fantom | f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom discovery evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>n7t6x2m4fAwAhNXD6HVPmgc6YqM/aBzvKYA65Nq3jlBslTnUDbGHsP5dW/RdOm1K1RvRSryd+ayoL6K1Puw9auNoUqeS7zOoBPQhG+RF7syPH9PYreKJFl8WWfduu8LJnewduYxhqb2ec7bziu+xZ4+IfegNQfQUaYWccLzmqWdxReY+iwBEcwAShVU7MdV+TjHYs3Ws6TRhHoVoTWWiqRodZG/wp0D3fhVFLxkh6RwLtdEmbichfizmVoQtyWyW3bUuvvdzeaeTx11Xl6BW2trH1anCfYr+qLETiRv9QmqJHebNO4v5wNXeyDT0t/BQBqh0pOce5D/uEySPhEJR3g==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (3037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
2196	WindowsUpdate.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	Fantom.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\Microsoft.BackgroundIntelligentTransfer.Management.dll-Help.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdsm.inf_amd64_neutral_be2b348981b2ef17\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Setup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep002.inf_amd64_neutral_efc4a7485b172c07\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced_parameters.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasicN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\MediaServer-Multicast-Migration-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Enterprise\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wialx006.inf_amd64_neutral_ae607a72b46f9cfc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Enterprise\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Starter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_WMI_Cmdlets.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_prompts.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Automatic_Variables.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Automatic_Variables.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Parsing.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_providers.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_neutral_df8bea40ac96ca21\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateE\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalE\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x4u.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x5u.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wstorflt.inf_amd64_neutral_3db956c41708f7f5\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_neutral_256ad642985694b3\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpd5100t.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnkm002.inf_amd64_neutral_7c42808e24ebff99\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\UPnPSSDP-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomePremiumE\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\RasmanService-Repl.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\PeerToPeerIdManager-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\RPC-HTTP_Proxy-DL.man	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpc4300t.xml	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Unimodem-Config-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_2.0.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumN\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxel.inf_amd64_neutral_ed1f16b3d0cae908\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\manifeststore\user32.amx	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Continue.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\wbem\Logs\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hp6500nt.cfg	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\smf6x4.ppd	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\Amd64\sml455u.xml	Fantom.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\RasDdm-Repl.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_profiles.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmts.inf_amd64_neutral_b7f0a8d5f67c19e8\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\StarterE\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comment_Based_Help.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\license.rtf	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_divider_right.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\viewSelectionChanged.js	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\LightSpirit.css	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImages.jpg	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_down.png	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\epl-v10.html	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_zh_CN.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay.css	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Teal.css	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-modules-appui.jar	Fantom.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-dock.png	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ext_5.5.0.165303.jar	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_ja.jar	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mr\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\gadget.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Civic.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate.css	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\localizedStrings.js	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\gadget.xml	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous_partly-cloudy.png	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.webapp.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-plaf.jar	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\settings.html	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml	Fantom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\zh-CN.pak	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\9.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatiod51afaa5#\867cbe7462b04e2cf1ae39abb576ae2a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_32\System.Transactions\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.Interop\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\smdiagnostics.resources\3.0.0.0_de_b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\system\DeviceCenter\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Entity.Build.Tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessApplications.RuntimeUi.Intl\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Dire573b08f5#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Workd8194f73#\3a72bcdeaedff46fde259a6cefb7062d\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ReachFramework\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\1033\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1053\LocalizedData.xml	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationTypes\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Vf4833439#\d39ce5e7df72ddb95f2098899b7330ae\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Configuration.Install\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Afternoon\Windows Balloon.wav	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1033\LocalizedData.xml	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_it_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\it\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Savanna\Windows Battery Low.wav	Fantom.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\ASP.NET_4.0.30319\0007\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Quirky\Windows User Account Control.wav	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_ja_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Security.resources\2.0.0.0_ja_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\v4.0_4.0.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\it\SqlPersistenceService_Logic.sql	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\ehiUserXp\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_ja_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_it_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.InfoPath\14.0.0.0__71e9bce111e9429c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_ja_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Windows.D#\e97b40597db13e8a8151b30b9c59007e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\2052\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceProviderSchema.sql	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\1.0.0.0_en_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Savanna\Windows User Account Control.wav	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\UninstallCommon.sql	Fantom.exe
File created	C:\Windows\PLA\Rules\fr-FR\Rules.System.Common.xml	Fantom.exe
File created	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp3.jpg	Fantom.exe
File created	C:\Windows\Help\Help\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000D\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Cityscape\Windows Battery Low.wav	Fantom.exe
File created	C:\Windows\Media\Cityscape\Windows Navigation Start.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\9859a6e0562f64eacfb8ad76f260a2d6\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Service#\5d0f494f1be2367fb0a634956f719965\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c968d57#\5685d6d6ada98c8dc25bb505e6421fd1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.Composition.Registration\v4.0_4.0.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2876	Fantom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	Fantom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2196	2876	Fantom.exe	31
PID 2876 wrote to memory of 2196	2876	Fantom.exe	31
PID 2876 wrote to memory of 2196	2876	Fantom.exe	31
PID 2876 wrote to memory of 2196	2876	Fantom.exe	31

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
8fd2e5506235523a878f06bb6b109f20

SHA1
52a88750567188668e193e6ea6cd54080a7e662d

SHA256
de70f16749369f9679892fa68413ec936b7c9843fc2f1a93ec0dff1563509cfa

SHA512
edefcc1dc4d2614ed0e0b6966f61ef04a00d7d9ee24113941dcb05c6220e4a72c17e70c5ef1ba52081a25f055de3de417139f8ed7f90bd48bd82581041ad2c71

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
352B

MD5
b578779760b17905939d23d9de4b8724

SHA1
99f23d41e10b3875828bb8b846606e855f17a09e

SHA256
0cd01a9fa850888d6d4d3a4205a2cca1d719d4bcf62d2049f2589a5a92abfa84

SHA512
542611b3ae36ec61d31f82f4fcd29e4499a2e7599fb11be5662969735f531a8976c6e7448fd0ba54ff56c3a7ffee26e76208a1e7178b342e48c697af4f2a19a3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
224B

MD5
d8858ad15e52a04a47dacc8ae0d4a991

SHA1
5a96e80875d551decd535d111f68b5dbd6ee1bad

SHA256
c6150b900d7a5a94b9baf769cefed406bb40d847aecd4f173b812c1abc0778e8

SHA512
9c41e86708876ffb9548b3ab8c969bf67166bd62ea0fb5d7d2f4f14a47d204eb34e71daacc3cc76d3e82990043463e6366cf01348c1b964531edc3bf290016a3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
9f16fabbbeb11396fbedda4f8f26c947

SHA1
a32f473054ad0f59f95f56ba8340b1654a328012

SHA256
89777456e48733f203978eb65d92ee81036ef90b7626b6a7fbdea4c1da27f772

SHA512
3a5840232d0f7ecd0fd6ee67a6544fc5a3d204a0c39681f1d4cb5dfaf126ea4227156feb6562fada86bda559c6c7c271c38d185bdc1fbd57e78330ae611dc215

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
a2ad02f61285851bbfe42ba575403455

SHA1
03dc87f3528922852403a1657c8a0183b8d3294d

SHA256
279d1325c9c3e3ead434fdfd1fee57724ebbc49f2fb202bb40c4dffc0f98b2ba

SHA512
ac5e662148d427a7a5c4493bde51d762860ab4f356adc337fffbc178dbc6594591a90e49c2ee644116cc2ac95a0505899f36d8e962f5b68e76fb531ce70071c6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
247aa8bde3048483b4be86f28e6f2915

SHA1
48c25b4054ca7ef1134fedc98a94cf4e0b74e4b1

SHA256
f3f493299448810a295cf2b13f6d5e1df677cd7ec1a6fdc3f1d97229392413ce

SHA512
aad5ca18f18fecfd6d070e93137d4318802759ec817f1fdffcb768a3ccd9b8c002dcf8ffa381c1da105a1bcc803620524138ee809eec048a52555053c8f577c4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
4dd0d5111553bdb0646d416e19c91f7b

