Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
02/03/2024, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe
Resource
win10v2004-20240226-en
General
-
Target
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe
-
Size
261KB
-
MD5
7d80230df68ccba871815d68f016c282
-
SHA1
e10874c6108a26ceedfc84f50881824462b5b6b6
-
SHA256
f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
-
SHA512
64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
-
SSDEEP
3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML
Signatures
-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (3045) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory 29 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\gmreadme.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Executes dropped EXE 1 IoCs
pid Process 2744 WindowsUpdate.exe -
Loads dropped DLL 1 IoCs
pid Process 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-HTTPLogging-Deployment-DL.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmoptn.inf_amd64_neutral_be2f30f68f2a5567\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\license.rtf f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\ProfessionalN\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseN\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_parameters.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_profiles.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\StarterN\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalN\license.rtf f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\fr-FR\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpoa710t.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration-DL.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft.Windows.COM.DTC.Setup-DL.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateN\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\vsssystemprovider-replacement.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Throw.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migration\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\he-IL\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Windows_PowerShell_2.0.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-OfflineFiles-DL\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_preference_variables.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_neutral_c3910bbf4fbccf97\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_neutral_4de24f49b5e60c45\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\IPv4IPv6CoexistenceMigration-Replacement.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_neutral_b64bd08009e7444f\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_transactions.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\000e\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Unimodem-Config\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_troubleshooting.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_FAQ.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\oobe\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\IME\IMEJP10\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\Ultimate\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\iis-powershellprovider-rm.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\prnrc005.inf_amd64_neutral_31e08a1c2f933124\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\Microsoft.PowerShell.Security.dll-Help.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\icsxml\osinfo.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-LegacySnapIn-Deployment-DL.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\XPSViewer\it-IT\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\rdvgwddm.inf_amd64_neutral_dd691eae66f3032d\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_objects.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\WindowsSearchEngine-DL.man f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WCN\es-ES\Add_a_device_or_computer_to_a_network_usb.rtf f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Comment_Based_Help.help.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0021\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_neutral_379fb0c62496be6e\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\SysWOW64\WCN\ja-JP\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\ProfessionalN\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\Amd64\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.servlet_1.1.500.v20140318-1755.jar f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIconsMask.bmp f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Microsoft Office\Office14\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left_over.gif f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\QuizShow.potx f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared16x16Images.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert.css f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Gradient.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows NT\TableTextService\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\currency.css f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent_partly-cloudy.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssLogo.gif f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\settings.css f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Default.dotx f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDisableUpArrow.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_zh_4.4.0.v20140623020002.jar f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Distinctive.dotx f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_windy.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\settings.js f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\currency.js f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Media\Quirky\Windows Logon Sound.wav f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\SQL\EN\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Panther\DDACLSys.log f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\0a5d39e601d2512b483a56408c3cec05\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\4308c2310ca6f08c6e0068172e5b709f\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Media\Cityscape\Windows Notify.wav f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Media\Garden\Windows Hardware Insert.wav f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\servicing\Sessions\31089658_208689232.back.