesize
3KB

MD5
9e8b4139b0f936c0e501f76157d1b449

SHA1
5a4ef98a90e1841d81a3747c090aa242ceb97cd9

SHA256
cfbb0b1583cb221f4747ea0fe1ab243706a1b38c8291bdf0bf93cbb696f02b2a

SHA512
27cf76ddcc8ec1e11cc72fd138537c1c5dc3dc9b178ae3dace8af3cf3f815565257c73adde7bab493cf5baff3e019fcd36c0e71300e867134dbb1e51e8d04710

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.kon

Filesize
976B

MD5
ecb75e33f9bfa8b44f91858139f6ccb0

SHA1
1d94113329c5938a97d222872dc2fdb1ef3ed0f9

SHA256
515b47d6aadd236098d5411fe2058897f9ad312088582a2c5dad05d594712f88

SHA512
0dc2772d7cd6bd58422ab045967220797042fa7cd9aa8cd423a1eb6447b737928a3add6462eab18ba931428e9b0311a802f78cd76353c1f2dcc76648c9199df1

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css.kon

Filesize
9KB

MD5
e828c83c69956724daa7276edde69235

SHA1
726c1b3ed74721254a1434cf8548518ec09ec8a4

SHA256
1686094afc873556c2e7f3888b02a8bfed814d2a088ada5868113a3c7c81d993

SHA512
60f78b6e2b7807eaa31001cd3133e1d7aa92206841f8ce1e8b4e29bf4260bbab7979de751df5398a5cb6e399ffe3e9a22dac16c6ddf5a9423e770970fed8a954

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.kon

Filesize
24KB

MD5
e993aed4274e9ea1b401fa93439690d6

SHA1
037ecc9381e8afb9a123a3492a235d038770f9ab

SHA256
20284e139fcad08b45a306621efc4725245c73e65558878ae75d49790dc68ed9

SHA512
f62fdf3d90acf60dfe524b8e3bbf8c852a07c0e032ea29c5402df75c03ca1d17710d97128bec944259273627e0e6fcb1bcf4c1766786a2d9666cc0c13ef13e51

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\highDpiImageSwap.js.kon

Filesize
1KB

MD5
b557be5e900a50e82696c36338be5fa3

SHA1
768507a4dde09c3cf26b5d15e7020aad69e28d1e

SHA256
44dca41ad1d41e31c071f1e63b12f761e11e99db05c4a1ab1cf56444c71c279c

SHA512
9813347aa9a69f295b42aeccd41e482c68f3798a82f1062632f4191820792978b06634345ff6dd1aa32e709867ec68cf608d072b63f000e7ad26276df275bb59

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\library.js.kon

Filesize
42KB

MD5
147dbcda75e9b6fdd84b0a3688e5e41d

SHA1
86e668dcb5d57c3ac444f219ff40aec506d18078

SHA256
665388dffb0a28ec951e675177e4ffdf47859992abcee04f617d848bdd4ca59c

SHA512
81a23c845f4b61a80684e2af4928ff03bd37df96d22187ade2e5d0317a0bf8aed95ac512dec6a1ff769cd36412a6287a85d57fa00fcfc32e7269dc0ff1e72d20

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\localizedStrings.js.kon

Filesize
14KB

MD5
722e3b2615cc1a2b778e868e37b9db2b

SHA1
96dd6076ce1f13cbf95d90c7ca9484fb69c293ed

SHA256
39f06551dc885ee7f38fb5dd30d77fc3cfa5703d60da0921b1789d2dc7045a43

SHA512
9d9acc6e775313ab1a2b3084e5cc31a5debb5c6eb7546a4aa097aa0e4576ac7157373191e04b732713cdcc68ea743735a8310891df137ef3cd98826fc266dfa0

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js.kon

Filesize
56KB

MD5
1c1131774d6386791f19cd705c3d5e97

SHA1
7f51eaa7a8e267f74a787c4e2f2c31f32a3c4eb7

SHA256
581800a1690c0ede0474ff38e1bd19f395565e6f4301ea29c44e9ab12e373506

SHA512
b37183e5f9414d8aef013c5c0571e7b344ed2ee5417f623972b2d20d392945241b3a4d0629e873d6212775f1660b58b12aa1556d3e335077e4d4401d6f19e54d