SHA1
9e4dc2b35cd964fc3a75b3196f876146b0f2130b

SHA256
8c6ae0026170eb395683b4af21fae045ee409de27d8bfd753e683588f3abcd3e

SHA512
63cdafa1762cd201ed627ba7e98095eb42786d002e37312ccb689b52fd63f81e61c8b802d6a62cc709e83e610774c0812bfb6a69fc88a6593c740a0432c2414d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
112B

MD5
e3ddb7ca99156178ed825dbe750870a1

SHA1
eec1866b7c1bdf5b05082196d2ccd8f94f77c257

SHA256
133bbf9a1f982f3b26185ddaf18122abb07749616d54bad115f79666375a1a19

SHA512
53d4981a0e4b8f3fb7fdcd19875fd8985c0b92db00640085bc0f8327cb28d8d33281621a319ca526ee95b0bc2c24f15102c985ecb663436954d6dbc8602b6571

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
22c371291da30266efd1141af0d7b431

SHA1
2bf9ba9b2448bed3d6640c874279f521ea96a894

SHA256
d2f509a7df2f7da8623fc01c12485cf6656df7803a6b68088232d0bac901f394

SHA512
3d706c809d7ead514dd10dba204964d2398fd983c2f832223a300621f492d4dd7c736cb6afdfdfd48c8ec133d235efd5b084b0a6edd4d7bacf7e4c91755a5e43

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
bf48eefa2aa56ca113757bcead857928

SHA1
110ca367f44c12ef6725d4bf924a408defbc62d7

SHA256
6fe7006c8ec6411be71d254f539241a9f747e3bfeeee5b52256c43f2b1636117

SHA512
6b67ff073fb6ad603c70de72fc276eed50c890dbbe5c34c92e31c473e6563e87e2d95fc71c7ac3d32ea78c51143c9f752407e91a5b9211125ad311dfbd6a96cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
8e4f5201300820f5e3c5fa58782e1afb

SHA1
03651b69d0ec96053d80c795d9e04509cad70a9e

SHA256
c08187993f40d3f5423c5ac2b8d628df190e73cf3b72c9b54296c542297a6e93

SHA512
e5696a41d00c13aee53b409a630d7c84978e71608e09a429d6acfa86c365aa12dc3690ce6efc35be8af3dfc384b3df792504b6a10eeab5d71fcf3b8697a3af30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
58c85ed000051bb02ed685c1807ac503

SHA1
fd859ecf5c24eb1b48d17c036a80f2cffa43ddbd

SHA256
73fb66af5c5e62556ec4cebfa7e862a0befc4aec21b2ea007c53f60425c21adb

SHA512
a640c9305c5f192fcac45cbb44a9c48af24cba0d4b6190a001e3ac48105ed647f3faf47da5b7b909a5d2372d08d7764cfa77acd15bf7328ba7799a1dc216c978

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
035965845bf26aeab1954d66913f4ad1

SHA1
69c2c2f23a09e779f768fbe12c878d73f8112829

SHA256
40203ae78afd676eb25b719d63bc70daa6f8448a5bb0cda0969a6c2b18e2e9c8

SHA512
b1f7fcd86d95f5f853a002f2a0a41e52f275b323941d4ea70975183cd8bac13a71f477319c68c6db37a80466c0e16eec3ae1bb6d1d1f6d6bf6090af3bfe24992

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
34a842b2830263a5dca3543f2c3d92a6

SHA1
dea7f6f42aee22e674dfc5e84c6d05124142c2aa

SHA256
9074efbcb205b7d2d2e5c382fe573b57818a55d72d2944116eeebdacd36659e4

SHA512
4355531372d470ecd917edcbe4fd13aded805e223322c5bdcf9d44b22d1e95f62ff64339ea876759b0c762072a0f2e6c74a405168d0bcc033c69c2dd6f9e9d23

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
ea31cccd6d028bc037b468ffe8a73d7a

SHA1
4c3382a7fa2f8e0ccf9d88857bad776cdda34e24

SHA256
86df11d8a6ab0f7458acb8e24b71a1ad4b2670295b724a974efef532a2abbb28

SHA512
1fe4b7a1ae08867093db8dde4d61e08673cb0577620480ba15112addaad7d1e9217ebc15ef3d2e860e19244b81e78d6695ff8749bfa4d6338a926b55c546e4f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
e2c8e7aacb274070f1615d75d52dff9b

SHA1
0256ec384ae93f9a9090d46293fa7ec022abb7aa

SHA256
dc6dcbcd43481fc4da74ffb8404dc83711b892a860d278b7fb6732ca84aa7fe4

SHA512
f2ec2968a82e9d0cc4b747190f3b750c133f4f0f7c323f3bcaf6b2efef479ab9e13fa8b15112c3f0703fdfe14ac16dd8a225a234adadfa81199696ee348dd1ec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
7KB

MD5
a25613440ac2aeff959fd65ea3a74864

SHA1
a702ca0b54c7c69826599d24726d695dc4683395

SHA256
020330fe2d1a639d61308263706168e23c1843bd0bf5b95fa33ab9d5d3e702be

SHA512
6d6b6ad014c48e1f6b990c0b7dd8f3194ceda3e7eb24ad5c01df86ee9e3a426b7ed45d62c8a28c0d6261aa588aea900ecd72b7b12651511c05299b5c58dc7262

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
336B

MD5
46188365f850f95b1c1677d1ce49892f

SHA1
a2cba7c749f79e33b6867a0d6af9aeccf949ea2d

SHA256
7b2a25f7ebead08ec0f057f970a1080b539698799e6cf7e9fb2977593e43e92a

SHA512
ddf0b31a8ea1ae065dabb07ea69b687ac30eabef84a1525a35c842efa1456b96929261f6001145849c89a76d8d228a802aa8ebd9151e55f18f54a459ad7155ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
240B

MD5
f4814bb1cb8627ce0d861d07d373970a

SHA1
681674c23ea8fcecfab0e2e120b5f5a366fc9740

SHA256
03238195e166ef150e5235e1bd4f663b3ef1cbbf10215e7596083eefe03986e6

SHA512
23723ffc19659f1e0bbb7bfc926dc0ad0bb93a6ae3e3b652d2ea77c8a8ffc35c20ffc9e827a1c117ed3f279fa557dc8767180bfb6379403ae1061d770fceb876

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
3b5021eefab5b8ef147043a1cdc70090

SHA1
b74edfec5b072b2880802b719fb517b07ba6d36a

SHA256
9e4b1a61335e2d3b573ab4469f5d53785baeca9560be4d08bf78b558761d143f

SHA512
e47af12e697844ac5eecd309f69c579a101302e3b956ab74fe673665b1264bb73585067af45f120e01cc3ddbd8e9480a1b573ffb889f8e6cbffca0c090c03f85

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
816B

MD5
612c5c97f48fa4bb9d088304c7764c70

SHA1
263a00b72cc6aa744f3c0299609ee658161217a8

SHA256
1ff8c32da8408725152ec7bb8041dc730186fe9fc10bb900643bf91249640b0b

SHA512
06a33005497e431e37093a0fbb7fcb25a165f5608cf2df529f9cbca3eae67d3c905d8d507424aff4eaeeb41b1a67f1b479774dffa9fb9c8fcb0b23ed44b8b29f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
9c79550e18723f7449736f792d129fa0

SHA1
96e338d17420116c20ccb0fbd9ffc6150e4006f5

SHA256
5991ca53884071d00e5c0ef9eb84daa9660ae914278749d08f57ac19e2d65e11

SHA512
6ba75c54f9008cc44ae8d2aa6271b15b8c565dc03bb1fdc86fa3375fc5f06cd084e4b980e34cc7953e6038ee9a55b7395f60de804ed3889c0558cba5fb8418b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
69677e9046d40e2acc6d797700b4c0f6

SHA1
c15d5b314900e4d64b8d5614f78e4e1a2620bdd3

SHA256
2af7945121153889eae6f74a22975a2537b5697da1fb9e169d87c4ed4b3566bc

SHA512
b36f6e5a7e42de8e13534197ec17ac05d8f2566b94498cf6da969d446a1232b5bcefe2d284d2bb19451dbb52dc6b4f57212d1e16155a175aa432e2954b5e2b8b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
fc7d7ecf427f005a6b9d605e5af64fb1