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Setup\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0008\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.Rtc\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\Tracking_Logic.sql f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Access.Dao\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Globalization\MCT\MCT-GB\Link\GB-3.url f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\it\SqlPersistenceProviderLogic.sql f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Media\Landscape\Windows Information Bar.wav f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp5.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\inf\wsearchidxpi\0411\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\PLA\Reports\ja-JP\Report.System.Summary.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn.resources\6.1.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\3.0.0.0_fr_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.22cc68a8#\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Media\Raga\Windows Print complete.wav f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\SQL\de\SqlPersistenceProviderSchema.sql f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\PLA\Reports\de-DE\Report.System.CPU.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\IEHost\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\MIGUIControls\5d7e85e3ad81826e2e1d7131284c63fe\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\diagnostics\system\HomeGroup\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\inf\TAPISRV\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Resources\Themes\Aero\de-DE\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\29c55874e34f9d5cd3ea739262f48adc\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Idena7b556ff#\0723ea64eb28deb30a0df931a69feba6\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Emit.ILGeneration\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\inf\ESENT\0000\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlWorkflowInstanceStoreLogic.sql f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\14.0.0.0__71e9bce111e9429c\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te3736ca4#\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\inf\es-ES\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\System.AddIn.Contra#\eadb7dd5fe85da92b491154484bc40e3\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\UIAutomationClient\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\it\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Panther\diagwrn.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\PLA\Rules\es-ES\Rules.System.NetTrace.xml f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\it\SqlPersistenceProviderSchema.sql f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\IME\IMETC10\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Media\Savanna\Windows Ding.wav f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activation\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe File created C:\Windows\assembly\GAC_MSIL\System.Data.SqlXml.resources\2.0.0.0_ja_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2744 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe 30 PID 1856 wrote to memory of 2744 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe 30 PID 1856 wrote to memory of 2744 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe 30 PID 1856 wrote to memory of 2744 1856 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe"C:\Users\Admin\AppData\Local\Temp\f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"2⤵
- Executes dropped EXE
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD569c0d88648ff336edafb02c73e75dc1f
SHA1f7fdf799eae7c355f5153185e2e0052001962580
SHA25695649d854c89bd911e3283e4956c1efcd4349ef32c87d254848a1d4f6e09e7bc
SHA512f38b88d2ed70e9036889782bb567393bfcf176eb634a8cacc427281df0aea4768d540167ea5928aed527923ee911433950937210e430886965ac49e8a7b8de5e
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
Filesize352B
MD50df2d2b69fa1c1ea5881e6454f5057d1
SHA15f0b449fbebe946f2fe2e6ffdda66162429b6e9c
SHA256d42d7839a1a22dd773630e3829b0ae13eef56beb5aac188794b728448b4d71b3
SHA5120d0387e157b662dc853a35bac31d51c86f68ce3a5b6f5693ff327747e3479a82327b89fd1c9a5d2f0aaf42e530c61b55c1bcd098bfe32a23e02752afeb86e811
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
Filesize224B
MD5e1f882c96afe28966bdae681fe3e2a81
SHA195d5dfcf5b2081afb549e223bf42e0f17f1f52f6
SHA256e424697af21bedf21bac37a57c9529edb60606699de451b945bcfa4c4a12a15f
SHA51218a222c5dc2b266ba499878d6f957245e347aa1f472a986b63a286818f6ad0c5ac53b30473933ff2a3e872779890b4915c1ac9be05cb179d53153dec9fff49a9
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Filesize5KB
MD55d3364af6f17c35f05cd4618659e8b77
SHA17f785e5bdddaaa434719ba6bf332430f51520a14
SHA25629d526edc1b03e9faa940c09b8bb0fde81db856dda8527e57594cfda01208808
SHA512509fdd62b220f70016d2cbda31612222288edd6cb1757f71e68b9609c78d4a605abb5e0c33f9d774dfcbe4398a33ffbf5fbfd21e0be93c2e95378808cd448ee8
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Filesize31KB
MD528459546a256cf2bffa1ae8731693c2d
SHA19759912fe597887dc56b0fe7b36f1e61815a18df
SHA256dd18773b2f63cb3ea263a9a5780534cca1f664867c76e38eb5bf85f665955dd9
SHA51278379a3a50fe88fdbd35211b0d644eb212fc80f596a24b4379754c8a539cd85d25965b4569f94b4a22097d9dfbb4045dc66f1439ca22ac736bbf58dc4c8868cc
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Filesize4KB
MD57b8c18380afa9a33724db89341938df3
SHA1e0d0fb0a3ef09aabbd7036dac30e8c9d8e57bc77
SHA2568e574df10db023b68f94869bd28e7074f30e3da13adf8f6d0011fff67463bd6b
SHA512638974e262804bb24a0a9ad30bc678ceb16addbc8dc698504e171bc7ec5614bf30ba6635225b51bba3739352cff6bfaf4004c10bbc463a7892448bcddd704379
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Filesize21KB
MD5101416bfdeb34a2c010da3950a053d28
SHA138b347ec113d7afee6e655b81c63567c0e295d81
SHA2562871113de2ae1aba17f7675d3aab88adc9ba24b00b48026bf31d7cca5e8cc950
