fantom | f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>B27PS5ii7C7t+GcR7ylfucBjnLiulY7HoLdLXOqf7IX4i75UVR/3J5SFoi9k1Uu7WkviMs1zwNQjObEseiBp6E0Kvbi3lurdpyZb52ZFjUWRf2j2Cv2yMkErjKCv9ait8/6XbmWVnKcw24MG2adftG+wxzOm5UG5qeFCuO6gG0TKeVQn9j/xOvY6qrzzRrHbcVTTAaMRBPJkgUKUcOmQHkTdhm/MQpd+MMcSX8KtwlxkvQHnyhh3ium8VmHN77c56s+paFrWH4ZRHMVGJ1ooG/62Wtp8W1204SNGB2hPTMT84ByjrrR6po9ztauChoH/XMxoQIWQQx9xB22rR2RAdg==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (3050) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
2836	WindowsUpdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2164	Fantom.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-CertificateServices-MSCEP-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_script_internationalization.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\StarterE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasic\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_neutral_d7409fccc5ef4078\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Starter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-RequestFiltering-Deployment-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Smss-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Core_Commands.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\com\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\config\TxR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_requirements.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Ultimate\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasic\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_neutral_8887242a56ee027e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\shell32-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\NDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_data_sections.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_providers.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\tsmxu003.xml	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-HttpTracing-Deployment-DL.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmntt1.inf_amd64_neutral_ecf5cff2236b273a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_neutral_ed16756f950857e8\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\crypto_keys-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\stickynotes-replacement.man	Fantom.exe
File created	C:\Windows\SysWOW64\migration\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_escape_characters.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xnacc.inf_amd64_neutral_13c4e272a96185a1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterE\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_arrays.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_neutral_213e93b5ced8b0fe\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_neutral_7f08406e40c6ede2\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky306.inf_amd64_ja-jp_97f0de39317f6837\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\UPnPSSDP-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc303.inf_amd64_ja-jp_b0dcc6693f67451a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_neutral_e561157e16aa2357\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\Rasppp-Repl.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_types.ps1xml.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smc610u.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_neutral_09132735f1063a47\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\ADSI-LDAP-Provider-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Enterprise\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr004.inf_amd64_neutral_ccf1bc353e588fe1\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\README.txt	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_pressed.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\gadget.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-actions.xml	Fantom.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\RSSFeeds.js	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\localizedStrings.js	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.bindings.nl_zh_4.4.0.v20140623020002.jar	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\gadget.xml	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\InfoPathWelcomeImage.jpg	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\localizedStrings.js	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\brx\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sq\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Groove.en-us\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Library\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\SketchIconImages.bmp	Fantom.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1036\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\ehome\wow\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Activities\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1041\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationBuildTa#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\DigitalLocker\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.5\MOF\fr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_64\Policy.6.0.Microsoft.Ink\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\EventViewer\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Registration\CRMLog\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servf73e6522#\37e8138f6301df1b77f76d6660ce3241\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runt93d54979#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\index\NetworkDiagnostics_2_FileShare.xml	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ehome\MediaRenderer\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\MSDTC\0409\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Sports\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Data.SqlXml\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallMembership.sql	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1049\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\system\Device\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\3.5.0.0_it_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\system\Search\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.cfg	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC\mscomctl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Web.resources\3.5.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\XamlBuildTask\91ea8f85079a8ae11c420ffe5c8e5988\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Transactions\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0019\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\addUser.aspx	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Drawing.Desi#\aa8854bd55fca246dd3226a671092bfa\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\TaskScheduler\a3883e7fc1bd0fbc54761b26c2bc5483\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Entity\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\BITS\0409\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\ehiUPnP\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.DirectorySer#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\aspnet_state\0011\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\ESENT\0410\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Windows Hardware Fail.wav	Fantom.exe
File created	C:\Windows\Media\Characters\Windows Battery Low.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\bb69e031fd35b02403c7c22ea5c8e4d4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.resources\3.5.0.0_fr_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Work0493292f#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Panther\UnattendGC\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\setupact.log	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\EventViewer.Resources\6.1.0.0_it_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Services\640959f71866e761622d3126105a2c35\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2164	Fantom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	Fantom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2836	2164	Fantom.exe	32
PID 2164 wrote to memory of 2836	2164	Fantom.exe	32
PID 2164 wrote to memory of 2836	2164	Fantom.exe	32
PID 2164 wrote to memory of 2836	2164	Fantom.exe	32

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2836

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
b521e12372941447eb85c5a148b90839

SHA1
c17f756906e10c3bd6eec04bd66565a14ab7bcf6

SHA256
7bab951d3296245b44f87c7cf7a712698915f1f34cf450856110859a063200d4

SHA512
654f4d5c61f158d5d1d1b3dbfa24fc639b13ac3db66ea96f73e7339b5e5420ca44af088589e612f11a17480e9884f39076d0c918be40b7ada114e8fa4f20d153

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
352B

MD5
d8b0dde6e7c0cad180738599452e510e

SHA1
a7c6292069a8455881e4b29968153d1ed48398c8

SHA256
8ff53a79b86a5fdd80df86f984fe3414e42f05a0ba65080849274b3a631a7ea0

SHA512
bcc404b786a0d55ce175313007c7fdd3dc4e252ef4f98e118255eee02d1cd061f5159c7ff0a027491aa4612a8f26b72ec7bfbee55cc24aae1afa5e855cb58997

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
224B

MD5
bc5455d063b2e5b9d8fbec2a0e971339

SHA1
4083dca5e8033578bf2f31ee1fd296631552e078

SHA256
5495ca8341f79fb8137583cbebeaa78f4d9b127b1386708b493f069826aa730d

SHA512
6219e2660972a2fda51b93c5fd1e865b1282dda8dca87ff278c7e05fd2e9386f2884189ca46fc1863561326291701938dd6226565678da780662d6b6f2e6df5d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
80d4fb99034d8ded3208f76d5e2cbfa5

SHA1
929705090f0d686084fd3d9dc0368a9b20a643f5

SHA256
65b5ad6cf4f766d37521e6c6938b2a8f7b6075865461f9aff455c27596331949

SHA512
105569c8f8d8ef09119a44697f4da53015cac2ecf031a42437d876190ef734fa1581954350872b8f53b380a10767c111a07b39895e37be807f7b247e0d3b26c6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
1f6c45ba8c38de59119e4842f0e2f541

SHA1
09a699302451187d1717667307dec00b03256f82

SHA256
0382f29e4e20d448b19ae3e7939e8df2fa0faa2389373d69cc06397124f8e15f

SHA512
10fbac1a0bb17d91605c13d3e9b1ddfa42f5c17363aecf572f01dddc59cf8c41047d1969e1afa115a7fea725e7414c87bd7b47833c5ba91563467e483e379788

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
c8d38db771ec04183afe297ed950c47d

SHA1
aab380dedd5293467993a24bfcb1cff94b1dd986

SHA256
4772585c7fe7c7725c07c933fa117c13b16d2455c262d1ab0eefefc87d636da7

SHA512
40639b542395fe48dc443315805888cde5bf545bd0496f98d26d094fe7b05c8fdaef5d3a3f216e1b0b2529a22d4cf807842cbcc1a2e703f4d01d84357930ab24

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
dafe0417fd2ad1b28514ddf74c0b2a73

SHA1
2f486ddd07678c02395d51be3a52ac4de3973905

SHA256
51439d295dc6f9ec6cbebada2bd82facc37e5cbc49569823a234344ca5941648

SHA512
d0413849d6235bcc13416073468303eda5728cefdc321c425befc4152c1aef77685dd01a9fb63ec3cb9fa1be1dc4616ad2bc69e9a93510a6b8b7412094fe14e4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
112B

MD5
74ba5b4a4cc31418ec061ae28ee1d6f5

SHA1
0e38facf7458048a4d396037778703e8de9ac544

SHA256
007efe559125423d4b48bf8795aa089cc2c45699c5e288f18181da1217021972

SHA512
65d9f4b4e7e9789ee6aca40bf0c11bc274e09135490b8ee98cea5fc3cee332a56703ec6c85b7cd248cad98a510c02d668319cabe21b83d076dd3828ff05c23fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
dd5255506c17c6ed8853317ec98ec923