SHA1
a184eb511df787138421e28b22e813252acf67cd

SHA256
2312a5c7980374391fbc21b24255e1a06facbce609f37715a974a6d80d8d1952

SHA512
a3e76b08f7751385ec4642d357049b5c9f5ff6a37c8b0d85b22ceb4680f0cf04d4aebf7fc7a802b0fd08c842faf0bc98eaf10c0ff2a05442d42462c34cb017e6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
896B

MD5
9d0bea772d6d5e66be7638682f26382a

SHA1
64fc7a6171e687a5ea2621b82c6009baab2447c8

SHA256
11393b70a5e7f449bda78c6671748860a972fd3d5588d6cd036b9e2390b96311

SHA512
2b64da7c360910444a2d8aeb0951d5c28c713b8925bc6a35a96de5ac7c161d85cde38dd7254bc4ea593668ced5f6ba72a9c0535f66d8cede9f5920cef3ab3fbd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
864B

MD5
1c76e4b3966b819c3860b4e6bd593aac

SHA1
f067419bfeb4d5183ff17a9ebb75de4083765b0b

SHA256
619169a9b46f43148736d4f5b22b8f16b78e71e35d33e9b4aee79ded2edd41aa

SHA512
3895b9be7c6993f2c0e5aa95f494a37adf0c971764e52bb1c2a9f01f0f2969cca5cb74a8766c278c72578ebdc00935aa91c087fe009f518d0c872575bfd4af9a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
864B

MD5
89aebdafa919e23b706e362955686fff

SHA1
dd147028eb07b6319d07d6c1ecbbe19bfe0302d5

SHA256
7eb316ec5f9fc400ddfbf5396a2b67a02318551c376e2998322ad2ce99ff1d66

SHA512
45f01d6bb3ee00e6d5f97c6892c710bca70b51f20ee853d8821d46b6c6325fc60efbffee01572c89a543a4d102c38e8ebe3f10c1a67a909155ca5e9b63df967a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
65d03880a47e8fe2f25a02c6266d5137

SHA1
769ba45c3c7b42673bad6d914bb322f11cb9e205

SHA256
a0536280bce36ffb5bb139645013a4201e6b9ee8b31a072504466938f61b0168

SHA512
c81b06b974a7a3ae6e10fd8026491e58eb8ab76e6a98b19d943a30217a41540b972983ad02b5645211144405170988e7044edf52e47dd2f13071bb4e049d56db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
bb3b22b9bb1898b1fbbe9be9108c781c

SHA1
08875b69759dae863ba84f7b76fe3a579ef426b6

SHA256
24ce07ab028899ace4ebd073b3837b5bc21788cd77e3aaa42d520fafbe2bf400

SHA512
3e5a9024d38e37855595da685f2d0411a60a8fba761b087937b7f5c8e78fabbf0b29e880f73f43edd2e7572b631715d1c5a22d6e15823703f9c141db281156ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
864B

MD5
1f0ea2e574f03e666cd3bb6d137c67f4

SHA1
c0eaadeefc6dab9aae1867b1a9ef571916fe6074

SHA256
466e22d5901ec6df476712f2eeba7e58116b0cfe4724023c19eda2c45df524f4

SHA512
75161c78bec63b36e17b717da758b898ab021aeeae0fda28a0c42dd4af494b284dabcd927ad7751eb12082c0b0df4c90d412077966e87b448d89222f3a6f69fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
848B

MD5
c80333318310502fe8eb916608e207a9

SHA1
85ee8e3126d24a9428714f2415263a476f9eae34

SHA256
45f38c41680eb1db0b613ce12ff9148185f003aff2b0938e5568e23273011bc1

SHA512
dfcc24334139407c52d1422859a28ee4fb39601765e34bbe57182822078d290f5928147d0761168145d5c757e40e4653a65f2b3d0a1af44af0852e12bdf5abce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
880B

MD5
11af5718495c36ecd1b1743ef39b6dae

SHA1
3855f6123e90fa10fb23f124ac6523c4c0265a32

SHA256
f368127e9447b9a688ae433eca22a29d34b5fe93356a92d413ce265443b4d2d2

SHA512
b6d39f3ce5dc8f6e02decd3e6ad2762f1968a9b50a4445323d0ac0554fc9765ade70f26b17675d44a72928f560e6b9457a4f89b8bdd57ac9243c43065016a931

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
848B

MD5
408e82773956ce729cdb406ef90b869e

SHA1
aae08300e7ec30ad28a9131016e7f1a31c6b6235

SHA256
96863d25f93ccb05e128dff7800894d4043d96f44a98c60be634f2e1600badf7

SHA512
507398682bb5f18d099e06acf7284dcc46459c3acf950c551bbdd8f076387dd0f9d92d9f9984ed37a484f8f727a717884476a0f712e83c9f421a89a2fb8bcdd6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
864B

MD5
c2818eef5919e9017796148277783bfb

SHA1
c60c4a5ed10d1e628bfb69eb224b525236493233

SHA256
b6628f364b6301713c77ad123e55f32a5a07c374b38a04e8ce0ec98e3e3eee1b

SHA512
8e9b89cddf624af77fa1b5a61ed74286ce309844253c56c70aa050dd90d2b3965a041168b0e2d118b80e6b3eb4235b5c4e644d590e798b5f6fb8af1d950b39ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
864B

MD5
cbc0ae5e2d2dc9cd8c9178d81b7a31b7

SHA1
6df8b05d4114043053e199eecc5eaa9503cc69f1

SHA256
9601cb9c48f623cb7d85ff0452d8e6fb5d42ac52d9466efe574e97ae8e20f19a

SHA512
ae86952459855f78639d1f3995cab3fdc96319fa56a1cd4df6f51fd3fad3fa204f80e40aa68a8ce2c17f98e073c3f974fd09c28f0e33f2488d4beb579eef3118

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
864B

MD5
1744f896167494a2b7de69ef40df9cfb

SHA1
937c11e2b38ce12ad2dbcabb56813589af906292

SHA256
2cfbe86ec4ad84a18a9f9db0025efd1da92b719695dc04b4ebaaf1628f2b88bf

SHA512
17813d615b9f7135f9c289b182f3ddda454ab5ceb41ee0b868835d81512aecbca4165e7a5e33a874065152a69bec3142da342b794d042c8ec2c927a851ef8c6f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
896B

MD5
0d087d19ce1478aa5be1ad075b879447

SHA1
f7c728f2d3d5aa1bf2f859b8bf219acb378769b1

SHA256
cef5562a0b6584e65c3147743e83be4bb24e3c5e9c14aacf1196ab9c47140f4a

SHA512
c7f98a153295268a8f7f4935a7493ba72e69bd71d1be536a9bf5d2e193202a9b3e00b557e9fa255c0fe9a40ac5e45e8cc135ddd675c4267c04bd1bb9300ab8f5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
ace7d1cc6da05d60d6a3b449f06547a2

SHA1
a0a459c109e2aea366ba3fc4318ef9ba746e981f

SHA256
19f7dfd8bf8c3a51f8af4fa54ab19ccca8d8330950c1a746a4756efb69e61e57

SHA512
b82fe904d0db982a3643f48dbd3439436b53fe80e62fa6608cd340fa6518df6299f4dbca7b082440b1c298efa2b3144ee62cc8864709b6d03f6a2e1b910b0f90

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
81b1c33451602892970a365f521c2afa

SHA1
cae64385d3e9698c65617364dc5dda0982f593cb

SHA256
b717a5d3673dea412b15a6786ba6168f73cd885757ba8b798266256b5aa3a709

SHA512
82d0d47b472e9e7a6ce24cc4d7b16beec67c8e5d139526961a1fc9a97a076c567414dd0484217179f9f72d7c70547130689d00e0f9c656af7e8e49b0185e6ddf

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
56899c235b4aab2f8b69019abcd4e197

SHA1
0dfc94f5b4ccb5b45502726fc1f34cebf94c066c

SHA256
d1b411e98a896aa1f2b0d29acb4f46cc1a4f07a7046e2829347f5ab7522d2b0b

SHA512
f153d87587cc0ef7c3d7d56894b65ef7f641ec31f3860d1106ed01c42d27736eb9bf741e0aef7af4229855ae59f7c13f92706dd2d9cd917ee31e7e4944d931d0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
591959679b9286b33bdffa950b49b955

