fantom | f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

Analysis

max time kernel
150s
max time network
55s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
28-11-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom discovery evasion ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Aw84mBVYLArc91ce1mlnyVcxY19AMvjTAyKpviDfr/3o4N4SA7ZJOnSK/G5KNETXDrOZOZLLGCD0EFCiKs8fAO2t55GpY6lJ67Q5jdOxexcUowFjvQNhPIXw0gqwSWuJ3z3G5FArbaPgoYhtPrYMdTvMNMUSmi3UA7V9sFNAoI/S9mbeOAgd6pysslQ5Rj266iBcSIDn064CnhYOjkyM0nvugHELdzJ3YXhS5Mx+cO5yXV+ZW3tjsJnjFIWsJSk7SwJZvP3TnKAA3LDZ1hMQ58ffpWvJQH2Kxamr+Ck/s6+NdE96Kd+vUJJ5IABeMfUiRikU8h7rIZinRlSlhBYJrA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

[email protected]

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Fantom family
fantom
Renames multiple (3039) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
1956	WindowsUpdate.exe

Loads dropped DLL 1 IoCs

pid	Process
1760	Fantom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpl7700t.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sbp2.inf_amd64_neutral_332943647e950ada\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sensorsalsdriver.inf_amd64_neutral_1c5bc8e71eb90127\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\license.rtf	Fantom.exe
File created	C:\Windows\System32\LogFiles\Firewall\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-DTC-Setup-DL\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr008.inf_amd64_neutral_0540370b0b1e348e\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\channels\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Enterprise\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_script_blocks.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\winrm\0C0A\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\DriverStore\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Tasks\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_neutral_4506dea11740c089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql40xx2.inf_amd64_neutral_b95932400326817e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\spp\tokens\ppdlic\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\srm-datascrndriver-repl.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_PSSnapins.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_neutral_9b64397618841a19\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\GroupPolicy-CSE-SoftwareInstallation-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Reserved_Words.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_troubleshooting.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_aliases.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpj4680t.xml	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremium\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasic\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\ntoskrnl-DL.man	Fantom.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\TCPIP-Replacement.man	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\Microsoft.PowerShell.ConsoleHost.dll-Help.xml	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\oobe\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_neutral_1975687236603184\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\it\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_requires.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-LicenseServer\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr006.inf_amd64_neutral_40c76453575b1208\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_job_details.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_requirements.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_neutral_6184912bd8e5b438\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_neutral_f8bdd2cbac28a8fd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\EnterpriseN\license.rtf	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_neutral_6c50ee5cb1ea2780\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_neutral_b64bd08009e7444f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\System32\LogFiles\AIT\AitEventLog.etl.001	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_regular_expressions.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_logical_operators.help.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wialx005.inf_amd64_neutral_5304c93e2193f237\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseN\license.rtf	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_requires.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_parameters.help.txt	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\MUI\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jvm.hprof.txt	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\booklist.gif	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png	Fantom.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\picturePuzzle.css	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png	Fantom.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\js\settings.js	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak	Fantom.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\CodeFile.zip	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-views.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\4.png	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_off.gif	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\mix.gif	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_up.png	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\attention.gif	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis.css	Fantom.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Maple.gif	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak	Fantom.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_ja.jar	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_bezel.png	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\gadget.xml	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png	Fantom.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\library.js	Fantom.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv	Fantom.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg	Fantom.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_h.png	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Log\v4.0_4.0.0.0__b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1040\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\ehshell\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Cityscape\Windows Exclamation.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WorkflowServiceHostPerformanceCounters.man	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\SecurityAuditPolici#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\Read Me.url	Fantom.exe
File created	C:\Windows\Boot\DVD\PCAT\fr-FR\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv30e99c02#\d876aaecebd9ea482120a1905ba2babe\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\ReachFramework\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Boot\PCAT\sv-SE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Logs\DPX\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.RegularE#\fc4fb8a45f4e2115c1290af5ffe5ace0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\2ba6bf6e9258afde91ab81fad2d37469\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_64\mscorlib\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Services.resources\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationTypes\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\AppPatch\de-DE\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\ehCIR\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\3082\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Help\mui\0410\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\ehome\CreateDisc\Styles\NTSC\Symphony\Symphony\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\RemoteAccess\0000\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Raga\Windows Exclamation.wav	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\header.bmp	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\6.1.0.0_de_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.WorkflowServices.resources\3.5.0.0_fr_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Printing\836fe321118ff3c6c51adccf758d138b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\UiInfo.xml	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1049\LocalizedData.xml	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_es_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Delta\Windows Exclamation.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing.Primitives\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.SDHost.Resources\1.0.0.0_es_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Compba577418#\ea53e69de4ca155788883a9c2d18f31a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es\Tracking_Logic.sql	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallPersonalization.sql	Fantom.exe
File opened for modification	C:\Windows\Performance\WinSAT\DataStore\2024-07-29 17.45.29.006 DWM.Assessment (Initial).WinSAT.xml	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualC\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\9abec9ee3dab00d67b395d1994a60776\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Serv759bfb78#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\inf\ASP.NET\0001\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Media\Raga\Windows Battery Low.wav	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_it_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fr_b03f5f7f11d50a3a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\2070\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\PLA\Rules\Rules.System.Common.xml	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\AspNetMMCExt\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fantom.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1760	Fantom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	Fantom.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1956	1760	Fantom.exe	30
PID 1760 wrote to memory of 1956	1760	Fantom.exe	30
PID 1760 wrote to memory of 1956	1760	Fantom.exe	30
PID 1760 wrote to memory of 1956	1760	Fantom.exe	30

