fantom | f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom discovery evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>P5ksL7B2+o1oeMC2yb2wnScJxObjq9jRVRdk2l5PZfRtSd9MQ4EPsNCIQrNy6h9IvT/Oc/RX8SqAjIvymd5LlY0wBZY41sWvKrwbrov2OlYti6McS59Mb311GUYvBojzuKU/up7xZzbyIa3ATPn/ZATBEbuW8Lp6aExYbdpobvILOtkXNhZQJHKIISMm4a2evkxQqzIoAgPW9RKo0oXo8QxyGlliLR1GSZdbdI4UkSHEdrnX4eIFXaqoJ9BSy1Hu8WwHvfDAJ+QZ5D3RO8jCHV9rICQvNRmHVgeAFRYfKhPhYkNX+857/4PEda/dojyzhpNn4Yr7gD+4cBSytsKXWw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (3039) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
1028	WindowsUpdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2872	Fantom.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_hash_tables.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\koc650X.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgcs.inf_amd64_neutral_aafcd45e4e890862\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseE\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WCN\it-IT\Add_a_device_or_computer_to_a_network_usb.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpd7500t.vdf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Special_Characters.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_properties.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Enterprise\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\hpb8500t.xml	Fantom.exe
File created	C:\Windows\SysWOW64\migration\WSMT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql40xx.inf_amd64_neutral_77a826e5c0a07842\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_neutral_269d7150439b3372\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\MUI\0411\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_If.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpk5400t.xml	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scopes.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_neutral_2ef24e9270d8b2a9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WCN\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\SmartCardSubsystem-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\Amd64\kyw7qur2.xml	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scopes.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-PerformanceCounterInfrastructure-DL\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\nb-NO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\Microsoft.PowerShell.ConsoleHost.dll-Help.xml	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Path_Syntax.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft.Windows.COM.ComPlus.Setup.DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pipelines.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasic\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_neutral_d225e15af1a594cd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky309.inf_amd64_ja-jp_afbb421e3dc1cb6b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\SchedSvc-DL.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00w.inf_amd64_neutral_d4c93bb2fbf75723\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\audiommecore-other-migration-replacement.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_script_blocks.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Enterprise\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMESC5\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\com\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_neutral_6cb3fb6811a3f83d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\com\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_join.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\System.Management.Automation.dll-Help.xml	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Networking-MPSSVC-Svc-DL.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpc4600t.vdf	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\currency.js	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\picturePuzzle.css	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler.xml	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\flyout.css	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.WW\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate.css	Fantom.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_dot.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg	Fantom.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\slideShow.css	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\RSSFeeds.css	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\es\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows NT\Accessories\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\1047x576black.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html	Fantom.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pt_BR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\localizedStrings.js	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_zh_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-j2se-1.3.2.jar	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\Microsoft.Office.InfoPath.xml	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif	Fantom.exe
File created	C:\Program Files (x86)\Common Files\System\MSMAPI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Premium.gif	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-queries.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg	Fantom.exe
File created	C:\Program Files (x86)\Uninstall Information\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Common Files\System\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\9469491f37d9c35b596968b206615309\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0416\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0019\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management.Resources\1.0.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Abstractions.resources\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Workd8194f73#\3a72bcdeaedff46fde259a6cefb7062d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp2.jpg	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Encoding\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\ff7aa68fbf75e4b7ca80813225c3db01\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\DebugAndTrace.aspx	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Workflow.Com#\20e46d1d15a9eaee80b1d16dafef4017\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\ESENT\0409\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Quirky\Windows Pop-up Blocked.wav	Fantom.exe
File created	C:\Windows\addins\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.Entity.D#\86fd874752b7cca432941e9f482c3590\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg	Fantom.exe
File created	C:\Windows\PLA\Reports\es-ES\Report.System.Network.xml	Fantom.exe
File created	C:\Windows\diagnostics\index\AudioPlaybackDiagnostic.xml	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\9d5e83b9d71682d12ac040f8f933b44a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Net\d567624f1206028ff852c689416d6b58\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Te3736ca4#\9312b7591cfb35c1c4b3e6d497c0489e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ehome\en-US\epgtos.txt	Fantom.exe
File created	C:\Windows\inf\BITS\0409\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Activities.Presentation\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.Diagnostics\14.0.0.0__71e9bce111e9429c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\system.identitymodel.selectors.resources\3.0.0.0_ja_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.Http\c2a702d703816f85cc229d96cb1b0c5f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Branding\Basebrd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\system\Device\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\ESENT\0C0A\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\PFRO.log	Fantom.exe
File created	C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1041\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\ServiceModelOperation 3.0.0.0\0000\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Boot\EFI\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.FileSystem.Watcher\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_es_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.9c7998a9#\ab42fe6c2d968bf5eef442b19382be06\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_fr_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Sonata\Windows Hardware Fail.wav	Fantom.exe
File created	C:\Windows\PLA\Rules\Rules.System.Summary.xml	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\Windows Workflow Foundation 3.0.0.0\0410\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\de\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ShellNew\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ehome\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\index\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\000A\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2872	Fantom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	Fantom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1028	2872	Fantom.exe	30
PID 2872 wrote to memory of 1028	2872	Fantom.exe	30
PID 2872 wrote to memory of 1028	2872	Fantom.exe	30
PID 2872 wrote to memory of 1028	2872	Fantom.exe	30

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
3a7a2c5a3b94f8bafb9b86d4e1ef241c

SHA1
5fd504a96381c3c04b7739fef84a4809c44eeac0

SHA256
71fbae8263d3fc8fb402fd81f7c342399d0d68899ed570499de9870ac57b94b5

SHA512
c1bdba6619fedbb7b2e25b26f6e3fc6a4cb7414588750f6ff59928da7c635e2f1af1e0e27aa2b60bf0a4f817ab758720acc8f4541deb16573ecbf339f1bfbf2c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
352B

MD5
7a677cf6c0e905a4b22624d00d99b676

SHA1
c41132a9b49e05318977efd1baea9c11196ddb9e

SHA256
8719ab3c9eddf6756f52453957a0a5ca0f41f9ce0aa65dec8df120ea0aa8ae31

SHA512
1404c3a4b1587ccf6987bb4273e52fe3c6642666e81c087a3d0530bc596751b7d949c89a047070a8dcf52483a776c782cc3bc093d279522b3830da0095d60b14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
224B

MD5
a87d62f68feffc4c305748990c062de5

SHA1
f040206262d5b02a729a52e27142fa9a5f4d7268

SHA256
7f2a7d74993022b0c4692523aa2a7e449fa77637951b8be352db4e22d0809bd6

SHA512
fc8c1000e7f885d85402edb5bf4257fccb1051993f115df02dbbecd155ce0f922dfc245fd0914bbb7e1ce78ec979a24712db860589c5009a029c6669d3ec0645

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
195bf91cb8feac3f628c3c672b2882d2

SHA1
29188603e4f39ffb9d72e05286df148c6dac69c5

SHA256
255e19576bd54d334b1d761fa56f8f3be959e7f28785bcc927f215aa667080c3

SHA512
bd0c412d78df74c233d650949e82230d7c7418b2a2a126914d90810652d74b78c839874e7c0c7bf65385bea9e1f6a197700d976305d4c08b7e2002aa16cf692c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
abe0041d7d5fbf7ad9e3b746ae579b29

SHA1
c3fa345a153fa9e1d948eeb8ba69cd90609e6987

SHA256
b0267baa634d7ef3bf21a65fbb9c1a863f1f915baa956ca36428e8f9ce0d2d22

SHA512
76d710af498b66d79c4048729e6ef8a3dac519416814fc5aaafd4378400426332f551a3b1023dabd604dc10e4803cb14fc53b30e8184837adb580f548b749b7d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
7fc178c221b750f694ff12a8744f932b

SHA1
967241799386a28e613bacf39c5f49c25024a6fb

SHA256
85a9d5fa99cb779e3171e5feaa906480a95e45ce92ec3dfd76aca8ae42d685dd

SHA512
be858709fb7a0047179d359e029716b0661a46645482e643146bbc1acbf15474618d626f62b4a29b806baa9a896f9ce62e691b65ce1479c6eca776cccc1f07d6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
e692b8d18e54ea0258ea367a65ef3ad5