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\weather.js.kon

Filesize
132KB

MD5
13ef52629ae88ca594a54ad7f2b316e3

SHA1
9b48d13acdd55275e022f45204116c5cf71ce86f

SHA256
0cdf4a9b59bd1983bffb93298783471c41e3ccd5376896bd7f9e97e6cea7aa3c

SHA512
dca3448b3eca808261b84390653fb2a82ba0d1b7f9bea2b9f3c4f607a48bf57d232e3c864760684fff28105d0a8290fbf7d0f4744ac6be5ca22bce9cde85ae34

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\settings.html.kon

Filesize
8KB

MD5
e9babf140ab03fb90d4b20e5e04147e1

SHA1
a8287248f4d1b92ced306b51a1791721ed8746ff

SHA256
522863dd101e91651bee05af6b02c48de589248e23d1a77f0b61934e1687fee8

SHA512
116b6b21830bc1f1a4750e112eaf1634cd83fd1794e8550ec4a8836dabb64bd091f7f88a1be6677e0bc9de95f929a1e9f0ca01f694cfa19e360e7f47e8dc17c6

Download Submit
C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.kon

Filesize
15KB

MD5
38019b6d6df27a2f372daf358620d1e0

SHA1
de87a1f125ccf709add16e2570182181db6c4907

SHA256
ebafb82175bfd939c791467f3dfc86100c0840226d652c41259749f05029eea2

SHA512
03527381b8040d8c7649f58a21b26ca5e2a5328c894abc5aacc2985e2e5ff0cf1ca1135b68792258c737ea2f27710db42a84df47e5d90eeea9686c8097b171f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\PTDOBUC5\desktop.ini.kon

Filesize
80B

MD5
9152a80b7c52ccca6c183455f0822994

SHA1
4fa9eb8190224ccd5b3a84e99fd7109605a44182

SHA256
acc9e466e63b8190e67cc1d536cd191ffc1a1fe3dbf044f06b09ac92146a2c87

SHA512
acd4b379c627001660815b33d327c1004d7e3d04b63ac7e6097723527410078892d77bdc5511d020f9f98c572cc873346a60e78e3d5d9afabb420e3b071a85ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Pretty_Peacock.jpg.kon

Filesize
5KB

MD5
69f1ba677db0cabf69761a71fe42212d

SHA1
dbfc2eba39ef46c045e60d019334b8cd899ad693

SHA256
04c8a6fac8408b4e837570826e06337b4b8c82aba5e024a1aa19e97656cc06e8

SHA512
bcb9f56335e27948ec3410479cebc0e1e7655f6d11cedd37b10a2570a7e58b4b0e4c9e6b805f1c65959efd7bd80110f2c2448d522fefb7712c3a92e7b714a371

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x07tfuqf.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.kon

Filesize
48KB

MD5
08da3c4d053505a29188782160ba7185

SHA1
03a1892ade3c3807039fc7d01e2a5ee186063412

SHA256
3f7cd22a15c5c87bc4d1f9a73f1e43bc525ed3eb7dcd17ab0dbaadac240a727b

SHA512
826c8a58ea56b969aba8ac3f12524954efb722296c050f7812d91807084d461755b196c7e6315fe7e67e6728a676c46369673272676bb4e34d78727af7d3dad1

Download Submit
C:\Windows\Media\Delta\Desktop.ini.kon

Filesize
1KB

MD5
337f6c8f9a71621fb071b6ad737541c0

SHA1
7484ab6c86deaa8926ac3a8f8c62be7edb451fbc

SHA256
8d1afef4e474d5b034086d0e438a7ec0ccb19f978221ad4fd136863401e29a90

SHA512
28b3418efe704bcea3ce7f4e47b25709b80047b160831552d4b3070f2f78b7c8785694ee938550145ec871bea4adb173850efc8b5a2c65d746e73f8149e7ecf3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_1x1.gif.kon

Filesize
64B

MD5
a614658b4562c98d05e25630b673e53b

SHA1
bebc28d0713e81f5d64317a8df1a7429fd7f5250

SHA256
8d43a13082a502449d64b7420c8f2d83374dd41637c0e52d2f598348578b92a0

SHA512
544188a1fe0de4900dc263e287f77a0269720698335e62345420b3adb8c0bea4c35d45ea2b8b95875b0ae724bc2ac9a64c0fa382728c52c54348528dcb36712a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe.config.kon

