fantom | 2eaccf2ffad0c83282b940b5ed1e65f38acacc9e002b48e3bf4f852e1097232a

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransomwares/Fantom/Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox fantomd12@yandex.ru or fantom12@techemail.com </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>UkGx+ymdE0lTgNARg2Q2adpLYcpSk6frnw2tf5k5JYeIQHVI4Wt+6cESXq65whJHQ5sELusGC+6hEC1PewRuM/oHz+i2x9y6IbQ3ppvW4sqxKlBGT9DUpOykbhNO2H63sraufMH9bzOhL08LmPBRhMik/DSrt5AJ0KCpY3zqpJCYhf12daOAV7lo54yqr89enyJomZcuTCwvILugb4+ni1hKsxxX8qLvBdxKvIJ6sQ8v2VDqXsWCZYD7kO9WAh4mjvWAj6W4G+annh8CjKhZZcXovCtDK6QGA1/ukOyAFps12GuAOKVjvVJwG+ZocC7afzgcdv2pQrNx0GRX0VeaEw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

fantomd12@yandex.ru

fantom12@techemail.com

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (3028) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 15 IoCs

Processes:

Fantom.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 1 IoCs

Processes:

Fantom.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML Fantom.exe
Executes dropped EXE 1 IoCs

Processes:

WindowsUpdate.exe

pid process

2344 WindowsUpdate.exe
Loads dropped DLL 1 IoCs

Processes:

Fantom.exe

pid process

2912 Fantom.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe

pid	process
2344	WindowsUpdate.exe

pid	process
2912	Fantom.exe

Drops file in System32 directory 64 IoCs

Processes:

Fantom.exe

description	ioc	process
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\GPMC-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_properties.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\Speech\Common\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netw5v64.inf_amd64_neutral_a6b778ba802632cc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\partmgr-DL.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasno.inf_amd64_neutral_c86d5b5e5fa8b48a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Signing.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpb8300t.xml	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\StarterN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-HtmlHelp-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\adpahci.inf_amd64_neutral_b082e95ec9f8c3f9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_neutral_395276dd9b7a7448\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_operators.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-OfflineFiles-Replacement.man	Fantom.exe
File created	C:\Windows\SysWOW64\ro-RO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\printing-localprinting-replacement.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseE\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\DHCPServerMigPlugin-DL.man	Fantom.exe
File created	C:\Windows\System32\LogFiles\AIT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdcomp.inf_amd64_neutral_11bbf54c8508434e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\oobe\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Comparison_Operators.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc005.inf_amd64_neutral_31e08a1c2f933124\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\StarterN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migration\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Break.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_neutral_80ee226e29362f51\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_neutral_6e65ea91a16f922a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_neutral_df8bea40ac96ca21\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_neutral_f5caca1789a3c28b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\sysprep\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\divacx64.inf_amd64_neutral_fa0f82f024789743\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\sysprep\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssessions.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_neutral_8087946c82068597\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_neutral_9b64397618841a19\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\winrm\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgcs.inf_amd64_neutral_aafcd45e4e890862\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_requires.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Switch.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\XPSViewer\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasic\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0003\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_neutral_d0615d6fd67bad03\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\iis-powershellprovider-rm.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\angel64.inf_amd64_neutral_6bed16c93db1ccf3\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Program Files directory 64 IoCs

Processes:

Fantom.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.ja_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png	Fantom.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\epl-v10.html	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp.ja_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\gadget.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Newsprint.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Person.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_play.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt	Fantom.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Maroon.css	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Americana.css	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\skins\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-javahelp.xml	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\settings.js	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip	Fantom.exe
File created	C:\Program Files (x86)\Windows Mail\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png	Fantom.exe
File created	C:\Program Files\Windows Media Player\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIconsMask.bmp	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\currency.js	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-awt.xml	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\gadget.xml	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar	Fantom.exe

Drops file in Windows directory 64 IoCs

Processes:

Fantom.exe

description	ioc	process
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_it_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiProxy\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Calligraphy\Windows Logon Sound.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\61dfb69c9ad6ed96809170d54d80b8a6\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\fr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\Version\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.IO.Cf61e09c5#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\SQL\de\DropSqlPersistenceProviderLogic.sql	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\1033\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\ba0cf5858766f7bc9413b1d4af6d69bd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt93d54979#\da2c6b516aa1681ed943b187b9c36c05\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Cityscape\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Annotations\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NetworkInformation\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\WizardPage.cs	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ApplicationConfigurationPage.cs	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_64\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\naphlpr\03d99e593bc94e308005a972667d7ca9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\system\PCW\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0804\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Raga\Windows Print complete.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Threading.ThreadPool\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Entity.resources\3.5.0.0_fr_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1053\LocalizedData.xml	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\52873358b397c328168f0a5be7f3b9ae\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\mcstore\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ehome\CreateDisc\Components\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallSqlState.sql	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\SqlPersistenceProviderSchema.sql	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.OutlookViewCtl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_it_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Branding\Basebrd\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\MSDTC Bridge 4.0.0.0\0005\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Landscape\Windows Critical Stop.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TextWriterTraceListener\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ehome\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.resources\3.0.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Sonata\Windows Battery Low.wav	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_fr_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\sysglobl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Workflow.Com#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Delta\Windows Print complete.wav	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Fantom.exe

pid process

2912 Fantom.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Fantom.exe

description pid process

Token: SeDebugPrivilege 2912 Fantom.exe

pid	process
2912	Fantom.exe

description	pid	process
Token: SeDebugPrivilege	2912	Fantom.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Fantom.exe

description	pid	process	target process
PID 2912 wrote to memory of 2344	2912	Fantom.exe	WindowsUpdate.exe
PID 2912 wrote to memory of 2344	2912	Fantom.exe	WindowsUpdate.exe
PID 2912 wrote to memory of 2344	2912	Fantom.exe	WindowsUpdate.exe
PID 2912 wrote to memory of 2344	2912	Fantom.exe	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\ransomwares\Fantom\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\ransomwares\Fantom\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
2⤵
- Executes dropped EXE
PID:2344

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML
Filesize
1KB

MD5
1f73085c6e37479e0566d5c59656b80d

SHA1
5a594b3bd6a3667f61f73fed0b21f47fc842b322

SHA256
906c720aaeb5815ec8b013876ddafe805e7785d945f176eaa2b6a76afd340527

SHA512
bca0d7081c1b3db079b551766e443070839fc4258a9b217f0db9a49e7b9637a8a2294957450ae7f5ae0620562b4d65bdf86b1118b84cd4defb56dac990c7d145

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
Filesize
352B

MD5
d8463335decec119fb2f61620ebe2af4

SHA1
43e35186d7ef064040aa9aaab2cbef1f8a4e7aa4

SHA256
5322958e6663e3843cf159d3a5a4aafc6e31ca458acb221b79a1de4ab0e8bb5d

SHA512
21b256af9b147c359442d0164ad40d6db053181ca3adc7c3cb0a42ede5ad745a845f58a022940ed55f92a2c62b625cffdf8ce46206a653a186f1b13190bd476b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
Filesize
224B

MD5
3bd511e4657887af8be5d6bd1ae8c632

SHA1
372fe6eab739fdd91e5fb8f78f4c82f22ac605dc

SHA256
fccecd4f4f8a9e135ad4c2e76fb5d24bb00bcc58d187b9e953b42d8277f08a07

SHA512
5ab7896c1f91d2ba728c901301a187923a8c0fe0812576befe0bcd98dd11a168a441d63b8815b6289cab4fe39ae71349357b837ff174d4997f362842a854b130

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Filesize
5KB

MD5
5d50c7321223f351ec38e8ebe69fda4b

SHA1
07e39cd5e95df510067cc7e35ea5bb8c57db7733

SHA256
6d8bd4ca5e26245e6d9d6ac24e467408c71b5adc3bfbb397d3798a05cb325b6d

SHA512
261c1f597fc433f0db27a61a94749e382a11b5015c698877bc36c564be5bc1637f96734022fdb63181d55f5029b79903829ffa95b9cbc177170a7a4a2db95b59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Filesize
31KB

MD5
ba19d85c873081224c48cc1db2ab08ec

SHA1
bb7d6f0212a67431f187aeaf2f9879048ace7a45

SHA256
012714017dcbead3c15f5e230d6190bc157b9ce25525db11d71fbf9c72dd42e5

SHA512
0c8e9e96899608384a0e9b424b9269994566369342cd91f128a24977cb260508803a65a699d51125560a02396b5b056734214a8367c5d06a783077636744cd6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Filesize
4KB