SHA1
05213b2923b151e5b63e11e4b05a346ada15121b

SHA256
2a78b47e11a7e89fb40447e19a3bec0fcb9e00f9ba256b22053144f19b680c67

SHA512
47d34c8888e3f20896731a239f90a47ec589fbf71bdf674ad1eafe23efb9669ca3efa54d3ea799b9a3712c11f841725eac7e23c5fe3ebab2834167f0c8f4a27c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
112B

MD5
ece1460ffef66b37050051404493dd46

SHA1
8a8f9ab5cffb57a35ab0fa233aa38959b00baefd

SHA256
2510ed43c98fee31cc59d6f6843ae2a59f05e409e423fd26657bc796ac9c0e16

SHA512
2eb0ee2aa44ecb9e254ccfe9f3010b1c315539a034ed011d178b4c7091043a6e6cda50fe06d10c0f6344f5e37deff6ee4b7d32eb3f04fe38e5f537a44a7344b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
371269f09de348c339caaae7ba5e8427

SHA1
fdf2428d3f59e9dc31066a66126524cc6077cb3d

SHA256
d77fd8a1d94e35a5f9e34a39b29e7e6188838af4d23526d7b928236e92dd228c

SHA512
a1a28eb8cf074062018b2a4c4de9661de481d8b77b01839dbf18e2e0a65dedda48d5731069af902ef4f9a713919e8d4aaeb6fb50219b88894eaf2d79d16e01ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
381d02af2a8ea2b5a0aa07b7d3319d0b

SHA1
e71b2a2e35212b42dfb6c444b2ea88e4b53c8821

SHA256
0281fdb5215c3b3e14b3d28de6296b7f280cba5ae3ecb2a3a983413b7d01ea67

SHA512
51129d9645e28c7469006f8ff37b76d88f581e1f9ed7cd80013429c5330fb27fce4d292306a125c78e0eee9603a70b271478eab049b3126391fb8c67d7d71283

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
73a4f873ec0d40790d3589ce55cc3873

SHA1
b7c5a6d246d9ba2448b8f35455e1b6079915d163

SHA256
1a85ff3e98cce9c04d161bd85d96607c8ac5ee0b705a959dc1ff054d20330ef1

SHA512
fe744ce22b59f8b1e02b6495dbf605af6ce008b0826dcc2ea48c0ebb5245d8ef32583822293feb9a86c7c919dc31636343f1547c86839f1aa1f8de020de5258f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
d482df6e92256100639263e707cb85a7

SHA1
a7d4acee47a32e5cb87f432c6e689a1b4d8b1979

SHA256
abd69c49196e7c27c7792006da461b527b3d15850672af43695be651e56a8a14

SHA512
a4cd99f773825a14942409df28c8c0a4bae1d38e652bc3d15581f1c0049865cbb3ad58182be1b26aa9c13c874ef625b6c7a31b8e46c81babc89d46c1b3669233

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
9e9c94128aa6e90d3340d49667c9f5df

SHA1
1859b7122fc8c533c7028fa040960d0e43bdf852

SHA256
ca6431d013ed3e2575fecf8a038889347e19de045fcdba07b51b0f655cbf2a3d

SHA512
d7a5ce3b197feb321d54357cde4a7af9237125153fd93b96cc60820decaf8981d735930a0844edde0365b60e091a9f56267283c614c6aca3eb94b52807449a89

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
6c6b22d7d9f5343181aa96f2e87cac4f

SHA1
8a94f1b50d52a24332a3e0771ae5502616b958b4

SHA256
33cad1289f40f241d0e63aa6a6d15a0d0e9b3cfcbdfca1b603b04c933347318f

SHA512
33d91c2b6466ee24ff63cafe493985750f83cce59590da81f4d951e59696b06dc1360453800754d74543573f1eb715c1f1323333e754db1f2717ad84c12f0676

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
ef6e1694dd86bea444dcfe01759334e8

SHA1
50eab038bc6d91f14ea2ffc8321de4c1ac1fbb31

SHA256
ad3b365f58ccd4790d9f6eeb9e51523ddd78f8f9e70cb6f306495d061c07d007

SHA512
34e57f9a13988825125d40e264ce5ac17540b04b38d3fd6f32ce128678e06fca226f2f99cc908661fe3d32ddc2c2030d5f11b5dda22609f5ae7500d129fd4769

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
386bfa6270c65ed2d2f1959828065529

SHA1
7ae673fcb8081b86c58fe9998dda98d2c096d283

SHA256
88e08276aa96061968b6ed017e8c6f0f9cb27a402e78a91259d2d85e480c0471

SHA512
a957e6f992f2890d21e71c6b92fc2380ebf9fa9906d3addd858e8a8d7fea3a025b4397ae8bf6dcbde22330e8c289aabde4b452615950ce0af835c361dd0d8b53

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
7KB

MD5
448dcc4a097e73271781a0947109afb7

SHA1
933b46c5c29f33e87889efd0dda837fd773ea941

SHA256
aedb540f86044113094eb7eef15898eea0c309c6bb07d49ca604245469cde34a

SHA512
075fc2b739d0918c33a93235f461a9bb9eedfb3aaf54111687cf521077b38d7fd003285305e9fc0cb14ca8e9ef22001a1151b480900bd69eefecfc13a6a9a850

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif.fantom

Filesize
336B

MD5
b460493693a130446b088638ab3876fb

SHA1
b621f62512bf1dd167c1f532f17d7128045670ca

SHA256
22664df8404cab6d0ae2e9dbd7128974960a187a97f7f726101948e7e6729272

SHA512
ea48241c891a2bce32f30fc04e0ac99f52942c6ddb82e2f2d2f3352f12b17a9b94452615458755d5769ede56bdfc0ac910242285ec3fa8d395338a8e1cf28911

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
240B

MD5
8a3578efb1b41b12f765e901d4b1e5a1

SHA1
8f74754e11c36250b4c2badbd67dd989e9881900

SHA256
f5471422ca9f2216effbc7f40ae6847078a6eb68d6653beff14b2b87898ffde6

SHA512
73c4a4d427754f251e0d8a86057a08a02dbb4cebc3dc47ad14684adaa3208c8326e4d89d0b623c535f3aae214e6a7acb59c89f9ab57aededd166e9e41d6d601f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
214eb9a108b8493f3341dd8c3401dfd5

SHA1
cd5cc7eac74a392349305c98a2275a3314515cce

SHA256
82ad5573fe014b16d865c6acdb97b571d085e34893f2aaaaf68f4e4480fce310

SHA512
0edd6124be3e3617992fc8e62809acaeb9962697460ba4e153e9e43bbd83a2e0fafccc42c6e29ad4c8835703db4b99e713b0280fc75c3b999ef033eae471adb6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
816B

MD5
123aa58b2017ccde0dbde296dbad822a

SHA1
71bd81cc45394ccecf927c0f8a539c06c33240a4

SHA256
22dedcb10c845bc7c96d616a3d7d9b967c571af1724a40b830dd097071ce9b38

SHA512
d16f5d009b7c0baf962eb362ab14e7d029d4d41da263a1bf011ec44805b693d81f9cc11d389511ff2f6ece1e726ff545390fd7777bd15d5f61bd775215d74132

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
c561135fb0f1fc170f9b99bded7c9d98

SHA1
a65bdf2e631927b59e43d378e55faace83e7d822

SHA256
3de07081446510ea630f31ce36905102dfab9ebeb45f9ca842aea4ec20d0d755

SHA512
f65a2037ab4741f67bd00ca27dee5e0971ca18d2816ca2aa41f1a9c83353dbf88312cc6b284c72c133aea518f6985e76b69701bcfd2cc9870049574cadd27fe1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
460ab445db8708ee13c2e2b9f5bc1a3f

SHA1
1dbbe26dc51b409b6b58c204e2d89c77d8fb68f4

SHA256
66e7ca4f775853d3b37852bc531812368054fc0660a5ce4c5a377005383d910d

SHA512
a5487b3ca1049f46f2fcbc00d976d576f826dfa122391ffd5af7558fe11105acea059b9bff1ba6750ec843548dd86b1c2d1cc2b5160995448f1716d843fc06f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
5e840f9ef0079c91203e3efee92f4312