SHA51299a86c4ec4c9440ee3d11276cbbff2a06fdaa46cfbff41cd993da0e151e5756bf118671e7f0f1daafa66471d3b3cdedc7ae786ef6dc24501c4a9444e84a12524
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
Filesize112B
MD5f8f80ad8dc2f9cefd81240d29f76355d
SHA1338193cd1620b9914f9ac489343f1eba1b681d14
SHA256bb90a7513e199e07f9e662af07c9778fc317ee8760207893a54c69c217f4c6a5
SHA512035174f0c6134b8cf4229396d5f1fdbe7ac238d453d7612d5db1dafb41b08478e4ca345b7eae1557c867d60088818231cb51e43529a32d52a45c1095de2d565f
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Filesize8KB
MD5820efdc5ed9d71eca5f39a774b912071
SHA10c6e6cd58d30d4bad829ba22d636a4411e48effc
SHA25671195b04bfaed83afe6c13b04680b91fccd1e7eef5f225db69f688833a1c2572
SHA51241b61e7e32ba9a4d2ec26231c99c1a500a779f1a670d71846f4e70b0aa949eeaaf047df702d44b2f25980d299e8cd299ecb1b8b7d49c5830292abe2bba2e3705
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Filesize15KB
MD52a59a8f7c2938ca903de374f03b30ae2
SHA1da9d8aba781ea146117855d61c27767e43912dba
SHA256fa293f8840223055926d137d5d7acf244237bb5f1db7b543fe59b1a69aa712e1
SHA512d7e7abd4340f2e54ecbc96e5f86e714dabdfb4bc9f92d3af29f11d5c64a3dd9e6169b8becc4184f9150cf270ffccb4a1e4e6ded6934026edc3b8417e240fa4c2
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Filesize6KB
MD5545b776c2c719253ab8d4141ad1014b2
SHA1a586412ecb7ccb322c4d343a00c837d018c8e17d
SHA256a2a9006ff0dc98efd473aecffc893e30a8ba74d0936b26a71291633238ff8fb4
SHA5126deb27b877e99b672c39bf3b63cc75463893ba4eb3942b6465443377cd453a9fa71e6ff1089c69d7f4942fcea16caeef98ffbed98a46d337a79691f3632a8e13
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Filesize20KB
MD55185ed0c639b3709ed520e6e47bb078c
SHA14a3aaa864dbfff95ff09c93e782b063c53f060af
SHA256e5abe07b152d0991734f5e6969da92d17028265ec1a95e6c952b9e29e02c5915
SHA5123f1eb642c8b54e619a5ffe9229697ecb6de5adddb9ec7e9b1bec7986be4059912425b64d875c56d38b80dbb6e9b43a083569fd379cb4ed17c9c62a9828ce7478
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Filesize6KB
MD5615acbc4cc4343bda9132819d0313e38
SHA107fbe84678440552f5cf1544a2f82c551a6bc284
SHA256263a6e10cbb58b6d3b05e36ac502ed0867c0f45488d7683f6eb1840b7e342bfb
SHA512ab550fd3058bd69c09bc5e00381057d93649231de524e8e10e8bda9713e39291c47061e49872c9af0be0c26e8f6bddd1639e8eb4f3a64ac1eadda0cec6183b6f
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Filesize15KB
MD5428f3bd49218b564e07892da7c0f5aa4
SHA1e6543629e868808ed7f63804e783a014214487b2
SHA256db02891bea7bd6c8967107ad87525f0f21b4045c224f5722e59e71ad60a5d958
SHA512d87cf93afe3004c1bf8d41d34f415db2b6b61ecfa59af8f8d79fde3afe4cf16e326c7323a6fcd13f375033bfe96a80533910b594a1c95e110b577cf286f642f8
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Filesize2KB
MD5296a08c4e07841ddd4bb59f2940f77b4
SHA1d809b5bfc4c2e8022b48b0f2ef2c42242db2ff76
SHA256afb515dcebd5e2fc299bfb6c64f8f58177cd399c8c3a69c48d21055dded89642
SHA5129d05231ac4368bbe74842e0fa88999f5d44a483d1ef713d7c720967385cecb2da52bf8aa509e103fddded81adf43eac0936c45e747fb23cd721409b87fbf875a
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Filesize2KB
MD512e4131a40849c78ae0b29928283ce19
SHA185f73b053d323400ec9fd0928b1ec0e7363e8212
SHA2567d50c900aaf6fb497b1c5cfff15266adbc85008f139c61be5a86991032b71ec3
SHA5129cd7e746fc54a4f7bbf6a4e39013680005668a6e418205d235155ef8d3064e04bc281b8e640708e9dc29246337bfff1a1ef736ab33c71c012b01eda7c1b4bdca
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize7KB
MD5bc3e2fe9405ddaea10984dd0ce5ca877
SHA194234682da51634ab9d52e88e5694f2df1f82762
SHA2564143ca03a2f0b03fd008279eaadc4ac00fd8c1aa5735bfd6f2b3c621b58382b5
SHA51276cad32d0378feecc0ae25d2afaf7c09451fce44a5b0cc2821a4a7834b3af3c14a52bbd7e8011e069fd9d19e6e2eae15df0b26ab8629ef01f1beefad845e2b2b
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Filesize336B
MD55af9294c3a121773732d5d810bfca394
SHA1eea88711d01ce692f9c32701c904823df78c7160
SHA256e6409ee5917d8d0458e8986cea829998059f4e8505bdccfed09dce97d2ed1183
SHA512050e43fc110430bdbc71037b18e8d4d43bd63f9d535f0b42dec0d3f87feb053dda80dfcb9929808f5c802bb06ee3bc5a483feafe776eefaadc65005afa383cfa
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Filesize240B
MD56f4b967b6e41b76eb3dd55b514b16df3
SHA11fc32ab76551d57a72f9d994d405198f12cd7d66
SHA2568e87368878502d1351f3a4d0129eafe245ec88d267ac81a461ae6b163a24e55c
SHA512282629a9c592e7b1764491f12198335a41e5b5cda1c5c1b6f6ab9f6f5806d38fc67ca2dff680bd81e94e6d2e9ff9cb044663977fefbed471b1a1658b727c2498
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Filesize6KB
MD5cb4983a60030b4f242e923b21f4eb1a7
SHA124066444990954876a1dd567f17bd723e33d32de
SHA256f1623bad9839941601141e2b2fcd4510680b023928830ece45ea6d6b83b14cca
SHA5120d112f896a94757a0f085579e0329f35a2299cee221c533daa835a25058fd7ef58395125c78fc451147eddb0b5dd2a31c1c8e5160c3f84b1789bc5c15803fd3e
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Filesize816B
MD5175cbbb8d4f9e82ffa97a40609e83ca0
SHA1367bb4afaa13e618fa03a35d1263bc088d438e83
SHA256036f833b7a7452a82aeb0813ab29b3eb86a87c930781aa5e3a48da014587e013
SHA512a1867b34f1a1b3358fbb6b626c05648ee17a3ce728bdc70d7b6aa6edf3d7ab8d9d640bd168276b007520fa135ec381d0bbad84eb07d7932e98fc99032966b872
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize3KB
MD56e74e40c1d7a160891b3d1ddba19ef32
SHA1843c4f8484c0d965b740ace5ae8c2cba2f2a28ef
SHA2566866034b68f3d3c548751d11e229a91de5f140d26a37aaa9b441467a235ae2ef
SHA5128b555215f6368f6674c195b0698802cb3b1407c83bf280a1f0aa7dc43c6f3747c30d41d59e1c3458fa227a50aca2068e4ca0dec7841d268b39b8c61001f285e6
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif.fantom
Filesize2KB
MD5d73f546f99fd0c197b3cf2bcda423916
SHA1d5eed9f8ab9064c6d07b4bea7dfbb421803b8289
SHA256177c751892507d4f824e2a7e6e5bfc3e7a97662aeaba8a20bb6e293ba8b472e5
SHA51235b65d80b508052a7d26333cd1d0137c31dfc3998d2ac931837cbeb37457244a4d22aa609f9176708fdcfb1965f67edc904d529fb74fc36861e5b7b15bd6742b
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Filesize19KB
MD53ecf0b9cb144eda088bc6c7ef99cbcbd
SHA109326b8d8727c48b487238fd1c9a49e85a3e9c31
SHA25608d1ff3173dd99a322475b16584aed1807e0a84eb57d2ac6d47914c69942e372
SHA5125b3cb1404d5bd173bf76bae23440f89e04ae9e46b57b25d764b043a8c7f543b99222ed744898b0e94da7e7307e2055f6cd497c87d00838122cb80bdeaaca8f0c
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Filesize896B
MD5d56214b8dbbd50ec2ce253faaae3c699