MD5
e1214922ee4256caece3a2de647af33c

SHA1
9353c1a0837db891e1e4390510985da53043bc44

SHA256
54607a3395eda7f05d352094d520b60031ae042bb6eb6265967438ec7fc1a3c1

SHA512
092859c96b7e3c50521369a76e1a463ef5f9e9f3f131cb66879cfdf7d2919a6be1d650bf861b11090a32f98c19575e9f7e0e73cdf0f6d5e93c3a74385289257c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Filesize
21KB

MD5
b3b6a80de5b929bc5882745a4b404948

SHA1
59039e20be18d4d3917a81e3d756f2347145a217

SHA256
43f20bc11ca549999c5d1d06fe3468c8c0655f2013f33f2e987590018ad3e85e

SHA512
e3ff91ac8db2e8137867f653e48d48a178e928b169ccbeabcf8b93f700ded6690529403ffa9e0d20fa55fb831557cacf7ba05a0f5fdb28d1d10a268fed777a6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
Filesize
112B

MD5
5e995158303e29e4a04f2db9915606d2

SHA1
fdad990dc59f63c106d48ae1ac0739328c5be556

SHA256
bd5e08a8ec6cbfb3f7d3873665d7f100dd752f6d00b3ad305ec674587d6d0ec6

SHA512
4deb0f23dbba409ca934fb8ab713ccaedc4ade10dcfdd193130d11539eea3e357f8d870cf19a2e4318495cc33a5a778d8c5a88b6fba0f1faf0513c0e4911a86c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Filesize
8KB

MD5
0373f79b44066f9a10bd2ec71ce73235

SHA1
e3bff2b3c2b3a5965cb1044948b2a44d868a67e5

SHA256
1109a32675c78d5d09ae421b96c48e59213e4bb254be40438bbe653491e6789c

SHA512
9126822931834478dd653d7f7388f24843578add8846a0d58bf8fa24e5f5072221726989a004c549eb707a02a72fb8a865a53f5836257912e36b80c6d03aafa1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Filesize
15KB

MD5
5b74e23376669e7e5889b278795b8567

SHA1
52ff7153dbf230e619e495e42429161a2f8692e3

SHA256
9f65ae0533ea081d4749635269a82f19eabb2aa445d7d5ec2ebcb5e002b08398

SHA512
77de87d7acd09b67d2b652e57b70e6d461e1168ae4f89fca1e6f683796731423b6054b386f2d1ac8642079538622c7f79ff9b0f7882748a7334f4a8d04f6ec59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Filesize
6KB

MD5
ee1c09d3594ba1fe579e7b9935b9f44e

SHA1
db8f3c193f16c362df88f3762dd9d8539d33f22f

SHA256
0c3b085c7aa9a41fab6186cfa1f59203849af49666b7947cb4d1e35626bbd4ee

SHA512
0ce8fd1f878b19cc71143ea5ae35b2910cf4fd861f7f5d37979604d25a3db23180ee67ec258ce350bdf760d6df27478c7302efb22b57e44cb0c6dec3063695a1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Filesize
20KB

MD5
b0a105840b0b78ca2d508163c5a342c9

SHA1
633bd38a696a7edd6ab7fc19010fc237c9bb7277

SHA256
3e30b8ca150dc74b40f6d53a94a9dced008ec20a08d33326ea824140e854cc26

SHA512
5c793952231507ae575ee1fd76b3f5aea618c9b4c5c22323755841ee40f7a4b169693344011b3115fe42d8fafdecae4382b5c082c4e40bb577f7dc3c0930ae26

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Filesize
6KB

MD5
973e25dc32e8f16f3b5a48d847d474e4

SHA1
3f699758e62a172cff58d4190e4e9576bca2770c

SHA256
5c7767547abf711bff645e2183e25cca6d97fd925da91c0d4d8d521741dabb07

SHA512
3be9070932945f131250dc9133d89c6798310c3089bdf747006fc23c985153e8005fd354a5df46097e7a6c66823e68f226b909b58c1af8b162ff47b2346d9cc9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Filesize
15KB

MD5
0c1c3a6235d1c9656cc2dd55102e1497

SHA1
c413c50ffe72593d0c8a50e0dc7a017fe38b1ad4

SHA256
332e067666a2a4fa835db1cef6416a825f61d274b88afa1212a0c54949df6371

SHA512
312f70124c06600166874404ae65f6a2756fe1115592058cb780dd33fd105c1a83dd3981bd91d3fd7eac0671ceec609272c650f456549601335b783d2b63c498

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Filesize
2KB

MD5
6a4fc8b78dcfe1675fa4156c91a1b5d7

SHA1
1c6a63a4f7a32a6077d219e46c3b6c606584301d

SHA256
f8a02f5d4474416f9fee2bff288e874b779d81c7108dfc5ea5d77b3cb7ccb35c

SHA512
a8ce609cc9ceec29e0da3ee4ca4081982d1dca6bc4dbc347aae97f786bcfd87fdb570145c6b9802ce6fc1d47b1264d87b350117814c44291f2fd8094b2a70486

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Filesize
2KB

MD5
9aaefdae4e21a30154586e3c9a116c7d

SHA1
b89119999d6f75964f5536d6c295090255194f7d

SHA256
3c10edb9cee31e5061d194e11ceff43d0e9983fa1762330e85db3464f3f40ee6

SHA512
fa15d628d60f5f2859a44fad56b486cb9531b5ad6dccfbd69d10dd5ab0e3e878a963c04a6e6bc3630e8e93ce1797f83d646a24ed157039034878b4998561b4cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize
7KB

MD5
37d7290db140cd61d1deff3e18838688

SHA1
dd1ec2bd9f4e2efd0e6a7165c84dc90e9836423c

SHA256
e8f66047bea5a7db8afec966aac604e8dfa55e569eb7f227ef0308c2a6c61016

SHA512
a1011ceaf617cc1e56b805bfafd31b2e559fcfbe0c44e92ac9d5e3e47a8764fa175ab381735309488a61ae3571616b58b41e93144507f09ee5cd5270660581ca

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Filesize
336B

MD5
af558785158f5e269ca9da928dc934de

SHA1
e746b0f7010c787f6dd8240a3a6bbc070940be6c

SHA256
c13546c7b8a324902af74da374e361f83d5ecc3103dbedfb79cdb4315275a30f

SHA512
d42aef0cb4afae15fb6e537e48e145adce0d8cff9cc09d9db85088cfa3834864e129dbbb6dd6cfec7f92bb4e6bce88c40f78a0825f8982a8e743e7c592bb85a7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Filesize
240B

MD5
2d8010eb610db894a3606aaae721a585

SHA1
72d4aca53de165c5bcf80377f8a7d69275ffe60b

SHA256
87aaf5df8fa179a9772424e5b54e9b1b3b32d0e221c3c08a5c8157321a9282b8

SHA512
edaf5ae97b588d2988562922962bfeab14db8268871b0b1de9f7064ca864e132cf4d78996aa495dccd8e80d783b023b48db3ba378b30fcd5ea4e2be292aebf8d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Filesize
6KB

MD5
c8b602a434770ba27c569440a2a55acc

SHA1
d88550b9b0bd19168ae9b451584b2ab6aafeead0

SHA256
e18ebcadef8976fec7295cf72d9042e22e25a4b00e14e6ba0b742c9e418f5683

SHA512
fa4091c6c863648c769910c24775a717c0c76e67551e4baa09ca7d2d766936e64756d271373be0074b348b91bd141603292ade187cf5ab95f389a8f1783cc4f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Filesize
816B

MD5
2c8ac76b9756a8058bc32d589279a2e8

SHA1
847dd6626cc908ce4486548a8493f567dd7d14ab

SHA256
d8b3cff0f7c3c27f8c6f41b3211fb2945702c59786838006d66d1a50ce91d3ab

SHA512
052f02f8fc45d80603e2db7745549610bc285bf5c40744e80659dd944389a7cfac695d98e50affa4f72fc570ecea1c44c5bfe9d24c775177bff6c75a9e24054a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize
3KB

MD5
39cd06b7680e8c2a62d2ababd49187ee

SHA1
c93815f947f8c5737e4efbdf64b655dfb9f3460c

SHA256
c0cd78df8973701a01cf9590ebc60faacb44af1d4dd5b4cdb3a939e3cc40d35d

SHA512
9989add777355903406a0c7095f945976275d1701ea0c24f86155e782b0a25be0f17ac67b0270f82146e0958c750998ea8fef6d88a3e062c95bfe330ba4b9f36