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML

Filesize
1KB

MD5
ac806501a95ab8f672db7faa5db3af89

SHA1
437fcaca14c6f37d33bb1f02a800946bd75dbec1

SHA256
67963ce2a62e1a2424d1e92f73991df3158831e50be10d0d44bf0a7023a6e5d0

SHA512
a7fb4e5ed653d254f77f88f1ae4267eb17da0d013da0ba8f4a31bdfb051d0bfca214a779fba485ffeaecb417c554b78d9f26cf83cb3bfb762d42ef82be07570a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif.fantom

Filesize
352B

MD5
3fed064bb26804b5bd781b804b5e0e46

SHA1
55547ecc42cd13cde2396290d55e00bc3e35c51c

SHA256
187351243e78fb3f09c2dd9106d78dd595ec4bbb0b5cc969cbd533103e57afe1

SHA512
80eac878efbc5d8be015f725a99d62f4eb3d109ac8cd8dd9073000929d71d2b1b14d22614a9150ed0cde55a590ac3678d0a728d8c040f8276b49ef54c777a7ff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
224B

MD5
290e3e5bbaae52c2b904265a5dc5a9d6

SHA1
30d65fd3b74abcc37d69a2b52956edbbe7c9cb30

SHA256
a8aefa89a92b8c3109f844d68793414bf509a4579b0645a5d2b386b41d6386eb

SHA512
4ad066fec2efddce78146dd7bf636edc3293e639d35cb73c5cdc0c86187de605d98669ae1e8848f0ae4ec4d68cec89ebca5e954b662945d2a742cd195351eeae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
99e2e61621b7b6197166d0dd11a87cec

SHA1
5b30552cdf152f20580e8961f9bf2e31d0d8cca9

SHA256
8ac3f44f5801aa1faf2e46244e3852d2d272de24b492931f6d9f99fe099dbf67

SHA512
fbb4cba1a10cc942d3876e9ea84c703e8ca05b1d7ae206395e907d9e468aeb3bfc19bc2c9a415e5c4d971db6f4e2824bc3dba60d462198319cf7b1383e0b9659

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
1f0a2330b441be28d8029555a6de7188

SHA1
e1976329683131f0d08d940d88379804245a57a2

SHA256
962306753e348ac1a293038a39f2f46117fc1039ad2c2dba98cbdced918132dd

SHA512
831aec6db0db00f68522f747b1524a9438aa19068ff94563699bf1a0ba47edf9ed4b8bd587d0f41ae09c684a89f1eef34fe013da496acf8cc3ab68b448cf4920

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
37593ede33cbdbd080eebe2c2ff058ed