SHA114708f124e6571a68b06b292d2430f668f8a293e
SHA256ebeef79292c2a48bf3b1b523b4c3e63dba8a7e2295d5b75405187ab1f1ee06e4
SHA512b7a102ced8dff2bf41f20e403dd8ac943b788d729c3c324fb814f709c123422d19429bce8dfcd7512556646a38f48012e7d443204b224b2e2386fb40513f0dc2
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Filesize864B
MD5e3b50040b452d8883a85064e5920ed37
SHA116b5a336a93cb69faf64c2708ba65f0fc5b11109
SHA2560a8f1d1caf6d7789ec21183fad5e0c3f1d1769621e547835b5bdd42cf68aa21b
SHA5126295660a7f662d241a33f6806ce3641b25eff36d53700189036ffc2b5d20eec8014a34d7698b967b8e7d379cdda7f688c092e9f55ae5dd87d20faadb63e47346
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Filesize864B
MD58d467361307f64c6f58598031aeff9f1
SHA1bad9a98c9176d9573d29881e9ce26195311c0747
SHA25656c1fa796ad4a0356b503492aeb8ef12725caebcbaa074a83989fcf3c7b09c87
SHA5120e7445024048b9dd19c25bb2043dbafb73dff8b599d911ad22b2e52d8df67d5d8d37e4a389cb888f96b1c06e0e780e3575298008d1d390adabe5c6dd645e1b56
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize5KB
MD55a7b322638379f78677ba6917bb962a0
SHA1c0ddd05763db8a963b31bff5353c81144365a6eb
SHA256f460f6e9ad45de14eb9cc18661f296254ba863821581e8cee93731e9aae5e7b6
SHA5122ae30bca86ba0878adc15f9c3d30095706b1d80f24803e019d87ef0744ade67d614094629b2d057d4f14ca85f18aa2d0455f8bd7d4478193f2af1c0fae1afd95
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Filesize1KB
MD591eb7c742a188b04a303fa8201bc9476
SHA12725ed782dd02ec544940aebb8d6daea4aba3001
SHA25628c66f89b9c8a313c2c830db4cf2a3f0dfe4ec335574b990b5f1e53070c9686f
SHA512405f73d18bf49f8fd6a618250f26a61d73dfabbf0556db3a56c55ff73ca7b9fb7ba412e13984fea71ad2f77635eb13d86773381afc4637111d8e93e5db333a61
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Filesize864B
MD583965d978743a397ebdbd3b912167238
SHA100c52a33265a02590007d8013159b0690bd82336
SHA256543a422855ddf3f49548dd7d4747590907a13f4f1d44af25d0efac593c019a66
SHA512ae39d1c8eaad5a79e415d36e3814180561050f2a62f566661c0925a2cb8e1f3a574ebec832f55a77aeae858b3709f3c54f4134b2c4fe0ee44223cc80d83a3159
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Filesize848B
MD54e9ce76814d0e101217687dcce8efcd2
SHA1bbbf329d1baa9f5a7acbcaa63d6a9a5d91fa9240
SHA2561b0cd6b6a1280aef1a4adb4ffadeb238aabcff1a08f20e313bfc299001379936
SHA51258b1c54608aa0c6562631ae99121970cb20724b534341a41b3e1aa69948421952c2fd816bd352e4fd6b4db9467f2cc8c61bb9806f99d65b4c801d3f4b3108b80
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Filesize880B
MD54c15dff23066195b3903abbfd56d6e19
SHA1d3c8599034adeacad6a6bb704ba68da20b761185
SHA2562b93ed149b325ec516837ca33f0346231b734208debada58addb2d31132c332c
SHA512535eb6d020ba8528dc8ebbe0ef95f27b9a67833f6ca56cf169d94c14d8e68371550583454caf6d46bd193b2cdbb8a602cb33f9ffb50fbb0d00cde4a8e243c7ba
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Filesize848B
MD5e4b44cf117925938f7f47776d0bba3de
SHA17873b648709c2d65b2f14a66b9891b01dfd994a1
SHA256bf820b5840fc986fb7009063779dab9df877f78f8f516e0e27a600bf9854e567
SHA5122989ff98fbd9ce5d23334bec61baef6d5ae648f5034023924e1f2214bbb303621369892ad6c0cb693ced7e4263f9b45a4bf9db493e9f315e7fef3c1a77043ce7
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Filesize864B
MD52274dc37b9218f5a694670c43ec3bd5a
SHA16713769f8afa807981e0fccd9bacd18cff1875cb
SHA2564831f006f387a64f6e741e6a2c4a08030146de5c8a1b86725a6cf61961500247
SHA512a8a807685eec99c6612e5cd713db8eea74e0a24a67a0707016019b5104d0041ae6a5696b3e6c68a09f79136cfa83f0354b19982d3060a2ced93a82775d9c4d07
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Filesize864B
MD51d8608ef2fcab9b2d1ea31e055d9f3cc
SHA126abf172f0a00cf13ca92960b1a0049ffbc7ddde
SHA256f3f15123dbc754ecabbc9890288a14030ce0baceef3a37494683c5f287645247
SHA51293374662d31aefa82db4d84f60d4984e1bed245b78586e9859dfa52da6e3a215a255ef868ba6e4b18b4ddf8c7c1f63b09d5d81c55e08e633f3834d5b201ca9ab
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Filesize864B
MD56c6520b7daef2fed5bddcc57dc6157b0
SHA1cb1df07c6d6f795d61e16297f36aa43c0b84634d
SHA2567f8fe0e97389e00309790b748a86452f2819fcfb5000274b51169063ecdd7cc1
SHA512b1ccad86da370e9defa8323b48b684615ecabdd80f35eff12e3b70af3ae9465e946d4321b7957aeb7fcda5a016b7ce630c212776a5905de91d877fe4852b3084
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Filesize896B
MD578e6a4e6d1f41f96eff6aea7e379f842
SHA177951d62a18dc39e9622694d63d1d84dbb197d3a
SHA256d3944c76593ab9e306fa2ec8f424bfc0534bf8130d21a0fb28de12799879cc53
SHA5129263c984856c28c15600399068d251db274c0495b85869336add48c2272a71ae0c35cb657963ea103ee7c0c383798ce98a8ed96466600429c1b0bc82e0e716fd
-
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml
Filesize247KB
MD53449a4f7fd44a2932f13b20da7966a3b
SHA13c49fc08e62ccb29885bd509d030a59ed606bcf1
SHA2565c88442b6b84b488441b4c228ebf9fef30bd1670682f6e144489223816bdc73b
SHA5127c1c2d2aaf850311c06ec72cea43494e6a01082f3428d3098d8b65cfd5374853c804454abdfa6b66963e7a6ccec144c8c6c23f2b63d7ddf2e99aba808d217683
-
Filesize
160B
MD5f76e652b1833d823dcfb3eea25c355a6
SHA13bda3645cd6c15a33f8a583a23e97f0838b821c8
SHA25669aa0c8cf5d83b17969277bde972c327f5973578c67c5a8563e456653d3ef9dd
SHA512fdabba703d7fc79a6b36b6c28f9e254f900371cb4686bab30fe63ea3b647ab11141775a365f7c93e079a1af91643852e8bc845d5a69def634884ef79cd76b111
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize12KB
MD5c7bc110935aba83735acf7e0ffcce237
SHA173c75f1ebffeb39a49ede545a6349bc2915298f3
SHA256a26ccc8a8cbdb25945d53e48edc0ba0ed8367103083bc17c4216703f6bc52f9d
SHA5129320bd3fc6e445a7219a4c09c3449c3f91c7964c7faad3876e0999f70d8fdb16f64b7ff4d05160dd0989012fe5e32a286e141d22098ca54c6334e2cc5d0fc69d
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize8KB
MD52c3fe2bc21dae7ff0ff3c63abc3696b8
SHA15de4e90dc8e6056cdc3a4669f111d990b5971369
SHA256c066516f5ab1668f40babe74fe2423f673d6f1d46a777bad1711f1235a649a45
SHA512df00a3e523575413576455e86ee495de604f5eb240e009520e9055fb9a1f99643897392f92291e5ceeb3b1eb4fe24ee48a43a2a37295f5a65fca174317772eea
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize11KB
MD57bfa41bc3c5789332c2e869702c4a317
SHA1829dd558ef55c250c850881a576437f6dd08c34b
SHA256cac3cb77e68df40df885f38e7a58ec955661733951fbb143cab105a29c30cfe5
SHA51230f7ae6844889caa19cc91acfdf30839adbc8b71184d4a94eadf7a0c3eeaf3ff489fb09a4be490c8376bec30143a9346e1e4c4ffbf3c5d3a3a932cf9e729e005
-
Filesize
109KB
MD59e8043c4b8805d57226715fd2ebdab0d