SHA1
71261cfeb40510b18551c0015f00b2fb61a49f9c

SHA256
f889b48ca5537a175d48ef82ffd8a51121755b091d0195b2200e47796015e714

SHA512
f8513e51ce9715513f63ea51819915162a20f5f29b7c542bd772d9b55a7e56e9d239d228bf7e7d3196f226f718361874e1767a09fb80fd94583e40c447b23482

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
d232a4f35059d2113bc8ab9373d06bf7

SHA1
a65eed667db4fca46321252c477241bf4ebff764

SHA256
af9c5630bba0727b982ad120667b2f5065efcaa1b39593faed43975f9069a217

SHA512
388ff3f65613b39290d4a328c96585c2869becf1563759d940752943bfeb34ab35de8c4d6e8cc24ba5b21d5a14d06c374a916c772cb382879b0aadd1b84a5ac2

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
cfab1a70e8aeb29c730ca370acb3b5e6

SHA1
df3315740e1f42865b8355e98fc59d878f745be7

SHA256
ea5fdeb4da293ef6eec77ad358e7c55b212e44bba33746b1c9ab885d5287d0f5

SHA512
cd8d5b16740c3f92e35fd474aa6c9d6668a59a7e9a09047e92225c307e81a7f3f1ba35214e47d636cadf60a4d67d6da3eb1bab7ca21405a622ad1cee3dd3f1ae

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
8435bab0482d0617abb67acacaa243d7

SHA1
c249bcd44f8d2ca361308e5628a71d14a530683a

SHA256
2458f4daba7cc3121cdc07b85b795e3f950569ba47a860a63ec26f2a83f05dc0

SHA512
04d41a898084172132406d902399a3b59a96951567b973316b38bb01a504230b1103fc5baee8e109cd36fc684ce7ac41dbec61f5a0250828d70931b80280bfa1

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
16B

MD5
89ce35e94ecd36867e5a7b2adc1e62ea

SHA1
b3788bc12561b28c9d4e4061afd793592e0f27bd

SHA256
83de4bbd0d57e611743268078d0f675e5e28eff9824073f6a6bea79cef0d7313

SHA512
16fba554934121b1de6eaa4edac4e60a2c9b72731618518be931d486cd80209504756bf9cb15e415836c73e896a1a946d60734f6e4936181c6f50cb47d3a9ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240704_210306716.html

Filesize
1.1MB

MD5
4e061c17bdb258292c6d1a892673ca81

SHA1
e9340429f87416025a8f46102cf927da7e2eb5d4

SHA256
ea4855a56bed8ba19bbcd352af947f370974ff68aeed4952129c3869121ed1fa

SHA512
b0d4846006afa52b59a2e51b1711146b0023feb4457fdf95ec105eeb6b02ba16073d46dbfe8ca1f5c52ea63bb856201a4f2fc89ee492d2f3f5cf384fcd494109

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
64B

MD5
e748158d53edbba4e665d23bf4a1b3a3

SHA1
bd7c7afa00617b20e517c573aae6a9bd9d2e842c

SHA256
e20edea5608e108b059891f8ab971b05b6a92291c6529ecdb368137695b350e7

SHA512
fccff122fe632062fd66cc2453d299a2dfa436745be4a8b1b00e0c648ea3450f59b45660c0e1e11a2d49d8b1356192f2ac2b4d92aaaa2a31154b33e35e4f9738

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
80B

MD5
2a7d80feb692a4b43f2f3f302e534685

SHA1
e3c6837ce7095518f9adb50a50314e952ee965c1

SHA256
631b0a9be5cd4126277fb25fcda60c38018e9a18299fc6add5945e97ea87dc4f

SHA512
c2bef67d73ca9c357102cbbcafe3c1012fe927528bc0e4c47fadca1ea9517e5be0d8dc581a9ddf868188c81eace7ff7b3d360a9b88ff4d0a6eed0d3169f34cc8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
80B

MD5
c0a07a7f2d748c28be627fc42df21ff0

SHA1
a8bd3563aabacabb311726df475d4360011a9c27

SHA256
7d70295d5d581518388ab7e0f3645f5e3e5d564e3848decf21a4ba6a3964e3f9

SHA512
3c8edaf8baf98d780c342827b769fefe70469af3318ca5519e5ac78559aa9b69233bebfb25ac01441fe23d1eb60477dab97b727ee5ab999b72cb1139a9408570

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
4c977f79a50f72f994d15e142b2b4322

SHA1
527cd13aebaf1e6f351d56561a77d683c1ca0b9b

SHA256
61b45f8368190765e7c6b1780af261d9bb3e6a7f96e2e5314739788c2956bc65

SHA512
138cda4f457996d40c3a13d17754363290611d48d074b3f0654baf7e73b29bfab60626299db317557407ec8dbee62ca928cd720c38477971578427fd033f3628

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
5efeb6d0b53f7eb0e9a734e0b4a95fc2

SHA1
4daa2f489b0cd72aeea4d89571327ad909bd3120

SHA256
e5de0d0c8a56cc48a2be417e82ca2e125e23e0608a2f14b320012f3a7506daad

SHA512
9ed1a37b748d938b8c160cdb793ef7442110d218070bf27dbcda61596e7863cdc43ff93f3e9f2249bd437fe38487c72b6176e51d02b59a9f310249761468acf6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
3KB

MD5
22208b495ada18a7b6e68bcb16505282

SHA1
d7faad5156ac54e4bd4442ddf050c765b31bac81

SHA256
a269f05595de42cbd345f0287c35299c5a4680ee788e40ece09e26ea73f63998

SHA512
3dd2cb4108e3a2c56f09eeb90ff7de4bab2cbaceb639c6745f7e3edd3413ad54dfac95cfe9bde3e4651802c3d82cae359130aa0d72ef66af57ee5083cabb43e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
9342e84d8fc32a295fb4dc48c8d2f7fb

SHA1
4a2f1be673e3087737294e91ebf67ddedfe927ee

SHA256
e82f366a7515cf87585ee2d347a72839f53cb579fe4597825f078cc6a199f077

SHA512
98bcbc1f6007acda9c2cccd397104aaca312cd4d2f542fe79c3b4769dd28211597587bf37ac48c494ccf7e8723cc425bc9c0fa025ee543aeb3647b30c0343a75

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
a10a65fe53c5e3a7b66efe961c25c124

SHA1
1b5d1936d1b0191be8a0b83cb4f47fc25975878a

SHA256
9a45a3a8fb27d4bec589904ebb6e9126d940979d6db8c533a6feaf9befccc567

SHA512
63149f883d1fa1a826cc56b5153a537375da3be0b9db48b1e19505e70287f5756f4fad1fb962fa9f76eadc7b16db29a68848f94beb687b08f4b09b029b630b1a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
4882ecc917cbe8de12442abe9ebfed8b

SHA1
ed22d9b58aa8a058be684b24e19d874765f76e01

SHA256
ff59ce59d35eadd23cd1b2cf7d7e427fce12151769f62c2881b785aacf211c1a

SHA512
95af248128ceb0824e38da74d3aec92d65c07d05bda6d3802f5647f8a014318e40ca8d3dbe6c383015737c7e37d65b35e3df9f0899da89a2190cc85863cf46f7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
7231a3479583c3c2ffcda4df9da51531

SHA1
7b12a4a98fa884d90c8e91368e9cadd3f77d4a8a

SHA256
96889e93e17277aa16b281dd7117f95f9279ba08cffabe73581f459b4b7fb78e

SHA512
6d4ee483cf3cc3518a7f983db740eeb134e21cfdf07237772f48a038fabac90c22ec5b86a827eec674af8df0185efe68bf144e26a8e2a1706aba3bc850388444

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
aa4ae6736cb1421684c7a38421b97152

SHA1
91fbd7678a0ffc9842ab3ed91e15162672070236

SHA256
a4886e22efa7380655f1661684cb0d62f5c0ac3a3b6831dc67a906a5233e12bc

SHA512
8a410d9f5b2fc2c554847647fcc862a85384ad6011063faba1fc21e880b02d00b6e9f84128e5725b16ee29903ebc7fd65fd5ffd1c66a8f44e0d2e1f422d2527f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
011603b6225a3255ccf2c7f0de228f60