SHA1
950bd711484d8317aaded209121ae4c25fbc3419

SHA256
dbe4f5e6863e452d15d5f5cd729111b703bd8be681e84e0e4411227ddaa93686

SHA512
35003175133a49fb963007898f6d153169c2ccfe55b40b8ea0d7b2348b731dbca1bdb712c361756cf62900130044aa6e0d22061192435201eed3fe0e66365446

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
21e5186c3028214d7a9e388cde199be9

SHA1
9f81476c39a0b6a4f8d5ad05511e51e5bdfb10a3

SHA256
1a68c4f39ea3a2f1d754399abfebbe3e1501aad9065e377eba88882fbd3cff74

SHA512
ef93402219a51927b11c2f3ac5160a2aba659c5b5b8acab217f425e47e4b46066e70d7fefc5e387a330f6a1022da1dfb8058857dedfb741cc0db42080bb19420

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
417dca42ab6a222e1f62baca1cd95ede

SHA1
223a12777fab9fcc3e0731fddd7baf1396141231

SHA256
670eeed1e07a20d2385ec8c3ae8e9e4ba7251b812003ccbd2c1ec1a24ff48f20

SHA512
a695dc3183657a852522116ac16f8d57739612ed7f2aee8659ccac7cf236869091d5493baa00001764283e644afd298216a30ef6f4e0d930103586fca6216d83

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
df319e76368690633f1b2181a15e8aba

SHA1
6d5a8726b736372363f61117069cade37e204595

SHA256
0d2c715d97c5d1e1cc7312f448702b948908958dde2ef633f994915f95926baf

SHA512
d31444f67c0e68a850d00e3f9adb65435b1419b5e9c4834760dd91443676a8d1cfd93ee445b432cf137ce94a8b4a14e0b6c3a5a9421bffd8b119e41450f771ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
9aeb7a888ccbded2c60a973d4c359e97

SHA1
608aa56ccb3f603992dfeabe89d9ab64bb94154d

SHA256
dd9213db40bd145cd5f623a5cfa97d2fccb0a7882014c434a1192fb62134243b

SHA512
40f5c56abd9f9c8c56b96c0b20e08000320a96589a37a7a0ee7fbc31ea44c34f405003206dbce4e29c4d4c2ccaab3a0d3dabdce2d3a48a83890a060fd7e69204

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
63f5d18ee2a76b43b8cdb1a141e281f7

SHA1
85547edac48a291662501e303b91c23bf297a84c

SHA256
1b7c2ff39df1cd3b25a89dfa50eb3e211691db0dc27afad4be27d22343e747d1

SHA512
db9aa7b89f264fffc13b03652c82fa021b192d01a18c2409eef638b72df4b521ddf0dbdd33727d84965b416e214aab932a45510d4b4fd1d77d3135cfb42fc39d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
f3e018a29a886c6890e5c3ce849847f0

SHA1
747ee91d9af453a04c38c8ae4ad24a79e681710f

SHA256
45ee0133dc537a8b03d54746e7f6410a03ec1eabec1a4b19934566329d64349c

SHA512
5b074f3665ab5cd43fc0a412e3609bc81e0b87a2b7054bffc35a61355b4be7bba18ca2643ef1ee84a53d892435d55f4672e46ff2d533bad10de021e679d175ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
a6644c42b46dcf29c04927eb2b069337

SHA1
0f07049423209601c3e20500b710ad2d6f4bc938

SHA256
45cc1d661045b8184c890ecb4f3d403727ea94c9ad83f6f6cabf952dbce29c4c

SHA512
72371c8dd3e444d115afb5a75c9be871c3e0e8cf5dce7cf2ac3523977392b4091e0bce681940185e53352ba5615efc0464630ecd57a6115258c4cd75feba7959

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
7KB

MD5
eaf8849ddaf7174166f373f4ab93e3c7

SHA1
d79306abe9ea83b621a16a532d50ba60865ccb5e

SHA256
db5662c1d2dc0493bc6613f04103adc6fc941ec57b15b212b376c7f5b1253402

SHA512
6638ecbf61db0749db74b0fd6fc6853576172b54b34fd5459a4d2561bbe0ae61b372984bd4c6802e6b97d41c6aaeae1ed0607ec4b1db86d01cdfc1c85730f78d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
336B

MD5
bf604fbc81d40a106dbf5d4131ba41b3

SHA1
4e5a7b024ae8afafcf9e4e7293a8c5e9013b1fac

SHA256
8f437a717af02fa30ea8687b6c531c7b00de0ad31c3fc91156543eee6a479102

SHA512
c526180d6a9b22623b62456d8c252713a31e4331d8fa32cc9d533e81ea66831537453df9e16c58f72ed6cfc80d0edae422c7a22c6effe7d2af415e9bcd4e66f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
240B

MD5
05806aa8f8ca020eae47247fc0df3a90

SHA1
f850b3891093703d1b67c1abb3682751544d0f9a

SHA256
6b9fb28528ea369241ec64bb9e72fa61952f84f7cdfe809a0328e2e2daabf5eb

SHA512
b645fe727230a66d6067e4dce9083172717ebd94315e357942b75e5d113524764ae3fc549de4a55fe96ef50ef3c8104f428aa22255e49169844eafa3cc432fb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
2905f5d04146ae72e889ee7c870d3f1a

SHA1
d5cae8b2646bb3631d729f40217df38e91f98f1a

SHA256
217e3ac485eb8367d6f929fab8a44333fb0fc283f651b514ecc3ca1ed53e4927

SHA512
1835c34c0669d48c30b55543687ac97a323c151ed872b119ed867553b543f9f80892e3481dee9a76e0fdd5f68286523f1f7e6c5454d09b1111aa3f99a1b87bcb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
816B

MD5
b1f724de02878d602e5cefa5d2ec66bd

SHA1
4d4c49671e9c3433405c759f90d42fe7f005adef

SHA256
137bc5fa2a98b1c71c15b62f69c3c3161ec513673a5214799efb543ca319f763

SHA512
6a6d6c5cacb71e56fb392d337b04113abd70511262a749ea986dfa026ce3da0e95cdf7d79bf39c5a10849d6af1198277238c6d75887c3ce1d2a6542900823d6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
763ef68681f6a338dd8ff135cb5c0002

SHA1
c8b7eb6386e31d01a989eba53a2e195f5d7205a6

SHA256
c7cc98af96f33c8b734a90a84a1599d8151ae6d44b32892ca5b1c7dca5a18166

SHA512
e334bf03a4efd665ff231521f3cad622282584db9f90d0cded8fa79620f4fa0165ecbe83994024e244311246bd5aea045f3818d579197e4e88b9dd99a53a37fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
8674fff1f3afa76c9e8d26681d0ef3cb

SHA1
88662fe7bf47e937bb2710cd2e213bff968672fc

SHA256
39363b0ab03b53f9a97d8e4405cd8cde0180db6d21ac398d39738c538f9c7db4

SHA512
ba7d65b861394b94d01e329f2e43887fbca6f786dddf4d6523fc6a29ce66092712910e2e6f6d803a9dd94c7cac0f0ca5bc34e7d198193a4a6c7b79a6e99dbd23

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
f5f2454c856346f354069319894df731

SHA1
cb93e9da302ee9014d275ff659579643977b27a2

SHA256
ba1640bb56dd7ea0b863ef547a5324d9b55f4c2bc1f3df219b3a9898f9f5666d

SHA512
09a5000a7db405544f1a9ca8bb3e9a4a90b533eed23fa3cd9bf320b8d4520e5e62082f004ded61cbc1249e65479c875c472e5ade09ef390d3ff9a261ceb03255