Filesize
160B

MD5
c0225b6ea6cf548535d43520832f6d56

SHA1
887811d4cb6f99a74e30dd52aeb09804fc1cfbb2

SHA256
4cd6ec84f554af902418ef8dad9ff153662b034b71ec82ee8e67a6bb33176563

SHA512
096ac2ca7ee66504b3106622db849a143db6e633cacd2e89daa688831f3f2308ac0471b43475a8515ec90a7accc971cd2a69fd7e7663d15b8d06bb24078848b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe.config.kon

Filesize
160B

MD5
c37d3160fb1e993dde4ff8c9fabfdb25

SHA1
434e0d09e81443f910c9b89912a53384e24e2aa1

SHA256
7299084f447fec9b7e2751f158786a29ddd7ca0ac5887f080cba6c000efbb799

SHA512
c3de67ab7de57e1fa72958c1219bd9410de74153da247e2baccb17081ec5b6b9aec13278ce492d63dd98f88a872d813eac36bad7df2ea006298ce29a01e7b5c5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif.kon

Filesize
80B

MD5
a9e356bfacd9f7f5fe1225bcf01f3882

SHA1
7a4355698c4fd9150b29c54f8a6cfa9479ced18b

SHA256
41706b88a4198a03722a2cd5f96a79cbf7d9862a8fa9352ef4200ddd93b2ff2f

SHA512
df2226f8e5751633ae36bf88d096c9fc395b15a3c1af896e99d3ef6a50975391248bb6d25b4efb1d7e72cbd9cec66eafb43b0f0b2fa8a215d41cabecd32f7a79

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif.kon

Filesize
80B

MD5
fe5c02d93beb01344d59c3e266337d0c

SHA1
5b65cbf02c9e8287358cf25d7e0d24c4e38f120e

SHA256
b3a4481cedd1dbc9a93808126e7aa12cfe8c8faa265be7ef24ebc946758a48b7

SHA512
cb2b1bb689dde0642a2b617a03cae132c6222a260ed0b209c3509665bc9d0259c7d60f7799a21c6625dd6a0e241a145c88b75bdc32c0a59e47b6e0de12ce542f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe.config.kon

Filesize
176B

MD5
b23fd5715ecbca9a7c5fea1b6282d131

SHA1
274ec71459379e7cb945579dce2b85412688b488

SHA256
b9c9d1a049b1a99c97160f6432926d20dbf8c58b54f0f543332c5a462f9f79be

SHA512
8bd446a4bb5d2ac67152c9e10a94d55a144ba82f97f5d10181ca0ef3394b60591dd48a49ddd14749633d9812235ec5824b97f0a73c344f3840e84e43fcb7c397

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\legacy.web_lowtrust.config.kon

Filesize
8KB

MD5
ca1d63ced1d90aa7a95af4847fc27b5e

SHA1
bf0445d51b7883c0e518f0277489d827e870455f

SHA256
541fb9bc7eaaf0c412467df81f263860a3d97c7066d1f1cb256475c8b88d8ac8

SHA512
d49332b3f07d148877f679e8ed4f16ca4732b765cc1d2726a3c71c0429f77492f1d946431760c0cbcc42e717416b7a49d2cd52bd7df7f3c90a39fed24d9ec894

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\legacy.web_minimaltrust.config.kon

Filesize
6KB

MD5
dbdfe3175f59b7a5d5f63b6d34d0cd36

SHA1
34bdb9a44ea2cfaed56c6f2edcc066d0e4e41d13

SHA256
887ec4d3e74fec45cdb6f2f13be47c89ec3f371b58a2d5e60a7d64893510cd36

SHA512
6573da74ed24e6d8eb9022ef2de54c80144c59dd7ec6fa67104fd5c65e1bd6e224a6fb45c3ec753fff0c403f194b8a5e2a9b88b0beb98bd9f8014b39d113024d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe.config.kon

Filesize
192B

MD5
d998c52f66e2b7680225cf68f5699d05

SHA1
39a849215060a8bfb56a9688c1448f930b9dbaed

SHA256
569b04e6d0a610f99feb43aeb778dce6b8726e71130bf61d11fd3488d9a08e9c

SHA512
2a76661c4a7edf770440ee0a6d7b7f5446eaeddab3fb74110cbd15a23bbb6ad218b0c18ad0d53cf415d905f9f54347ffd949143660b32f1cd4290b7092125cff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\applaunch.exe.config.kon