SHA19be0716d81235e879c73a9d844a8dfe86c25d9f9
SHA256e38d19d446fb0d75a4d52291362bc72eaf13974c7d0760a846b396d195a0e1c2
SHA512f48fa718fdb92a3744117c3c16411af7e8cf0c3a0a5b773c6c74c0a0627b1eb0b243bb5a203bf4d73578057d87f2d5556b9d9fb6afac5396ee20f31471bf90a7
-
Filesize
172KB
MD53ed4dd243424f5a9dd41339ffc3096d2
SHA16d790441be94b0cd11fc2fa708c7df1ccd7cb45b
SHA2562583df66fb0a62a9f0558c8c230e95d3a8971f232f000692c4a7e9a74df9793e
SHA5127f6e66e359f24e660243f8f5caa966e27ab7261bbab97866745868af1653e91c547906e3a53914585de59ac4151cc8bb5ecdaed2b3bed67f2da37d1a39c32b93
-
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001
Filesize16B
MD5e987858771df2eb8c28f345cd7861d0c
SHA1f63349e44434d95137afe052111d3ae96cf6328a
SHA256835040ecdcc910a9a1735ca2197e4df2f62fd8f4577e54cdab90f48f31eb60f2
SHA512e9e033426773807d3e2df71ecc8ca3a5b126612c2cf16de5452936573f915b20671e3a5856447bc791c8025f6fbe8bf6a2bd662ef9ec1c33c627ec1a3cce63ba
-
Filesize
1.1MB
MD582938f610596e7829d57fc41ad7dbb38
SHA189d9fa74112a349f328a048d7b1206cefc705b60
SHA2566994a80b9e63730494024f77eddd1df85540b172c4f0e9e1a01a4b0bb18626a4
SHA51268d4d10a448e6c56b4fd39b26e0de3600ba2685e9f45f22acd16cce76a737aa8bfed22479ae7ea8d312e9afbefe74ab7ce809feca2870c47b5d2e61177524b82
-
Filesize
64B
MD5467e3e5c5979f1bbc221520d8e273d7d
SHA145597e957af1ce232c49f6233e3db10acd6773cd
SHA25682310d28b51a59f812b327086617f30d42651804e889306db255f0a2c0d66339
SHA5121a98c6e47acbca154e96543b2b1ffca18bca1ab1da45408413faa79e2d8b7979c98de7294365dba6ab34db68c88748734424f35b9834fcb2deab5c4c83a693e7
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize80B
MD59e166d9bb8d1042a3b1b783d8c0a1842
SHA1492c052fbcabb9b4980f3fd21101500ba6d379d4
SHA2567b14b4dbd57fa867dcc04d47ba56828412b46679c515cdfe1bde997bf09435d7
SHA512753f72110e7812704a79eb41c4599fa7c65bbfb729a3c149203465f1263833c393252afd7a9fe35395f6687c6d92293e53d3db79d1a96eda549397c9519e5d3f
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize80B
MD5633c122cacb7cf0ec997cb57d3434783
SHA1bdc53c76521e5028625f57a2f7d57ca3ecd24181
SHA2565bf0f447be39beab9eb53fd5c0ffdf395917f19719a74f7fa77cbdee420e5431
SHA51258cd46975952555d891fb227ef8170ec827de731979b7664a9891e3b16ac8216b4261a20be7e50ec1e00db4942065120caa58b93a6283809cad6fa613c30eb91
-
Filesize
6KB
MD53dfd5bced06fea65cf5db4826fe8b6be
SHA12c033f0424f597a6c99829981bc0740a4ac31536
SHA2565a8da539e6c8c83730788ada870b20fae8f57d39e0490b899a019417877a2f40
SHA512843e6c67306acc23d5be57baabb5a49662d0f18e67ccc9fad76ccf1b668059d24e0202b6337ddb50f9733883ddec236084f64828a5fbb6d1fc97bb61501fe75b
-
Filesize
13KB
MD523e13d9b73fcbff881262d021a5cfe65
SHA124a7a433bfd38ed8d83820929a58a8892ea5e849
SHA2566350feb368176678e6a979beba175ecefefbc4a58f5fe139fa55f92cdd0dd6a3
SHA5121cfa394e028214197717dc1db0a19ab89470b6a55d177bfd8168b219f0871b21a590ca2463f03ef51a487bc0995067b6e763869baffaa4b3d23832b3a659bf6e
-
Filesize
3KB
MD54ec01917499744173fc76868cbb27af1
SHA1c1659c5f2bcebf3176b8e2f860650fcf35f82d67
SHA2564b28be9b4d743738ab365bc0ed32cc664980982cff778c12acdc6358bced8018
SHA512f8d938b48ce7b9b0e13be44803b26b4837f1c7887d2e9a164af6082075486b96f0b36011e34accc215b228ef1e9b662211b77881f832daff3362a4c541da8a2b
-
Filesize
6KB
MD5ad56ca49f5119f2de366d25d5363f54f
SHA133da8d8643d79be1f46cc0c89f545778076073a9
SHA256832f6b438b1be6766735cfa7657de0ed2ed682b4e450d1d1c3f3be5880d2a707
SHA512f217d710a2425c4c51b4f6093405810cea5e794ec9273f11a97da33745e2d391297c6ed8621a7405f82a93216f26a0f731d931016f2c3b8041729f61a7a48702
-
Filesize
10KB
MD544d79f174b3c5acb057f62baf681e510
SHA1c799315c93e6501a88caf890dce6774e494468dc
SHA256c1e924d62e8d55fd995cbcb4d684dbd49bacfb6b0b32d2b9dc69e891ef3a1ebd
SHA5126b0ee6c39affaa9605d56f1a85240a9ebb20796fa7c776acc39458f672ea0115a4921471d69f8277bb2103ac13e2cef71946844a7fedead103c4be80e2c1d07c
-
Filesize
68KB
MD5180b43cf2fa11ffed401f17bee49a77c
SHA170b2bb14f444b43b1e0d84c9a638c4c4e4d20f08
SHA256a9fa371ecade90a11d6fd26b90acbbfd478e610f99725750aee90fd704ea2ab1
SHA512fa8041c8b603670992a979acf012281b6fa97c659cd95bf1371616c415347de7c43ee0a813df83d5fc2efadd1d3d252cdd6c0dbdc8f26a721e88ddf6a18585a5
-
Filesize
24KB
MD5aeb883f9a7b9dbcc65b748c5ee88caec
SHA15577b4a0980248a78a5b1bd89433d808bb494ad3
SHA256ff9e8aae6753774f3cfaa161b82987af03e7cc91c8d110f95190cb29e73286e5
SHA512d1c9a67a849aadc553d76e6e0ccfc5fd3366cb6049ba65677e4acf1934209de593867c46db87c0e0f58893be8550e9f50d0022470212415d18db23d211d18427
-
Filesize
54KB
MD5abb91f1fae40aed2740d1db78f36ba3a
SHA1034231af97df67cf1a8c916d488bcdc8efdbd82d
SHA25605f0acb0857c354c5be2e610fb7dc5080cedc75626999a69accd3b78ac2c2ba1
SHA5123ea8e5a820682935c0ca63f9f207cc715db65acedfcc226a972c796b90c894d3d8fca32d177150253d827de4976e82a1b653001c15d249483847d44cd6711969
-
Filesize
51KB
MD5e58b33296c5f98a0bd222d171b043f68
SHA1084c3b90ae2a058889dcc8123c158676aed3c54e
SHA256c1a9125fcd63d65db3d38e1eb868c4fb0aa4ff6dd66397c5e1b009882b356602
SHA5123867c6c3b3e068b0e18048d723d7f03a546541880461a6a34107f8aeaa3ba3de40ebd80eb669cabb9bdeb1f800e23277a77f1467338eb30ad9a32e3471924f49
-
Filesize
34KB
MD5f6e4905c907e54300b67dae26f526fe5
SHA17fa1b1427028096634cc7aac7fa5f53521560375
SHA2567c6c36ca8d642dcb1e6de084fe3804b640c90899915576c138613437638fbd1d
SHA51247bf2e0e540bc72886be0fe76f6c6fa9c4efe348fd7b90353d3534ba71cc0a17e3c6cdcfac3bb488b6c6314e25954a1c9d371ff9a557993b1888bd0b646db5fe
-
Filesize
33KB
MD592d7300c6128f88fef65868e4eeda74b
SHA1e533a6c052d3a4f25fdaeeef83a7ce1165ad4f55
SHA25622ea2e8afe4eedc933f593e6d4ecb76f7aba3a35f2f674b53ca9738161d098a6
SHA512864f40285488d6e8d94d66f641076cac66f091628c5d2fc388bb1d3c32d840b7e1b1f673fa6642665ebb0b1fee06161e1b00b73141b6b3791a0cfa45760e9e4e
-
Filesize
50KB
MD527b3100ad14183860ed29433de9c72d8
SHA1f9b21954872d8adc5169ac300a4d275ad3b3f8bc
SHA25648d5a8239fa6c4e38af46dceeff2c792e0b1e79588b4b02662237a55cdd7ac86
SHA5126336c2261afb441d1cc65bc5f2b8775b53cd6c550759578c4721977c9e2a42a08171784fc5099e7738e8a1a9c2bedbddb7958904377552bd4d7f1600a53b8662
-
Filesize
52KB
MD568edd9a5b0df9de3664ca2559ae46465
SHA1ce544940854464861f491c55acaf5e6a82491f9c
SHA2562e1cde5e0f233866181dc2e5c8e2a9b4b3cc3ad446597de0fe0e09710b19d9a5
SHA512daf284b8572997d6a99242b91ef4118ca86958befdaf358c2b4c1352175efb20e00e3fb9a806a5a2e63f284edb8af821e7ae6169f45826f8be592d76609077cf
-
Filesize
6KB
MD55cdb84bb4df163e420698c704754f519