SHA1
dac615cd5d028fcc0cb65e00f268a62627beaf55

SHA256
eea87f602d1aa8398865e4d59708182428b0f84f003cdd031187b99168faf97e

SHA512
6da043da80b46436e8871ce73c4257c31357e9ba979a8b7c8b7cbac2da199b96122a988a93573a68fa687eac45ceccbd9c981c9e64850906bc4364e54c2c5686

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
896B

MD5
9b23f42634877a660373fa8b63eccbd3

SHA1
fc42013c4ca8d1a681e74ff0e86290624f5e9a16

SHA256
98e0548ed34f717e93d6adb8a91cca1a5bccae4a41f4e06cf89a77198ce53b49

SHA512
35d9e21798ca11471ff50163c5688dbbd96cf1d59e27d0e6056e2724fe5b142f0ecc4e1e94409493e90225874912ba492d7c598d0ff8e9c22b0b7274186cb875

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
864B

MD5
ca532a33fbe02e5a3bdf0a089de2bd7e

SHA1
a5aaee235164a4e43e6569a2f063a16560a9b7d0

SHA256
3779de847c1effbebad84289f30c77f1ad410779fd0c4c7b35190775589e3d2a

SHA512
69a3f8aaaeaf39ae0b1bba7546179f9a96cb641f266aa7254e704cc07f85a8f69468e347b7329f7b8280004ef2312d61c4a20439f952343a07711c1716d0cde2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
864B

MD5
db3674d16c04085a8b1ecb1ef5f05108

SHA1
0805e7ec29d531d2309ca91547ade3419cdcc65d

SHA256
c3ad1c88a8f0f719e6ff2a1b96502a831461bfbf83c25a96eb3951ef547eb875

SHA512
9224cb76c5fbfa26d6e4f6954c93d692e8866fdcceaeb8d02395bdd2ad4e184af33ed94d8a3f1218efe0d176b08f92ac451876e2bb3ff7e3f6f975f1181be139

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
d272025382cda1d9eee2ea02b33a299d

SHA1
8aa08cfa1208306af7dd75a04d62188475216f29

SHA256
955e1e92c5dcfd3a5c068ba3dec633b6455f6f1a185916a6dad9bb1bd98507eb

SHA512
af5d7c8bcc168b5778c488ba7840c7eea3cb23e425324bfea324367d0768e883c723597c7cb52bf6796a7b4eccba5b071a921613dca463ea4a650a219a1985f8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
28119ebfe03ee2f7bd4c67b385e0985e

SHA1
803260a376039114cf33f94a64bf0345fe07e1d9

SHA256
21b43cecf859dc9a9e8770859ee4322547ba8a0c6f13baa5a005adbd7482c72c

SHA512
e3208c8627b2aaf8cc8597b75a31ebefeee51a58f88b2bfe602bda676759b1dc3699ce304b9e85d8a02bff141799072aae59dae80a270e6cc4e5f81004b614bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
864B

MD5
5a2431b88c49a4707b4fc3e7407062c9

SHA1
bbe017797ba8e94846704241922182e2b3a75afc

SHA256
1f24648f8b4c17b2c894ac3cd9bb7cf28f6cc83c5ce0cce381706936a6f087ec

SHA512
018bca3810935ab6fbcabe45a56ed0f6252f3c1c9fffec9632b11764355130def95dcbfe42dd21c5c9550646c546091cb8acbebc4b63b5858ad49546ee9566ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
848B

MD5
41e0b220840b6eea281f7acf20977cf6

SHA1
c458647dcea5f2737e8b10d395812139fde20cc2

SHA256
424a55f789f71ae21cd3aa7160320327de31f59643121d71804d258561df2a41

SHA512
bff46d7049149a6e17fbfe1522af12352132b3173263d4c2bfbaa89121639c76618339da54fba280edadcfd72f1a236b9d421439dd6bbd1089f08eeaea55daa8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
880B

MD5
934d1f2389b183eee935fbe1844d1c62

SHA1
ac8db1d9f8c0acea38c577fa698c7285919b7077

SHA256
e4cd0b8a21a8dbf2211ebd59d751d2da05115a218cccea7b6ed213d2a317892f

SHA512
0a4f036ce821e5253be496dfc735cfd39b8132affeb541d5434b46daff6dd59283e2a92a7d7b2d894c99621e1609b1ed5c159a06f78c4f4ce3fbe170b0527b64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
848B

MD5
c0291508df1260cbf4dd2c928db0add9

SHA1
9f4fe04955e10c619e5c56ac6d0710d7032e3fb0

SHA256
cc4ee3c961602c529bb3b1eb286975b902a99f50d5d97488b2c8710b15e0792c

SHA512
63a78e393d1d568bce7fa249f8c56518003b9103b3b4b3db09f17bf3dace7af07bc2023af4d6524ac6e0b49084c5a0ac508a227576c14bd6b95fa1a98748290b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
864B

MD5
19cb496cadf723019d08041bc8bf3315

SHA1
ec98fb41a158cd3dc9504ac2da87545235badf1a

SHA256
462b1820b91065b6dbcd2f61aff561b6838742cd16e7a3d89cbab83dd7c131ed

SHA512
8c55fdba121202ed9d22d4bc8be5a2f1fcdc3afd650e5b72b22bd21f7475a97cb206bdc38599b3f5d7ab7992f31aaee3acf82ea3a373fe750256bb9fee5ff7b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
864B

MD5
ba43e4ebd2e949b5166465ac3c5d114d

SHA1
c88458a207f1b9e8601aeb8b83554e99a5d29d6e

SHA256
85fac188035e9e04ca8736799d3675bfdf2baa85cdde33bd55149a281d52c10a

SHA512
fa8a33f684b98f8bf54a1a64c8aad39285bceb088e615a111b5423cc2319fdde4bc0a4f4b54c25239dd948b00c1fcdd147c386069ef599f99c6e0cd8cc7f22ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
864B

MD5
c8184f088c5f2ebb5ab55bed38da590c

SHA1
ad036236b79de7510694d1a1a076101ccb92389e

SHA256
8aee8c299307b5012c3ada9dad9a76229b56f211fe09981945bcc05874ec15d4

SHA512
a36d1fd34ffbd4c82515785c4dd895283a0ec4beb4101f79731ab1c5c2f820023d95e44f0b9c5183dd20f94873f1144d152f372170e76477ccd5f0ec32f6daed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
896B

MD5
a3acb168927c8907cdf9259c10df8db9

SHA1
1085cdcb089e1b9f4f4fa05dea3822afe74ea0d3

SHA256
d6ad25209407c4e428ae58d1f3c2e7dca0f2d448a0e52d1afa1e405bb7d10a80

SHA512
dfe73e992b9af205df7daf4048415f048695030c11320acc0a6454048ab928753ab6156c133487ff4d38d9b50f865d6facaada935ca4ae064b1a9b7de61bb1e2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
8a6cc944f9ed62c3c94106aae03a543f

SHA1
9e8e3eefa202b3934ed40d7e4ad2dfbb3677406e

SHA256
85a5cc414c717c01a17e82139a5868a033254fc09296e055a1671686a6c327df

SHA512
41d881f32a3100af34646f4dec0aca0e68dc061fe7c7e279da2ad5e0974bfa22b9c1fa119addc74cc6bf2d723a683a7c18b37caade55a68e44e907a19b486a66

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
682977d8cbdfc236d580e7d2c37e4e17

SHA1
4b96fa7b8c9e9bf59f31432a624ca6a835c5a0f7

SHA256
284e90fb38232ed4563fed241f621551830626bb1ffac3850d8d56f1f819c7a8

SHA512
267b305332c6a3507a7d9a76ab1822fc5c0413d83117f51dd251d2113f1505ac27a59768a6b3b0bd029427201f31ce1351a9be0f82309d391e855123ba962969

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
97363f6f7e8ec839f99ade6b1d980341

SHA1
935c021deba9508c4077d2ca2716f9f7e1e77bb2

SHA256
31dd5da9e0ba4772a6e9af34dd091f9a1071cd7c5f220be324a91035aa57476f

SHA512
9884aba8fef455f22f61700b9daae850f375790dfa52857bb0f381aef5b75b4d8ab563af68e6347752bc3395663abca41343f435aba169236585e0b800d7d648

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
724140432633a1982b285a3b1ec4e47f