SHA1
cc1ca95674f1866b3d8e8b28f6ee40ecd5af8a01

SHA256
e80135f5922c8690b4b787722290109e56609432f026062235dcfb813013673e

SHA512
ca90e4e9367123f78b209a2027774536298d41cdd08d56db9c2ba2189b17c2918036035d2f16e635d0081b8a686e391db37989c8f35e830e5fbe078b96860c66

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
23061921ec5f2a04a8c54696fdd31cb8

SHA1
c13d9f7c3462162a28c1189f8fa09d726df4a1e5

SHA256
8a2dad774fc4adf1082d132626d0130fca5f74468bebdb18893c78cd6d54924a

SHA512
9a831b510339a8cfc6e49adb9307a44839054953f5584c4e40c66343df8c032c3f4abb4c1b6046acd0ee868094b0b2982b55c7dbfb57b29b9da3f782e316fe80

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
112B

MD5
198a808ff5d78fdfdf4d349aa98cf52b

SHA1
635d5512e8aba52205e0e57a03164bd0eab89a0f

SHA256
609f59c963753010caa2ad39acd4a01dc450cf3ab313e9ccaf7d3ea94dd7ee67

SHA512
a8f0e2e3417fb8d27145cd199c2d8383ee6e556ae84c79bfe989307f5575742574870bb6928f459638ddaf8077f937fc18e577e5e88776b34615b4055458be65

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
8eac4d5543668bd571cf0372d38c05a4

SHA1
7c1f94eca26bcea003ea98d755b4ad95df7bb1b7

SHA256
caff3ad2daa2524c7cc0c117d2e3c4783df6483f918cb7b172af91592c0dc41f

SHA512
414b3cd523405393dfcf98b093c7ac971bb6a232895cdb15a57f419d73c49d5e00be425e5247316de4a92f2795ab0de34762890db7239b2f6e861b23ed729f80

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
349d51c1cc0074916e8af86ea8c8a2c1

SHA1
6d976ce9b73d853942962de9e278c6dc5de4f86c

SHA256
a42c3dda71d4c3b4a8dc2bd38d5245c7b694e5c8cc03c5eab5015f7e6db03608

SHA512
b5537d180723ccc1274ef03f15909e2740cacf1bc125c3e0b77acf95875f77ef8288749d7e824d62ae8fefceb439853bdbcb8b0d5aff55302465d65d2319b2b4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
91382fabd0d0200514bbd03fa6db6a53

SHA1
722bc9cc53e110cb9d801a4f13fca1f17a88c666

SHA256
915313627ca4b7a06ce4203af64972c67259ed9198ed32678b2cd5bb266f8bfd

SHA512
8a611f6f67e54213921348a4df89cfb0c2c8d5a028c54fafe8db1a129b547000e0152da72452d1190cdba6cdc26fcda67f9f32aab73f215ff3cd00f6a0e0faf5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
c6fd5c6a8e22fa91ce6db39ae5c731fa

SHA1
2cd1a5ff4f9ccec0759e3f5d633d7799c5ff2707

SHA256
63b238026bc721e719f8317fd1a84076c2c1dc1f5d54e631a387283ab4586a11

SHA512
4c8a4b57cc50a34aefa362f93bcc603fa946ae9072b5ee19ba2b97d66e10151bd91cfd9a7fb44d21f915f5969d7285b58136c7f3faa3c42593a7804dc1caccaf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
8a86042842fd2fb0fc6768070317cf20

SHA1
ab3031a3a89961577abb7228142e46984d61bdc6

SHA256
8eb697fbbbba905865c95a0d2c37b76ecb73c2225ca5d565f21857ecf35e9450

SHA512
f1883c378540cf12d0b9936bb4b8a7152ea8ee024323e1badc2ff7c077085666e397b2e3769703ac9630dc6f026de03aba61010075b8553f17cb2c8f87b0582b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
3eb064ed6e4b7f01f94b5de8f6cb05ea

SHA1
485bf9922746feb0ca7103cea69dee453e193c98

SHA256
e5f46bc193a467376f5778ba0ab58948f1a11c4de8957697aec2afc7a42aa75a

SHA512
114edd2163a888e7b502cf0aaf52a71095f0a2b29d80cb387fa0ae3c2c49c53644fc23c3b019021a22a5bb548c407c05da04fbb50cbded3192f468e0ad3d4d2f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
0dba5fbb7350faf843c9794fbaf88803