Filesize
288B

MD5
093cf2801efc6f7a9e579ddea4c30ee3

SHA1
025569a43ba35db85b143e4abf2939067b5b70e7

SHA256
5fc3fd5739a1814b4fc5a3fd72c80acd71cac09e0113781e090325d29b74be57

SHA512
013c4af90f07a3c47ea821ea38e82e19c335b671e35b4a52d980e20f96750e59a7a04ca727b5f2cad58d525eada83c029e85505561cfdfb740bd1018e7925175

Download Submit
C:\Windows\Microsoft.NET\Framework\3082\admin.chm.kon

Filesize
48KB

MD5
c83a0ab1bec5aff441f1512dd54a5f8e

SHA1
591df19bcd0021af84ce7d8de22d8ccc56f5bb98

SHA256
eca2e8a528e3ba5fdc5f2a712ef6694924a2cb8c9f84cc5bf65da554722a9ac5

SHA512
f999f5b40c3e61570c03d85a44a3d78b84f705fa073c9114c6e9e288d67bc09c60c40af9fe4cbd0058a2b0c9a0204bff80ec5ecae7231ed8c03ae925573c44a8

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\regsvcs.exe.config.kon

Filesize
192B

MD5
8add6430174db6b593fdf65fb3d50adc

SHA1
d96dd9f2aeed2b95a158c641370beb6506ef360b

SHA256
dafc18464f23a0afaa201186c759e190ee5c80c81e96f4074fad35361fa01004

SHA512
e23294f5e6018c24beb284fddb2ab2588d792b7b3e0ea39d55857d569c695aa8c09ff5c73e87f63d6f9cbb90a6bdd09ff77aacef90344b373d1f60186d8f0f1c

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\DropSqlPersistenceProviderLogic.sql.kon

Filesize
2KB

MD5
b81a07cb076c990b00c58a83ec9d475f

SHA1
93d2dc271f3bc5048f38eb26dc850c295d723906

SHA256
6aaf40f8db347981cce88020c0ce7e9ed7ed981223fa3eeebb60b8373dd4a219

SHA512
61c31aaf2fdf592e294e8e1d8fa0809b280c7caadd3622f0e10bd3467d200107654e0c85cdd7f573832a1b68aa58e3741388fc8ca4a02599a4ba8cfa19a30f7e

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\it\SqlPersistenceProviderLogic.sql.kon

Filesize
13KB

MD5
ea549a0dc92db3d32ac419ca839daf64

SHA1
c11be8b818433d5aeef5c3e081b7325f9551d7cb

SHA256
add0367d57f1a39faba4a0e5aaffa1cf46134e4e373ae2bed581bca1aad0c199

SHA512
58e6626fe89d425f641bd7fe36c97a2317a3b97bf292a438728fda5dde0b98b7c14e6d305fd0cd059b94e4b3e656c16d2642ccd6b2449aa98d9d3e1eecb04e26

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe.config.kon

Filesize
224B

MD5
d803d5c0b9fd9c41c3e531c75e17eb78

SHA1
e159bab00d350da9d4b0d400b9519622e43a72ea

SHA256
0ef36d68c932fa1260a2131d0f574e3b3fa76373e19f1f979d5793721789b365

SHA512
b56f2860a3274e24cf499ba9c38804945e5099b137660c657fb144abbd16c58b1db17783a00556c21b51eb1e8f660c3a5b9fabc4018df489963bd465ae1b582d

Download Submit
C:\Windows\PLA\Reports\it-IT\Report.System.NetTrace.xml.kon

Filesize
80B

MD5
958d2c7f8c5e86d261b5b551ba80066b

SHA1
30514fb66d2084d76ce6c74477a0cf6d1175a296

SHA256
8ce6b274333e5d6c3240def9e9297eb2c7555d365ebcf40650645754e5d0b294

SHA512
7accc01c8fb026a920e8aad8883f77f2c55371a3fce4bf8c1b6b0597f332cb763ec3958380ce3349b3919f550ed138c988e7526460df93f7eea14cdb9a445f2b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini.kon

Filesize
160B

MD5
7281d8aac20ea22a73d07489986ef79f

SHA1
063afcc8bc1378730d25d58ed13e2c4fc8a24241

SHA256
ae0bc929844d7c16979f1c831ffe9217d1d3881e01f484d0326ab3c6a96e0a89

SHA512
e883bd5615abd098c9bb123c1fa85fdee8715799b9e00ad9077cbad677782024239b9a4ae28049ad703ecd66ee96b933758ea157acf66cfc8074e00f1f384cf3