SHA1
63dd0f89fd12c21854f4d9fc0897d08987e01d73

SHA256
9d0922de14f4cf0cd36e2630b5cb8d387dd7bfe05536c7712b0cb476d5ccae1f

SHA512
fd4a4441660333144aec9e57bf636d1a434ba490c689105b44402465df2e90e2c4a47bc3eff0e027c41bc692d60dcd076f409a61d3a0470d731b9896d2b50362

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
122f1f198940196fcd6a2741882d9905

SHA1
6c78cc1e6dc5f9f34f0b274eb33441479b30f4ed

SHA256
17a2524d6526f29cbe9ebcaf0039cd3de3513de7f04d727131585358e02073f3

SHA512
758e27fb4219259a26d180bc43671573193e6060aa0930b3ace280c72ba979b9dc990ddb901d713c665876bb8103a568c8eae2e8f9d0408c5ff34dc6301fabe7

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
cb590119f50309d00cb64166f8a6dd6e

SHA1
db0d53b0a2b5ad1f055994153d62b51f8438132d

SHA256
532a3fc2eb663040103815aae42dd6d2a3ac05b4577350242eb07b4dee9af4dd

SHA512
926ceaa11612c8087d57b002b0754bd5b269d7c132b62e87c979daf22cd4df89e3ada8998ef00d06cbde3521c3cb97d1cfbcd005e332dcf2e105beccd08ee332

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
95289c745d1c7270ea1523a0168ed02c

SHA1
0af4697f448581795257f0f8f2978dad7723e0fb

SHA256
22107624a1ac2ddfccb049f116e9c015e8efc26629d449aece9a1191030944dd

SHA512
8681e98d47863158f58e2e5ce8a3c5444fe897b283c580c56aceedfda6de98f59a0b1e087a17fcbc181cbed6f08e57387746f884089ff61ed12c8f0780df1d2c

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
16B

MD5
ce500204199c55a8817d32dc6b90a246

SHA1
68538b2681bfc4e86a189ac53e4d575ab9770130

SHA256
2b03e548d818c3572d22c727f118e63c92007333bf20ab137e8731aaad52eea0

SHA512
938cca694d74d93efb28d5c8359a1f4e26cb4f68590c7ba4c3e35c320e54fbba2009c4ae176b1a1f0001e6d478fd8c9cd8d923e140ef0046cfcb5906a9fa121a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240903_051533049.html

Filesize
1.1MB

MD5
662c37635f353bea7b7de33ac9011b98

SHA1
4df693509f91cf3a1c46be342fb6fd12eb4470c2

SHA256
a1407295faaadfb8c79c4db8f78f1181ac50fcaa86eb7660f97969aee2d6b38c

SHA512
6d0e63b77c17cc532642ce84d961f3338f562bf15570d6c9729f7cf2c3c8cbf3772cb7b640fcc4c54b3a44fb70b9978e6a2515f6ac516bfb8596678018809526

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\Documents\SwitchWrite.xlsx

Filesize
10KB

MD5
2a9ab55dacdd5bcf81d78c6963934ff8

SHA1
79b25373e42087b67cd8f62da33cfbe4ecdb2b47

SHA256
65ab8d5c9be0bc7e712f7d38fe6acd1ebad569382b829777149643ab19e54bd1

SHA512
6bb8de95ea88753908d54776cc350a908d12c1c05661801b7de0c594eefa4d648d4ba8fb18ec97ccfc76d4d5e13e398c2c357ca2621bc450ee4dd53d2863e0d5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
64B

MD5
94c281cd760ac23bdb95f046bb5b9285

SHA1
1b04fe3775766c919b8fa8363a19dbc256ece0b6

SHA256
a26c6c7c4a18da7296a3e1cd7409e640f46687796f18055bd68949069fc0b232

SHA512
9d2ea55627a9d58f140c5a9dcd2f05f75d8b6ac21283c2240f144a8652d3ba58ca55114f49f406f5eec012ef1a3c2ed551ab5c22ad7a0ce9f6b746287617c52b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
80B

MD5
881a6e2c7e654fbee3747276eefb4c6c

SHA1
482bdf5ade2162aab4af445411b6d682c10d8fed

SHA256
b0448207619e00f1eba3a0d92a89c79201b61f01b01df06b343f0ab48760e4fb

SHA512
3adb38e5290a8c4152abec075b7915711305b38354dbaa070e245f4a4023a69716ac6b2f1b78213bb5d557c77052f1c7c27964728bbcfd760e6388f08484798d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
80B

MD5
510056b30114f495ca4c8fc40fb2056b

SHA1
cf920b3943502d21892f5cd97d01338f4ff3d7ea

SHA256
30451f1fca7551e5214a8b154aa5baf59596259cc982ee95d08c190ba47d6aa8

SHA512
e7186ab76749617c1d67992872c369990525539f765a62e319e165f8c23ad829eb6486ab6db572831d36e76d3bf9d913464b4725c7b494d4dff5c4f0d8c17778

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
9f3d17397fd02d0ac95a353b62ffe0d0

SHA1
a66b4179bd166c0e2355b57b813a5cbf5f09fa52

SHA256
1f8e3c57edd26f0b81fd965339a655160998d6c2f066db239425af8f3cc4b58f

SHA512
af63bb784e53b4eae3222cb36dd8d2660dbf89a340dc00d4a7697ce437f05fea76b92e30008da6f5bb9e053828966466b32a1ce2df974bec05d6920a0cb243f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
f73dfc67174d00ae0413233359d03a5d

SHA1
19517fa1443fdfe32d466443c09166b6e013ec21

SHA256
8c9a1e1a7449f4afa62870cb82942324481ac5911436252aa3f1ffeadc2c1bee

SHA512
1331fad23dfc5b385874e121d75514518930b7204c190aa37ce8a219bf1e69ebd9e5358484e9b27b450fb79940be27c00ac1ec93f629f0be20bd0c7af1bee8ff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
3KB

MD5
c0a8b1ca783b98980ae93bb429d51121

SHA1
4ba5ba5a2272e55446bfdfa172be7caa7cd4d04f

SHA256
839e140d0e9502fcec70f2db4757dc1a75e57c142087acd55b8d0a6c65b968fd

SHA512
d8c8469402b26974cfd538abaaccb250f8d062aa2d013fcd4059186e9e320566ab450d0f0e41f6438e4a953af58ec19453606f7110fcb1330e0624d992bd4ae2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
fa42d32d358bd7ee40e978b7fe153d35

SHA1
93728df142d082129f170b91ed649382891de70b

SHA256
26054ed480b86ffaa718fb99e929d184b155d22b8af8775bb91de572e4d425ef

SHA512
a69a2b1a9d13cb5ccc3b3be931b61e67cc6e6cc9751595804ae4c376c8d4635d6c1688c5d6b0a133f51cfb0b65f6cbb062a829112d3aefa6c0b7d398fa993366

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
dd3cc07a767f57b5088e240e23d57d87

SHA1
53c2af44f6885f3dded197f8675add75e9c44a25

SHA256
18c85e83526e9f9253ce3314dc9cbe04d5977a60e749d9f5457503fede282b18

SHA512
e3fd817e42611263da8930e4d628ffbf73a18cc64d34b5df842cfeb3bd047ebe2be3dfed5f11aa35a98710c3c393b1abf83c13967844d08e11a14fcfc4dda151

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
ced63dc3f3201492fab93cc4dda1f8d7

SHA1
83bfba7a4c282baa24dee8bee8a5bb550cc373fd

SHA256
22bf4789bbda40e3ccf9226893e5197e5c890f7a947606e8b34519437c667d80

SHA512
0ca21f5f2d0c2bd8f76adfc855b08eafb635156bec06a7cc58c44472425842f38f5e8ddfa778d7cc03d56092c229f1dd616bd5eef6a62299a489409b2ebcc90f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
a7de6f1e68270610ace7550389d67c9c

SHA1
a651624c4726ac1ad73338167f02709c97e00930

SHA256
06464a6e2dcd2a5d15320b839a347a7e794ed5f93890ce0b61021350d99c6156

SHA512
e884ec84bade18ce02dc00d4f1f5eb458872d7159092a7502e00acba179ef3384312437af28ee0977865ec636689f8b375fc9521e2b367d40a3161342b2fdb99

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
919d6cb8014a63ca5547ac827e73f486