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
Filesize
2KB

MD5
e8a794f42a987e71583ee02c68c1bef2

SHA1
3e9e88b04e893b595261c9257a933d584f3d032c

SHA256
c0e0acfe18be389e07059de45403304954b689f061e3a9d654326cffe8a6c7cc

SHA512
ef911d52928897a502d142524c40d1d6910a1a87d7357718ba876e9149dd7f9c60d37e4db76f88861b899675e9dee78c9ce96183be044df99b6683bd10cd90d8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Filesize
19KB

MD5
5e3e517855fff41d9eef3dfc84f73a83

SHA1
a072b628e45b2f89e0b159c69ff7f6fe6dea30bf

SHA256
120b1daa796d1c7573e90c5b6d8380b5d391938feffc5d0e1f204523ada08412

SHA512
63b240dc8a2ff18e2ff2fa4c322f5e8930bf026f589a76f51b749b8a7609ca0c88c350944ed2f94de26ef53c147b90f4f0ca98ea762f888041ac529a1d50d5b9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Filesize
896B

MD5
24169c96d7416c3faa0f8a31dcad19fe

SHA1
8cf2c01b00fb1741f6053ba27ff2496fa4639727

SHA256
4e687d501df40cef2693af69fa40b57dab806fa762630e8943d99d6772627417

SHA512
8b886a315093a2c24a12135105b9b1cbdc353f635a84e6d190da6e7e1c277a05cbc08759970185d8e2741e95fb19c390fde5fc30e6529edaa331354223297a8a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Filesize
864B

MD5
de69d8052a25f28417f3bdf10bc5bdc6

SHA1
6a11595b4740d5bdc9270cd5c5af65addf732fdb

SHA256
f65dca0b820a58564092ec404c4d10c657e19a6ad9a89ad87a7377f89697ceb9

SHA512
04a0e50bb02e9605865614d14b52bce083565fd1395544fd53941db59d54c3d620f2a100a82c5af1d59e507af984e4ab3268e3649cc90d074efa7415a0b7074b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Filesize
864B

MD5
2d7ccf4679e2b38bd9452d9efde1024f

SHA1
9ebd95cb0e43df1dadafee5d02ef82b2c1bcaba6

SHA256
d47c9e40d6b37c4fdc451d45e8418c50965a52398a1275ddb77e753f824a268c

SHA512
41f25926f9b08d01cc7542feedce8426b4f46f4440182ca9768b143a5dba7c6f3492d2921a9eb863afdbf7e94f2b2ce79197eb25ce18e96252fe5ee071abbcac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize
5KB

MD5
e9853aeedf91727371de1abbfc4692eb

SHA1
b9ccd1ce1ae96a9b8d8a0afb17ef8eb3cc246981

SHA256
625c6f9cbfecb82da2eb5c080ed76a69cbf45084d7b8b0a203e7b936a055fee1

SHA512
fa94f64474c0dc06b282324fc2557238f7df3c97151f840d3b7aaa81ef8d0f0b8b9e0b5feb9fbd70c0648189bf33d6b6a2d7542baf5b30086435498bc97ffe10

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Filesize
1KB

MD5
db69e5079ff27811170a530339997f41

SHA1
9de313f70390e4f166481fe38e170108a72d6410

SHA256
f525be61d3d3e58a24061c455819884910b4ffc12afda34f11d13663b855b9a8

SHA512
5061da51896a9eca8d086c2e0d616d656bec18b1307eb9917388ec8a0652b5f389b793b8883e8a7faf0d6dc3d1c95806a238b0c2cc86b22cc46d3267a3222050

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Filesize
864B

MD5
71bb3c414a7ec5647943f86cd2692d1b

SHA1
82f6c43962f2e7f1e4bb4f4f0fdc31d9d1d933c8

SHA256
ae71aae9dd53aabda52418362dd4dafe8c7fdb74166da47a175fa472d3976c47

SHA512
fb9d1c0945cbd291c7afca6f604d09fefdf541a12d6bbafa2e51fa4eac1661ab590989b9cc528ab3e17358facdb8f83be70b8d68b190744dce0c7a4ec904e559

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Filesize
848B

MD5
a11b25728d5133afd56d02cd45841741

SHA1
8fd6a7a776fcd9be93515debd9d6937ddb2decd3

SHA256
657c274c65fb5820a59255ae393cd197c04da46ecfe8efdc29e04fa417f75249

SHA512
33da2f900a2036e0ac6dda887fd328000f225008f7910b9ff4f4f0ba92d3843eeeb0d95c8310670278c34ca58ff33c0721b6816296a914ba698b5515d413a179

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Filesize
880B

MD5
e961caf0d86d5a4f3eeefae29160ea71

SHA1
8e9741b801e5aea8fe2af244ba10ed683fed227f

SHA256
54c9e26ad133eedeb3fe74cbbe39838a503621b6811ef65dfd08996e80b6f2ac

SHA512
b333272c6812caddc1c4abea8f2330a6c2b9bd6f8bc106b24e8a4b95af9798e3e4c046c7fed7a4330545e1170d98696afa2bde6e91f8d78fd612dcfa5e78fa72

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Filesize
848B

MD5
54e2b77b4ba557a906b43a92ad086949

SHA1
eda642c83d38d805635293812055817ebded42f7

SHA256
ac665978994367c3793099475e549d4a23c90e5c0c2cfdae23fe20c26fe906fd

SHA512
6adb89ba76572bc48154ad59c746258ee0ccae98715232e7c5334aee9c90040a067f52306145c8867dfc3bdf18e75f1d6f9d040ae0902b98845178d740fa44bf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Filesize
864B

MD5
7e0102b18c1f5a1585a17ac376b5fb2b

SHA1
4b7a2c99685f5041d39daec435073cfd36211b7e

SHA256
3e84481c730146bd4fa67cb4cde94324be344ae4fc2184263632d6df0de2c05c

SHA512
9e74961a5a34c69455332bbf0043a3e083841616b90a37f56c51f58eb09018cb8bcab50e7b36cb5c44bf096e845cb758d53377f49a9917a7edbe0ec7cfea6906

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Filesize
864B

MD5
c29567d924bee4c7359d739378516fd6

SHA1
90010da529c398bb038ebea902026193de55720f

SHA256
0a9a172c7197e0b5b8840692ec6bb2b55b04a26db3cf33a546f22443ef3a0d7d

SHA512
be2c81f02f969cbe023e4e095fd136b21fd129cdc1a5a432d853c4a262b9ab587a3083f3496b4269ffa6a0ee271c4cbedb30057fff729cd9704aac52b99e6064

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Filesize
864B

MD5
a5ff08ba5944d1c015e040c9bb4e692c

SHA1
51d2153b7a3c5c3795e9f1ac3692adfea6fa8f14

SHA256
639cefd5518f91fe3c246027a960edba6cfce248b5628535a7afce3254c8a412

SHA512
ad565613a831e30ffe77ad9f0d13f34deac5b3fde04126caf303e7738fad39aec16d8a0025ccfdb37d538e7081715398486e68141444b4963017a1508e8b0de0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Filesize
896B

MD5
966cef0fcb6d51a5ad4d48fbda842442

SHA1
3cf269072b2f7e67d915b9fe0ea7b09046f94309

SHA256
a83a4d56db3e61b0420bfcb76d9e2cfe32d80430d7f6e30354800a19732fc8f9

SHA512
0b4ea392ff650fe91046f27af0e7a665439e628601fa0cbe9c12645102aef58e08d61a53139568041ad32b647df41de792bd3383ceca8b4cf0a25ddd6cfea294

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml
Filesize
247KB

MD5
4056e9d7bfa31c7e2002adc8cd930600

SHA1
a63075d12c54b979339dc5475d14566bef868a51

SHA256
e9b2edd53c6e1a57858e0061b8157e9fc13ed179ebf82f6fbd943827d35c2310

SHA512
00bc3cc2032d7b13ad60a672e4b8d8d29e75281891b63a1c14d6c871a53442e1a40d8a0b7adc300bd21b0fef40b00e93aaefb034b5128e82f082addfe154c7f4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
Filesize
160B

MD5
bda067840fa0b1924b57ffb14731229b

SHA1
de5b8290bf49051f9a25d7328104acd00b5068da

SHA256
a63d2b7181abcf21803a1cf7b94fff0e03755cdce4200d974884f329536b5704

SHA512
02916a6247123c3065b488cbb81109c87bba6073460001353334d797a2712fe1cf06ef0cee88902ca83a324867ede0785e1d59588343958a64c677abb8e5d978

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize
12KB

MD5
f3bd4289cfb2b5892fc66991694f970a

SHA1
7c02d5899ed760ccb302c2ac351db1c600e6fad1

SHA256
2b40768b2eefceca29faeac5c999f36aa94499541a9a0c5a52afd97e43d4ce24

SHA512
5396c1f9861b0181a720cf1534bd67053dc361316493578a3dcffaabf014cbf9c301e3d47d33ebd622029ebd1789e9e780dd73415b8b504a14b215cf7b09a7a5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize
8KB