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
896B

MD5
2bfd8ef872ea8e53ed0b0f138023ed77

SHA1
be7665298e2fb6b5931e6bf7f8f25dcd7428f6c6

SHA256
947513a2cfd2ce8ef117e84a3039cbc893d78831d239c5f4a5defd808e374fd6

SHA512
06ea95a2e73d335a370fec32e0069343a62b96b7524388a5986a7346cd0b270a8bf06867375488faab26e4e68e23c5f81863b24068c883c6a2d5ada30eba66ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
864B

MD5
b5e5383bd9745f42b045f53863f95a25

SHA1
ea02b0a53494a0d656b554f0d135ef4a6badd0d9

SHA256
dd06f67a009536f2f32eda3130f4fcba260262749910b079e254c0571a66abbf

SHA512
d22e950b2faa3608c05c9f076b702074c62ce69a4f4ea6f599bd20a8d8024f95ad2a13f952941fe77826d5f7a8fec216b72b23875dce0fa96a17ce93d946936d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
864B

MD5
d79e8dbe17f37dac3f7163b800cc8474

SHA1
bd87caf4384daeae69811c4981550d0670de21d0

SHA256
e5aaef27fc31a494f2320be1baa9d52477c936543e7ed7db22152434a9fe7399

SHA512
c7107a787a704d8c10f947b9e179ee9972e38b3655078d6db00f5131525a78a11b024b92b186421270775834156b37553d9219efbc8cc1e9a7457a41fa1251e0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
17a2f5ef0f53ce880a2bd4dda6fac5fd

SHA1
6de29425acefd925b882ebe3fae5ee263d87dc8c

SHA256
2283fa9f626b4b5d0f2d7d4ebb1a4f304f8e36cac73c302bdf1562d363dcf7cf

SHA512
cab301bf66dd5ff1b8891a3e5642ecb797f05dbf5fe370e093347db3f7bb44d7a3b020f57312ef43cf28ee352fa62a34a5d96ba248e817595dc1eed129d03f16

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
109605aa1400ef3289601cc58ef0f199

SHA1
e4176e97e5388f5d5b5ac208dd592745ee5341f0

SHA256
5a1244a8f18a4fff1ef65db54ba42c709da1562542ef27a5756f49c3cdd2aea1

SHA512
1177c2b1256ec1a5d84d53f13866b5a38954b06f3f3fc56d6a5a552e202554be2897fd030b2326bf1117dcdd4da6724be76ea2485bb5e836d912968bad56bdfa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
864B

MD5
dce1ae453b6de536efd1f41ab34335a8

SHA1
2642d78a3fc89b6c538c38b77342cab1d75ec018

SHA256
a83c61b712b0827c2642aa2505ce68093202152a36fb592a0fdb7efdea583e8a

SHA512
40a0e1b13858ea40fbae12e5248d8172f520bb09715a49d519f493de8ff59aa461f0f8ea81d62fe2d1c9f75d78d7dcefa8bb412726d61824bd7305e03ccf7a57

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
848B

MD5
508e2fd33364098f9aae89b51cbd527a

SHA1
e7db65c71960f726ff47503993cb51eb6141ac2a

SHA256
d8d755a52b52f84ce16644e7444b7cd487480ef58150780319aeb3ffb089b92a

SHA512
72aab15685ee55e1f80deedb71afc2a43d6f31a3e9c6ba42280912a7313e9aa4490953b648bb9299af7deca9ac98932134e4f8ad651c550c01065bf3af62abb6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
880B

MD5
fd21800e8a8027139e71717275c93107

SHA1
98f26a701f852bc7a419e11ffaf144ed10f3106a

SHA256
93beee97ec09936e6d18269a064e95c49b7e7571accd440a311681d1772d04ba

SHA512
d94552831c79f959bf4087a5b52bfba836322b17b5dcf96e3e9a44b5885ef764381127b611b2126d3d87342eed584ea610edfc3ce300ddb633efcb10c43e824c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
848B

MD5
59d1d6c58c7257be56bfaca8dff43ed0

SHA1
f186bd5f72a665b1a2caddd3f60ca7064df9beaf

SHA256
b0dfb702aed4ba93ae9ba59763a785712f1abcecd34a267a335da32ad90681f4

SHA512
32861cff6f3657c4546884986bdf7fceb58daebe8332369589ba86f9ee6a0ca4accfe7d56387c17e7b0e5cec3a54fd2cceb2efc7611210635d6a876b662d652b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
864B

MD5
82ef21e729dfe1abba24ea6d6da0b8e3

SHA1
16374d4a67754468a129a501e509cc4644f8d173

SHA256
5af2d00f73c73375f68b893ce63f857d58980ce5d66ca0a8c29a74ac5fe2dade

SHA512
65b15034f13eda889754e108fe626eec0ef1d52712cfe4b6409e62c8b0a9afa3687c6736130764ffe00e152b0b114164a0feff534443b228ddcec031210f698f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
864B

MD5
ca6f29f9fbdca25379674057d8202253

SHA1
77b1300b9899d9a50146b0c49cdc1c6557f185f1

SHA256
a7e156c1117004739390f88b15534f416acd9bba8bedda04b006b62cc1bbeabb

SHA512
e4eb02626d588ed20a6ede52d144029caeda2172f1ae5c93d9196343707c694dc5a402fe0735cc0ea51ae49320359a11060e9681296478757df0d42607b297b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
864B

MD5
f7533630ce6802deec5977e7db28a05d

SHA1
2eed4790008bc329f3560b90effeb002f69e2f79

SHA256
442557c1b31674a0a8b4c7913ecff0da3d718e76000b1a0527dbcbdd09d2c8db

SHA512
c2ddb9c31732744ac1a38b702f8630f14a066aa91bde823902d7587faef0356283f7381b2938d73e0e370c8f4dba97b9bd64013c4ed1d625f8586d750a67b3c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
896B

MD5
61078965aed8aac4775d70e6642299dc

SHA1
a9dc4d9b22dad7f5c7407e1daf8e7ea54ac4b14a

SHA256
937930d77b1200c96a4fe7e7da5bb3c4a1ea5a42335160acd54f1027e8dfaecc

SHA512
beb05788ad21d88b870487d47a5df27fa4d0e6229b8c2a497314010c0467d553a3b23e92a9edc00a61761002c14125c8223adb3cb27b38c600d4d2893b4db448

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
3108de414ef0ac2af86843d38c74c444

SHA1
54294463bed89af72d7e398692db4ef56a4f817a

SHA256
01fb78378790ab764ab1576828f3b56d220f1c15117871d09f26fdd03de45581

SHA512
de5401d7f72c78f2b16a8931f9a4a146a5bd73c725628fd7507e03cb14b34a10709861d2a8f06293ed1139d904278daf551954c122fcf7a8744c07e3c8b1e4b4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
4005dac1c6fac61a50be87c8503d7c10

SHA1
4358c215fdc738bd6a19f18cde374e89a01188ab

SHA256
d8ebe257878d619c6967e4e2868f8d0e170f66c3511e71d7f254fa2beb7f4fd9

SHA512
0103327de0fc93fccabc371eebacd27484b63a36015737568e4af8319efd445bbe5b143bcd7e583aa57dc51beed2ba600461400c81aca5bda6c88385211bf33d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
301027f6c25c5a623cff763d0ddd8012

SHA1
7a08d41101f790fe12e01e21e2f9355832390309

SHA256
7cd09e760068cd8a0435fc2e15e65263e5250fd02b1884d1f59dac338ed95bdc

SHA512
2e46baecaf2aff0b6f452fc431f15e9e5f479ced5a3a72fbb2fcc163407ef94008e4804483d804ebe3cbaf7c6499edbeffdcc0f0313d995e68f2f5349daa1269

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
f296e4bae94b05ac2af42a5acf2ff1b8

SHA1
e8f40b968996b32cdcfac57ad5ba871f9e9f9fed

SHA256
6fd59fa1a0862739ee39c9c1adfd542e3242d63304a501fab8b8539e498956be

SHA512
f8396809967061e590ab6478c9d125df19962904add08e12f390716c6a485c3dab5c1f10e29bbc11074ac2a05b9a4122099b1bcedc23e8df34a76f75f308b6af

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
269a9ec8700420abe0b48b2cb4d538b1