SHA13a1830150abbabb05370bd43532370c95b918fc6
SHA256e9ff118932aba2e624c1d4ace3217b17a9688a7f5daf81e40af5caf332f33cee
SHA512a7a48adde02b7c20f67d09d71eac55694adb1032ad286c5f32026de30bea7b08446e8c970d4d071765f9b88591671f4f56d696bc1d26b40e79ef5598d53457b5
-
Filesize
3KB
MD5f6b28ec47bc49dce2f1fd7a905aa2cda
SHA171355507bdf5afa85df6556c711f52ad67cc4050
SHA2566a51ff80b4bcdb17d3780fec94b51f8ecd849dddf6093ae088b7d29f891c54f9
SHA512cf3df1c0bda8377e893c2de2ff79549b0b5b40c88ddb82fa3f9b5f81740cf2c1c77309b8912c4275a54b2ed93402d00762b7600daab4f0cdd5b8c50bf8726a8e
-
Filesize
6KB
MD54f677b83093c7406ccf6f7e3318d6d4c
SHA1e3606e634efe6a5b1cb657cbcf3557ca0cc7d33b
SHA25678f26ed6d2b3653869d8f49a45ab3e572242d12d08a4ee976d4315a033eb3c61
SHA5120146ec50e00672c324b0b0b8f1c7f00c075449a3d5d313bca7a881b082a0460da65fb2cb3dd25203a6d34adadebec77b33a3a352c457c3b70d5642c288b0d882
-
Filesize
9KB
MD583ffdf6736268bff02218333dfa64a56
SHA17abe9917dbe7341878bf50bf5d20c2c8b67ca703
SHA256c075ef57e47e28bc1e97f109e27f1d69c2e65a9999cc60bb652891cdbb5b2d6c
SHA5124c658bb73bfb6b564f74d56548e0fab4feb93c2a9a2de940fa59b81402d531237a07329944c6ba9503e1ebf6da84dadf59a0d3ff9a80bcd8bf3991575738af22
-
Filesize
7KB
MD5498a12839dd851cf0c8f53f62f73316b
SHA1177d2d5de6ea2607e2935009b000d4b607636b9e
SHA2569b866c37dd2d0e5f9483783c0a187d19770c1a4432438bff9b442b56ccd3cad2
SHA5128229e3fb954ab73eb93084c6434ece3dd8e1df223cf632e743fc7c3071b4f83fe211dd2b7fd04c959b7301f04b88da2af8b9f4add0de8af5a396fce60eeb0c86
-
Filesize
5KB
MD5bcd60a55d5134b97ab5fa0e8a8ca2be9
SHA185bd3a0508266be814000623ab5c86ad835b0cd5
SHA25634c200b80e137177079318f7ff05d4de588288b99e55f9f9f4282e2bb4929470
SHA51247ad5e3c32469587dcd92158c1ec38780abfd38161e66399a70c0331bf141cf9af68f435523ad823e2402887f46cf1be064766be30de4fc42116893d88de5b2d
-
Filesize
9KB
MD5ca3e6281563984d74c645f99cf1a1118
SHA1dc5ff031ff3c91b23830e263fbd1b663eeb9fa25
SHA2566e74c789b54cee9e5de684adc90e4990d45fa0752f34e825025814db1e3abd4f
SHA5126ec1272ce1edf39d27fd026da8a3c41c390eea86a0819072af400f9abe42220fd469c4ecf043f1eaf50907bc91cdeae8c1e91163b70cfa1187c3484a7cbefff8
-
Filesize
11KB
MD5ab24cfae6ab81e9204bf5a816ec9fcf6
SHA135e71f8ee32d3ec76cf5aa9eb1d5e80999969b04
SHA25679f8deb969c6d95aff1065819562ee477d0086e599a6f000df41adbb8df9d7d7
SHA512513c77bb4c3a412a6f2ad9d6e15cd81fb22f4c6d5c7840fa289aa0d175cabf752038bed3a0544131be4607660686580b32ab4a98446ceb7845198b17097377c3
-
Filesize
2KB
MD58e4969ad5ef7aac78b75942ab5f01e05
SHA1383acc60dc5d13bdefb0e55ea2bd725eb7960e35
SHA2560ad0b4751a4b518163291534596129cbf5acf857b699bbc978fa4f6f7c89e234
SHA512c79ed2c641a930ffc557d88ee02218e19aaf9cba906173781a22c7d5e78cf5ffd6305ecfb302168131a9fae46ad1795f800c468994d61fd5414b0a858aeda178
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx
Filesize3KB
MD58c1b440e16576b893abda00057b0a14c
SHA1ee5c41794c03d316cee0e9896cfba7324b550551
SHA256235807d29658c4c44d5c6ce6ccab042aec96cbc09992831670c819d7cd692800
SHA512c73aad2a0fffda8657875edaf08bca31fab0b0aa2490b88686d08030da84a51cedb451b7c76f3f523a8b36e216ae5c6f804f1f314d195219254a658a3ce1dab5
-
Filesize
2KB
MD5bc617e52861efc8c9161d619a13de7e1
SHA1ee53645c34d4975a3e7f7dc3e60e3e62bd6ee212
SHA256ffc3475946897dee946a7ef95c16d3edc6e77e5c0e12710513c892aed75aca43
SHA5123015f934688b520c4e00b11c77256627dea7ad0fef0221b8558d6b85541b96ff8dc5ef64413cf7819de4bad8574f9091c41d7c4848186ca7e14341e72880436c
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx
Filesize14KB
MD5d7fdb3d23180f6a251fef35281a2735d
SHA15381c29cee05625223862233f32fdfb39123d711
SHA256229e929859f46123a60bc7888f03dae504d29a2b5e7717af10dd8cce63b40fdc
SHA512aae425eb3099e06042b9c23782a58a608ce1ede770e2330b83e784fa94e20896ee332a785c88c15d0792acdf73f7a8ca00b0dbe8a7b46a6dc6f6e29e92b43c2f
-
Filesize
320B
MD5fe2bf733d766131717acf769c4c94891
SHA1272108eea8e2383c12bc68307fd0655feb25a196
SHA25688aee71578db75bdac2abcbd7fe23e98b46cf7049839416295f82239c1f37d31
SHA5123b66d57db77e30ad4bee4689f0f8c4c47f456f7734fcbb9ecc7b84b20eb19937060587939c567d29e7af476798b438ceb45043d8543d7245b180d5c08de80fe9
-
Filesize
21KB
MD50f199cfbc8e1f3c1593dbcf2ed570320
SHA190d75d4bb19e35e1be91150093b4aa026cfd4ae5
SHA256e916a75f4641b431414f863df85be25deef247d9755bc0296ccd82a0a7cc8a02
SHA512228394ca8a62c72b6f59b3a4fbc42cb8bd7d57f0fa33ecede960bccb425347ccdf1cebd1b075e0c1f5b2fc6123982ca9647925f90150601ed1cb9e4192378ce9
-
Filesize
1KB
MD5d4f3cd3d632bed2ae637ed63c9fccf5d
SHA1626d13b0df54b44d8ae5423ccd8c9e906d171447
SHA2564cdaf2a552d82caca8c93d1e1ce17c25fb83d82285fed9899a650ea0fe15f402
SHA5126e5ba34f6d8e4cf1b7e1d7f5bc37729055cf31773a5fdc297e70374bfdc0c00339a3007d00d66ce938d7c3906667aa7c8c8fab966830dbd07cb6e3ab078bb4ed
-
Filesize
960B
MD52dd0dd907e7201be5e99c0e10f12d032
SHA19241d1e9236bba40f96c2e6e05fbe43394cf2d13
SHA2561801b171b6238c3bb892fcfe14354cde4233c5601b69455aaf0cb625474febde
SHA5121c6960ce0aff7ae247ccc9196194826093bef8d638f9d0333eebf7d1d06a7b61f5902a8a4537242666d681f19f40a3e1620e1404dce8f632c66584adb7acd880
-
Filesize
128B
MD55921d8c4e6927290ca91d0c1d2c56529
SHA14c9025aa0e16d4a0faf5b1b62507fc0d8163637f
SHA25605950e047012fa124311eb5ac6662415bd5eafad8044acc4470cb8000c99c7a7
SHA5125d7776b734878506f570350f7eab855c9126c535725f62149e56e9c22548c84d95da22184fac60cd8d441925e1064c1215ffa594377d553d77e540fbb0bdbf0f
-
Filesize
1KB
MD56820a460d6abc07a47bcb2b5aa7dc9c2
SHA19fd4616afe20fedd394346bc360af886dd09f7ad
SHA256013b75f70537aa7c384800d0d6ad2b6749c85211713478edc79e017f7392230d
SHA512f907522ab577b7ba703820afa6656f34f51f5f8dbf5c90a7753cfe075ce57a51a6ddac17074e73e624f0f9f9befecaf3a7bc229e17ea1d40ab76b85fd1d10428
-
Filesize
8KB
MD5b5018793e54f3fe1a6b5ba3912d09a9a
SHA1ab58b8765b3563333de008380e6ea6025c05ab55
SHA25661466fd9ad6aa2257ed57ee58cd3e85e33f08e7a8058c0fee3dd18a3a9b458ef
SHA512d0e8a5c7884f6ca00a587b38e44edf906791bad77b97d3d588461471effac9f01d3925d485ecde1df0cdf92c30547d9d52775958491447c690c88deeda7d3812
-
Filesize
64B
MD59bcd998e45251eb7a9514926ba04bfb6
SHA15e602d4c76b85d0e192bfd8de156ae4657e47360
SHA256c0455941d2cd784b85c8b87b09b52ae36e6caf080220b8f40ee8157be9d95337
SHA512c91c5f8452a0592c89381e4814bcc5a4cbbeda53cf68c84598f2e7b6e665c2c991f0aa024253a6c0dcffd1847021cc99a674a716e486db8eabdaea3aa1e6b25c
-
Filesize
928B
MD538499eff69f7c83a038c02a63e9a830f
SHA10c24d205c10b958e9d2b49ff4d32c08a2d08a035
SHA2561bef0f086b362f6ac7df0a0026c305819c6d590ff4f0a58250fbf56bd18a1f88