SHA1
4a6fcb42fb391bd761778dcb13000ea5ce0d09cb

SHA256
e52e1fc1d70b59aefb74c7e9ac03c426d78f12f22b346c6376239560d3c4950f

SHA512
9c16e67a1a6eaf2998fd7e05d6c817c4197b9328a6303f4b523532514a58b0e7aeeecb90fadb993532161a041be1ef2dea0ff319ab0037c80fa6b83deeaac22e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
fb1c0aa6c0ebfeac469d22f0f4103ce9

SHA1
95fe7bc1cfd5c9d923e4604e86eca8f64bc2fce6

SHA256
ef231b0489559363eca81b0da898392eaa71071a1edb91d6e52759698fa1c8ac

SHA512
b5117d929a023f2439632ea091b6d9a50224dba4a9bb2c5e1df88ca731da03f46d3a28e54840cbf335b87c0c97b3ac6894543750c4d463754a601c9b1151baec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
29d5bd2d58488b3ac61fe281bf41c918

SHA1
80300797cd5959d0f74c31b4e2cacacebf9eee76

SHA256
7d0cb64790cadb42389922a22069f33e2fc45b8221298108a64eafebb1ddccf1

SHA512
21b18b73e10b67ae80a5cca584bf72a6903163f510ac5b2c22702cfe2298f8c76a4647e2af8f6e4cac5e127eb9165e36ca137eb7dd7b8e9444a25ed4ca1ac60d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
d246bb38b5491ccf2eb034e5ef9e7172

SHA1
4e1a6ef966a2bc22f05b05af0b48d57278da92e8

SHA256
f1aa541ff521583d97be8bfd4e14780c0fb827fd410763e976e34cb94560007c

SHA512
7fbb76813187ba80943c1f5e980936f5e6bff67b08ed6fa0896a088f534a33e9e87310fc105083c3a08a2ed91164e5b3cbe213366f1643b0f51ad8ab379e1bc7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
dbb5ae8cc38a372bfc6e96fb02fda4c4

SHA1
05cb4c25893e3ce47e44cd5fa8cbcdc4f53fdcff

SHA256
245184665e652cbab1b24424c1534d30bf278d6278fd3ef1450350a85d630607

SHA512
9370c0cce2bdff50e29daa8e050ba7c0d7d6a9f60734842131c6b7ac2f4c76e59706b12091e082c830f97bbdafdb5a9fb3c06dae868c8d953d6850f9a846d527

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
70d22bb26cebc8d9d2df33dbbc67e65d

SHA1
94809ce9d574dda95ab1a3e28e24e43c397b1854

SHA256
4011cacd29c6a8f1367663dfc3bfc4f6ded8d22fe8c90bac4499a3e627d4ff31

SHA512
39f221fe8842ec19dc51b23ada390ba9d7cabc9126ca00ee51ef9c6c6e6387cb320e915da85e8260b89fe4896f7116786ecf421558a50d3126750c453a125848

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
c99497a5729951b892939f64a932aea1

SHA1
3da04a01e236b6929cc0c7cf3fc7dba2d632bed3

SHA256
22baa10596a495933dbf5d61cb0655d54dd555420eb17c4efa83cea3d786266b

SHA512
af882eabf8f6c1a970f96d9c2d4547d2527a1ba24de8388138e6a238506b7805c20d27c1ece3b39860227e9de40d5ecc3e3621f5747c2da02a8a23acbae0c073

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
a564f7f7ee04dc7975162b2711fe0025

SHA1
132d810f1c2068457e83864edc8bc70a4820c9ef

SHA256
2b1b23d029e26ef69d7a9ed3acc2cc48618d7f0fb751ea0b2bc3fa823c090b73

SHA512
e57b2abd30a8d2c8de0c00a1c7286dc90ee5976a90fc266a0ef0286394169db7b17a1e947c28eed762a1b74a9b602817b8a086419066d16202640ea8220873a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
e04eacb283bf88e75096f97c950b63a2

SHA1
79fc6c5aea76482b4559b732cec9be8d14ddb16f

SHA256
e4970de380b60ca191a42eaa486dee3d0d229b8379c66d5bdd80aab098b9a775

SHA512
35e6df5b2b042456c31c7a2793ba8af7916fcd40a0ef4d889fdc7ea1f880e653996a51fcb4831832711a4be32950d7d96b50c747534a39293941fa5e9c85379e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
0f7f4f970f72ed3d483830c5c438bb95

SHA1
abab73a81288371baa27d40d4186ed7dbaa65d6b

SHA256
8d133f0176ac616bd697c0ff0a8586d78cc813bbc0b787156d9fa6cadc3012eb

SHA512
5ec95dde4862aea0c4b4f833957b221078cf33beca4efd48964fad57b09ff3ae8c9b510f61014676697390aa2d092b6f6467086926951dddbeac5ed26b5569d6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
ccbb440ad8095949725caa0711530aa5

SHA1
bb6832e6603da5f2fc11b7be140832b0215b616b

SHA256
1291e570de1bac3d7ddb2c7ad5383f6938f3f0f10ede84ff2b522bf51cef0e80

SHA512
8c0b331439aeb74eb731b9bbc87b63aef10b01f275a42ad22bad92a32a132ae7d32a858937dc26d20616cc11d5fb28e98653e65f2862434f0dcd69e0aca832bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
99667ca8c9dee6cd67b06f800a723df8

SHA1
fb46596279b94d911cd54126964f7d228bdfef2b

SHA256
00fa0081f30f9dbd1559ec4c25a8f41d33280ea22d2eb90e1fa5547f07e3dc4a

SHA512
c92df33b6c9ba16b91aca1ccc18022220010d5c01e006918828bf6e4a03a70d0e58708a6000db5983f62cc640dded5682c6bde629b86062b4d4460a450aeabdf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
32a55196fc19340bc98a7ae1991be126

SHA1
ce6dee303ee8281fd04b0cab1577200e1a1ca596

SHA256
d1c827136223df3c6be40fcc197d3764f207a5a9c20baf1f922c4b8193733090

SHA512
ddaf467dd4e96b33b4124483d06a5e1f175a0b30b20a4012cc136a843b4fb389361a9f9b96458bb869c4bc8d7bc83f760d07e53163948b619d69b79ec3ebc59f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
685213dda52569dd055ca4a7f201b08d

SHA1
5921c29b4f7ce96085c9666a8e621de7f68286ee

SHA256
749c1a95e2dc932834a5bdfa5bc344e7daf495c06aeff590ce89f1c26411c59a

SHA512
a8e173ad537cf3d57d1d1006e11efc1e887d7311312c6a23dc550617522ac51fd97e989ffc11ce42520f207059fa7d75ce86de46576883b3f879dd7f0c4d7c11

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
c336e5e547f178e4af5c6e24db571277

SHA1
c081874b96dd0edc0c2904e40127f1bc30810d88

SHA256
4bc333cea56a48ec4eee25e95edfc438fe742cc489efe9734b13a5b25aecfa86

SHA512
245945c17955d76554d3910f0536f6903e6e3fd58ad5461d565fcd9d29f4b0dc126878caa6c91e613393b0032b87614479b8a65360e636086d86a8c42f6ea705

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
5b9097e7a832ba5715bae2782055d8c9

SHA1
6d213fdb9d073e8077e29b9476fd20e9794ba35f

SHA256
ded3c1508e11037774d626b5a472c8c5e8d25a233bd4123c0dd4779a79849531

SHA512
50d5838dd88014d1d9e2f5b32b95cbcc5d2de3bfdb1d208a2a8c4f43ce98594e5b6bca11ccf1247a91816fba4dc03ab57156ff00ee11ce83393601d0363eedf0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx.fantom

Filesize
2KB

MD5
5f78ee4e14f5628731f65360a5cd18fb

SHA1
21bc97b82d1a71d99d26622afce97d9a8ebfb4a1

SHA256
7c91e9e2aba268ba6341fac8f5a0203ed82370a8b6cac500a57f1e035e23fdde

SHA512
011d4755de2b6a01aae3261fce32bdc1a9b89386d1ca7b7bcd795522c3e2847f9b33ccf986f55cbafac8550f32ffcbffb0a9e132cfafe62dd86678d3941e865e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
0199b26021c24f5de0191f718f2c4e4a