SHA1
ea9846680f07005d8d895b354dd8ea8e8d4f43d9

SHA256
400a1309236643c34fc9e6fb2ac7148477c87055ca51bd731dc47c075873a83f

SHA512
01b73d251e8965078d51532aa72feb6316de5c3a96db2c31ae4598b26c7794da1dff32c48a51deccf7f2e92b3bed4c8ba5d7d7afb46c1f115229fe42c0847c96

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
924b3c83bbcfea4ba46bdf6d09ec3cf2

SHA1
9d62ec13f133ce6c130aee6b7d8f4ce5434e0b3e

SHA256
46de21da35b8b7596e5a24514fd4a74471ed1f3ac027ee4b30ed47f73e338c3c

SHA512
f0e17ec2378297633a97d531c17cf1120f8f31d3e070783ab66c1d643a404772e9f464d1579fc9ed137f7487699d1b5627470559cbf08a8aac3dc8fa120c217e

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
c1adf0ee145cb2d793a85ccf90b1ccdb

SHA1
dbce3a5f6977a5e895e16319731adf3dd100bafd

SHA256
e9db9f3b88df42e91744466cce65a917c33797cc057037cdfe8804ffd6808b64

SHA512
16293374315574cc2023c4976b452de61584480c01183ebbf071b2ad345575d122b2b20ec38f012f5a838bb3caa242164b3aae9c1abf716b8a1ff6bedef787e0

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
16B

MD5
541661bd7c59144119806461d2468c79

SHA1
befee927bb5171966b738fd7f38c5a5fced46c31

SHA256
844d243f8183a801d17fc09fcabe5ebc00248db60287e2074a40cb894499fbe9

SHA512
3024874fb24ff7177d7d2fafe15d181b1a9e3f07ebc2198c676d33bd1e252758786e5de7418bd28e0ce36a58b72452665e4cf3239b797d55c333105e56b9f6e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240419_125759045.html

Filesize
1.1MB

MD5
d4bf2018b810ee32af38b3ba9223b4a8

SHA1
8df8873f684156eab09d6eb543fde0d30fdb5dbd

SHA256
69e4c9e870b1d79c0114b8670d26be4c879dadc95b59ef27d22012e16579bc08

SHA512
2cf0b48d6ebf2f4db5bb7d2c2e428d1ad7518e56435fa5dc4086d25430569460318efb2a6bc19784d0268d2d951668dd540beee7a1fde89253ee6a5088560874

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
64B

MD5
fa775d90b9f444184c59363ff5b633d6

SHA1
424924885470a153b8bcb7b085d335288533fd37

SHA256
5901ae83651d3f92f328ddcaaebed1afda1b3a43628e565c762365088efbb277

SHA512
47e93b23e912fb6c16309cda47ae9f67820c4c5c1f870198c789edaa25f6634424a54e5903cbef507a99874a6c7eca64d7e6c7de1275c8f60c6a929d80a45c6f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
80B

MD5
9d632cd091bbfb06e113af24328691f2

SHA1
c1ad5aea01f7725d23498e96b5acf793d3d05041

SHA256
e57daaa4901c86091ddf560076964fabc584921766b201aa245934bdde35e809

SHA512
fb08acc9e530242e3f06714142bf68f8a0e2a0b441bb7f787ff6ec25255e15322143cd7454fb96af5866e80bcb6c9c0f330c53c0cc96c316d0c5adbaf6aa16ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
80B

MD5
06a22a664ea2270e886a926fb5f3a6a1

SHA1
fd5f8abdcd02ad93ab4ce6021e217626ffced0f8

SHA256
4c21ca4cf4dcdc53b9c8290eb4c6378309ce845c0a62aa65d22f36c5bbd1ef1f

SHA512
83e56009b7049526fec28d2289fc46654e005a2ebe94fc70902fa89a7608793de14af15777f25ff80f1cc5df16d0c27686f876824a9156047a10010fe8abf52f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
7027365077f796a498e2d4d0a264302f

SHA1
e3217349158d6f6d287e8ebeb07b163f0615fbf9

SHA256
599ae214eceaa0f1612f429cc501e84cee78641b30029ebc5856d413ed3cdd52

SHA512
8cfb5bb3a7ff95afeb03aa512c0d26bb7c7b02f4b90ba2ca1bb21325d4da540ba3c59c249aaf5dc21487abfc9fb9b3c955432a1a3fe4b32e818748cdc033f8a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
cccc79263dc1cff7cc79e44330de3ea4

SHA1
09da13f78d12e28d8f822ca384dc6dda6719d203

SHA256
5424d9cb7f9c340d6a94bfeec9fac201d0b70c5a3b9322e3ddfd15d7f7926f6f

SHA512
1ceda6d838704e8c5d1055471330397242a247eada7749004b8d8509505601feb50950eef8924f16603de2ffba5f89714721fc390767e20f2ff0b7979a3f4406

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
3KB

MD5
93fe952755f29b6c24cf449c267a873d

SHA1
6ac07bd2aaab3f4663239f10e92712c7da4931d4

SHA256
354bf95ae57310a70321c46741227d885d695325c0d5fb4a691048dc22cb1498

SHA512
d4a8afaa1037d83ac2b093051c7e582058bbf99fc395e4aa2413ee76a32e492c462f8e8ce43a368599b056424b5e2ce2491f4f230abcb5f3c077e6f9cbc9db04

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
7f5822e3b75d9ffbdd9f38b9275e904e

SHA1
77582d2efdb642c02b3656389d9c0a34acf57ad7

SHA256
3e4bf805ae55721a5dbd68e98f0e87d0ebad187bbf36ed108719d361b332535b

SHA512
f190a92ae480ac458d6299deb01493d418108daf6a42666ea715579d2cd96822909de78c9882e01ae6adafc4931c2629eb72d18d736856449467a9b0410ab59a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
c80689c12158a1085df6db16b6a94ff7

SHA1
a2132f761a27a9bffae219d291f9ff7345aea26c

SHA256
04c413601dade3d8a55c7ffce282b3418c7b69d8d6cc0f9032a75c5acb38ae60

SHA512
7c472dced7415abab980f164f0d42035764d156da00af99c0a8de049fc9de4469f4b04386a8e489cff34f9c63ff2cf60dbf15a3d59af53d84dc85b3ccd51e443

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
9a9d0ad8b75da3ce94d08459d728c942

SHA1
67387368c189b6f723072b7d0ce1f5e150be41d4

SHA256
c405a989b3477019f0bd29d176125ccefadac9e69d3ed8cc85a3f3dc8c968c6b

SHA512
4dda7365850e9be27e5a4b3865e9d344ec37c5c77cdd399725828edef8fb40ba282570045fa3c50b701baed2649eb04e62b17a87734df7064f2264e11b37af5d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
9c1c4a545681c088b4bff7c2b68ea245

SHA1
55d780b50519dad9534d12c94f4967daf71a403f

SHA256
7c0c69db7878f7d4dc6a176f3ae39f9aefe719a3c2d335667a469728006a6155

SHA512
50dca02cd9ec8cfe567df042d518eb0f5b9a243994a55da2ecdf9108f090ee2c134edcd262964b30d76d5f28eb2c4f1a5e86b3d689b86bb7f1569dabbd29c32f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
c643df95e11bf49ad6471eb889fc4eaf

SHA1
5299e6cbd8a45c48da35fed4a4b823c66275eae1

SHA256
bcce27c4fa58b60b67dde4b67bf63d73db2b72f60aee09aee744e5edfb62867b

SHA512
248ab786822b2a629dc6ab7b0dbf9e85e671c7a5dc1695cf1bc02ba240001e101144ee5b60871d82335df6798a929a0b2e2a163fcd322b4206fbd1e1c22fffc8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
21091728bea5df07f34d1b5c582c9653

SHA1
4c4736f894f3a99ec2b8a41ff6570c29c3f1523f

SHA256
cdab54f49c7bb204907245173fe7363e5459d09a854a11756bdd29aa33c044ca

SHA512
daab17e814764d7ee53e95eb738a6267fd97b9ead786a3eb7a6c0e2360031bfd9a187d6c72d668b3dc9464d6bc284d4f388080522e023d7bc517fc428e2e0999