SHA1
5c9538f587dfdd981e274aa9e07209db4a053f2a

SHA256
646b1945f3652215a2a36d511203ead429191f0e58f0214cc7b7e25b11b9ec31

SHA512
8f45c512428ecc6735107b34097910e93e08d2882833d7dc699f70a915b042d9a51bdce15e6b9f82baf86a386dd4261c9915956a1b64e02858dac641cfba1621

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
01a59fccd8ed5ad6db9d89dc49c8251c

SHA1
eb80accb4d9c497b0674185ca7aa6d81b0a0c116

SHA256
fded4ac180c3e68055c3dbec45e259033dc7f903fa38057c661d5db949fa5aa7

SHA512
724d6b6b40674310c805146dc9f3814dab382ab8cc04eb9e06bf64b0965936a6dd7c912170c5401495cacf3d834bfa98bc40e343be0de85d5831ca877df39516

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
cc274c31f127388d42b7576c76d992f8

SHA1
2ae13a8dfa9e0cfc2790c6649082778df5dc634d

SHA256
230a0043c472d7190c9ac9b3c31a8890c35ff04bc32085cf2086f6bcbcad1240

SHA512
1be06d7a51a6edc038d4c904ebde9810627387e85835ec34539cfc1ee149e93dfa3c9e0677a9a3334c6989d1f453e273a6a86c9afdc84bab792c39d5694e786e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
8f5c35077678e3835d16cde4af16b9b0

SHA1
373e8a46d47bae0fc9f49dde47823c6d697eb526

SHA256
fba6552306d7342452391d05968fbcc0146c1fb2068fa76380ee7dd0eaec5dfd

SHA512
4ba8f54aa3f085f24ddee89bb46393a869192401c9c6f102bcc696352e91aaaa6a422c1c7942ed7454eff2c745c8abe0223bb15d0902cef741f3356c4902b9dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
b2049c5cea618e90084b16ba335f6337

SHA1
52434ee30265681538582b3b8123abbe4cb0f894

SHA256
45484eba1e3a7977bcfcb72f73f2d6927458726da4f8349837d523761d955c31

SHA512
ab024e3239e9773e27dafff55bb24bbbc2123ff3128512c27170910b7aed20fbe7d1d30b08c44a3bf3a24491135587821cd4553c9668bb145fdf8a17c55dbeca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
ec77ee16ddb7c9bbd6f7259636353399

SHA1
cc855fd8447c9152865c88bf2bc2e96418539925

SHA256
fa64256c0e7e7dd81ca580d997d896d95f9ec87bb7f83426847cfdb87f217caf

SHA512
3bd979bb40f9176da3869143f953bb6f008f03f5cd5b1cb0e93fe2c7adda1af97db39bef7b9512b4473530843bb958a93a682192f7ef2593b89c3766cc5fe8d9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
ce1d7ec52340d7f2a8182dd864b5bfda

SHA1
97bbc2c335646ebbbcc47529223a40a65eec7e9e

SHA256
a4121379003e7704c87be6158c503dca2487a7704cd7c41a696967c845bce0af

SHA512
293f8ff8130e6e77851135a0995827dcefeef506fca2925a8967ce939b58e7955a9916e9443b0340aacdb4daa0d94382158e7057386d7c7becada252a7e0e424

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
4b9e3a8a6910a973b89b0a9b503e90aa

SHA1
1ebe8d1cb3b4e6bcffbf027ea7af45f52784a341

SHA256
e47b2b0385edea8f4a1f225679e61f8ef4b8d25a1e79f2222d8896e790b2e47c

SHA512
15b3d3e96dba22242b7e7538271bf993d46778afbd82d4888d69127b9d0529fd4a53e71479f5bee78e45b7e058a453195b54a51f912853bf93862e8d4b58d2cd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
7ff59c653e20f4cd0a7496c61e0f5959

SHA1
00382d745a4dfb8f7eb2b58652cbeb47c9b0030f

SHA256
fa9288c5bb08691fc14f55d875a1bb931d0a579b38c4645834d8431e1dd6ebf4

SHA512
17d57f5b26ffe7dddc0dbbbba0c5d749f53f2163652a5c194de933ed213c5892d86653e97d70909aad8667adafbaeac9c4a7822b7a4bf2126eb1466a11d1a1ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
024204c73b55f5a0a6976e27901ad67d

SHA1
8172e79aad7517012f9b934d7096c417985975f1

SHA256
1dedcb7de9fd6c344b157305657badb216f12932cab7bbd848f2f65c0ba653e3

SHA512
308241b02ff952ad4ab69eb1836b8f2b4886e590aa78ad48fc8b9de4fb86eb28b33a293622e7848d76a72d35ad714d35ccf2d52d763b320937dd02e2bedcd990

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
84f3803b45e597445007891effd07def

SHA1
7def2c7e341ee767905af4be81a445c0ab51739a

SHA256
24121278c7e194fea4ff8b1a568b73f88eef2905b08a3bab7b110890aaf089a7

SHA512
0373f8a96d84c911b502dc41fe997f8db7dd2c45d354d13f194908a0b9be3c3438ddbf1754e631bc71f2a94f6ba44f07ad7ae9408fc9ff982d09a564b4e23128

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
f3771071df48345f7b9403bc56fbacba

SHA1
65ba2cf83f0fad4fbb957c5a010aa3945b3ae041

SHA256
218297f1e2db7164b4a956f21ebb354c9a3178f9ce0653363dcc2ddc1acfb8f4

SHA512
2002aaee055645a0684d347f6f8ce1caa09a13f9630298b51a863e63c5758f31c413dae706fbadd3151aaa296016c1b6a26f32ce634216893a0bfb988edbce77

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
4e95b5f8a3803ae92ddf22085918a47a

SHA1
c498c22da1958c534cc98d0ca68ed0a9079126ee

SHA256
085ca94b9b87631e8f660e500818416c1f29fd740a96c6c9908ddac78d00b36f

SHA512
bb9405e7e726ef550499fafecc09eaa07029a29a9f05acc0743b80a63fa0265d295bfaa068954298eef0ce73a896c958b6e29a93a5a229e534e6c329f666167f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
f94671e2e9606201c625fe32882f3ffd

SHA1
d724b93379a007c57a6b06f4c1da095aa843f275

SHA256
d1fdb93c4a840bf9bf9877ff2ed683e9dcf3c9d0eff97158c30aa9c3b43827f0

SHA512
a47638bdc49a1c74c6740ec97e7be3e2a3e8c430c225a1341a21e6e8d259d6d47b7213182815884ae3af342b6262ad8f814d45f80ea879c872dfd1c0c70260c2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
6f0fb91e62a8e61078c0514281ab8fb7

SHA1
5edc8bb2eacaba1f620488496e4f0dc6d93f899a

SHA256
98ef27f81e3236ba87a53aa6e620a396f18539fd1efeea553412d3d23bd8d8f1

SHA512
b5b724df3bffcc123d54716d90ff923f3025cc4829a4edc1d3860076ebd36781068f3a4686f0b739b0e8a6c32fd2174ce798e238754a600d2c2e66ceedbb1ee6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
065d63394ac457d7823cdf1b9d0ebb36

SHA1
425402a709322b1d0dfa4124d514be4084e4e57f

SHA256
65ac766e3c5bb8b99ab81e448dc25a45502634d35133998c21951223f85cf6b0

SHA512
c9e39f10bdcdd00b1e8a165e01663fccf9f9ffc0408023c2b77f166be9e4ebdc1f44462ca8abe4f7965bcc58ffe873414f10fa2ca4ad52a6cac87701b05f7792

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
01329fc49d466ab167d1b704dba36576

SHA1
ff43d5098bbe1169360b71b5cd4a7f92ced5b124

SHA256
d22b84bf7b48e744ad39fdfb7b97bb27e4d55dc176722b26c8da014e0f587094

SHA512
e362824c8cf68252543c2a43efa8f7bff07aa2e98017fc6fbc048ad42075eb5f774153e574104e2195e353a05caa3b3e7b77f6aabe74068a1caff0300a6558d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
320B