SHA1
bf8e44217a1f026805b5b18227e781cfffc41416

SHA256
89413ee15c6f99352e9417e29b19d04029bb8d4ef53f1ac5d02ae4b0bb63aadc

SHA512
5e7c197708853e75ac599bfd4fab6403d0e14bc873493eb1f9bcd6313f89780eff81f79566f6118a529073e452d9646b35bc3af1982d396ea3c070fff8e719b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
320B

MD5
764d6be8bb976c07ee9c61f53d5b22ed

SHA1
81a775bef260f042d792ed6d51d47954f2ad42f4

SHA256
9f2fb66da66ed5c7e7988df06d421bce8e2d3ef65365cb7fa4d994d484adaa23

SHA512
e68597f14147266fba2a8a88e858f66d22d827b651acd6e1b4f4708faf83e44e6b4fb8b26374ad591cb8ac73ac9aeaa4ab015f7a921e17eb79f88ace9088ff08

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
0e801516b037ffb6fba7015da34d5053

SHA1
9cf7b8827c9a3aea26850224674d2227f9d34ba4

SHA256
53d914367434950161e60fe35a9307a6e0e69ce0bbb402d8bc08da3972e5bd2e

SHA512
5f460f004062762b0f554f5434e3b12d89531b198a868b7673cab9ddf94765cc6ae8f3f989db0c02c3a66c47db1a576d19f0af06350c36395cd19184caabe871

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
c432c8f2562789297c0566c16d77ec84

SHA1
3fd5c12bece4e1881ea978f43d23ca254615e446

SHA256
ecd019d83e3c57ef9e88b78ae2378ef464ebef05b45c3cf5aa6380e6a1666ca3

SHA512
75100f3af550d1f870efe72f5d5185c1afe10891df9c7339b617dcb8d5f4135923f0b5e3390ae649f5cc3111b842f340bec24bef2722e621832e69e35eecebe2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
960B

MD5
36359784c53ea7ad2f1a6cee399057e5

SHA1
4ffbb4cca42d6f73872b3299cd4018d9df997d72

SHA256
c2bb2ff4a3af65856f0ce50ff58cdb49d43e9209675b821ce147845e5f0c7980

SHA512
7f6e87640281587a608685400a051a13794f07c8f178c5d3f5a960488630cdbda48b73f14a3ff77611d650dca29d6d334ddbbbb95ae7bf518cc469cf733ae6da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
128B

MD5
fb8a2ffc7950101b5289326008f1555e

SHA1
fa8e2a5d428aebcedc6b516cf6e5f9c77b3ffa89

SHA256
310d52089adf14ffdc44647dbb8c0049bf1a146909177cca63cabe0eb5d2aac4

SHA512
b22eeb70038ca784ed79a3d61c67157fe440e04cf6d2daa5504c2716d51a846c195480beb9e1624ab2640ceb62753bc61d7183e6cf39d59ecdb102f2ccb4568d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d1d789dd19a538d52ae349591959228d

SHA1
bc3d831639a7d8479ef9d1478536ed26aafc6e3f

SHA256
949443d15e18589519fc9048b72516e3aabfccdeba14592ebcfe474b5c5252d2

SHA512
1afd980f32171d6bdd8bff032309ccf12946ba92010f3f56858ed6186377c400f3d5ae2f20f6303deaf20e572284c3f694bc9c5f3cbcb585425ebbf974cb1318

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
f737ba54d18b2398d1e628090a75e4fa

SHA1
c83ad3a52dd58d6bf33b1d4f1860818ca60127d5

SHA256
891ba2d401832844bd616ed875eb35684277349a31ecf39a358c11b334149ec9

SHA512
754650c3c851009bc9a1073a7b2345cf3e22def4c5a8b05193d97034a95dae61f5411a9df0199569ea2f65b033b73bb30a832830b5e1e8635a29f11646f3ef75

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
64B

MD5
20d51f2d7fdb459c49fb369fb83c0391

SHA1
d37d028d4ee09e2400ed3812ec9119a2deb9d03f

SHA256
04ac07f985055cbfb34da05c48569e1ec84c3f68b0a895dca94ac2415df20af7

SHA512
9b687e57714beecbb18d8fb09756adf31bd4b3350c38522fa660fce985f77868c12651a17d848476aac55370e49c0002ad93ce04e5812effe1a67594c1c0b85e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
928B

MD5
2665406f54b5035f2a3a21287e2c54b0

SHA1
c661d8e8b6de5351b4cea5e0b4079a4e98d1a8fc

SHA256
fe3a4532698be1991e8d13914fb4b038eae6dd4df9163216a3f21437d8b01aa4

SHA512
9e5d921553635d48a399f7ac73cddfd7b01ff9af56e7e0415bde78691e77502cf7fc1d7b53f59fb9cc4e2d96ce163d62827ffc18c9f3a2e279cddfa2189a6a3e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
96B

MD5
71f81f2f2f1762da9cadd5698fa83f2e

SHA1
c9ef01bbe0a8a810dfcc4be386bd58da2fc86a2a

SHA256
0fda30d634109a8807f90706a89872b463133a12823bd59a3e8237864febfd80

SHA512
456a83fa5c8d02c8736522e83bbbc23cd2a08561e1315b6f739c84f3dd94a5bddcc43ada32ac7729d3befd77d494a5b1caf49aac8c97728f3f7547dcdd6bf51e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
96B

MD5
29210a7e6a534a85b3a374d4fe373e6c

SHA1
6b3448f360574d177324190181a36106a0d18fb2

SHA256
6220c708e825cc470b31698ed3b8520cec5e4e35eae54903c895247b98a49a14

SHA512
35dbbc405c9cd781f7c2e84b0a2e64b0186d16221dae3e0763bbe707e6f21dbbbdf05c836f016998bc1a114151435c740bf69fbcdb7477a1c725351afe2f0bf6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
336B

MD5
7aa959189e98445089e0698e82f79272

SHA1
bf3064727225ab07ef896cce639d230d8d75588e

SHA256
51579c91d65e850a510d47fc07b71162d7e5f4f81a7f9f12529aee4c8aba8a84

SHA512
b514e083ea5bf9522a9e119df1d65bd597a17568168adc196ef75ae2b949daed0fabf1e774533a5233c02c0dcad128e8374b4aca57aa69b9b83aff4eefb22501

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
ddb62b809b111ebe48e972f4a5c278c9

SHA1
d88e9ce6f975c608e30efe1e9d2719c58677ac8e

SHA256
86b316af203225975bcc8ab47b3822981c1b5f284e80ec66816b82ad3977c999

SHA512
11bce481237d439739f66c6a97ba3d9c79efa2e934b7c87657719da1a28188b656f9c43b707e75a830bb781979c10bed4284959fb28a06bc82c3519f9b3840a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
176B

MD5
f93ee5502e64667b72eee7a0af6d4f4c

SHA1
0e8ed0bcb7e3d104fbd20ff47310dfa7f5eadb81

SHA256
a577eaf954eaaba07cd5c0a6a73b0b8c84e58ea1d6b0b9ded40464f10795f19d

SHA512
7db5074a2f411c2172b6e449711bf6104a1dcf535269e0bb892c417676d10c0d9dbc220d5377348279136d37bdf307e51c05c09adb1fb4948fbd1945eb3d6d45

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
592B

MD5
c6c828e3295f5d23b3735f8a577f75a4

SHA1
fcfd77f4cd211dbabd9be89341bf0472ab55e7f7

SHA256
97c2fef24a0ebc73716f5760a516ffe556d302d984fa0d3fc795c956c18f7793

SHA512
58a3dab78e42d05da57b7570e1caa20539eaf358d21aac1ec3beddfb38b55853a7e6b72fa5f94e94f1f3838984e9aff0046e34a992abe2a363808a7d6fc0b728

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
128B

MD5
63b1f8a596ae0b7cd9d1fa187727ed5b

SHA1
bb2bdc8dfe2094d8ebe25939ebb1299f7553eb94

SHA256
4c67136cbfed12bc823c3dfa61ccb169bc84e594da37ad6e875ad836fab4c247

SHA512
77e1d4806b44423d29724ecdebb77ab0c13dae387228d2a450de476027b04c03ced3ce1cdea2f90a6b8849e73985ec59cb342c49ce9e777e05add788b499264d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
ddcdddcf07099e74fc6c126ba4c65609