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
92471cc9d7c4c9a0c1da631ee269aaee

SHA1
e409a739c5bbb2181891b10d680eb7920bbf2d65

SHA256
4a541ea1b463ae7143236ba80539029a35e3ccb0d5c4dce323d93ac32c30b6bc

SHA512
41c563f4357edd5d9071dacd847ea80d94224e31365a5dc1b1b35aecf40c4de771061b56113dae9caa45efb691e6c670eaad10c86f0ec10c92a51c76b0aca82a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
2a72aeddd7ee42a3c07bffbbc20ce4f2

SHA1
ff81feab1de63a8eab26b7418aad7305d3ea39fc

SHA256
7377abb74f9127e8b1c11ea61073c95d27217c6da79545d03b70fb738de7924a

SHA512
ec3e8096e4dad00df33773a85eef6a5baacf9452620196df98158676d545dfd81676bb7d62c75c9776d08218a3c0f2f834c032459a599c36c27691ef3de2e29c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
2e35e67c11984dd58a330a801426690f

SHA1
d9a2e221e5d68931e168bdf0f5c3ce308366e4ee

SHA256
93968135b0fc02f71dc831d96e5f4c84720fa050326dc4ef278ad7bfbd288308

SHA512
20d7e36bb762b7008c49e60081936ebe5538e96243956615806fa7246589a7c61c3ae537b08be217c91e86d48ee7821bc1fbf65aa053acf990cadaee0c968e4d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
27c856cf37bc95542c3387614a14ceb5

SHA1
10948b7e0b1da7d1b051365823ce3629108b9e4d

SHA256
68e86911e2451944fffba12807021ef6299d17d3fe4aaff637853336f4e42d6e

SHA512
4208c0db138dbd5c42c0eb25933f1aabcba290524141dbee2e02085b0b97c114e4185a17819c83a25192e4d50c660578b91fb568342bbfe1a1478292194726d1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
8ca933ab6e88c55b747f394a126d8eaf

SHA1
3e0a812b705cc2513d564ef4095e6e09f3fb98c8

SHA256
0c7fc8e0469a55f332f0a66c9c674787765f53502d56731798627adb1959770d

SHA512
104e30e33dd71cbbb738520b396648182b257b84f7c9a77103a67e40692b84dcf32b70d4bd43ddf8f3d7007ac4e09acc378b7e6747e7475397ddb3b7a5211bc1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
fd1ee2f53a50f9e990a34ef4d756509e

SHA1
8a1fc7e1f764efbc1f0f7e39556a6b46e9a7b319

SHA256
8fe89295353e9647dda0d06c3d92d6ec9ba0c4140837634e2ffab5b5075e7c4e

SHA512
2098e0393fc1e5a4f3b761a14f109e137ba07e3462dc7a5dbec93a91b2050c56cfabf56f752133de6f3cee5442728a298a8159067a243957eb050a527d4200c8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
ed43351ca8d4d1a79a469590cf197958

SHA1
b2a1d623dff1c9b14b4d482b3cf442491a493237

SHA256
41c2e66e39fd8a9549be007455b8339bff6f459c13b07219ab79e986e066ed05

SHA512
221c8f824b5fef8175fa602995627f4d1e8c08f8f7ac234f6bbfb29f68acfaa9a9f80a9b83f76ce19a2ccd72840c48e2ab93e5789f38f499420e278ddecfe4f4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
7c78fb1f1b25f39bab4b3a5c6d4550e1

SHA1
594e1304bceb71f2ddbc2cd18d82e9f0a7f123e6

SHA256
ec3b0d4a97cf50492cc243bbe0ff81707386b2582fc13fc9a83a223543ec2235

SHA512
86721afc83ed8aebf482938de3e6fb37397dfe690af7488d2bd78c81b37d4fd9e0d2523c6327fd668e90ba885d8a26aac045eced65f7da211162151367e6723d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
defd037cb5dc646344cb4e23f4379107

SHA1
91dbca052efb650da9872e19f3e995b4630b51e7

SHA256
b661570e8295b9d6a684441ce4526e73966fa8c35303c5bbd972a607e031107c

SHA512
24515ff78fc9c0cb601ff2b3ea66b3603831e8236eb4753e6fcb67101e7ea41bf4f729d7ead545d020cd9fbfb75323989cd87499a7cf81407ecfd3dc00d53430

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
e9464438ae34b39e78dd6b7b630b8a1f

SHA1
7a45612c07e6524b9211a75eb57113e18eeb46ae

SHA256
ceeb8870bc0aa6084de3073f842bcb2eac3287e61c9a640055a24bc9316b30a6

SHA512
560195477aad284baee751098dbaec89ef653a4eff749caea921bb1696cd5319dfcaf40f57cde1fb5ea392d3b1bf2c15c5d13ca05e93d9ef74fd9e8f8b70473b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
5d331c59039890d4ee2aa7613042ab81

SHA1
4e0515708f78299f7949d99f65e79b7f9adab363

SHA256
91c86fa338270434a89c2f87b6720a20dfb55bfbaae5da0096a8f12fa873cf4f

SHA512
825762183e1d3524bef86e4bbecd15d2b67b1435696bc72aee4763f6da2fb32c89f3deaab1121ab00020954f3777ac593868bd7c2ca45b6b569e67d589010d2c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
fef560b63435eaaa00d4f6da623bf2b7

SHA1
df3bf5a92d4b6c42fa594dd20a34f1f943c77680

SHA256
deabb923b18fcd6172dcbf0d76c556e73512946e6aeff02945babb9e45b04856

SHA512
ab3da2ce942eac69790930d5835b0457fff2a9b3d40f36790439d6fed95640d2bb7a634f66949fda1425701bf416f2a88ddf9f7bb86f7d7fd39e600c4f3fccec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
7133fb73c8aa6d29a0a6d97039458c42

SHA1
6829e551744ca6fe2e90c861e6690a07413cb286

SHA256
ec77e10c24dd37831687de56de340f618e4deea61c89d9c439d385f474361b6d

SHA512
35d5464c1328dfb378ad32c530767667bf48525e98100faef711b5e5121908eba73dfa401e67e870c2facaa1a3038686af0605f537d01936d0c28b3e55c5ff57

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
852b876f3122a703558fc4ed0bf7931e

SHA1
14dac1509abca7072c56bd9866c81f63ed145315

SHA256
901bdf5811dbc397319a53c445a105077d99e56fe45de9aaedc62fa588840028

SHA512
52f74156016d82ef1883aa395bf592aba3b87693fa6bafd1975bd24bfe26bb46e9884a7f5ccbeadc0920d555c98c0939d61bfbdc50bd8db581f9de406d40f247

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
67e5b03753205173e89a414f786628d4

SHA1
8fc814fbaab900488228161a02474ae94d8eeed3

SHA256
d8dd3c573a2b5585edc9b529271bf0163fba7b69f6066a3d7e96881bc94c100d

SHA512
2d4446ef40ce92a32b8ee076ec986e29cce6283bc2926cbf8bcf696c419224a9d294017976bd9bd766eec0867f92662947f938ee6beb518c18132d4cb4de5722

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
164d8222e5880c1ec9b7555e80a2f36c

SHA1
22441f2112e35f7789737e5bdbccd579370c83fc

SHA256
2ad61971a19e0514d4fb29f7296e7ba7401e3af2194ebc188fbebe39547eda9f

SHA512
8fd6769d14c25135d0622ea7285e0a8da565e9891ae7abd8241c9989ec4593da3d3a231ea8777b38331ee67463c112f6d026f4dad70b031da4a2282f8e545241

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
320B

MD5
8c0f6d67de7c8fc9cd2055088bd60928

SHA1
abf8eb0d1d48027066bc54b750908e5898de2e64

SHA256
3e7d3b074e801dda4bf4a46189a76805c2f8300952045ae414f4ac4172f722ed

SHA512
1ffb3e48655cc584c7986c19a074c0cdd44bf5e775faa542e9df0486629ac27e867229bf90acde8b0d63a2947637200db4f58ad8247b0e9f077fa4c442368f79