MD5
6056533322cfa5771a3a372c65073e0f

SHA1
4445a2ddecb69e2b215629e150427cf43e7cb8e4

SHA256
39dd3f8014163a48c42671f6662cbe37aadfd78bef9dd67d22912609d448b6df

SHA512
5220c67e7daf731d9d936f678b4bfbfe28fcab18fba69cffe044cfbfc4fd0270f8c2c16ad8a0490467381fc979a25b4821d922a3987543e4aefdd1044a799fa9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize
11KB

MD5
5e32287a7f1d57a65cf8ecbc0ee3abfe

SHA1
51f2e0c4481e3b304afe08b710771cfd0a346fa5

SHA256
b6326705eecb473a398a4522a31a0ad30ff179558813e3645c21a184f973fa0a

SHA512
9c1218f14d70d60994e338da8b41ba6825b94309135a66e04ea88671737d93d6bd041829c928af95c98ec171b34c8863e8d5fa86d3303b4d934070caac01d574

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
109KB

MD5
df015c565f259531256798c81dc46269

SHA1
f85406047f1dea6f51b7294f40cf04e218e0b4d1

SHA256
6f3f06d99f96ab8d7dae6df16e0fdebd978ca4e77a96cec623425d384483f210

SHA512
3b4ad55d3e85c44a918f722591cc3c250fce1149e9ffb398f3c7c645974debcfbc6070e5c642d91e9f9aca9e89ab288b7362e8144c0e5816a22d95067c0122e6

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Filesize
172KB

MD5
4c2c63296878048a8f9bda10516b69b0

SHA1
dacedb46eae0363652b07371f8f75143b6547308

SHA256
9a2e78053a12077bb7d48d5a8cbb007389d5a2e845a295a8e5fb89ea0390e572

SHA512
bd722331420991b9c3808da6f7fcff31b365fc07c2b1234646634097ddcd493943ce9f9986f0641f7723dd4fb109490c4f2d2591e78d1a06ce8871b215a77c86

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001
Filesize
16B

MD5
38360b56dbca987a64dbf731ab33b015

SHA1
03368b32397d8facfe71cd5d335347041922e797

SHA256
6477c16ad139e8c0cce8c860f1a526318a17e1ac0165de0ad0a4c5a208dfbbbb

SHA512
15e596d01a96adf91c0adb0b375dc0188a377629aca7bb49cd9c0871bcfb16994a201ab18064d9def8fb7e48945bf42d73143cf0de9d91974128c5e9f5b923f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20231129_171222707.html
Filesize
1.1MB

MD5
5929b4fd73d1f964351f7a40dd798e45

SHA1
f17fd4523ef06bec8eb98684f97222b7f1c1539c

SHA256
97529d17d10720a1109631582726cecc1b4d7e4d273bc97fa27b5cb643aa86bd

SHA512
7ccb930d5b2af07739e3e5fac7d642fa52c84ec4250f325fb3470cd77da2304cfab64d0e85a34ca6dc0d5ce2af7cfb95119018124310866ef912bb2cf0f1e05f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif
Filesize
64B

MD5
846ee45862c3fea0e4798288a425e1a3

SHA1
acc3b73e67f9f62d4b491ea57c746f8991d283f0

SHA256
e55c966769ac62d23393375c1b4ceb85e76c79ec96e63131205cc9af94df976f

SHA512
60639adc087df7de738da752fe98ed3edbc21f47278ce98aceb59cbf1af86ff2cc73b3a369387fa9659b13fa0df90af6768943f37153efdbec2b2d6d1b2b6cc9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize
80B

MD5
7b94bfe63d083cd0b0e60683a745cc63

SHA1
0d83773d438ecee42a3d2f4c5562ceb74e2e7ba7

SHA256
8c7aa06a730d12eaf2ce602cf3e4a54708e0d344f14d2f34e45dec4b9338be43

SHA512
2cfc85df6b705b388650ae707a0df99641fb9632427b69040f00d2e84ee3ad7cae19bcdf08676b912c24b14196096e926c387224e96c51a30587f5a2428aa1e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize
80B

MD5
db038a09a90e47e8d7c0be05099cce26

SHA1
600a2f2ac258717442c02aaf2d1c7c236267a3c7

SHA256
cf7517f1b03077cc27e59b28eca00db8c8979fbee77cde2e3aac04ed0e7b965b

SHA512
8fb1ca26707351e683743cf9e0ae5a0b0f7ed1e40b74e3f85470ebf348b7266384fc2892a035ec0ca6645549d62ea9fdb11ecd87cd765ac08261cbcb1d996e4d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx
Filesize
6KB

MD5
f1976db5e8b5cab775e2597f6140f50f

SHA1
bec88514761acb33f7493b0babf4063261d20f74

SHA256
a4654cc8848b2e5b297d673f6808791113cff0a68f57074e58132cbeed5d8161

SHA512
1d3b36005c804368b22fcdb5d4563c8496f11b5edad20ea189f298ccc2b8d8f33014692f5ab65a1ebd187fe006b9e3fed924c74fe8460313b69f6c817738ccd0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx
Filesize
13KB

MD5
bfe0a2e560f17615417341645e37fec5

SHA1
e01556b4308741ab2a8bfe3bfac31b81ba5fe8f9

SHA256
24f2c0ef9ea344adca98e7e7a4f06462163ff90575de433a69ce2476aa73b2be

SHA512
b6eeacb7c748d27fc0d15c93d36e7d2c112791a2ccc82c99064b2ff8adbbb0ab882b1879870c35ead44cc90c53330b3bb6c43feb41d86adda6add14e802b5e8e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx
Filesize
3KB

MD5
6f8f3dfca98eabe6f6bff5b78356db7e

SHA1
48e2a9bbc00c8ae57f9c70b5cd580c814e556c25

SHA256
327ea52ed302280af470345175ea5f55a0a8381008b30832e144c83de9660d79

SHA512
28031411727c5072281cadc29b8e995703f0f42c36deabe5ccff368fffd094ffccf271d215d5a323b602f1153538bab56a5337e7268369d488ed94a72eef43b5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx
Filesize
6KB

MD5
bdb249377c13c16d0da071c4f85de221

SHA1
7df3c708fbdb3804dff6aa7cade7ac53d2f80446

SHA256
112c16fba7e56a39ccbb70861d3f73fc35c4e1e9c662e5581207f174b8f5752f

SHA512
cfee3f305d9521d3dbd42322b761f3365f54712128fa937c248da9e0338d2f07cae2841d098ed7f09eea7c84334b97dfaeb3f19793851fe9ab102171e6ce9d91

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx
Filesize
10KB

MD5
8de89f51d8028cd9ca8d88f1125f3763

SHA1
1f6be5dfb0b2b6c64ec74972d730614bb1cf174d

SHA256
abdc49c4822c7262d6869f726262e1c9d66f1470fca3004a3ac4c87ff0c82b7f

SHA512
d1d69791dc41773a416d3c051fa157ed81b193b3b7d89471b68324a82016c69dc78acae42929168e7b2da48b765909fbb74e738fa6516fd8c69bff63ec4d00d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx
Filesize
68KB

MD5
882d29e2a244812f631bcb8abf283528

SHA1
3c9e8fee4737ed6c4207ff64995691fcda8e2a0b

SHA256
2f7bf384e09411498dc241af7e8ba24b0339c6cca391956c678d042cecca489a

SHA512
718214a70a1192f2bb179a3a67f1821f42b50727b137b8e2a3c2e759d68e5d9e83187441eaed85d77e8f5d35526426bfa3ebbecd5d9690695f1a798d149b5405

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql
Filesize
24KB

MD5
7d427a65a168ace7d2f00ad9ec22bf16

SHA1
091075f4a84fa50af94f6919c448eda376e182da

SHA256
56e973cc0cd54daaf231b76ed6a9abe06d80af5e8f96f507f02395930cf90ab8

SHA512
4fb8b9be08cd6e4c35f15cc117668ecfa105e99a384ebacdfee752961e87dc2301e70274658f0f4dc98bae331fa522a400e6993cad9392ac77164e1bb9b7a602

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql
Filesize
54KB

MD5
57a4795c3e5a2310f6c7cd31091d9701

SHA1
a44f2b13884711a32ff115c8df72fde1c598579e

SHA256
ce2d9e0855b5d7e8410189fb184bcc8fd1266dabbeca45bd15478c445ccb456f

SHA512
8cd330a5da24fc1946327e161b9512f677dc8299d15d86c349e74b57d84b9a388d57c50be8504f92630ea3254afa2b8196c8c0f0410e0295e127a2636a869616