MD5
c5fd16aa5bbf1a75cefa8d37f55954b6

SHA1
367a6029428101c1a8e094e15bccf4a1a104429a

SHA256
0802579cfee809aee89c78f5950232a1c7cea2d4270b2a9fd4c941ecda791a13

SHA512
024df02641ea9755cd5f59bf5c2bff5571f319ea4ef6ba766abf2cd9f73d387d582a7999ccf0321e9a348a2bbb7032ea5ebb9b5213f0016d8c82cf3192a4a52f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
f55121d51b17df607096991cab8bd6d4

SHA1
8d88b3efb583125505c1c4b19c11cf743ca9b6db

SHA256
160fef74bec4698a0db8f7e9231284392e4c9466b84f079751e5470feb2ade08

SHA512
8bd2ec88e9c9d8cebd6124f8fae5115ee1f0abb281580e408e8b236bdc7cab2a6e70656ff82efc80b7fbfc8f700102c9dc833294c891412f0a4444dda6d43ecc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
b9d1b67ea8192b710c29b344fca2ef3b

SHA1
e33586de32c5533dec7ac30b97522a66da46b204

SHA256
fae6709f371f81cb8e6352283040554d48e212e3401e9448e610c5025b2e81b5

SHA512
08fa5b684e940edc4fb375b96b4ffb9a85c765cd4fea040f17de28f177b22188e22a2f593784360b5a4c0077d2be514abce8a4c77be8e770f7b072a93a24118a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
960B

MD5
a61f17b117060ac5533a6d0633a1f170

SHA1
09db8d72c56fa2f8411f5fff2bb86c761bcaebe8

SHA256
bdc3b9cce27399abb42f89b632c327e4b6144749f85dda2090ec86a88eae2078

SHA512
adea5a8d266a6389a81248eb0f99987409f6e3e213be28249fab49ac2b597d0f9dea49adc5170c3a5c9958aa7a0d8a66fa86aeab89658930aa5cdf09208a12da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
128B

MD5
49fdc8b060ed43bf0dbd384e681f4111

SHA1
2a7e25f1da9bfa2b33777210899cbef335864a8d

SHA256
49d0252dccb8236061035dd393f69ac2cb58b00b9180604e2efdfd8f4573a082

SHA512
652b94afa54df3c6d1a0312651a4c7ea6de1d4118421399ebce9e6dcf91ab945020436d7d5c9423530e1902d55230dadb98b88c1d0723bdae5b18f96804f3512

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
179c04ba44f56f8597e614dacb7e82f4

SHA1
64bab10b4b2f095bc9c9fb1c41118c646995be99

SHA256
594e7a93347f52b6cba1e359137208e0270999f913edb2778a98645e1b25ad76

SHA512
d04c92072ab8ce0ced16a9a78107673cb83dbe3355097a28ece8819e11ed9a6920603ef6da3048e6ee7e59b4ed58382fcca451df462a66f2e34ace7dd3e48bda

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
af829092d074b5c26b2722921fa27f8e

SHA1
bdfb09cb3c0fd5588783b9249de6858e633ead1b

SHA256
db37cc433286a009abf88e8327623e6527e08d985b25b275cbe55d051688e5ea

SHA512
4424bbe5093f5dbc20ef3ce1279c0c470b066c5c7dad85ea597cbfffb48364983aa5f13e9b30f3271473859d733fff33602749cc2db3934678246c0d1197bd54

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
64B

MD5
7e9224b3c41ec866dd0401564f85ff29

SHA1
dd7cc02ba0aad77e5c59d8f8e28461a8dd2edf83

SHA256
f734ce1df53a6180e41b353c20d65f2509a33a308e97514c23890761f63f58eb

SHA512
dd7f2da835819a87e4af44c895bbb16247967c2df4b013f30196c5fcf349f4264e7c098982d64e1dd08ff48a061962cc61b97dea661cdcdf9dc7d56c3127a08e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
928B

MD5
17927aba0c6927fd870f81e6ec06d91e

SHA1
bfbba20658ba2db7070e53ae7ef648dfb420eb8e

SHA256
c76bab55082cd2d6a3612ba42d4167b988589263b1b07ff873e9f77d44d671c5

SHA512
8fe0b58a9d675663ec115eeb6f28860d93ce8d9e9e5128dac449870706c6eb729c92ebc8cc1decba19977660b18042fc6ef99f4620620b05d4fd09ecd118fbdc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
96B

MD5
cb7ab31db4f4a9d9f25c2fc825894bd7

SHA1
01d2b48a73634a71781b59d3d28355a4a2286323

SHA256
f45c861a75bab3968915352c2b2f337aef83eadf4df5b10f2af9ba0eb1bd3e57

SHA512
1776a5cc97cf1543b93689bb759bf44bd980eef6e821423a0757aaefc42959e48435b29517f7783db889a17efb83354588bd13f3475eb66eb63756c0fa4a5db3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
96B

MD5
6456d48558d78eb5536ac5fb631e8a8d

SHA1
f1607ecd4d63ca54879f9cf65320ec39787e3a1e

SHA256
ff54fe0167be13c18cb02a76cc5dc927f06cbe173d847a402070c86498846b76

SHA512
b46942d532595e8c084e26525352d43008ab0e182a479d9fd811ec74aeb6de9c7f8be9c1ff223f91dd953685437e5c92d1feef4d8e910152f10292e075cf60ad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
336B

MD5
6da3fb31327d94a92840cb06840dda7c

SHA1
f2641761121ba0877496f68afeebe774fc99e855

SHA256
250a8b40895a81086e7446733c1bf2159f3c15caae924b956f514a4974ce78a2

SHA512
2284975e8ba93e8fb3759f291d18f5f299c2c474932c943de4a9a4fa96a473431e6c84c38ec9570f0caed56c35fb471655e9430d0c53f8389670da7d806308a3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
28b29973422bd41439bccaf34fdeaba6

SHA1
8704ee66ecf4840e8370f01453c0f4d1d985bf77

SHA256
c3dccf9ad5b6f7b02cd718fdd8dcdf36c4d1a7e50265640b3ecc51511c1dbfb6

SHA512
d33af764a091ecd3ca8a357f1ca287c2be52e9d1281e967ac5e84cfb310055b559e028e438861898752154e430b806e66103f1f464c89fd4e51209a7093504c7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
176B

MD5
716f0bf6f081d40952029025c2f609c1

SHA1
3349ff18865ce4f51ebffbcbbac09d587b99b72b

SHA256
0198a629b92b0c11ed1803846b8bfa64d5397cee2ff4aaa162522b903f39a6e7

SHA512
fef63463e6552cf1259d507f19f1efa5d0a1b4b99c19a2ef9ab5cf030a2a25c4e4a58d300e491330c94cf114356f885e957c83b2c2d1f1ae4ed40e80fa91c107

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
592B

MD5
0c0cd7c871a37fbb1988d2dd323a6eed

SHA1
6e56cb96719f10dca4f4e0cc672e78b9531f4fc2

SHA256
daaf0a0f7e39d247566e40a3c114caa9ad677c306d1eca88db0f469d8314f8f5

SHA512
fdc3700df365df3670e91df20a46a2bcdb6af359fc0513ab58db8d146818d2d83cfcf535a7aa8790cfdd19094ba0bbad1b1871d5b23cc2503098ada5eaf8c7ab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
128B

MD5
b36b2d08eee44c40f25035305e8cab92

SHA1
5f5561e2c109213a093849b7d8e125bc32b88147

SHA256
41862dc5c13cf0fdf3dfed973efff992ae9debe1662e13545ac62e4e89702d17

SHA512
ffc1161f12614455d3980bac5d7d57241144645aee3285807773e382f61a113d4e88657533e0927d37428f2f38227d3cc105197bc353ee2a970c17dfc09816e0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
91867055ac372d68f2401feddcb7d71e

SHA1
ea09b376056de310d2a745a6bf95853bf342e4c3

SHA256
fdb30527c3a2fe99449299dac281c61ec5841f1b6bbdad060aee0d52fa519965

SHA512
a9dc3f91904aa0c75525b9e958da01d30e5b416d927b5113b466b349c6dabd1e9db8efe92b348f5bdf0846b7c7835a5eeef1def580b89b1606d49b96511cfca2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
896B