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
0c7ff963249f45638c648161a5cdb853

SHA1
4a61e010f51012fe49862e6bab727185a3c5ed0c

SHA256
d4771d6f137d8060b45f76f95846a0a81c653e68bda1920c58220ff6ca8d6d9b

SHA512
08f13cd22254b5caaadafa257ae6d80fe892e773ee31c96df7c8a500e3f707c6c7753f6632da460aaa7d5245ff83876db0a39b2aded6ae5beaa91095bf2bff1b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
3e0ed5050f4640403b8c35540dc74d17

SHA1
4a10fd8f43cac978dc208608d7f0946a173ae32a

SHA256
44fe0e2eb2410fef608bb28c3899fb6f283cb8c7ee962a2f3c3e534ea574644b

SHA512
8bda5594479470a8043ae6c80be1aaa1eb1393ecd43694415832fc4ba37d78cd6880f19df20a85cd35475620c05453ffe963174aa26da730b6587386dc44ccfe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
960B

MD5
c88426719dd5775d33f6b80204b76631

SHA1
30b02953817f5672e669b1e74e639e68a279cbaa

SHA256
f3a5455d069fbb398b54cf9023bf448fb12e1141ef308b0794409a750d24fd40

SHA512
f578bb774bd6ffa2788683c8bf70faec60666d56e4c10ad5184c50fbd6759ac27d6bade7e4ff311333723a9c626e8cc1686fc7f5171b12642a856f945135f24c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
128B

MD5
802aa536f1cfe08baea17650c681e09b

SHA1
2332ab8fb1eca9359d3a28d571545623ae843f93

SHA256
09ef1ba3072cc6d6b18374b87fac536761fddc4807bcd7ecf39c247a8f026f0d

SHA512
bc07931dd384507ca13e0e2404b95d7434cba6e3ab450f407bef34fa16da2077de54b0162060ed65ec0edb6cff5e0913be3e0557993302d41f01babe8b488e14

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
75daea93531df04be69e927dadc34c1f

SHA1
0048ae6378970d60ea55e7e7492ed2e0b4c48edd

SHA256
521b10a25978a29950508977fbf59e42166e03f2293176f4900b526a4296abc6

SHA512
a7e8aa473b667b8cd3112777aec93e3d65b3d3700e113393ca1ef08bdf7c375da3dceac5ed94025d5484ee78351d69eb857d282c1a1036f54e74f66c3ea72db8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
556a05ba321d877430da28d004b78e32

SHA1
a3e2ddafe98dd39ec968760fd30a4b6967e0415d

SHA256
ceb7e035c8ebaebf2a21ba430a0050e788ff5ac41300ec0f536475f9123d65ce

SHA512
e022212376a4d83522bedc84efda8957f781759939f27306586173b1e46d0fe86464d4c04e8fbcafc5a3395befacd47dd2989189d736e38afa909f45a559cd4e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
64B

MD5
f9ee8783297bbc02f66abebb0e6499f8

SHA1
165ad67be8503d05282d66e03f0f58fb20b20f84

SHA256
8c916104180b0452e5587ae13ae00afb52cbe54ccab2c53c7ca5a50f8677cec1

SHA512
628bb8a808cf4707ecccbf094aff63d373b582c0e4f0b777db09d54c8bd2cb8f5721b7f70ce2b2512503c653264fedf4973738db37c59e385b396bbed35b999a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
928B

MD5
cdec04754df008e6e83896e1c32b6e27

SHA1
4bcffc808e096cac9de3f5dc55c49b85f9467b03

SHA256
b816edcfeb6e77964fce7635bbf969de814e7cd35cb3fbbcb00cd0f8ce7e97d2

SHA512
47905a913577b6c1d09a5d84b786ea5e819efa6fa4449046a02007121fca066cf2bf18eba5d4060334045f8093725f45cde50dcf0f447fd5cc5b266701842d3e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
96B

MD5
0ecc663b294e1357f4027cdc3560e203

SHA1
87644e6e6a74cb6bfb7a1e22e79235bc4ca92805

SHA256
f5f483873dcb26d2a3db37c610d0f00c0ba0781787c5f41cae184a71fb28ea98

SHA512
777a8c98d39d543891df2576759412698a4f4355d898e82ba707c3100cc11b4aea2a1bbfe0f7d679388d6d8cae597f435bc8ad2240ebbf3d11f328a0c53fc4be

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
96B

MD5
257cacb8be6b97ca4ca81ce6d2d14de8

SHA1
c6ae3962ccd7aebd6779718df27250abe90cba65

SHA256
586f905eaaef6a07be338d1b9b0a6ffb6a390258c9f82e1a847ae73ad47e004f

SHA512
2f5ae5d071927efebd84110c30d48d8eb001b6b0d104b8f73b16acfed644c614193b934547f18dc56b5b0b477fe281b781d1d8d798bd6b25aad176debedee8a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
336B

MD5
90e514c7fddf659c7af446c1f1038509

SHA1
ffa283463d484b06b6876b6d2bb38c5b15a0c8e4

SHA256
edfd5092f0f1dd56373749ea80396271e169e4875ecbf57eb30c65ac55a818e6

SHA512
a2bf08b966b9ce7f1035bc40cc7f5de5b9545908b069957da6b95415aa85d08c517a2b8897b571068aadeaf671a9127c0514cbfd4a89d65878ede92a034bced6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
ae06ab5824b0ac413251e584ecc9378a

SHA1
c11b9110a9e18a22be5e5d9d7c718962590db34a

SHA256
bdb727d74d1a05b931cbc1527980539bfe20e66bcb85e12c447764b1632dfe68

SHA512
5a391b6cdfc1b1f1e723d2a2cfbd75a91b62e9a8be9b8948e5b85e29a1a6aa5ade54a3ae0abcfddd1a96fd77a05a9d9a7dc5b3486e73f3891c0a0b6cd1d71397

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
176B

MD5
ba069a8dbefeca0366d72a77052cb5a5

SHA1
2562b3b3267c5e0dcfa519f0f9828e406ff1adb8

SHA256
47bc7dd4a47ffc22aac88c0f0f1c6543be67212894e1cec5d10cd7e1591909e0

SHA512
690102644a09930b0aa6f0e2b3bfb80e3e0aab7b1337023b922afac4911104250f0dbba8e7eb9670c6a2f2940bbf38b2a2f8916ad4a38adf573ccab6f7411e7c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
592B

MD5
3e5d1c2a00fc1745ee6a6b1afaac1d07

SHA1
4b6918b0e0bb78989d48d4fb61a38e441e258f0a

SHA256
90522db89f21abb5d189ba9873ebf5849ac07ec5595431d185fc489421974cd5

SHA512
081b6458ca4a7612b01654228a4d617bfa454b2365887c3b891fc9b46bba043767cd67d395feb2c83bbc597f22f7f49d5c28711db7025500cd1478ce2e2e2e49

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
128B

MD5
7561cc1f5b650a5f661e5f1b4801a98d

SHA1
6acca13ac19dd00d094ebfe4f4bd4c0a75294860

SHA256
39c955505ff816290dd22f8130669e0f82ed5ac04695c775ba825194ebefd996

SHA512
83d6daa22e42ba63963e76912eb636b87dde58c8c2017dd08ee761efd6db4f4a4f849c0f3ad1397181acba50999ba1e71f5683d5cec0aa06dba2613a0ada19f0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
445336767c4252dfa78fe778e3549c1e

SHA1
ce33869cca2930988f06c3a5cf378926fe3cdfa2

SHA256
255dd12ca758d457355d5a6b50cb0912dca65c7f290469466c32151c13361ff6

SHA512
1fe5ca949ca88a9ab5df5b4138537e8ac43b159629c6c830a070277c70f85d539c9d1fe82cd7033199c6d98f21b4cb2abc089b7af96c1d3453ed5ab83deb4a6a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
896B