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql
Filesize
51KB

MD5
069f95132dcd6439fbd2d2f21b06793b

SHA1
3da7fdb5d3aa6f90540ba6621e865d71de3eb09b

SHA256
96e2918be4701df1b04bbe3e486eb5815428f36910f23b7464e624897fa0bfa4

SHA512
e4b814457dcef949473fe58e093fadddbcf27780f61b126d7dc5bdb2e04121f3b1ae8ee85c2b110e265631d9d27e5622f2bce6ebfef9ad1af1d3fccd6d096e3e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql
Filesize
34KB

MD5
651f86f321c1be54c8861d93187dafcf

SHA1
faeeea59c5a5afdb32e9136af11caeb4a112fdc9

SHA256
698722c7357e9a8ee486fa27b3169cebd0c3116711b4beacff0463725b802abb

SHA512
9ecf1dacb006f8e0bf466c8f894e7930f8ef57274fe4718c3fd2518c129a036580fba47edb5ff81c63d368cfe68e0ca2dea2c2a581c398f233f5934f211c43a1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql
Filesize
33KB

MD5
0eaeb3d01adedb04c86fea7b86f23b6c

SHA1
c7064cfcdb040beb131f2e4ae0cf5028927351f5

SHA256
1639c94adb3d1e39e7ac13473eec0719686d910e1b9c408d99b2eb23097da31c

SHA512
bbb1f56edcd3e5bacc52111d82988b077fd45ddb148d00b2e0501d716ead7113d8e223bec144d43f62a2a09ef1520f0f8cbc58600a1b17b26b8bb2251d4dc530

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql
Filesize
50KB

MD5
f5c7bf5f2e3e0b4e99ca034fee577907

SHA1
4d022f4bf5c9beee727ff2950a8f9671c80a1f20

SHA256
3b62634541ee9dff5550f35bbe6af3ae20f70e2229cbbeb569a148cfdfdc1096

SHA512
e4bf0f2a2d0462d16f14e0b0fa7991961cda734eaa63469b0922ead5113176c0d1c348607b0d4c44316b11adc0efa6b2c5405f89447c42c744f288c8ff1919a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql
Filesize
52KB

MD5
ced440e356ce6ce07b0beeebeb994806

SHA1
efa5f2c3a070d103d2898c0dfd2e074eb68f7e22

SHA256
67493ed69446ab475976a4965081c08de1b219cbafd39495db83ce32af377542

SHA512
614c2310f350b6219c15bbab2d81ba598971ca9f8543d4ae664c718151a4803a531797af3e042b1de9a4eba251fb7ca09705e301386122a0196cffdb938bca90

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql
Filesize
6KB

MD5
f68d38858754685cb550df828a0fb405

SHA1
e7fde6b034359ad85f9df4f252d16ceab60d09c7

SHA256
2c90049c0fee215c1ac78053e5b1588ca3675d3ebfd93a571fd312b7bd2d1b12

SHA512
b545522fb3d7b553e2ffca89af84f02b0e6680900de487a16c85e929952f5212c135af19d7d8fb3ce0ce3230d04e5c97f80f85ce127ec8784b126f630def27d5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql
Filesize
3KB

MD5
fa37d0780d4e8b87a2968e1b71ed64eb

SHA1
88800fae0bd1b885738d098c3af17555c20e88df

SHA256
404303ccdb73755a58e3d080c57c65257d2debdff685a3e6bc6cccae64068335

SHA512
31d364cf91dad22b7018f19a90b6013d65d2c38caf41573e5466abe0e366ce39e7b87896c171d2bc1aedd59de2185e3ed5b0731c9aac61c86d3890b00db63451

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql
Filesize
6KB

MD5
900a24f1d87cc98902082fbcb00d3786

SHA1
696dd3179ab6a3561f81b6fd21a60bc8eeb5688b

SHA256
3ebf090c5dd708ee67a1b2b8f2d49b70b4ad4b3697ff0a045fef388f86fadf62

SHA512
42bd50a6f5b28057b93f573a9ecda73b125fb27a0894aff285535f34a2da3b4fd91e74b189be6cb348a3b6d69265a797520c0927674d3dd847ab62cc79cf195d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql
Filesize
9KB

MD5
a20bd3fdd5a69f67129fa4120600b376

SHA1
9acc3d292adce404cb66df004d818d9db9303bb6

SHA256
1fc732839adcc3bbd41cf55fda7b13f981a72c71f7396b26e0030905753351f2

SHA512
0dd43b6f614555119aa5622e884a12d67e796e6072ef7047b44a8b160d9132688ec572b3ab15f09ff92bc303cce1fef999e3075c8b921419024bc12958040a40

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql
Filesize
7KB

MD5
a1cee7d8436eaeeb9d0485969c48b3be

SHA1
2549823d3836217e257a83ed426797ea301fc3c1

SHA256
cecde64e933d035655d139489c293881c87ddc3de8323d6a25609befd970b0b7

SHA512
ecc90a3f0c85de4638dd2a6d1f03ca26ffce0f6b9993303947d2974f2cfc247fd3b0dc65cf71f1aeb89dc843b78869a0167bb3fb55d2954bbc215ef73d522693

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql
Filesize
5KB

MD5
3c539f760c4e9189a30401bc4960d452

SHA1
da7c50c247b4273b4c39b00bffe6f7fc0afe58a4

SHA256
3ad06abb62d41e949243b49258440adda831bc713cc9886ffd49d98202ba095f

SHA512
59d92587710ebd994eb9d02c35450e65c266d3f966641b450e959f49ff9a2bdd27e608299b43042b4f2e85b70b1859ae99586bfb6f2dff6fcae6d78735fa0109

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql
Filesize
9KB

MD5
2198c6b17252cce6fd1b90b8d1aef3d7

SHA1
0c79192904a2b6fe1870a2d983701a7e167dea18

SHA256
b5faf5bcda67b130cb33bea99e70faa0dd9029405771b1aebd300414c09fc892

SHA512
e3587083d4ef6361955614c1dbc934f7164cf02f8c9671d583e4151adc0d45116f0431efa79057874dba05d54b1a2e3f43aee09cd24abc6138f4a42fd7921316

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql
Filesize
11KB

MD5
1ffc5c5ab7830f4c73932f0d3ec233ca

SHA1
40f8ea56910dee6ebe643705dca433b4814b6250

SHA256
0e8b54c6eface82176996ec30ad94a5dafeb97eaa6f102735e89129c5bd9e83d

SHA512
717b70e11359fa904eb4415e8253d290bc52f43d9ef0b80eec95217cd0387bcd37c6a5545b0a495940cf4f9fd6a618bf604dcbf3b5f42271a9cb08166eb9f6d7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql
Filesize
2KB

MD5
4f619507242ce5c340fd56deeedcdeb3

SHA1
8387fa3ca2520ce4e994c553017a36ced69c88cb

SHA256
ca122a24463e39433a23ab33a1d41abd54dbdd59da5b6bc9db27fb496fed4f8e

SHA512
e50fd5f90766cf3dccb87ae92faffe2057db3f12988a12ff64bb49b0bea7c9935f27e18f3bcfcbd948426af7a9d562c380e783412e932b4c495e5c423f1735d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx
Filesize
3KB

MD5
a12787012133ed533b4762f8c525c102

SHA1
3317ce0827bddf3f57be5a144829ac6c2e7c425d

SHA256
85d1001e11bb5af24dcf2df342a040d886659f7f37d728cf6c14f5a2443c8692

SHA512
b09092456fbe971a2be01782b6c7d06b868957cb119654cdfc0357117f654e0c9eebdce0d7b4a8af16ea188b1bfad8d85826135588e4c33ca18cdd0a3d8c7784

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx
Filesize
2KB

MD5
bc8b23e024b955988ec58037ddf0827c

SHA1
f02c16fb34eabd5668a937d081b078bef1d2e4d3

SHA256
4bf01e748fb8a60f5d5814d303d2dee926e3288f2383056cc23a80c6f3197fa9

SHA512
f85f60508fb17167e3627ab769473e980ab0ccbf37869690e12923869cc69558ed4bd2306f4087985cf301100fdeb2337854f109526d6658287d9dcf65fb0cf1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx
Filesize
14KB

MD5
538120082b740c8a7cc194236cd6dd1f

SHA1
ffa84a159e52375900efd4c0219868c87925ff9e

SHA256
1d7abaf6f7791c3b86c734fbfd089ba6cd6a2aa99d2baf665d24322a4d5873af

SHA512
8e23516fe38a4a22b0ee43220857cb6abf43a1e749ff1d8b0667bc6ad971989bf9b2059a6c50c67981188ad1a46ae6df568bd053dbc746237ab6ec3b31e23185