SHA512e0e555d22e6e944308cf40312ded757afa16d7cb9a3df8ff7149d6f02cc2394353ea2574d7c46de643f04e498a5f1ecd08a65be59f05de2fbfaa2f8101f3fce9
-
Filesize
96B
MD5b67184a4c45ccdeb27064479f4ce08ba
SHA1c925613fdc11c8219e17374e4b03e93a0aa10090
SHA2564e671acc9c84744545e3cfa983d64620fd04a4516f737599c277066f9ff2acad
SHA51240f479ec537609e07904e0b8857f86e1d2c63e97f0d68dbe7d9e4b6af4207b17e87759e95e8c64533324d906a5317863777af794581af728364e34fb88683929
-
Filesize
96B
MD5c7919ea876c8a8dba0e94067851958ae
SHA131b48c510a618219153c201d212d06c3013d13ff
SHA256f635aa5b1a192d1f6d464c0f4fc5d5b440b2bb521854676583f20e32574377ce
SHA5120c96f985cb03119e509bebcf45e48fcbae35aac9b6697b42fa16d215edcdc93c5600606e011d1f5802f493b5e83bfecb7c5114682c4289d65729f74503c53e21
-
Filesize
336B
MD547a8887abaa48fee2f86cfc9030bedd1
SHA15a94ac68fbb216e5b610f66610e869290c6871a4
SHA256afbd76bf38a36d7c2a25f28564fce74fc7a8f29640600c767fc909e6a3a5e619
SHA512d8e9fc73f77d217d13013fbad48da178c450a4d7bf86fb08c089249ac685853aabe831d966a53c8568187623b389b9e934f3f5d2603ba0099127904827f91a9d
-
Filesize
1KB
MD5d60c4208dbeb292f0307abc2f12e3c30
SHA17a1ceb106fbf53932c4bcaa4837126ad6541282c
SHA256920022534a4162fdc4de7440543f564671ee1aa1b4782a45c6689f6df8d6bbec
SHA51257fe81866cd748f96c76b8e2afc4fec3c0818d813baaf59490c0ff1050584b6771f3a4c389c51fd4912d6a8bf4614f0782e144db436eb37fbadfaa89ac52fcb4
-
Filesize
176B
MD54ab0e99c7acaf1e634a3f57c2bf237c7
SHA18c50b2f53e9c2f1fe955bc4f98a0027facd4cf35
SHA25671979ae8caed2bb8c0d7d7ea07e4bbce096103fddb46352aac5a695ea68ae304
SHA512380a04b9df66a7179912b7c871dfd7c2909dbc9919f2e4bb85f0dc6040d17918de0b610a5e5a738da48ccd3c5a060f40f83576d2679d88014bef2f5ae131d1cd
-
Filesize
592B
MD5d3042564bb5e12b13be231a36c3bef72
SHA17635e5f3ba8488b24a648bd62c65885aaa424531
SHA256f8f21475b432a62989ac994248404405bccf25f9d4079c32192a1fe3a4e93866
SHA512fcb05794b26c368b8c4eb92c8e62b660c5fa65bd42c2964d923f478c79c18e7b6f98cf040778a0dbe01c0dce589f43a679d83032c5b1377ecfdc67671b874a11
-
Filesize
128B
MD57b0a00bdc168b483638d0bd643d5a076
SHA151c95650ca310e439b8b98d0fc4d199ce11cb4a8
SHA256680a681da06aa3fa1e231b94556d18b629c91e8861860f80a9c79af97f887a83
SHA512cd2ed4c1a404b7ed9b30e8ee9f4a2b2faf8fe3e05d131ed45e1b841b3fa87c4c276321d3cad8d269144a1b68e57c91d8357bab5a1d05ec0a14b4c62fa7a82451
-
Filesize
8KB
MD5e9c93b573481c5ecd7e5ed84555c434b
SHA195b0e485be9187bba91484f6e2d7b4630aafe832
SHA2562af5ba991368fb0e2ddde691bcfd5ed70d349b7c7cb7413924dc792aaeb85e98
SHA5127493cf5273ac9c621b3894a960585668f7ed8364cae9a05ffc80608ce3b4b38e8acf1465d1c54c7bf3f81ecfb3e637ce39348498c33e66f07d56d2ac968eaa4f
-
Filesize
896B
MD58fb8bcab124b28d81c4af67ebc4a8836
SHA131650d46d73d575ab74b9098e204515f3217c086
SHA256b94debbcebc3a67244aeba85fa7e57b4535b2e524e435589ba9b27af4c2f34d1
SHA51282c49aacc9f46fc106d556f9864320c2704f3e91fe39d31fb7e8c044f471d2eff0295b56452fc36b44605403f0e508994f1745b0ba86669c2f7ec4bd49c256e5
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx
Filesize12KB
MD5d8b713e964d8a7a865955cdcd1177c2d
SHA193c459354d0afdd772bd5384c1708d7a3461a677
SHA2568613b9f7219c88a903f6f0a37519a3180d6a554ddafd1b76567bd5e1a29b58e4
SHA5123882fc730c15be96956a94b387ec9c7cd74dbf3c069cf62e1237a3fc9733780dbfc8ca6eb2c79791aa1358fedd2c524010c86fd4b83e4bcc5e579681b5284f88
-
Filesize
9KB
MD54d0f1f77e66f0528c55eabeab6f13fd0
SHA10fced1f068868fe3a73e617a6acb746fa9f14078
SHA256e32dba874ae1fe13d4968caeca16c8e750b60b6462b6bcea4c91c3912e7af2e8
SHA5127f05de107c36b75463b5f47b72f6b5d9a6feaae2ab18255ed3ba8afe8ad3c948e67509dc14ac6be545b604c6268eb5e0c40b00b01b3e655e0260275f0974bbbd
-
Filesize
9KB
MD5b6ed21cbadcde3ce89e32576ee7bdc0c
SHA199ff687d10c87e8c3c16e00c14a13061de7e7fb5
SHA25664bbecc397fe0604d9d5d433d510c10ef2703da6500ce435171e96ccfc200e65
SHA51266eef2d6a050ecdb1ead16446bf562092d222b4e3273b78609d2c31cf3ed68779b54f97f84a1593c144f38aff30cd8cc303687e25ab35f2ebb9dd3a8e05218e3
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx
Filesize2KB
MD56d58cced6d6cd2cbc2c537a6caaf6809
SHA163257f2a31ea5b8fdb3d855b4bed38eb5eaa2605
SHA2568f9d9cb6c9daa81c0d1374dd7fe689075318a3ac6aaf7aef1807a3ecc8177e95
SHA5128fbce9ec8a2fce7d859237e73f70016e52bcd5b2960d1e9dd7f979474a5f8364f891fd672c11378e4708e9eb35ec65d4f848cdee33a365d2fdee66246e2981e7
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx
Filesize10KB
MD5d2e027f3821edd5f1144f2b7a6a2397d
SHA14fa92b6d115c37fc79cb72a9b0b0cd2e6e46044e
SHA256b121ce06021bd31e3dd8faa5c16b48f62a52c9a4f58e0ce48c9f36fd7f39670c
SHA512b24bc6ca4e040ce85d4d0b99185d1fc9a89f548e07a0fe59fbe73026be9f5254fd56b85c1211dc9f95cfabc77e6732ed483ec5d05e9bc5f4c804f1f7356df5e0
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx
Filesize21KB
MD5eadb8431daaf7c29c52dd6f2a5895fe2
SHA191d120b9765d1c327c7168fea67a791e842a5fa5
SHA25629a7d8c35102266bd43528a665662bb7e5907c1e0615f4a6790e654d70f9d5a1
SHA512230c811f9f3d85a68bd2d30fb11c4d1a39b6f43fcac0593a4d6c35b7e7bbb5d10885ff45cf802bd3614089f80d47e02e36c701106663759a86e9a406eb9fe367
-
Filesize
11KB
MD53c59857e54890137566b9309b6ecf711
SHA1385f45e1714ddad345510b61e1a111467a6bec29
SHA256e7e97d37d7c96f728f95d93ca24f81d01ba515f0591b626db443c2fa05c6f0a1
SHA512875c5c25d085bd59c219a8da6a3d2300420aee7d99b24f68cc76118c7dd5e472ac2b2bb5f53a3b7fdc132152a66479201b4fc4d0f85cfaa4b9678234242ba731
-
Filesize
10KB
MD5f5b360b9494cde8834df610ec9832704
SHA15ffb076e665f7dec70623b1e6e6bdf33f9810e75
SHA2567706879de1f0908585383c1e7a14ce9525d008f29f3d0fa498776f707cfe48e8
SHA5128ce9a9e0420260889010a037ed0c282ff8f02b54880ddc970fd12e5b272dcaca5f810471ab0cbc879459af90b53fd1586108750c73355d722b07ddbf27c35cd5
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx
Filesize2KB
MD5738876dea47152b5f6515ebde4546958
SHA19a7dd73112372f529c54523e9d694330c877435e
SHA2560e8362fdcb9ccf07847be8790e1fd25dc8330357bd408cc937f87e0e05212d5a
SHA512cb4201e389069715d3e5539e3c703d25a3a07f91eaebbe7a6223d9a1240cfef25c4c346029aa4a7086fa81ccb67e3934985bc564dc8e88b2900e16f2b6312d4e
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx
Filesize7KB
MD5b8a8f57260b65132f4d1e6331280eb79
SHA1095876ec3f96bd0c8570f82875abc78a0e5a2690
SHA256238a97ef55c25c884316a1a328b99f0ab48c5a1487e6a7d916909a76f6dc3539
SHA51259db5e00104116b724afb9f533d06bd8cd8f024da34b63a4182cabbf57f8f98c4287285625688cd128e7241d8e4afdd86c048aece47e0e2cf758f299ee28a354