MD5
7aa5e5ac7a990a90c80e20c1001ac1ca

SHA1
97f4842dcb10413940080b3e84830fa30e3a223c

SHA256
bdec1feaf63c72420ad76a2d5bf5bc034cc2b810114742369eb2d0775727e552

SHA512
eb0c1b960d343241de5c54f312a5f6d7e1484517069ebd5d99c71667f702f2dcc340e96c1bc2d93968a1a8ef64ada81116d1f86c87e62047eec903757301847e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
f9f7191a540e31162a99d8bc7a509f35

SHA1
0ac084f418e2b3fecd2091d1f284d74fe476d432

SHA256
63553b16c854dd52f766e9e2a4700bc90fc7f8289784ddcbc1faca78479795d4

SHA512
f25b8dda9692b457863a5b6aac7c7fa2196ea42b1953301e46651645d8df204716ea98d4574339cc8d85d3821efbd211eaa5abea44783ca392254864785ba878

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
cef2b2e981b7bcaa1ce3e63c093f4407

SHA1
ff0d3516d0a55fcf7489d5a96dc702a73b94d823

SHA256
14b4bfab5fb8b8e647d302ae373d6d6c0f51c9bbf84ed359af25eae519fe759d

SHA512
9a3195017d474943c61b632b43acbea2429e207039e513d0cc469d509d7292179e953068b6ae3d6a5ad950de43cd6e2becfaf8f23347352e0cfa7a4f31303f6a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ProviderList.ascx

Filesize
9KB

MD5
104fce4c81c101bd2a3074e690d39e39

SHA1
4698b9ad7fc62f7e7906d9fb5837a8467a461383

SHA256
9898de3d49785af7ef8fddda1d41dec2bf267ec3d963a60db45828562d0141da

SHA512
26192d2bc345815a6c5671e26133ec296f860dced1f024481d0cafe284a42abe13697750516334b7f7ea76f2835e46b5f6f38fc16493a7ef22965dc2aa40f9a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
435920552355ac1d8cddcfac6f99085b

SHA1
c2130f7ae5d45eda5af6592478a10c8c0eefb1c5

SHA256
fbbf87f4b251d12d5b98c2f86f240f861168f5907d4fa2c74aabd5fcc07071d3

SHA512
0d36d69e80a02c37eea984982b0cc27cedd95d2a313485eb28f929c8925e346c6a8d1b4cf2e52a3ae7be670c141dbaa044508407fe9f63ac0086a26574b9beca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
a96e03bf69390f404d18052477bc164e

SHA1
cde2a83a73556814883b235512b5c1964d5b066a

SHA256
fad733ee1ee817a547d7097a02521fbcc0b46f6f7d9f676c6d204a857fd2b4d4

SHA512
5468c2af3bccb2923c87cae3ae8897ec077b7ad3c1915bdb3cef31f87ce82f46e5bca49a0154462cd78dbf4814e8f15e49d890585dfeb23acd1bd4eaff7247b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
209d0f2aa5ef1623f3c7bbb507663651

SHA1
582f4f815dc17ad396f63e0cca2bb8048998a7c3

SHA256
634ed9df261712e763b65748c61fd608ae7f3bd1440ea646bcb63e5ba36baf3b

SHA512
5cd71187f9f4e88d5f9da1d7febc43fb9e5f078d3f5460e4eee74f0bf2b71e303f374b87974cee8195c7e49615736b5fc7e1c6ff24b60cd892fe21a7657592e4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
db79dbfa6306445a2fd5efcff628d194

SHA1
d26d9268fb7563b24ec2f720f786f1aa18a1173d

SHA256
bed5bc4ccfeffa27f0144b6da6796fcfeb815315bf76ab023498edd9809464e9

SHA512
fc25deb28459eb73b6efcd6c52b9e9123088afa4f66749b21dd3fe2f81303e39abf56b91cde24508adf0f30c0057c73c0b8ef98fe488c0dc18d009139748bee1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
0c3d3ead0226d802654852def79221d9

SHA1
299b8a3b724bffbad81900487a1faad7372ac9bb

SHA256
47e8dc90dbf1d887721b3d2929d92ce904bdb6f958e2731d3ba8f6c488994f24

SHA512
8e0e156eb4704269a166f1da2e503e406d7977d4460791983d173fa5f2be9b899969ad78680e233baf486a5e90bc8f04ca98cdb991c846703b0139b1cb1c2b3e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx

Filesize
2KB

MD5
c9397f1b4aa932e5293d2aba3e797727

SHA1
b50cb1501fb4271dfeff379da2470571ca1ba41e

SHA256
07e11f4bff74e60a8aa24c9c380a093658c12cc6a60276868a15f9e44caa0018

SHA512
f996e921c0cf92a670c764b4572a443308762f58dbcbd77d6430f847a090ae22ae30271577e6172fa341b711ced6866283c1a84d2653a79b7059736c2e419203

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx

Filesize
7KB

MD5
3062dcde699409d554641aeb516e2d4c

SHA1
051543943482a0373ee90e1ede6660d37079b261

SHA256
ace53f2fecefd0b7526f683b3203457d3adcbd0df0af0eb0b2891a725d876ec1

SHA512
f59514cd989fbaf5a8b7c1833a1ee6a37824fe33437d166f451f0db6efadc6a0943fbf86aa6a33f5da58ad854b231e0560e55eff56fdcfb2f9e65ffcf40d4be8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx

Filesize
272B

MD5
6317513570f6114bd99e71146d5bf47b

SHA1
785360ce53591733353eff035cf79c61c14186a6

SHA256
7eef4982143595e168a6f3e9603ebdbd920e5a78b15cce2d4619c7bdc8ffe1ef

SHA512
d5725e956919aab2b123e0ded2f4e8a02797331294f29ec8e854a6eaad57457899bcab79c6c6be5fd42898338b824523a2017870a9b959e11b38489298d4f134

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx

Filesize
496B

MD5
9a608ba9020299ee5ffa2b70b56f18a8

SHA1
3a2a066dbca1f7f92c6eb366273d6e5fe1158a3e

SHA256
273c07f7f29902ec5da206c797bb1edb26857dc17ccfa1b4ba598d381bd485a4

SHA512
0e5798c55e8a64bbce4c7e03e62960d26a95451f87140090ea69e00e03486e3d1dbf564b6bf83f1b9b37b26eb07b47c4c2f3ee3ca312304106b02a27034abc2f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx

Filesize
24KB

MD5
c68d0b3817182040b08a7c3b4ab888b0

SHA1
12571304bd6648b68272277b652db8a2ce74e8de

SHA256
58c3757eda9705894c2b144a4eba04d0f34bd1d147bb68b5b0bd8e44e2b72708

SHA512
a9b3b2abb20b74fb365134d05a0e4ffcfb3d79f530d2b97d3ce4d4ebc867ef59b05f1067a57aa023f223d95f87284995e95057319841639aa9aac760d23ce6b3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx

Filesize
1KB

MD5
3bf2241e09567eb9439185ace4ff8e30

SHA1
78c840e879e1f2217450ae6d8855a7d8e02c660e

SHA256
723961d2bd298d13c8720f34a5d3e8d593cc51a6ce32ef8b7ad458eca2775829

SHA512
aef7ec2772fb5a5dfa55100b805c3bc7ba00060c732df096d4bdd56fb36cef0796e1626313fecf72e190ea112b9b6a882aca13c20f772f5bdaf4ade8ecd9015b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security.aspx

Filesize
9KB

MD5
44b6054d4fa2e0e6296bf240119d87d5

SHA1
437efc242efb93ad2f9659669d332acbe7fcd0c7

SHA256
33b4032be07c0a608692986082debaca70ebc0db765912beb2db377f8943714a

SHA512
0b50fde4371384eed76f0db087d80f508c95730acd76abb2102aba008d990dd09fb7c7606ab524819bf5af18cd3d1f78f24ef01e0e4beca8db58ccf0b132247e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
df6c526ba8848629383750ff294eb542