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml
Filesize
320B

MD5
4575ca295316c56538e2af52a2a55506

SHA1
aea5a808e11854063772e94bbf130a882c484436

SHA256
ef98298ee6ff14af173a54e982b3b204937e9a4e73a16d06242c83d8fa552dca

SHA512
4edad5db6fa5944b578e87275befb19fc58dc9482637d7916181bdb5439598b452eaec2f9a0f03043cc822262894c5d5a8fa995c4531f8d5913d863d51ebf3e0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Filesize
21KB

MD5
7aa1d4a838ac7ce000db47e88acf6809

SHA1
caa584379b3cb995034fb09fd3d0bbd1410f284c

SHA256
0fde0b17d1ac7492d59e20d4c11990aa5fab82a80e26ea5f81978a0e14d4fe5c

SHA512
0ab36b4b3d5bcaa68f2b102798b1d6e089e3952533557d35080837c1158b54fe886be9ba712cba2db2ad767c6b42047e059befc7becce0d60e9408a54602a18d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Filesize
1KB

MD5
f8af5c7a5cda160d82842e4e484140fb

SHA1
fb10c77bc534cfc7c08a71eca0a707ada777afa8

SHA256
1f57be029fa81833b80b5f87a2917ed3d3262e66977add2a80a58dd8edbd8caf

SHA512
842ef9a5f8ace88178f3eb4de643041d212d1e473a0ee5053e0751278df84578c23a352d97a30dde7f0f9bf89049ab8ec60b5bb248367d0268c8653d675b9086

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Filesize
960B

MD5
c11905f517b104a9f0b04a67b10f489a

SHA1
f778c90ae4b5570b2ce631adf62f5d0f86401684

SHA256
9cfd32bdc468b3823dc82ff6b60d6fb8c63047d74bfffbefdd5bc17c30137b06

SHA512
5595bf684602d85a7f2dd7b06e2157d072ce70d857822cb84c728cea9e054ee2cf54c09ea2e7e2ac74c95a8f573c535ff9894c584bd5f2fb22e2e3451710cac1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif
Filesize
128B

MD5
a49ccafb2624de53ae18182fe2123769

SHA1
1f0c8ef01ed6e57ad9e124ca3433bae9450db243

SHA256
d0a9480180e5185f87450bf83f2b9cbda477b75b10b32932b2eb6ee5f9bb6864

SHA512
17cf08d8ac86559c329f9de50650a9c811702e0f5727fcdcc8249fdfeca8e5de423d0c69575770474496243737ea21afe74f2d4201d8464a39b4a35d4afeb5d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Filesize
1KB

MD5
1296c3589faf37652e999563ac413da1

SHA1
96179a34adf87ef2cba6ba702a52ef52a298d9a5

SHA256
d6bbb8170a3b9119f0ac50aab69a89be2f77e7de6d11fd341188508e4ca4f835

SHA512
c956e68d961cc5a3c154a046fc9c704160c3c69a7ffaac755950e9f107ad3c53c0800d0d5ee2d44eabaa2d969a9be1497392386fc625bbc7387ff32edfc02aed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Filesize
8KB

MD5
55ab3c56b8f2b194d93a9a922ad6be37

SHA1
a6a0e19582ac6e59f1d79821a1fad721d414c258

SHA256
a7f9a44a226b7182ab89319aae884f10bc8c1d76618e8974b8c2fbdf35e8d874

SHA512
eb9822976bc376404f9adc01c9760b58ced8f7f7b71c1f049ae35a30a40c48f44964dc4a71767b2bebfa3ca600f098ccb2453a0b2d5b0f542201bb8744d1a3cb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Filesize
64B

MD5
94150d9e14ad073f035720b77b23e9ea

SHA1
8115b2eefd825f5029bd8c4353454e55b19fa5a6

SHA256
474af06e21b410aec28b978aad732b88e0a8fa62d87da3abc022eda39b8be741

SHA512
1665256c2742175a4a8c99b71740fb4112d010e00486e496c08f0f7c7582c297c9d28efd5daa9d528449bf9af218dc13c08204e403dd07e6a3611a5a6fbce09a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif
Filesize
928B

MD5
32df2e41e83e712bcf3e8bd37b4e86a8

SHA1
5f0346bfb82d0a0b166e98f01c24d5f886a68912

SHA256
5775ddc69b8279804d8459037ecdc46c8e31d6393958f130b07376324fda5f72

SHA512
8db97abfee8efa80583fd577027f6436a883e84c50359c31676a55e760a67e8bb6bf9eb8424774bb5e94cf68ae0b778bc5b18ad8a70a60b9106ed83eac31fac8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Filesize
96B

MD5
3d82a62c5fa192c5ffbb5611fc33af0f

SHA1
1c11f2e6a83fc81366293b269423da033494df15

SHA256
9ed3465210a4b25a39ac1a899ac7a73e741db1cbcda8a1c88a5c61f94e9d499a

SHA512
8b780cc6f8552d2c9bb222dda85c22cac5de5c3a404234555af4404b65ebb07c823f11d80ebdc99aef7249e624d91b9d90a4fa4ccd9d2a2653a35eb20b465297

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Filesize
96B

MD5
d736a0e48f69617e226b7a44bc956862

SHA1
605673cb8c1b8d340cc2d40a03c4f1f89b785b2e

SHA256
6a31bbd9a4bfe41e4871d1fe91d5308eea215fffc9d7e74d61341cc96d8b3ce1

SHA512
8bdb1073c000ad1e22ad77bb8b23c484ae61816056f1d036569ff4e635a3f05732501383a096d5a33d48c278b6ea04d38d857b897fb6175ff0c7abf2dc871dcd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Filesize
336B

MD5
72fb6a06e4dbbb6a2b15859502039d51

SHA1
305d92ab42aec61b914de245155bbe95cfddc671

SHA256
f1d9b68edea78bb1889df4df62d5aba1ec77452664d91facf95134bbb3b7a096

SHA512
6dbb9dbe04a9abb6575bd39e01928108904fb6fa554946107338cb2aa748b97baa290bbad242b82672b0ce2cd3d587ab9d13ac81738300cffdcf59fa8eeab543

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
Filesize
1KB

MD5
4c125c04604275da3bf6a594ba1db90a

SHA1
b406501ecc12070da1b01558deb48bff7c094264

SHA256
a6808df05c77472acdbd24b1f0ce5376e6dd33ed6dffd8817ab0b8a559b6ada0

SHA512
0652020be1a61a360e44c7c7f4d32dcb90cd81068e7429ba22519a9eed615cd353c8814a315815ebe4b33e7e912fa002ac1bc91e201a1f7fce721bb4a4319cc6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif
Filesize
176B

MD5
a59317595d484a79697c30ef56636af6

SHA1
f3b9bc2866eaa93c0e095b7b121258f9d1a5e1b6

SHA256
5860a1a6f103595e8393e784b3eb613740db65114c2ea17f73f791be08041269

SHA512
34545953d8204eecf9d25e87f4e52984b2207d39a154d39fba2bf4905249cf333a21a3a3873a76ec88c0b54f5e795beecff5fa4945f8e3fc200ad0523adabc29

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif
Filesize
592B

MD5
19c1c96e4c3d2e7eafbcc2074afbab84

SHA1
01dc8d76446317d81571c826a94f7773a0e719bc

SHA256
1ccb494f48361d60f3f664b6bf4bb7c8a80dd3375ef1ffe188d0b8d28b0aa774

SHA512
26ec7054962edbe2292555c5589aa4b3e82faaeadbfc9633076bab824ba02d0ea4e1df979a0ba1ad9f1a5883d49acb4d177505097ffc683dc65c028f311b691b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif
Filesize
128B

MD5
59e9df5dd267deaf917f7c12a1287b23

SHA1
3c65054c5c102b6f03d760768f182ebe91fb3f24

SHA256
287f864ee3caafe01bdf6573138332455789000aeafaa13668642d1470e78b60

SHA512
ee13555718edc39203c1c935a5f149252825cc769e55d2b0775bee45f3e410b7e5e81b2e9a461ba2c9878cf9c2039efb6ac7a7d3032e010169fc2ac7bfbe8362

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Filesize
8KB

MD5
6714aeef466294ff6b130c98f301bf28

SHA1
40da563adefd6c5eb81065a6c5052c1cb07d8212

SHA256
072c5717a1dd2cf7a7f5ded68ce59da2897f969ae4f62d4fdd97d5ef814b5bbe

SHA512
b1f259703ac444ebf229742156d057b24440cc3aea78dc4141ff81e9ef73d818fac504eebc48dacf38f0933b11f2d904d879accfb945e171b2778358525cafbc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Filesize
896B