Download Submit
C:\Windows\System32\perfh009.dat.kon

Filesize
646KB

MD5
5574208b06938b0fbfbcd8dfa6abb842

SHA1
3068530238ab6494c30165b2c4abb766f29a5cf4

SHA256
f55739ddf966777a4df37787f0cae59fabd88bf6ceffc68954fe4712f437e9a4

SHA512
1707d8e26621a5fcb5774e3f5db27a5d87ee4f97cc5ecf83f48ffbca6bfc7d7ebc059ded666cdbfc499dcf6be447876ef5de2cc768876d002865b09dd9af6f74

Download Submit
C:\Windows\ehome\wow\ehexthost32.exe.config.kon

Filesize
2KB

MD5
07c9356268d120f4745582cb549d8166

SHA1
20b50e992ee55c72074736f2f4a48b9c8a35bcc3

SHA256
044a32791ee6e2d82827f5b678de8a1c851836354fc16d5c7e2080a8ad3c2b62

SHA512
4eaf1f77571c551b245209c97abda3b758e52d6f28d135e4354099188de4779d5fd5a75cf3cf583c206f4a442571f75cdbdd6f68f0dc495684ba027c52c31ea4

Download Submit
C:\Windows\inf\.NET CLR Data\0410\_DataPerfCounters_D.ini.kon

Filesize
48B

MD5
37d1be6df4f0f9394a112d59e95c88ae

SHA1
5328cfd3ab2b45b3330a3f7237fc80fe7bfc5386

SHA256
c1752e5b9b4767f64d663475afe708620f0ea8a6dfd8a00d015dd892f647de4c

SHA512
466b211f969a3b75eb51835973b7bdbadc4692952cbf4cc31d68c01b833dcecf062684c909786769a4d3e15f42ba07f93e76d74b76118ab3f1f42379ede11b79

Download Submit
C:\Windows\inf\.NET CLR Networking 4.0.0.0\0008\_Networkingperfcounters.ini.kon

Filesize
162KB

MD5
15b3a9f2149ffc57a70d7c97b7caf034

SHA1
3044adbbc3de24d84d9084d309ba3546a1c9a822

SHA256
a99761700cc7a7731cac73431b85b212cdb49f77a46b6960b301ab89c3e6d97a

SHA512
8fd1c8d70a5e34e39a9261fd63f8de076e9c177094d5ff404a17c82297c7b6286ea305a6164db16288149d38a65c94ea5b47ff463a3efcc194f8cd06a6377e2d

Download Submit
C:\Windows\inf\.NET CLR Networking\0410\_Networkingperfcounters_D.ini.kon

Filesize
48B

MD5
dc45abab67cf0a5b2fc1bc1cf4f9e6c0

SHA1
f5640eb3a2e4eb7b801ebf5b8477634c538fc5a8

SHA256
7b566160b1b12e30aff82268cb420fb21143c8d526c5395bcfefab395a6b51b1

SHA512
4bc0a6827dbead8365ddb19e654382e844f1558e902f88c574386d70f03dfc87dc6a431625fd026cb8f69c5cdb7ff435411fb804cd881ddcfa335704df9e1462

Download Submit
C:\Windows\inf\.NET Data Provider for Oracle\0410\_DataOracleClientPerfCounters_shared12_neutral_D.ini.kon

Filesize
80B

MD5
f062eb60ebb2379af75721a67a00498d

SHA1
0de7dce6ae45213c63abc3599a5f74bb58b2f026

SHA256
a6f60f1aed46a83a919ad525769a89c575eb942d447f9b800a68b44e5c899ced

SHA512
8e2b0388470d89a1fd6892c129d12877b66b7d28fe6c06b526b1d58f8fbbe45e25d3047f82c59917fc6dbb52456be538d5cccffe231b4da27aecba0ce343aebe

Download Submit
C:\Windows\inf\.NET Data Provider for SqlServer\0410\_dataperfcounters_shared12_neutral_D.ini.kon

Filesize
64B

MD5
7712256242e65cb949179b2256da1fcb

SHA1
dd69a5b7d90361deb228fb6ae97a3a2a1ab7d9d4

SHA256
aceac8be7d488b50166c46cd94f1fca12b9082f681b7109683f1254ebafa5230

SHA512
0986b02aaf1061c944592a35c924524f2095fb9f9a8783ea88c01a07d32db00e7a092fa760aab3a406810b9b13e0b5d0242c7dde2e7af70ea19bad4128cd1efb