SHA1
f292c1d68208217ba5495983319c67050db44cf3

SHA256
dda7e15002f29a15ba8eb4ff0bc69db25a6e1c38cdeaec4c63b8c9b268ea1492

SHA512
bb6e58c3b67754f727900656b1b81ff3fbdea0b574be81b6398bb83e687dfa9665bfe9c08cab9b5e96d55c57f7812d82e965356397830ce7d758b9b1f6e76d96

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
4ae23d20093e9c91de469cf232afbb32

SHA1
851a84e9fbf2cc0ceb6a62dd321cd770580882fc

SHA256
5f9644591d49cef0461801de578ec58a65d104d4d7d3d92cfff9d3da3abc1d88

SHA512
213ed6233a6a3df9e5c62dbb921d65a3b99f40a4ee9e77410b904efbe0259d706d828e1236747551382ab2eabf222ab3c083959c6f6ea506e0be507d265c7c5d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
7KB

MD5
0f96b040c85bfdf35345d11d05d5d66d

SHA1
9870a648cf69a26e8ff69afb452dde0bd6df283b

SHA256
ae648517d30c4e8ae798db444d99f9fa6825a7a277a56d034183f5979a69fdc9

SHA512
b2d4eb46bae89310ffb1f2709824072e0121871e0a197f298b0a345876b1a48af6eb0a859549498c59709b40c746b0e8757cb6c8632b6abc3d362845a0ab402f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
336B

MD5
4272cea0af68034cc02212288d0d797c

SHA1
fd9bf3fcdf0ab58295d1229a3b80c2d99f3947bc

SHA256
af4399ed7b1d7cb1e2966fd0989bd05a97ea1657eaa81105e46093e6870db23d

SHA512
1643f8281d69af50c4cd2d876c339f8b2829421c31ba16df199037ef4962ec3ea0889edc6454f2c6965273d4cd3b2b3207f6051551dc191c2b8eea7ee0978cf7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
240B

MD5
ebf514e7c3b7b1c8822cb4f24aa43fc4

SHA1
b88fe2ae3007b5e5ca55bce5dc0a5c471acb9b46

SHA256
44039b4e0877af1ddb454cc67b4bb271e6ed4c71ae3b6a70e76f95e8ca54cc75

SHA512
4ed7c3ba30213b594a577f064f1112634b52ef0ebff8bfc0363564bd71feeb376ec65fe7f1758d15f88d9b5384d94af781fb2785b6387df8aabc520a62cc6f8a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
e8e6b208cd2bcded851c111a2601e69d

SHA1
33dadf2448f88a4e93c7392354ae0a7571024981

SHA256
4ce94687a53456d4db2e6214c0b4f8c193c7032d0caf70cb6993c7a524ac4046

SHA512
b3934954b28387da2b3cecdb0aefd856d3121382bad35f670a1b52b411347653e934a7378a29392beaf614c0fa2b583ca4bf84e90cb06a191b5f6d1ceef71e7a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
816B

MD5
a789fae2c1b43bff2f705f1dc44ee35c

SHA1
941f211d6e33372491e9e8a2d4743accf68f5d74

SHA256
985cd8475c421a897d610026d4e513146a3b602d4d28f55f7a5db36822871ee0

SHA512
27be7b40de2b4dbc887d6e7625d02f9d06257e74dd53b2d555f71cbaaff44340bc5e2e2c6facd92fa129c7587eef831e349c87ccfc54957b7076c28a6a30018a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
f93eafb9e5d7a0fb334c87c1d3991d4d

SHA1
5a801914486ce4452437f1eabcb2a2459ff45a69

SHA256
fdabac151aebf3e4cf7f1231a034d72d46d24f2bb760d2b6060f9a1752f18a03

SHA512
90d2955180c610bd9f8bcb593c936bd29e57126a609c41430d7408d89ee3bb30e56d5c0793642804125f172dc3b677ea85783526461e98b9931f988aeb896fed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
1459f891215fd6273928ab4937ac0eb1