MD5
3c60fe957ed47101efc76de1127dcafb

SHA1
d2b812f6098580ecefc300ca80d9db705a5ccf89

SHA256
0ba3449e0784c1f52f5130ac616046e9b18ba642ca79a9f787b48f940b033b16

SHA512
939525565a3e13dcb0f4378c4b73618a8deb5eb5e264665f0cc6f8515cc608102919a482099b34df27e174f39aa9203fe9df4423ea6aca85da71f1c3b7b60093

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx
Filesize
12KB

MD5
98ab79a252a9f1cb66bec7391c1c3c3b

SHA1
abdb8450b690085240f15eb2f83876dcd5ca06bd

SHA256
4236e22f2277ca6b566a4beb467c9647c920f664c30b6c410ba6262ab1d6d23b

SHA512
4d55ef735a1f0826a60eae9302f11df7b051fead54ac64bd9bdbd026f7a28689ac1fb813cfeda0788b3fab679d59b9e988c35ba0ba494458f612f69a6d2bd8b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx
Filesize
9KB

MD5
8f517c59efdd65eb334783f6582127b5

SHA1
0cebdf369012aab013a634b06480460402ad99cc

SHA256
c035dc1981b2c613dba07424198758fa2f0bc2fee2c1bd1c973412bcbce3471e

SHA512
639f9815b2d6a69acc094468cff5e8574a46af6377ba0d5dbe4298618f6657c94efc6325b85fcfa4c0f07c0a56c2b83f90eec2dbcba69d1c1a990c933e5aeae4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ProviderList.ascx
Filesize
9KB

MD5
cf0a159d7555d0173b27438173065506

SHA1
8fdf3668c05fe9c1fb6693f78be6d4899647c2ec

SHA256
c15ba4c13abc3d886167d7a29f72b53f006e90fc7ce5bc8f0490c092031724a7

SHA512
c026aa960198f1bdef2e1c4b1305583e3e68cf2742f0b2acfda40d3694e7c2cf04d44a28e9391569a8842c46625a6ce3218d06e0ac0356a17d5c5f170e8bcc0f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx
Filesize
2KB

MD5
5408d24761335f06fc1a0f2b9f0d7712

SHA1
b4f854548bf66db583e1164586760c6a1ece1f0a

SHA256
f72f535232a16b55a0f55270e60629d7128b0d9a0dc9cb916c0366b8994ed63e

SHA512
e6c804c036c35aa0a5c4f17d523cd1f37bb93567548f02b68a0ee6830d9277d1affe6e16d667aa11a81e02c643416528f1bde397dd93652c73c73474fdeebcfb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx
Filesize
10KB

MD5
ec8cab369813f4d9b3e1d2e3554dceb5

SHA1
e9964425964de853b552772f29c437e2eab650a4

SHA256
c85a7fa14250ffea06c0c71b09fd3719d20861ecd4cf029d22f46c73aeaffbc8

SHA512
32925f7cc4297c138ab57eb5256190b7d83c75cdb4e9269ac5ef8c44f58bc5ac09fdf0d4e0303ac67b4b7860e6acfad6e600caa9a330e25f91b94d88808cb538

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx
Filesize
21KB

MD5
c1c6735226e2da25722fed54d380903a

SHA1
1b7353960f3ac0d95ac6f722bcda32d312a1aacc

SHA256
922a21f0069e8b097b8974d9019f62308dee4666682542a631566ae2350b2b7c

SHA512
b818e889a8125ff14072f6d827712bdfe9bb096773f0387fd28552766dacc85515ccbf3e8169f4c810c846bd46159df39e5abd34494b3f31c92c4e4d8d92ba33

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\editUser.aspx
Filesize
11KB

MD5
3376d79f71b3666974d133990937d73c

SHA1
65b6595058eccac3b7ec1fbcee001f2acaa800e7

SHA256
84e7b00dd97cca7ec01d5546c9ccf99206d3c68a7bd10977ad6d139c4a6ab82e

SHA512
d8d7630ce0abdf7cc1bb60fdd831ce880b40abf1afef9c8105c87f4f69662d682f4f8223da1d36fada4df64d59da190426f227732e3a14395ecaf10e9f23586e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx
Filesize
10KB

MD5
6b38ca63af283763c70a0fc5c07f43a8

SHA1
8e8958a6f07876966a23a46549d89af076d37430

SHA256
54cd2ee852776c315a2ea6b6bf140957248ca56ab1ca9ea19232592b51b274a7

SHA512
17ae189224dc1c1db94831a124b0ebc482c611c1e52925810e389e025f9e2478e194e6c746d19fce568c45d6696730a23bd7d76428402c85b27942bab6311d89

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx
Filesize
2KB

MD5
2fdd817cbc53f3489575909d2a2f9103

SHA1
71b5de62975b81c9b8fdccc8382a13dbfe2d944b

SHA256
b4153c68b15ce54efd3c9cb7d391b83da4cb90dae83c5639c2f44234fb118ab7

SHA512
036ebd61043e651e42a1e6e259878b993c7ffd5ca2cf98fe6981c56e71fea3f6aed4515d7295d7f38d7f442009009dc131469cfbd7a73af38de11ea4f524fa6d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx
Filesize
7KB

MD5
12170e62ca514fb3ba563eae7bffd95a

SHA1
15d5ab5fbf354f95b5b5e479ea96bd377a97d70f

SHA256
b0d46cadd60d6e74251c2da12fec251ffe0ea8ba9f60cf3224e60b51d6ef7056

SHA512
16cb276d61778bdf65dbe3354f6ea356353fea6ccd831493b81d70618b0c64ea311abc6c961ac74612bcd076a44d7d01e7cad8ec2e5f02a3f223ff36973cb87d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx
Filesize
272B

MD5
db35ba141796142995dd75afd164a8fb

SHA1
6d21d78fcc281fde97e7630f05afe501a1d8e66f

SHA256
2e3fb565334965a199f072ef6ff3f000b506b856b8e5d40ee701346eb08d5adf

SHA512
16e8387b76344b89b5a06114f8cb3a82f625fb3ca1b77aadbd34540c988dbc28f8220b1636a2952ae2cd22bf3453718873f0d7bcd967f874e99bd9e15ce01019

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx
Filesize
496B

MD5
0fde271eb21ce4c64dfb63d66baee5f7

SHA1
1020135ddad97f9b5fa7523641e7ce3a264a0a63

SHA256
f6f176f90f1781f2bba8b4fdc68682095b2dc8d67eb7fdfb88773fb548b7cf56

SHA512
db0193ae6269c494d772a7d92bba83d4946498590290b2c3892d6f2e17efd5445aa28a2b2c64885f744b5ef4235993e0fcfb161b91e21459a4560fb225ed97b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx
Filesize
24KB

MD5
fc66e9e35961073a74ae1cfff9ea584c

SHA1
b880dfac223e70a520be6fc7f144e14b89b6353c

SHA256
e8bacba3b9322417db3bb14a226d0b728f8762c424f4a89482a28571b2ec5943

SHA512
869e7dde749fe82e46b95094b96b09bfc545edc84f133bb65c8dbd4543b51d3f1badbbc092d857008e97c7a34213001a95bfa471193bc8fad81b35fa1bbd1203

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx
Filesize
1KB

MD5
9785c3b9dea0a00b945d993f688a1127

SHA1
f4adfc001c7ebe5ca02b941dfd558f94ac5d8929

SHA256
7ae7e510bb0486ecd62aab4d79fa40c4e937aaf6b474020dd78a16bedf304432

SHA512
249495386e8919c960b67491384b9c916034fdccffe6d2df295d967b493fe16e76d68aa045d230afc925c5810eb9f4de2af58ead21993932eecd45c590476295

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security.aspx
Filesize
9KB

MD5
dacbcb9c99ba1a6bb9ca7f8a07e7bd9e

SHA1
d5bb455828b860b5d80f0454c838f525e85b076e

SHA256
ae675d2254b8abbb8eb6ee79dd92a53c5cd503be0bca2babc2939f1dcf6b4eac

SHA512
83aa170b6b08b0ea3b731eb94b2baf4acdea85b26410739a88ea5f83cb15ad81a8e4bf195ec864ec64c014ac328f98400627f48ca3cbd1961ed15f95f0b37af4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security0.aspx
Filesize
1KB