SHA1
3f683642acca95c9ee4f9af119fd6e59805db3a8

SHA256
231a5ead8cbde90af87cba2d2f67e7ccee17b10a24ed258927f7635fae91355b

SHA512
468f420a40401fd65f985c69aa8b6cad9bf44243a5c0356bb127e23bf38080ba6ba2de3fffdfece0519a7fd7c1948439280acc147abfe9deafdc088e59690b34

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
896B

MD5
f80d94da91aa8b80f532cdc8ddb09163

SHA1
2f1420f3c95e110a30cb0cab7fdcb952475800a0

SHA256
db88b0f46e8174a4958a206ccb698e5a1f0e00a89d8437bcaf366757e39c93a0

SHA512
fa8183681ce0fcaffe92af31c193825ab8047c38a2add50513b9102c12b4d97550c3f34aa13104a68186e998326a9b5dcb9e596f1b8e64c5b5d2f5a888393991

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
770acff88901c204c78d751f700397a4

SHA1
2ad812097899b948bc64b5f4e8cdc2481c781eff

SHA256
828e7bec1f749d01a9ce89774ba1aac443fed9ff2112ee0de3383d9239630951

SHA512
a04b2ffbbb0273b4f5d9686bf0e004b8f16c3cf75ffabc69abc3a20fdaf338a4c81d579fa5ce6b2339c5ba8a438a0cc290a0d005a32413691576e42ff5f0e42a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
8f319ae1b7a9f14f7e5214bd02bf2069

SHA1
9a753c1c07ebdb0c2b341a27a71684d4ee2a7aa5

SHA256
761dee2df90bb804cb6373e054312d4c1c0c46637c54a36dbddb462b449caf00

SHA512
73fed5ff4985d4e62c775da8b8b0fd3a2c5c2d5972a4b6a21d2400bb54f8fac6f81420d206bda3eaa0abacac00fb8619b835482fbad3f88dc931568f91dd7505

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ProviderList.ascx

Filesize
9KB

MD5
3884d9df498017151be56e87cd30d5ba

SHA1
85d48bc8670bfa0f59e4053adb92719b89f5e366

SHA256
50993c696c0254770cd501d60e91d1f4993b30c59637a9c0059eec6b614aaec2

SHA512
83dfa7a75365df43b45dacea46bc863d63818cd7dbd675a38ab34692c569aa15f52676e3667bca51afa07cde42189cc781b855d4f60ba2d481d3baca13b1dd18

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
fb1a1ce121300f837a4569664e407082

SHA1
5214d0274a0087dce433e4315e373e70c146724f

SHA256
1d53964a43f0fdd9f709a514039552395ce252f52c8e9f52f953b9b4c4f48ab9

SHA512
1ef59d176a73229905bf9fa73a2b3db56807fa00381b86d5de6f603965c4445fb739fb8fc8c931d091b9e394a534787d3f8a1ec9cbcb4cf628af36575bb4e76c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
5fc198dc17ae2fd05f54a61f4d648c44

SHA1
70ed4eeb6aa88a81df376466ee32a65034cc333d

SHA256
2f52761c93ccefa10d7cf01433894a9c6d462fef9f6bc2093e8ac94407ab6364

SHA512
7d45e392b3f7e2950971549a9e53c3a47baa4227af281a42acf074af48292e89592278f317700b755397e4ddc39efbeaba85f5c7ed66ae6a8abb062ddb3d8b44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
c0d05f71fb08e7d717c998f350bdbb6f

SHA1
8c487ed583386349275ded65614d2a9f8582ad8e

SHA256
8babd38e7bae94944c0e07aaa0cb697eacec8cf055a2eff5f19966266c4da5c7

SHA512
2cd72392053d9532378e5f3ceb4f74912acb828e7e692052b2a4b9e3a23b8e8db75f5fcef239763a9db2e831151f7b3b1fed5705731f27aa10273a574b6dea44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
68f642f7ec615efdaba93777cb10be54

SHA1
d66ce242a98640a2fe01527d8eab4215eb0b4f90

SHA256
5d78ab02c665ca2ae3ca4e3e7f785d940bafc4409c59b24c76729b923cb03f0e

SHA512
49d7c719577f5629f0422d495d964b50975db65ad579bea40618755969eb6600239a285f4de2af8f92ca002d1ee5e3e53333ff98afd813f1ec3959debfe40bb4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
9c450bdd76d28cdb278b79a6301cde64

SHA1
6f535e7a47a1e8ecd7bb366e7516c0ad757740b8

SHA256
b4f32e84cf43abe89918c2fdb90f6b2772320c40435c644be0a286e11d94e81c

SHA512
54ba45e5d767c051e213143bdb23dfb60cce487f48b645d250c7fe66d1e485c4b218d6b62b2b40c918c0edc559ebd993e35a22b9be51b6fd0aa0c68aafd4acb2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx

Filesize
2KB

MD5
1a05dd3d6f07f557bf0eb4eb82ecb996

SHA1
2ccae5e6980fbcfe9a3a6edb8ad634412d57054c

SHA256
3b87cb472f3d5c2882af4993ba7c2e8516cf433e57cecb520959adb61ee0071c

SHA512
208edb698709b324646048659955a2421275d1f3da6aa6b070c462f137c4308fb075fb3d951239d8aa2865f847e6d82bde04c52bf2320832703f20a74f60f381

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx

Filesize
7KB

MD5
fd3c11074ec7a1cf394e0ff6b4d0b412

SHA1
54261598b48604fb4de6d702b92ca8d71354016b

SHA256
e32460dac0a22b1dce014602a2339cc5dcd067a854c244905298fb53bc479c4e

SHA512
d43738ea2d1783f3c79d7ed6102199db2c0a19b05fae48b8bbfdc275089bd46397b0d0edb8bb3e4fad0bdd2fe931a7a18d6d83f59c79cc8f7deebebd8b7c91fe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx

Filesize
272B

MD5
7012f29a8690da9bd64dd2fbc61666d6

SHA1
06eaf3be665c38bf07ec3f26e6a7e843a877a913

SHA256
af52e071d064957d443757c4fc1235f64c07e0541784880c17c6e7780b1214c8

SHA512
e97d84e6101256f8ae9ee7ca3b53e32e224a613b3925ecae7d6b531836977b67ef0f2ef45153a5749c200165db72137b18d5809a5d1091a5c1ec698766162cab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx

Filesize
496B

MD5
ba32bedc8032e0ef5abef41fed565db0

SHA1
676f15ba2526f83cd029e63b0a1293fde087e92c

SHA256
7cc603aac13e9d1857f67a47c9e7e9bf04577fda9648cacda00b36bde19bc039

SHA512
d40bdf53645f17a632263bb790a6724b3d13e37846d0f468b912d80aa190d03115b5126f02b55b57825ed33b42ce74e6c23dd1c4116c25b4dc9320e6f4dcd127

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx

Filesize
24KB

MD5
4c3625b37453f651291c52a0efb10ab9

SHA1
9495427ed68182415cd8b753c832960599b1cae7

SHA256
5b11ea803442c411dec6bc2076ef6d1aaf8661fe8413d81dacaf48c62aa4b56f

SHA512
aaa4a4a9ee46f54ead7c5f0b173e9b88ba4c61330ec2605f1f6677bcf904081b7d81df5e9b247925d130f183179766ab2edb26b9d1ffb9f1124baa29654b8357

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx

Filesize
1KB

MD5
6d31ee260c1861198a1f55664e96fc10

SHA1
c084e853b262a75d26bc4f4b08124f0d0c7c4f4d

SHA256
70af033a893e8b8174deb3f2ab9410c9eee951a57ee3c2a7ef6afc0f2cfe6a91

SHA512
c4e144f4c8d79ab5c14bf8fe54a514d09f4cbf69f71e39a9cd343411628ea8c2cb988f7c27081fc7cd331bb309580d9113e009a07d84c7d87d2252e61c48fb8b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security.aspx

Filesize
9KB

MD5
abe0222adcfdabf62f888684d40832e7

SHA1
3cbee0159ccdd0262eb796067bbb57994611a65a

SHA256
4daf3a0c40a759d80c5b08d9ffd08fe16b09d97dc79e5f759f21a94c1ab2febf

SHA512
fd6af49ae00ac6c26e5963ad5d843e8e8dddd9a2788f955448a9067055ce0f62a18573f433799dbb8358ec662ddc58184d260eb5f806edc29a7ad5dd8add2bed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
5f694c0f5874bf7e0330876caf298bd9