SHA1
abe061c6cbc0ea6c14c0ba080f1082f21395892b

SHA256
01cc162d50b3496261118a3995372d43003ca7988e3b45e490b1c1f31e8dfb2a

SHA512
7b899285bb759cf23328dbfe7d65ea4e654a507c5a9be9aa047351f8b6f7fed7feaaf2c28052636a0fbb7c9f2d6baf192b82458ccf7738a0c791accf594260f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
bf23053c86fd927ef91603930b04892d

SHA1
c3d638031abf1ec46590cc76486b29db0e7fa82e

SHA256
2032bd2969482995a4f259506a30a20ce3e078655b7dcb7235acb931fdf4d094

SHA512
f4f2ceb754e0ba7cf85c571d6db9c503f99b6e1182e4185eb735bdaa5b44d53477d71bd9c7ff7020fd040318cdff467d5f7d2a54d7b787f99190b955ccfbd45a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
a302dd619ea0fb2b3f645aec6bf7d151

SHA1
70048bd8057a134a1ef2b831e75207ab1ef5290f

SHA256
8348e8b5ddc8c640c97ed2fc70453a27b24a9d3dcca60c7784baa109a391f1b2

SHA512
1f553c56a1ee773c7f7038d352b22ad980a04a4c7bceced6ac3aa875cb2ae997bd80f28ffe72f1f602dbb5e6d7722e4315c0c130921a54e74929992ff016c17b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
4af07929e7f3babf9c177e0534bb08f0

SHA1
b796af7ab5f3b5146556ecec4f85cacc0eba97f7

SHA256
a51881f7861d6b58892800d46f173e39749e667c4da12e30de0dcbc758890cd9

SHA512
c12cedaa650dcb91c0ed6a11d60ad8723cb47b9479fc0aa7c52dd646e23268d6ebc260de706c7c63b0d1b936bd8383369ac1d78f8484bc642b7bf463cbe455f3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
921c312af554e100578d841c06cf1efc

SHA1
b8afe1b946ff6d08598db7864f6ce3d9637f10f0

SHA256
564aa023d4d5daffed52198268c0b39662436dfadc17ee0491cf85fc9d99f548

SHA512
68b2be4a71b67bf9322d9c51b55507a93b6521a820b96ab2f2607f038051be28751ba0429cd5a93a30c7647a1381410b1fa8a94f622f200ba59abdb9a5897591

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home1.aspx

Filesize
752B

MD5
fb2f30fc7f7bad9f7b605b57af5e030f

SHA1
2401f39e63f59b659fff72b7dd0f11edf053399a

SHA256
b9ebc0973b215d319a8e1a2404877d32fb5a5a19b7d974eafbc84696fb24f11f

SHA512
f2ae2afc27133a6e78a1c931f8a02ef7761e6fbd01a69432ab59069ac52be26a92da4ca6702fd6ec1b859d27b735660ac85728a306052f17e35745e9bbe287a4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
1a85cb06d3afeabfbc86eba4d1eb93fb

SHA1
810730f871a71b71fdca0e2bbf796e84996d78f5

SHA256
a1eb57d7df109c1d856f042a4d741c4e6c0e49abc4417ba51ff8d6ed634095eb

SHA512
6e64dde34d40f43c31f731403404f4c7872c5e6b9d245b5f501a08ee1f72e6c289af0bd15dd7e509b2fd8c6f0b51ed2cd20e8d3d4998d3b2935900532ef2ccc3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx

Filesize
8KB

MD5
d2b9e5dcc86910a3be270fd3c43b5163

SHA1
0e90620eecee5f10f274f2e5812a04f4f86b10f5

SHA256
3110a1efa48bcfe7dc2502358be72289e4852bbd08c13ab1ea5be8196fbb9923

SHA512
c0dd9f6edb5b5bbb9a7b8b06ace9318100be0b41d354a18fb0a2ef04b89d24ef2537e00196ca6ec153fff47a28436f3467d82f76501869f1fa7c1297d6229e17

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
8f77dfddd3edea0edac2a540efc75ee4

SHA1
9294d7141490599efde8b1558724f2ba7231fb66

SHA256
23f4f8d7d94ec59110057d1d6abd432b16183cefca4ce72a08ce62a27c5ac2ad

SHA512
1735139414e6d224923ffb5f1b0f1c7ccf3716c6ccc95f9eca59637dca32a8a4410fb41e54dfc7d4aaadafa2abc4567cd15ab0530e2f0cbebb1ef2387d09f567

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
c1cc86c787bd82c81bd764c506ec72d4

SHA1
a8f30844dda1c968c2f7f9733fc8a22b9ecd9687

SHA256
dbb1c437a248bd90748a7162d2ebbd41cf46b99cf0fe903bb4898114dc3c967e

SHA512
046753907b5411879169c5ab3f230a739eb8f43c6c019153ccf71764a12e8af205af893526b0186f53ec0139ec81aa73227032b3b11c2a0a7470f2837f1a6de7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
0b03da30ee00667b84ed99d9937e0775

SHA1
e68b17a3dea63f984bd43f883a3f68db0261f8c3

SHA256
1cd09ab8e782306baf613077f89645e4d93f6777b81adec97519619a04f55715

SHA512
420ae5dfa93cb8f1b2e779ef669d62630fa8fde92fe806fd020c88f8bd06528dbd8094117824db81d67d2ad1931f7abd07131e2eb487ac51ec152ca5b196c22b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
ec1ee6dca17d09430d281a1cd2949062

SHA1
618eb07a79044bbdac3e217e96c03b57c072b585

SHA256
09b25d49c24b674dbc5ea0b708ccf04e48f244613696ba71d79a22458eb167c8

SHA512
bd197e154910cdcd93b247d7c0467b76135edf935359193eab96322bc497829f3139712a6849c9c543f11adf5fb60f24717d577d93c5490d9dbb8415be5ddd1c

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
ba3cc0cf601063ca4ab72c3f51bd04e2

SHA1
dd839867350a477ab423efb03deec1c145ff77d1

SHA256
4ca16876b109ccf5bf2ee6fd9fa6ccf248139c4542326f58126537bd7b440fb0

SHA512
5dfbffcd85f0aaa104093845f32b3ab0b0d4efd3b2561cc67d0d53dcfba428f58ae62fad2aacd0bd40112eb5e18eacb05e367c7bd1276c76e0d1ef604a339a35

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
fa5e7f74ab077c6f3b5a1a2a3540df49

SHA1
2eb93bd7e7e630f04eb053501dc2e00d6b990749

SHA256
3b221a605033594ec8576c018b4616d3af7b508ed70551e051887ef3602ebd2a

SHA512
662b47f674a9c1239d58952c55828989a9cfd01b463e358e51183553479b2502a1e1463fde5b1ab2d7dadccfae8aea513c15aeea9eb800535d6fe8693e93f75b

Download Submit
\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
memory/2164-24-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-20-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-44-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-46-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-48-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-50-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-52-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-130-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-129-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-54-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-56-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-60-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-62-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-64-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-66-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-68-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-34-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-32-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-38-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-30-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-28-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-26-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-22-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-42-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-18-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-16-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-14-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-12-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-10-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-58-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-8-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-40-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-6-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-5-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-4-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-3-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-2-0x0000000002050000-0x0000000002082000-memory.dmp

Filesize
200KB

Download
memory/2164-1-0x0000000001FE0000-0x0000000002012000-memory.dmp

Filesize
200KB

Download
memory/2164-0-0x00000000746EE000-0x00000000746EF000-memory.dmp

Filesize
4KB

Download
memory/2164-36-0x0000000002050000-0x000000000207B000-memory.dmp

Filesize
172KB

Download
memory/2164-131-0x00000000746E0000-0x0000000074DCE000-memory.dmp

Filesize
6.9MB

Download
memory/2164-132-0x0000000002270000-0x000000000227E000-memory.dmp

Filesize
56KB

Download
memory/2836-1815-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download
memory/2836-140-0x0000000000E20000-0x0000000000E2C000-memory.dmp

Filesize
48KB

Download
memory/2836-139-0x000007FEF52B3000-0x000007FEF52B4000-memory.dmp

Filesize
4KB

Download