MD5
f7091caba6d830a002aa63cc3547d3b1

SHA1
bd98e9a64cfa6a8a518a89500b468ec7943cd679

SHA256
3c23af6a39a6fc02ab12fea5d030f400c92b3186b0a18a9975fbc08d89c0dcc5

SHA512
77ae094fe1f45f9cbe07657a9b32baa925bbe9f9365ee69d2986c0350a171df9a718693df9ec82b70ffb60b0557af9d515146c58899091d7672cd6c520e8dc65

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
04088fb5952c7bdb079442d0e5f94d19

SHA1
853870cafc6d7645660554f5eda6f42a25cbf6f4

SHA256
6079ff7ae7f8e91dea92fad5ccd648af9505734d7562218ee0647464062d4f92

SHA512
364370784b0b10b31221dbb38f1cd965e6ebfd64a12f74e0a215278233e503ee806481222b0e95231aafa694b7374f96dbc89007f0cabf78f680d3d0f1f61706

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
0f41c47b4f6f802cdb26406b27edd4e3

SHA1
026f60fbf34c4c074af94d05210a8a7b3cbf4060

SHA256
7cf3fb6c3af13d2b9aa7171df038e5ae5ed8e087ad15f33c56ca2062b750b3ca

SHA512
6faf2cde033c4ff4bb204f815b4790c3c0e46dc144a3627fce6d1d9503257a980fa75464da0ff0fa1e1e7a09f3c1490a1a335f8ca4bc62466a9cbc046a20bd00

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ProviderList.ascx

Filesize
9KB

MD5
a75b32a4ff2da5077de13ae9521f1af1

SHA1
be5f6bd38ae030469bb3854b23b1f55a7c51f287

SHA256
ac95617c4c05492191dc858fab086d4d6f5fb00f428fcec393dc9f20380a4281

SHA512
98cc0f3dceea0b7d642b9b1de3afee1a100545e66b96ae3730bd955072b305c87df0d7bc9d33f62859f8c243ca76b9c21c0fb6865a22964b83481e6aed6752e8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
e124d942633b8d8a3107815512b05a64

SHA1
e6373db29c5c625139318f067a45b85aaea38f0b

SHA256
d9b5b2a740be7557101f54eedb3ca44c0f0b98f6fb588606caa576bbab474a73

SHA512
9e3dfa8f2874214285f7ac9282d1b8063c32e458d09d86f3a7d6099dc0e9c061515fbba66aeed0ccc188790e977fb8ef039b5398bc634af8303bfaafc25253d9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
86e1512b95f2412b56c1020c16e4248f

SHA1
70aa20c706d260be6f6f19609ea4ddb81dc38204

SHA256
5e8f2556ac91d5d8c190bccb1e9410e4efa11546a06e91ebdcbdafefbb78185e

SHA512
c27fbfd647d7a4a472a29b58d81f34dc937e22261441761c4ca773fcf2415dca0d60834f68ffd086a534cd8c49df59c49e91d55f063c909052f572346d79e6d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
69fd86f9a9aa8ac5f359d96d1d180a29

SHA1
c35dcda88b6321b28902128c89fc38276eb7af76

SHA256
5127965e32e196ef663d76d070215eff7b09c45b922ce3cee5889bc5407a1e94

SHA512
225b04956879feb2400d6666e113061ab3a03198fc9b76f5669f8093f1d405901b5e8793011bdbfea0c6ed708afcd95c5aca1643d57d56958ab6271bf6a14362

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
c8dc10ae7c29bf4dbd1358a2cd824c31

SHA1
1104f848dc0ca33a7f9431e9ed4f43f46256e360

SHA256
c8841ab78a235e9a85eaa68984ea87643a722ef9030988affddd2c2b7379cba3

SHA512
73bba803147db440324d847e93007a72c0ddf5dfc54e7c309b7f1c75fa5307459a52de2c877de9e3348c6f8f9360d5ba101fcd13e19df9801a97d8484ee0352a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
fd66bc27ed6f2150960ac9a05178c538

SHA1
e612736b12e397e145ef23a023131ca399b55723

SHA256
aee9d28b5e60517b2b0c832465335c074d491c000e243b6c1006999ec718db25

SHA512
b6ac74ca630ff817486e9e340ac07d5ca36dbf789144f99b7f031aacc60f4ad542b438d18bbfeafd92b5f80bc5e611be18fe1c5136e27c7c53b847be22457301

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx

Filesize
2KB

MD5
0108fad076d857d72da16a937245c27c

SHA1
9eb478213bafde2c47a71aa7f5c217e8fb6ac71d

SHA256
07ded056eed615fdb71d53f6bc12be6af02d1b1eb91856a39b76ef06ac88a24b

SHA512
bd271c0223f61ffbd0ea4e9a69708cf6722f0b92b0b7ce22e9270609db2df0acbbc35641ea95ceda0d33ff6644484a21410b97254a0936fc9e4495ba21dfab8a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx

Filesize
7KB

MD5
2927a55b9c0954f6322d11baf560ca89

SHA1
2de670f855bfb8ff70e147d481ea6d360816e258

SHA256
cb1b4e441dc9901ee46e63063dcaf8ae76236f77b31b523e6a2483c39f37635e

SHA512
ed5771a795b69871e529534b3728b855ca23776fbf4d9704c687486b94ca3dec774e7880ca3c071fb433b9716bfd775718fa36a447150ee12a03926769b3e898

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx

Filesize
272B

MD5
979f57168b7307002d27f23d73a394c1

SHA1
546e1709866ab8ee183ad43243951b3cb042859a

SHA256
c03c4f99f3c5a56eb8d9998046fccb34374952eecdfcaf16711771442e81707f

SHA512
c2d7e2f4c6cbdebbf547e6842b1c8612a10ce4ec92df3a4c5a4a6b9d4959bb5df3009dc3f759292aa6420cb91b16220c4f97643b7e4a74132a14170e623f1a9e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx

Filesize
496B

MD5
c357066bebc1097a2276828770cefe78

SHA1
96054f71ec3bafb230288de265e236ae3f30bf50

SHA256
c7555601ee891b2f4eb33b9e313fca2c52c4c04c33e0cdf3e9f9d1174af9a640

SHA512
8b8410ca23532821725b160d44504e24a8c0e182f13091dd6978c531808326a39502099a09166681e3a5de6cbb154d3334a1542caf7631edd6f039e1111f6460

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx

Filesize
24KB

MD5
3183f3418b34b8ec11245688bc74a570

SHA1
e2c83b38bcf68d1126f6391b16d83c6e0660f423

SHA256
17c79450546df352fa0eff773750a6ed8d4b31efa4477f2b2648e87ba2b5f3cd

SHA512
bbe6551b6f57ef72d8102e3def45c03a7b2b741921404f069820f6665ceb36d83a6680b0eb57de25f802cdf20899d896fe98fd9d14c9f2fa65d0b391933c3667

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx

Filesize
1KB

MD5
10d1cefd6c7e10fce7d955d1824f37c4

SHA1
8fdaf3c1016db82565a0d7f6c12c39e7c2a6be0c

SHA256
385fb2c9cb2fee05054b8df818851dbed69156ec732cb0a2eda17aefb5bad94d

SHA512
6b9b48af2018240b4a7613d551a181f74e37408389d32978df3250e4e39bd24e5999a5f9e37fdc5f9a05b9868967939d7a317fb21118438b61988784cf9c9898

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security.aspx

Filesize
9KB

MD5
39afd976fc7e641c5f1625e109557141

SHA1
f3591a8768fc25ae4b749a779c58c7488adf9aea

SHA256
2b460f2154bbf8daa630ab1a563195ac41b42cb5e8b57fa2c56f6eea729a0727

SHA512
2f726408912e967b594ecdea7e7ef5388935b21d4465841beff8d5c49eea26bcafc8ac1984ad9c09019b3132eabed5a4f6f36dd30e312bcd7ffd3e91d16246d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
9beaca712ca3aaa544f8e198016e0ec9