SHA1
ac051591c56a93da0eb248c2d828a8416fb79816

SHA256
0d4824e7b96adfd5d29bd5c1533ce72aa002a241bf4fb19aae14753df93de910

SHA512
fc704a56ac04eb6848d2143276cd2097a6d7f10d3afbef4d263fe4476ff11df625dd8c8fbcb22bbc6585a5bc830c18a96a601451e4c5ed8bc26f226f13642cd3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
20d38bbbf6c7808120da107a6a37a8e2

SHA1
50bb8a1abb46dda4e3b8e6c20e0b1e304d0ff966

SHA256
cf007879747464a476977c6092696cb0d957a17e302b160f3f114d6dd659c2a1

SHA512
adfe4a3e288fb2b2452ac38589ad6f711550b3520ae48bb2b5dad975a680efce24a3d77101ce1e68bc022ef57b39959227de27efc964add4d33d385f47558dcc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
9e767e9497f1a6c4a1b3544be7ab231e

SHA1
157f5d3c1f3cc6dd08c0be128092e9e93be5972c

SHA256
c69a9b1d32aa1ba6864ed18f2979e51ea1a0141a11a7722c8d5df795c1270769

SHA512
a574828162f35a119966f2c24ce3b6d622494044a8d2c90458e9d65def1585b281cc094f7c30fd24c31084fc132c28aa4aede92e47f931f43f8969be8068a578

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
0b6962f06df90278ac8eb6454465e013

SHA1
eaa4645fa384dc9769b080b4bad0e4ef2e9db06f

SHA256
08cf62b2844bcdac7d69298c12f1e83dbe882ea2926dcb9805883ccead0d3b2c

SHA512
bb28815cbcc5bd2fecce4d75180b815b69a7a21a06fbf6a276a9471fa60cedc275eabd25607db53df6cce00290b11a56efb8d818ab952ed18f9b1108e8dcd17b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx.fantom

Filesize
1KB

MD5
95d91ed48a574afe0ce46b210469d757

SHA1
73f770adceae1a7ccc41f862a8fb292867ef4c1d

SHA256
1e4f5207c9ab246327e73d046e296e3efc4d4851dbcbd8571bd1d6b02bdb4c87

SHA512
18360a5dd9e6ac48e2191db816dc1a39113ace3c723bc108f70036f3ecd74bc3bcb2da6716bc6272d9f45b7c1e3708ba05b13d06ec0e839a28b652827a82a632

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home1.aspx

Filesize
752B

MD5
ab104307e4efa82b74af22b7fb5fb8e8

SHA1
e7165f99faacefb5e5c099c0f19d75a13429cd4e

SHA256
d4047d07ee828f173f4d93c3bd881d518ad2028254b034cb59972d4e6b5630f8

SHA512
3c2244f524772a53257305d22a759157a15e2e885c275ab5592f57d07966ccc118787959f3946a0926ff6adbdcddf583d433c7ea3d4448f86d5006563b0aa9b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
c047308d2c0803974a770959e2d2f8fe

SHA1
ab1f1e8033d9860dc3da998d8895d3fab22afb15

SHA256
407087d8f75674f3d6f7343da9551b50793fbc2c382fef558d0401327d5e4e1a

SHA512
c1071ee9277a804732b71b535f204fb9af5457df815e21b3e803c77236a59b2eb40bf31f654698d1a4429f24ce8c11f48d93a2def3a59f17c0640f21566a2ef3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx

Filesize
8KB

MD5
e9f53d46b53754a8f996eaaa3732377b

SHA1
c6eb7aa9e3c892618f598c97102beb23fafc3b6a

SHA256
38bde68cb84ef94045166edb72453298cf792d759cf23ffa8a9b2e01e867dc26

SHA512
62e05a12a8bc563c000db0756134f7047a9f2ed7bec2c4250e07ef1741ccb5c6b48e26e723b439118536c87ec3e2ffb3504f36e76d4879483139d79fbc90624c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
cb18de7c8c6060986a8c0a169362dc0f

SHA1
258e6e49cd7ac3e9cf02a9455887249d305871c4

SHA256
80750f25727021d78e5ee1a953c16678863dcdc6c6139a9405b342e597c5f306

SHA512
23686c6c4223140d03bb3e5e6bee4a28bbea741e86fdc7605c503d07bc5861484b60f4fe44db75238655e682606df895496cd92e44487cfe20f2ebb76ada9bfa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
3e6b3e07fc90e1f6eb7d242db063e07f

SHA1
fac23dec234a80e5a0c0151a9bb15530d3535488

SHA256
d017695db8b114a9ccc6e68893d982fc3988925fb32be8a265b949ca00e13cdb

SHA512
d144225a3c10a5a09da8cd035d7efcf3def0389a55d3ba4c72e4de4bb1e3800882a26ae7a79d4fb3f8f405059018a3e2e20050e0862087bc131d00836fb63a18

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
6dbf6094439b44b178ddd0a7310f857a

SHA1
67f45c1a23b5883227b55493d3cbbe4aa8c53f4b

SHA256
ee1fe5b568be0fa447d2362ca305f5e52ee3462666ae7feb39a7376f21142031

SHA512
cb305dfd7e50ec797ca5dd9a1e73c17455d02413f0fedafcadf4b5ee70552e7ab3f8024578e0c417feefa39be2e79045b384fba09828bcc6c0698b2e40e6157e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
77581fd603fb0e3f64c4f49ec885cf26

SHA1
e75109c2a4616fd543223606b3ad166f7ae1dd81

SHA256
4ad806450907e2e46c52c0e2f01f0cf2d8cd7c7f05914b7012597c4787fe6fab

SHA512
d6af8f2929e858a2225e0b1d5f8543e06ac6243729c0be6b898952ad4ef97748c87fdcb2dcaec66d4bcfe64f9088923dd11e19055c751849b6385ab45a5ce73c

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
9e3939eabe730ceb825d7389ce6f6fe0

SHA1
38095461c5dfc010078e5e4096554ebfea8901b8

SHA256
dc0090ee7d4934942cb115352e1eca4349279411b1eee791b13de52d78661c55

SHA512
bc70825cb88a871e62dcf5325ffccb3d3b7bf593615c84f02be8b3d4a39ad8bc1c1760c5f2a07475ca8a8ef3bdeae23f0f144bd69d5bea1da3fac1421101a0ef

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
d060b2c5627039466db4a9df5a9bc477

SHA1
d346d32415daa49bd575d1331a85a0bd2ab91cad

SHA256
6e26894b05d5508aab05742937617dfc2ac7f4bf0958907437d384d6908bd78e

SHA512
7cd3acf888559948092c2fe8ad8ce4ecf76522f43299f26d165a4571bce84533847d91a383d40e1ef719d7070b2863b6af53c86f248e38b355a0aa3964294e2d

Download Submit
memory/1028-643-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/1028-642-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/1028-143-0x000007FEF56D0000-0x000007FEF60BC000-memory.dmp

Filesize
9.9MB

Download
memory/1028-142-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/1028-141-0x000007FEF56D3000-0x000007FEF56D4000-memory.dmp

Filesize
4KB

Download
memory/2872-39-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-51-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-11-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-13-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-0-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/2872-15-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-17-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-19-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-21-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-25-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-27-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-29-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-31-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-33-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-35-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-37-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-133-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-41-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-43-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-45-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-47-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-132-0x00000000744AE000-0x00000000744AF000-memory.dmp

Filesize
4KB

Download
memory/2872-53-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-57-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-59-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-61-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-131-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-130-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-63-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-65-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-67-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-69-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-55-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-49-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-23-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-9-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-7-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-6-0x00000000046A0000-0x00000000046CB000-memory.dmp

Filesize
172KB

Download
memory/2872-5-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-4-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-134-0x0000000004770000-0x000000000477E000-memory.dmp

Filesize
56KB

Download
memory/2872-3-0x00000000744A0000-0x0000000074B8E000-memory.dmp

Filesize
6.9MB

Download
memory/2872-2-0x00000000046A0000-0x00000000046D2000-memory.dmp

Filesize
200KB

Download
memory/2872-1-0x0000000002160000-0x0000000002192000-memory.dmp

Filesize
200KB

Download