Download Submit
C:\Windows\inf\.NETFramework\0410\corperfmonsymbols_D.ini.kon

Filesize
48B

MD5
0421b9e67d0c23a4c9d46c00cbb943fe

SHA1
bc1a9eea1fe7b0b7a778d1828460406347b4db51

SHA256
9b2371daf0b63e6199fbc31da3da2e917982f813f5b46c405cc6c3d73862233e

SHA512
879acd76d77fade0f782fb0bb0acf45cd817d8b92bea4a67566be00e39e8ee2eaee748f561e2250306e515b274bc22e77939c00523e255aef4c70a9175e55e46

Download Submit
C:\Windows\inf\ASP.NET\0007\aspnet_perf2.ini.kon

Filesize
972KB

MD5
93de86e52dc78e4b7637f13e71e41be6

SHA1
1f6d391b986911dc299e0491ca51208e969a3586

SHA256
6803e5379ea257aef808931fdae28c90ef303026422911a746019a203117326c

SHA512
3e1b3be16ac577175ce51c74e67821027c6b581791664a48bb6c39de31a24455c03665d46a631d05d679621869f663d636b13089c128dba427307ac040fd2593

Download Submit
C:\Windows\inf\ASP.NET_4.0.30319\0007\aspnet_perf.ini.kon

Filesize
974KB

MD5
f449f63ebedba2f7faf1504f23bfebf2

SHA1
c2939b48791fca5f86517e80d96e85de3ce2903c

SHA256
e05dcd3cdc3f272ae61a074dff79c972ab4f4420b54e956d377548dc04b7faec

SHA512
1134de53c957f9a607d61a6532818a2614f7ed963b04083c91d78070d1dcdefd319e86ea3ffb9358181b7a66a07a15829f069fc178becc39f170c330ca668fa2

Download Submit
C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\_TransactionBridgePerfCounters_D.ini.kon

Filesize
64B

MD5
27dfc4e8ca851f6e6d7f484b9bed3605

SHA1
ebe5e564dc2e4edbfe8838d8b04f192c431f5404

SHA256
09b8577f7c5aec5ee188ac4864383d7bfe19d9630871d928c6ac9dc406efe8c0

SHA512
b59b1d926b064711fe79ce231d64b39351b658d3ff4673520258f8d427e5bad696a0b2cf058c3fe8cc85608ac4ac9526718b55bde1f913133f28697a1104d7ed

Download Submit
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0008\_TransactionBridgePerfCounters.ini.kon

Filesize
132KB

MD5
95534240855a797015a70f77d811936a

SHA1
0e7090356d26a0fbf41174ca7516f57d1a5c0776

SHA256
2b09de1f0e127141f388ea620e107585b4a6e390dc3841dcc27c589514cca7e6

SHA512
1dfa0607699531b609b22b0986560855ac450ff9c1db589198f4f83909ef1ccde535aa71a27fe507e83412e482fe14406528750146f6729543a656c86574e510

Download Submit
C:\Windows\inf\PERFLIB\0411\perfc.dat.kon

Filesize
30KB

MD5
a78d1cc81d6ead9900a5afdcd0dcbe3e

SHA1
df2b400d4441bee8c37b692282069d0d24f408ad

SHA256
26b56eb07c8ea04b535d465bde01db9db51f38939d6ace45f4c61223d1533886

SHA512
5fb79fbb4a4777e4dea76b7e7bbb2d40d5d9e5e844b8c2c36f99474624f852996ec47d84e60bc5268007c1305661f48641f9ffe29b4ea63116329f4f42a2d208

Download Submit
C:\Windows\inf\SMSvcHost 3.0.0.0\0410\_SMSvcHostPerfCounters_D.ini.kon

Filesize
48B

MD5
04e0d354df421211c58b1c6093570715

SHA1
fbe45660d3cde704c2dd7e11223d49591b732acc

SHA256
dc902e7fc689fce509139248e88e96eecb96d3678a4a4e8558c0b0aca25cc28c

SHA512
18dcd046877254e746686efd9e2f7313336b8519a4d389562d3c9efb6da9fedd2b8d418ba53d5c9ad19ba0d359f842b33f34020353be0dceddd072848cd3b11a