MD5
c05cb57a58316591c33dbc80df830aa5

SHA1
8b4b87acaf723152e5c02ae84acbbef4eee5989c

SHA256
0b2b49357dc810764362d7ddf842cc0fc0fc54639da9e3e90ccfceec8497a3ac

SHA512
b55318757a80eb90172bc9623aeb025bd3d260c2c04ff2707737c2a9300e7b7afc8271c69778eb59f3f58c53b4a4ad76a0a130b736b1748c224c60e069e5cf8a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx
Filesize
2KB

MD5
976c95f6dec9b3fe244d7bced3c46b1c

SHA1
68686fb885136771171ece1766f887f101750620

SHA256
db306872f4d0d8c525a374edcb3ecc0bfbaaccacca985d7aa4af4394eda75a7a

SHA512
b01290f327b74299e3b5a4f40ebe9fa07ab9a229e5450f527ba8036f040f6e40490946763ac75074a4887d81220a8cccbd43c54f158a4cd87ffde74402f670f2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\default.aspx
Filesize
4KB

MD5
f3a63024a7a036caed1fec5b93227e00

SHA1
e2c0705a1ab9b0de21d29a90a9ae2ed09d1497e1

SHA256
e75b927af5920a05ac6e0a4e10067f7bf75eab89d7998ddba42ae6e9239097f0

SHA512
459942ff28d9ee6212f1f992cd08a9571dc91ac952d3ad78337f74b97190870a15908bbd3aeb49534742e0f33f9ea5dd59558d1d565860c208abe58142bc1bb3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\error.aspx
Filesize
6KB

MD5
b9c7d97c597b1ead9b2f6718ba107942

SHA1
bb996ebe6584ac7e524ad1e35fd1c4c3e694e8e0

SHA256
decbd7e19e2df81ee9ecfe8ed048686f56af430c16f0ca8caf37d0bb0ee0c19c

SHA512
98c945d1325488081a53aa3a1743f4ea96414ae0e9b28f19142827e7082becd3790cb0b6b88376b5e6b3aba228aeab39c9b5b42f348f0edc23ca534d45753b19

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx
Filesize
1KB

MD5
3a126f44c109772947fb502354e21330

SHA1
b1628d07c27465b16a0c373deb587cb8303af30e

SHA256
c1a97f6a38cec8e78c046dbbd3f8094fcb7e73a6c18edf9e41b21bd0797d5d89

SHA512
8f56726915b5574ecd9da903272c6d5685b9baeeddf9b0066df26ae8c7cbc7fd3a23a9a2b9bbf0fd8b38100b266db208cec6c11122022b89474e367b51077bcf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home1.aspx
Filesize
752B

MD5
03ffff7dbae0b586e42f0ea973e67389

SHA1
bdf2f87bfed5c5e0d57fe30dc19425ea29a8a069

SHA256
c3b7f6eb38f520dd160c7794e50cadf0fed1719627de46233ae9b64630e7dbe5

SHA512
ac6a9cf9732bf9b4b99c342f528f809fa52aa07f9e51877024748431956f2b0d6e0e426177c05ba400a5861dd58ad6628cff6bbc3b51b1c960106ab713b8dba9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home2.aspx
Filesize
1KB

MD5
a1f3f2b49d6fcabf250fba00d93de982

SHA1
0fefef61aa9137648169c3c530abf11a12f74309

SHA256
d26319343241256bec937b566b4a93dcfdbadeff79f8e5d019d1711ed2227693

SHA512
a662c0b1aacc2f80320071354d55612fe60c0d17705778bbe7a568778e5928d8978b9cc99ae6320e9032c945331b8b61581a71dd3f40a47eeaa31acb36d4f757

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx
Filesize
8KB

MD5
c48188a3d41771089f239b2baec511a8

SHA1
b7ecc93ef6f57c49aed7996b11cb7ff047d421a7

SHA256
169638c793b7ef240549cda184ee039097dfad1d2e1d7adb13459a98daedf4a9

SHA512
c252861d324acfba8249a31ac041ffec3526a6473c3d1fecb7f7cd16e67b425492f81487c699b0f90d2387c6923503614d3581efd14d923a1e1579dabf10c928

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql
Filesize
23KB

MD5
bef04169880e1b078d8f906579bbc730

SHA1
641ac855774249fc8578a40a42815e2039bb7bd0

SHA256
a75b8c816ae40c28f595130fdbeffb7a73fd93ae3f1a098472f32673ebbc2623

SHA512
41f5658841da39258f0eb36578f8cd2f22201b33aa6f6484b5687ca5854e384b148deea431d02e50a1c5f8d718bf679e087a9da95167f1a2dbb4a9e3690e28cb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql
Filesize
4KB

MD5
eccf52615aadc637dd10e754b43b8df8

SHA1
2b16dde7a281bdfb247420b10557a648637fd068

SHA256
5c98d8743612695d6ec3c966ed4324031a6a4511aca84d1cff8c63472893da3c

SHA512
04e97195157adeedbdc3e486e0afa00c211fbf4a2737c37f8af13b5bad64e6b2e2353c540cf74383b5d7f730b16a6174cba65913efab7a0cea78208b835e2d46

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql
Filesize
372KB

MD5
6b48cda873ff8eced5827e4bbc09d3a4

SHA1
9a957b93b9fab4aaf7aea6a8d2bee4625a34619a

SHA256
ecc484237f48869756a0828516df70a76afb65b95aafe9bfb402297601f0ec76

SHA512
5cdb9ae2f824e8dd4082c7b7f2ddce19de0c04b27cc48fd3ce2c285af4679678fb730013b737061c6b8e4f9a0e9211480bb97e30b04d18bfce16a1cdcd479d43

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql
Filesize
49KB

MD5
48caa5c08bfa4ed35a1a561ca6086ecd

SHA1
5b56a56523a7b58c92c6801c03af24a2d54e2c78

SHA256
3e510e7f73f88b7dbcd222abddb718285b406ef8e58e4d23b0d27e9bbe8ad529

SHA512
6a83fce24db668368d656afcc17355862069d39e20616538123ff44a85a7a55d6718c7589e1fbf1546308fcb1c6d55e2653b78fdb2ba7b109f956ae58a653b62

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql
Filesize
2KB

MD5
1cef7fb4885f2b9fb5c99e56dafe9143

SHA1
f25ec09810b46dac453cb88187f698ffacd0dcb1

SHA256
2367faaecdfd868ab02fd8a4eebfd546c1c31b5c5a70ea346f8dc1cf66074f83

SHA512
2b03edfed4d64f04252ee070dddcf7dc04420106c52670a91c2ae43b1807c16f0bb10c10c7ef9c7250409d214c1c447d39a14eb40c3bc398a347dc6590b892f9

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
Filesize
13KB

MD5
6a18ab79adf3e78ffdeb14da0c6a437e

SHA1
ceae93a3e1f0ebd09e741aef745e2b3a79426c91

SHA256
1aa2d2133f87d9eca9aa8de339d8fedaaaa7588106bfff628b2a2e29289b21d9

SHA512
75a4445837d8b2f5b3c5cb5d0e23441a8fbe8ed360ec3ff3f68815a8ba070c229c6266de530da86b14038e9dd639fe3b1bdbd31beac0df7252aab1bfa8b54638

Download Submit
\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
memory/2344-1488-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2344-141-0x0000000001330000-0x000000000133C000-memory.dmp

Filesize
48KB

Download
memory/2344-142-0x000007FEF61B0000-0x000007FEF6B9C000-memory.dmp

Filesize
9.9MB

Download
memory/2344-143-0x00000000012B0000-0x0000000001330000-memory.dmp

Filesize
512KB

Download
memory/2344-1877-0x00000000012B0000-0x0000000001330000-memory.dmp

Filesize
512KB

Download
memory/2912-36-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-50-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-12-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-14-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-16-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-18-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-20-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-22-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-24-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-26-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-28-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-30-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-32-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-34-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-10-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-38-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-40-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-42-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-44-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-46-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-48-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-1-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-52-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-54-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-56-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-129-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2912-130-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/2912-58-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-60-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-62-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-64-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-66-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-68-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-8-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-6-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-5-0x0000000000880000-0x00000000008AB000-memory.dmp

Filesize
172KB

Download
memory/2912-4-0x0000000000880000-0x00000000008B2000-memory.dmp

Filesize
200KB

Download
memory/2912-3-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2912-2-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2912-0-0x0000000000850000-0x0000000000882000-memory.dmp

Filesize
200KB

Download
memory/2912-131-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-132-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2912-133-0x0000000004800000-0x0000000004840000-memory.dmp

Filesize
256KB

Download
memory/2912-134-0x0000000002040000-0x000000000204E000-memory.dmp

Filesize
56KB

Download