SHA1
a9eecadce4abab5dd1f0638087adf890043398b8

SHA256
517cf54fbc987a48a90b4bb5504c8fe23309d7e2ce8358637814b0b0e14d1524

SHA512
9c091df12feeff4153649868aa478a0ae5e2577c68d0579f20c668fbe69cb4148a06d325fc6f0f1118a1931ca16ce830932138affc6ee9233e37db861e50b3cf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
5490b2bb96f8653fc9b8cc3a7129d3e0

SHA1
01863183e88b5690a5639cbddb1a5f782741bd40

SHA256
1b6fff77338c4a29a7dae8c2e48590bbc3892fcbde5abe98a838ee27ae5a5e31

SHA512
26e12a94d1e54e8e5dc569176dd66cec1dcb664b342e9ac7658c5bdcbd94e724e6c365494f059bb3d58a78bf964de07f63d227565f8aefc4520ac95621376c0b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
896B

MD5
594b0b433244216824dde32457ce466a

SHA1
29398d43c86255e08cc6b7532ab2be869a988d3e

SHA256
5ed3993b5bec3a75f188b098f551dacb06c3f8b24aa140f8c29855a182b24950

SHA512
993aba498a04a8dc81eb5112970b959db88aeaa06416956fae9483dbfe5eb0e7658edeb61ec769715df57eb6af3260c7103eb7e4214cf3de9f88d07134a91656

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
864B

MD5
252fcdc4b69d6c11993fc17871d5d6aa

SHA1
87fd7db28e4816278bf8d00d1e3a1e7d71a9b245

SHA256
02e4429678fcbeb2836c2c8241c20a3e833575e32ff019fab1759288b0339da1

SHA512
39df26f079d659f0dd49e567cf708e6be7dc34afd40f95a445cea1839a1b04d14e3e766ec24b9b86e94742c694c663f1b5d63629cdc5d10360b01c91a3764c31

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
864B

MD5
742852f616c43df685889a74d589358e

SHA1
a17602a727fe40c4ac7e73deb8167cd81fef5e0e

SHA256
3169d618a6b745c774a977693bdeb5882d1361946e173e89a1e27d50649a16d9

SHA512
324dcaa2bf825956eb3f8ed9eb3fe69fd5285c89b9fb6d6fed6847cb51330d0cf6dc82985d071fb9139b52847ed762cd925cb3aac8423fd034f8347e59b16fcb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
c7cc3bcec9b6534f45adcded8434ce9b

SHA1
48964d316b983e187fde8141bf5d1287a15d8941

SHA256
fe543a1e96e80b455895fa9ee0924997b037d92c3a0b584e03cc50d009719e14

SHA512
965d492f6243f56f1628b91d966efe1066cfac17657422b8d127a14a3a7601395a193ccfefb5f6db12e700f691a10d5d2fcb3c17de7f407045c45e7f3344519e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
cd78c98f96184e4c1ec3d1c382f264c7

SHA1
58444025e310edb0d415be3c9c3280769ec9e85f

SHA256
4e4c5333f405659d28ca5815b008d9426137bc0bb588943816c68a62a70bcfec

SHA512
ce41a160c36bdc76312aee9f72d964e874fc6a496443b2852666f2f1932661870e550f2ca4e5a30a21bfb3ac8a1e485ef6575cc034659091efca7ee3eb5824b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
864B

MD5
1c23366a624fa6529a875c6517e1c558

SHA1
6a62f695236db9796ca4ef991b9a29b3d9e21dcc

SHA256
46f829a85b5c6ab27203ec48f3696acfcb6ec8ac482f6763f8b95584b96301c0

SHA512
9bf0723777a479561ba8b41d12e95d35e06b3ab7ba8d6227bd9ea62fddde8ce62e84d5aa04c58268a5f8c4a48a38a0cc9d66ad4fcc976d13fb38ac755627b1e3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
848B

MD5
7efcb3008839c6a561b58771f32d3b92

SHA1
32f8d43365ba3caf91710980546988a697239474

SHA256
205287c671f757753b213c888c5eb3112260ce035cb3abeaaf51900f9fc85905

SHA512
1f1ffbb8caf55f3667ee5d7255de8dfe7efc037c90ec02eb88b1d4b5d49e3986e8b4458f84921f47d025ef9d27e64c1779bf0be4c7b6c7bc139244d573d9fabc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
880B