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx
Filesize272B
MD5412baee0e740aba4afd6e2d078b8046f
SHA1afda3a264c0f879b7395816496d22703305d4ede
SHA25646ebe5b2c2c512b148c489715f8221be9dcf03ac04b6373ec6525bf92c74866f
SHA512f92959117237ae151edece3f1448842db458dcd492f1f76f01cb170b16dc4854b3de0dd4dd29fcb1afc53ec973f988fa7438d99e536f838d92c52223ea4e5af5
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx
Filesize496B
MD5466ad7479240b494b6dd63c31104186d
SHA1b1a9d3534ee79e72b128b4a830ee977b42a97f01
SHA256391ed824edd89204bf33b4f7674378d807192c84eb8578c3a1b6d80fec983dc9
SHA512d4b26184df59a28207d41ea90227a67a9611006468306eac262725b2ded33d1d93e34295d4a950d3045cce36769384d0e9a224e8c20332b47df9fb6adc3ace5d
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx
Filesize24KB
MD5f352b92e4f45afe66936df28051273f1
SHA13aa946bbcfebef6be7a58f4fa4b3052200a04efa
SHA256f57b926c6c94095dbb4c52a8c7deec8b59eaffd32c886ad9af7964396ca44f57
SHA51293abca696647031115383a88a34a565b5a1af488c0630459c0db9416ebe327636ba7c9319d1175cfbb6cd1ef5c933ee8712f7e2d1340e32afcba54d0c30b531d
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx
Filesize1KB
MD56d73eceedb58163c5eb4acd2c4627286
SHA104b5fc06da41a184f008c5bb6881182518cd6479
SHA256c9b27db5ffe714aef057dfabb3b9397bb4126a7741de713aa4e5fd6eb5d8dfc3
SHA5128e3ddf2c0dbc12cce3369498f80fd38b75a504bbc5ddb3820f93b73ee49d5b674ab286ea1ca86e940305aa9dcce6eebf3896c6f7ad2614533cd39f966456c9d4
-
Filesize
9KB
MD52bd20e919b1b328d0789011f0c951ea8
SHA17abaded08ac5f16192953aea8f065b6ba37bf250
SHA2568975200a15514029334149ba00e1255a3d808c2be80dd7cf989b766d0ba47468
SHA512e9420ab83f3920b0139bcc5281b668ad351aba5515042ac26356e300dd8bbc6a3ad7d955e15a1f29b3a7d86ea4eeacc3387eab2acccc8d016067ba83649ab320
-
Filesize
1KB
MD537ccc1804d163a46478f9e805d417b26
SHA1c122a6c1efdb8c5b19de8040168c5dd89b8f67b8
SHA256143e8aa475ce212ae8b4e25f2220de7a1292ccdbc6a55915880b6d1de48bcbdf
SHA512aeb87f3e3c50a05c5bcd7a8d2f4c377cae348eabfff4f010adaad2b74a6861de532cd1bdd34a733e9b27190b7f61b74503baf90cdc70d8881e5dce97d6569e28
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx
Filesize2KB
MD5b527822b9ab16b3b14f7c75336028850
SHA1ab4fa88a23e2a6a387f9d7f384c33ca6f7a811dd
SHA2566d6b68ec3342938d2a6582f137ff95c3667f5f2778c7eeced469ecbc750f720f
SHA512bd5cf98e9e8175c230dd14868c1d8ed0087fbf6db98e611c0b0b8c78a1589d371108c4d83bfa03e347054d84fd0a2105fef5f5a5831e7ea38a51240a7b289efd
-
Filesize
4KB
MD5530b03f45413e3425900d38fe6b0ad37
SHA1bf3b1ce268f50e2a93f8375af8aa7ff245a69282
SHA25626e79f0697351fddf20f4fae416ed23e6cb3092b48ac2c6d2a34654d7b4f55dc
SHA512bfeab65c3c30dda51afb98c1b6aa496b069fd1026a502bf03a3ba337e03ea3d205a3b7fc4c9c279619ccd507cd07e1e314ed0860d6eb005126bff13c244ae37f
-
Filesize
6KB
MD599937f175eb4d89a9b700e1dbc767451
SHA1b893784d7ae9910a9c82229c2fd98cc73a5792af
SHA25667f83649d66629dcc4c4d11f35b63f6cdc187f6f9367ad77dd01999dba743d8c
SHA512fbaa9ade2ff2d93e4b94e82f8e656716aab6e860998852737c4ecca4068f1267723a7d2387f060732ccb9e88df5fe9508a634f137212421a8b3f6864fdedca74
-
Filesize
1KB
MD5769822d8bf0b05716d139d8924b9adbc
SHA1589e04db42a32b9944fd4ca0d09c12de8d97cd02
SHA256c8a1602bbbc11bfd8aed42447d0d9205c15f74c2f81a18f158c1332d5471cd07
SHA512f80ad1d9293bc8c4dfb25fdc28d0c5da36a8aab07ef120faeedbd50d48030bbc2d0c4884b4a09f07b605785b78df3fc5927cc9a049784077e9525aba20a98bda
-
Filesize
752B
MD563f47b9046c04c9ad0cfced1f9f48e1b
SHA1d4375fdcabd1fa4c47b2a080e2e4d0c3f3a5b48d
SHA256c28a9c14e978de86feb2952bf193416d3db89d6bbd73d00fc2602f538a6d5287
SHA512df425865084d9de58f1f4730a2f1f6e0c4c57b1b817b7b26185e567c118e51083ce6f3c7041b56f5e73ca4d58990d5a36a75ecda877f463a809c24fd3d664f27
-
Filesize
1KB
MD52e971b9d2afa978e059e9001e0f90e67
SHA1e8654d961baab04bb791d1682179de8212bc58a2
SHA2569310539cf95b33aa187b25257d11ff21ae3d728d0d265ed008a688a49b3640ea
SHA512ef74cf5fe064f4f9cf1dc010baebc013d197e816d09a48badb888c711def952a35843f71390b770c0b7d613c23157f99a5812f85b22657d071a841a5ebf40092
-
Filesize
8KB
MD54547b3479bdc2cca04de6f1e0b4b0284
SHA16d937671653f173f47549390bf46e6671ce14aa6
SHA256230f00d1a7906bb27589c92b2f0e2e26a6c99d5da15233cc764766683f890350
SHA512ca75626c066098fad4e1ffaabbc8b7acca756f0aaf8c9d707fe0fcd413727608a44eba4e34f41fc6cb80c2522f7696ccd94acf7baadc34475f360ceee5e96a74
-
Filesize
23KB
MD52361353d1e19d267819ba5f633fdbb5f
SHA1056f35a3ba4ac6d482d92110c0b106339043d36d
SHA2561fc161506e26578a3e77dbc98cbdc4b5ed2caa2b68dea27218cd8e1a5708c62e
SHA512bebf3fa5faab5999b8fbfcc6b6cbdcc1e475bf47bd5f0d5d23b1329bc6c25e892794dde91fa9b785f053331926e49eed9586f63572741f8574ae922551b76d9a
-
Filesize
4KB
MD5f7376570b1de7eda181387ff6e497354
SHA11567548feef30a8e7eaa5be48d732f728f8f712d
SHA2565bf344c4e9272496e5d702ea429c1e7ac6d1719156c881f717b361ed6f3005e7
SHA512f6894d32331c74750268c30390904dd6336a566c2805617c62365334a3a702bce215d52c0e85872c42151ee1dda5c0af8d65a56ded620c8190f3f386c6e551b1
-
Filesize
372KB
MD59a3fd3ae40873e422ca02c270d40bbbc
SHA1bfd5f4d9feac91b473ef533925e9df6d17f057ce
SHA256c6633e6fcec0e406a8bfd68c8c3f1d3bf618d86a4cf1dc37eae8b3281f72ca6f
SHA51228416a14d99b99c17af6b136df553bca561933f5a8d34de1bc921677718eb871539073db70a60af532c622c6f82511cd077828e40bd6946e608b071b9e23dbab
-
Filesize
49KB
MD59cd63c02c5b75c7c5bf1396481277343
SHA1b1bf5db6392900350b7e3b70dfd3fef811acf4bd
SHA256de591969b997b159930799208c85e8c8483d298c98b6ca3f1a8321e19c42175c
SHA512f29ce3fe6082df59261cdf3c68928136df7bce21dbd43342af56cba59dd452dfa87d0bcdfcf1a4a55f4d4dcedd3f8bbc3010a08ace20d84495d24d43d80b162d
-
Filesize
2KB
MD52da213b9a7059fad52a66871d2a6ed0f
SHA13cce48095560a2c0fae84db61c6e5ce17c8d7226
SHA25651d5c46cc7bf8d1db0e6f0c64ef8305ea6d66d235bca3ac4b7890db7149e4fc4
SHA5121104bce45d9bcc2acede98034183559d9fae1b30e9fb4925ce0f0891bcfbb7e8ea435f9f63de2ade4628c96c73d491cdcca45947f229ca0b064415c38ee9419d
-
Filesize
13KB
MD54bcb6fd9ff9c06ef7e1c8882763232d4
SHA1f3ff4e44a3a90562529bb9e624d86e0b51e32fb4
SHA25633c0e062fbeeac55aea4994c36aaec6206d56cb4b9da0b84410f4bf9dd9426a7
SHA5120b315e1436bd03939ae3031562a4732b5224044d5303180cb0b34f4d9b916aa00b86b8ab954ed22973d5de1ca34adfd1a9f43386a8efcf9288a260d446000c31
-
Filesize
21KB
MD5fec89e9d2784b4c015fed6f5ae558e08
SHA1581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2
SHA256489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065
SHA512e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24