Download Submit
C:\Windows\inf\SMSvcHost 4.0.0.0\0008\_SMSvcHostPerfCounters.ini.kon

Filesize
130KB

MD5
84954713b2c8af6b4c2623af8cb3a068

SHA1
b2015486dd39873c370801e157b2cb17ba43905e

SHA256
0b88cec73aca41216222c86f5f89aa578c7b0db8ef2b8eea603e14527d93fb16

SHA512
0920df01b95a84810edf8561b996b06925dcd560e2824b238a3eb57f4a4ee3b2b3e721ee1ecddb70c81700f73e56f8555d598aa6e04acdff3738783c1b1303d5

Download Submit
C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0410\_ServiceModelEndpointPerfCounters_D.ini.kon

Filesize
64B

MD5
a9e62822044d743e16392b18398b7cfe

SHA1
72661f2a1828c059de6e4ec4638c8db1fde61783

SHA256
cda5b9ba947c80d17920bef5e1407e8a1a212bf3acaf43e03dcdef43f7692ec1

SHA512
96cdf7f04f6f7c92057e79b6f59e3ee73d049b96d0d0e258c86cfa05d86c6cbad179cd3fd66cb4c924572d2cf02809258aedabfc1eba8cc3dcb92d6f75eac225

Download Submit
C:\Windows\inf\ServiceModelOperation 3.0.0.0\0410\_ServiceModelOperationPerfCounters_D.ini.kon

Filesize
64B

MD5
5a414940e02b7ad63be722d08de52f40

SHA1
2443dfac96ccbf0aeb87c651744d5665a8b0e3ca

SHA256
9e73aca3486f95c8e45e6319d2fd9924dc7003c1cde87ca65524e5b28d4606ea

SHA512
047a2a7222bfd2ec8385366166a396150dd81e15aa4fe13a0fc42595466c8a490dbff16568650c7a28b10bdbfa8068300ea60ce5aa35c60809491c58fbd522aa

Download Submit
C:\Windows\inf\ServiceModelService 3.0.0.0\0410\_ServiceModelServicePerfCounters_D.ini.kon

Filesize
64B

MD5
8f49c4ea6dcb306e4f953e8c059aade8

SHA1
d4bb7b9b5ac353b9baa91c0324c58cbd1fee242e

SHA256
494700b7ae7afc1a1019cf6aa65c519b9233c619210725f7776b666266e0375c

SHA512
9f6e7cf74181bdcb73787765a6f90a73510220faab8b9f886ecdced85ca33af43b26c2db219735bd71a4e12a98ec95ade0468be6050289d63ad39ea2946e7097

Download Submit
C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\PerfCounters_D.ini.kon

Filesize
32B

MD5
f487c8f71e82a9e78e1fd68d91c933f8

SHA1
b6e6db8729813e67a3f9388b63293f1f7ed09b28

SHA256
014bc555ac6cdf3737d9fec726c0dee8a1589a26a020c3d066552c5ed3b1e759

SHA512
feb73cdd2cb7a015295d15eb72913fe79e979f44836a02f50da131fe38eeaaba98483046345fc8dcbd37cf577a2ffb7dd3a8217ef47ed39d9b80301335fe4b37

Download Submit
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0008\PerfCounters.ini.kon

Filesize
150KB

MD5
ee65a2ffbddee414aed0c3ba89e13d3a

SHA1
e1fd3f17accf1647bd22aafad8bb6acc90e0af0a

SHA256
f9c83e106350e1fab98f57bfa9f7d5527fad02f78b7395e681926f449820fcb7

SHA512
10b62bc4019c13ea69be580e50fee88e91f393cc25a003a279e2ee916b48365ec9be5b25667fa03eab87e0dae9ead39b4eaadbf2c2ed08016f155b17a25a427c

Download Submit
C:\Windows\inf\aspnet_state\0007\aspnet_state_perf.ini.kon

Filesize
42KB

MD5
1e9821d6a8c4862122f702b1ef2b9aee

SHA1
db7ff1ede187e2975425173e3cff43e8bd3160ab

SHA256
7e971d5c6e9a223708f9859d04ccc073968face911fd29f5fd8457deac6c7deb

SHA512
02b7c82362301d9b8508501a393ca37b8adde6106cdca5aecb7ba6d749c9a485ac062328eb856a5fa3e834d11c6c00b389cdcc537ee2ceb9be83e449ddfa7092

Download Submit