MD5
e44f5a6a9c42ea3001702e2b3e0aa503

SHA1
3fe107d4ee7f1efb6d8c30650e8aa6b45e5eaffc

SHA256
e075511ee7325ce17e2e4ff41677e8f8b24903180e0f1550d2c8f663f9c18301

SHA512
d919d968904d8bad028f25b9c49303ceaab2531c2db412786f0486a59a0ec592ee174a3823980f9a936dc50521eefa3a85fd3ec842d5179c15857db109e0f85d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
848B

MD5
7c01332d9b99928fda8584fd8500c2e5

SHA1
4e80ed9ba77f4f1a405333bbbaa96ff52dead25b

SHA256
78e2b81b3845b52107da6aa273d41c6975709e69cadff692747c43011b5084c6

SHA512
dab6a7e00a72188f826a30853c701488b98fd0bafbe8ccb8e7871ad9be1c3455989457c5f7db3d761d66e6d84920b42481233466f90031aff4ae66a39699a31d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
864B

MD5
20488021b7697b028c23c78adbc88235

SHA1
c6539bc9d3a5431e05814a952386991144a7c854

SHA256
7469df047dd0f799286b6db3198781629235e588aefca02e46d55e5d266d7361

SHA512
aa21731e26c646b2c1ec1424df65b20b4e72ab56bf4b985ec6eab55cab44453680a291c848b6b68714a9c4d8a7a6d8ced6ef5db66fcfefb0f79497f531486eea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
864B

MD5
dea7bee76b2bc9105475e6e78739082e

SHA1
196c5a293f2d064864db56cf14528de5b1ed13fe

SHA256
9c7a5820351cac8e365b2df9fdbdf3d159903f72c918cd6b83ecafc989c53adb

SHA512
0f2aa74dd2ce70ef0711bf500140fd664914c8c9102b26d5f24232a28cb1160f146f684a33ad576476c894f6b678d4ce7b8d33838efbd23a0bde9193b74bc1fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
864B

MD5
eff25cb1a7bf689d66fe6d2911611e20

SHA1
d63cbeb05274efa975af39c3fa4cc65c3002d760

SHA256
aca7486c8b51115ff022bb5d5ba8382122d6f4ba259cc246f8da29bae8080471

SHA512
846907f6d39dda3c9b4dda03b4b6b1103332005f5836c4e21c779e56db728af16cd0b470661e19db050429b6ec5d2042d7edcbc54a23d482b16fdcd70436601f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
896B

MD5
190a3e9f113e716973c92c28e8508be5

SHA1
f119b5058d9f21cf043b6e36b1ccd12f13bba667

SHA256
57894acdfc0175e0e72c6b4194e2dc20cab4d660412d464e4d4b7f506f37f802

SHA512
e5d36e10f4dd638fa503e30dca897c603a1cd20d73321b7d2df3437d456cecc19ae52238dd88916cba065f12b18b428f4b25ce3d49f224afd072ca8b318e25ff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
761ed442d73766d98b43086d66169911

SHA1
dcde90aad967a7ccd70029c1bcd02226c0058d87

SHA256
bf835bf92b61a44282a6e7d9a2e597dbeb97999633f9a04747d77bfe0b40a4d3

SHA512
a834e845703f0dd506860a443c88e2891d333754703351a98ea0336cc7cb785607081e09e314fa1abc27378a9ec1665c9e53c488f2fafc50132cb13debeadedb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
c61d7697280af8898c00cccc05ef129e

SHA1
2021fd869d16877bf9ea113b21c624f6efc8bc59

SHA256
98ccba802e509e3460c5d8fb5c2de8f4aa86bccb24f48f746c1c6abc41b90ad1

SHA512
be49b74c6385f5477edf115049d9f328036f04b445f8e8058b4cd213a0251317f1e007ca162aeb8ebba1e170de672f0b2c4afcee07424a323509162db85f80ab

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
04e8a284fa2be3e70d4f8008bb5e80cc