SHA1
eb1ad336aa29494c1b3252383ed12d5a95c88ab1

SHA256
950a2e0dded5220ad86b3fb07b7032a143157c8ab44b1b78ecfa0651026d3a71

SHA512
5a65056c067fa27d42cace6f88dea96510b0c878ef589150327c16faa69460a598b3cad2749e9843929ec4d464bc1fd0fdef007040fe2803e257b3cabee84fa1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
59ab233fb59e42eff6f43ff9c4131526

SHA1
7815f374a5ad566039154f75778856e42c580f70

SHA256
67d6438746b18b4db4c7351dfcf79cdb957447219f63fad2cfe82b2969ef17f5

SHA512
4233549b4c66c9a508f528a028bbe37d6a54f34e036940e41dcc802917c2753ef8fac348e0b4e5f5cb7fb4827c8afbc0de47e11fac2563603a49085b6cba70de

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\default.aspx.fantom

Filesize
4KB

MD5
d71af33202a43f2422a460c831fbbf09

SHA1
0d68480ecbaf921e8e4896a8c0a715cbdf4e270c

SHA256
798a319219fa39cc4074f0364ee9853b78f6526a42c2051403adadea044d54d6

SHA512
e44a09dbfa8e9242d1c047bdeb310bae6826b4a07f4f081cb20c4f9d22885655df84fa93d8c586955c1f24ec06ba416062fbbf79cdfea92e5c87338c9762d94d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
36cd2d97c49c7cc67a8e4858380b1051

SHA1
acf326af442baf747b747b57c7153a35f9594756

SHA256
a964fea9b7e7fd95dfb7a4971819562ec7bdef9fefd191ada02305bafbe9d109

SHA512
b8adddb4bb17741e8400be750675d5220a8b5e3299a51da6c0c8019da6a4ecbbe9c5b87b8e1dd01bb8568c573106e51ed38fa8c556113ddce7c3a7845c41a394

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
20b43c369c990a2469a7caa38ddd4ee5

SHA1
75387f5a52b76556e551c50c86ad60ac9a5a8e71

SHA256
e19136fbfb3aa46188e91a70e7ca8a7d6ecf6c63ea92fcc864b17d84464de6a4

SHA512
0ce6eda2462b31123d773b73fd12b1c555edf7055c9ae4a47e1ece307e87530e5c7d81b8d2536b2ff88f323a798f88460d5fa7330082d07108ad81dc05ea9ddf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home1.aspx

Filesize
752B

MD5
48f8553261de1b4f882a7133521c39c7

SHA1
80ae6267e7de46a6b1986b241cb669944af3dfe0

SHA256
eb476f9567cc9f83207e18f1c21272c7f23b818b202504c34a2bdf2853809aae

SHA512
62de54778245a843b3f8342dfb1adcec08925147dff8bce867ab496c3f9c4f76b6ded4ae7cb70a2ad53db8de56838e1de0ca0e7c905eb3f50f1dfe4037003a20

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
855e01b8a1146796a2f93369d0ad41c5

SHA1
1c24231d28289eae00a8188663f1d8916e2c2fa7

SHA256
dc5125d4dee55cda69436da2f1ddf0c61090c34f193733f06621e9ac6b16f365

SHA512
a9f530a76fcc9127c644a99965d77c4ae508292d5e68fedbef29fe73164e9d179682658a24cfdfc311be50de0f59c242c9a21cc353dbf81c9dad716e0982979f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx

Filesize
8KB

MD5
a15450cb9337da2d77d5ffa591576b44

SHA1
ff8fb3f3e19773c31938af3e2a3bbe1fb3fe19a5

SHA256
9adedb8a9990dd0cd25359dec47be10442fe3f74a2324136014357c41891d8b8

SHA512
958f00bc467c3d5946ab221fefdc86be7cb2e7353a2bd9851046236d4419a091b7ae4ff1d1d875800dfda5266c0153b17bdfbeacf2bcd45b7054cdfd23b98255

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
0f3b7d8a8a74e138b7606c646878d20e

SHA1
9de69f0179e641e1b1c2a09557e45f9029f1d46e

SHA256
0c81d3c73186aa6a0d1be64739769e2dc32a6d3f4e55a0ff8ea1e8e50fba9cb4

SHA512
282a918cf545fafad99892a183fd1382eeaac445ac4a7262b4fb61a93cce9d0934a230047a5068a7adfe5b159d5c52ad4dd561855bc80241e161abaec2a01eb3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
361f16594c1bbeb1ae4d49d6ee50e1ce

SHA1
e67c80ec8c035895517db5656cdd5c9b0c871acd

SHA256
f832bd10301cdf63ef6a6d2242f88f26146e3c16b79e681b20dc537e392313f3

SHA512
f96e70203f7c52b786e8a07ad9aaa1b36df0b117830a2f51d4757964cefe1095de7d9332b7423de26d476550b42d075619e32f7439b14fbef5d4f548ab004556

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
3558ebc10fdbd4fb5b2010c35e61a9e0

SHA1
6f19f0858b4c5c0c4098c9b219d48b66971af8f7

SHA256
138c5e63de1359aee0e9bc99588581cb065faadf6aa63fb10b0a546cec5a8628

SHA512
9ac04b61d0d15dfdbfaf31f35c11dd0012f9c3f2ec900af6451c1002272415ced64905f1697e472021d494bc46b33a8a2691ab97fd398aaacab1b579b859c69a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
39eb3dd334e93c74dd0e67dba1347bc5

SHA1
89c51a58aa49e3c00ead0055f2e24a6b960c50e4

SHA256
1f19e761188243de8eeb14e646daf1a51a80e77b9988370c231dfc10851474e2

SHA512
c5127c76fdc82af98e40431f66d6be6eabe1829a674db85676e50ed4d5ba8f78f95182bf995d3f0646880a89e262f8e2218d9ee7805c1164a98d07dd9603c2d8

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
6bfdcffa92b2b72fdf05c8d5edcaff5a

SHA1
fb2fe1d0a3a37c7da1bb34719997105345bafd28

SHA256
9e2492c9336e08c6f81daa7e61f4a22d8cdf710ded5c0f8ffaab5d9608ae08a2

SHA512
74137d47e5c6790e2bf6ff19f43f72329e33157d78eb02c72c63fc053d96ea5d70967122520e78e72fbbafd282a0ff76c1d66b934ca1f73278b1a2edaaaa3006

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
408ea288ee1d42d4b4c234bfe679e16a

SHA1
9755872eb2161a1216428404f0420afad5349557

SHA256
be506b66cd9dc26cf7eb37c74202dd7c517e087d76cf58f24cb336faecdbc858

SHA512
b6f43c184564bbe07a33e09849d4cbe9e0f1fee46966cfda65aba3e3142abcc9738d492dc7c2d9ebc4f31a884f46d922f4f9218a31452d00e741bac5aaf230aa

Download Submit
\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
memory/2196-651-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-140-0x0000000000810000-0x000000000081C000-memory.dmp

Filesize
48KB

Download
memory/2196-139-0x000007FEF5453000-0x000007FEF5454000-memory.dmp

Filesize
4KB

Download
memory/2196-141-0x000007FEF5450000-0x000007FEF5E3C000-memory.dmp

Filesize
9.9MB

Download
memory/2196-650-0x000007FEF5453000-0x000007FEF5454000-memory.dmp

Filesize
4KB

Download
memory/2876-52-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-68-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-16-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-19-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-20-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-24-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-26-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-30-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-33-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-44-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-46-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-48-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-50-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-130-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2876-54-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-58-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-60-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-62-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-65-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-66-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-129-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2876-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2876-56-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-34-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-28-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-22-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-14-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-12-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-10-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-8-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-6-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-5-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-36-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-38-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-40-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-42-0x0000000000840000-0x000000000086B000-memory.dmp

Filesize
172KB

Download
memory/2876-4-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2876-3-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2876-131-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2876-132-0x0000000002160000-0x000000000216E000-memory.dmp

Filesize
56KB

Download
memory/2876-2-0x0000000000840000-0x0000000000872000-memory.dmp

Filesize
200KB

Download
memory/2876-1-0x00000000005E0000-0x0000000000612000-memory.dmp

Filesize
200KB

Download