SHA1
ed59cc34098181cc7d6cd5d3e6c2bbaf5d258eb9

SHA256
f862c587af89e592d3be10111b8b45d160d1499a250c83128610819a0a2467f0

SHA512
ec34a679657e05823cec4162d79a353e92f38a6267c9eb76afcae1320ec5197a44c1f86bdd79c16ca34bf08d39b9c4b214f3d46e04639a9a7a65dbbf80118370

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
73bc05d66c5a707e195738185a38420d

SHA1
a560b0dea0c8e498ffac3f48767deae79a6b50bd

SHA256
4d9d0bbb9d6736eabccbf38c27d0eef6c85a03d816a9ee425a58cd1b3ac0e926

SHA512
935b107c972a2bf9fd0851d7b5a5ee37ea57a78fbfa932330a6d5efe99d95da6d82a54d22e93f876db8e6af442e5d09b9d15982a50cfe36470d2953937bd8d21

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
458880fb3b26c5d0e34d2dd3fefea5df

SHA1
c0306f73a51746c1548ed1015677eaed9c9aacb5

SHA256
ce4e679a159fd6d419bb5ac460324368a9906560b9a17d82dfc6e90b6b3959db

SHA512
8b58de26626a61b91a5500f3371618e7ee78a9886146d5aae5a13c7c4c23026551152ba391b5d99fbaa6df86169dd2c375c2af0df7e2a86204f103c0c646aeea

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
ae7b017f34bcb304f4399048ea00300e

SHA1
f61f664a914a0f57c7d00890cec4a01488ba7615

SHA256
89f6ae4df7547774a64060d804263185b4722f054d99b7d3cfa9a15ff2086213

SHA512
dd961887c2b44e7782c85defb9322a1ed3847baa58e9a9f1cde28d7f51ef42d7a3ac3790670cc724ff1869a88bed65c6a64ef400e3606abc3efb650d650dffcf

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
1b7fc4da123326dbc9c7022ea5a4b8da

SHA1
53cadaf3e0a49fa81dbc8a0ea04723e3a4567820

SHA256
439c59b2892f0617fbd6dfcaf90e8e6e83d27c28dbd97fee6938d1e80bafcd5a

SHA512
1aaf3c9a62c5f07d28dcfbacb399354ed4b84c6e4227394ab9f3c14c948b56b1515afb6fe1271023fe7a9c866ab3e47c50a881c9fcbc14a80690a15b3d7f3402

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
16B

MD5
a1a70517b1999628524418ce1200e8a5

SHA1
363faa598c6ffa11e11dbf76a2696e4fedee21b0

SHA256
6c8e555a0e76d0a8eb66db5df1547869575d902db9dbc30ed0b13a5e3f90efcd

SHA512
9854624582f56b8e3106ce1e2dc28d3c4d61710e9b0054141210db14d0be349ebf9c9a325c4678d00c4b3dd4ef0263221ef402c802d12a22f81ab78296e0fa9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240729_174811932.html

Filesize
1.1MB

MD5
be3a5f2d3df6c627dd933073bfdfd634

SHA1
1698a0bcad47820c11f25aa6bb7d3e9a5c6a82d3

SHA256
808a5578a240c2f5a9d0d2895211604f098f6f89c9862fb4859e99a9c04b67e4

SHA512
c0df1e92ceb35f0480ae8af20fccfffa5f9d0b7e213dc0ad229007d2a54558668c94a405a00891df8fac943a20c49f129b8ed1a8e6970874581313c788683d2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe

Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
64B

MD5
1d345c3182cb61dc6dcea980efaf03b9

SHA1
e212a0c5ede45a07b108d82178a53d54b937c9f8

SHA256
b7146531406e4bc83271de73e3a08cdf44a987911ef89a0ed6e10363c7126f6f

SHA512
22e83375bc2e2ef07946135b40dafcc05a2ef9fb2cdba429c1fe7a284f86eadd419b3da8302cfa6a282100e35ba45d2873ed497923c606b8b3350132afea2a2c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
80B

MD5
8f229b26f0bd9a84d98faea077588ca0

SHA1
3e2473c726a7530081276401bfe65964de9ceab9

SHA256
132333eab794c4319e2a011a396955bf3e59ee877d93fdcbf06c118553f951d2

SHA512
4a9d0fcbd2d5acfbce5106455bdc2d3d08e65da13d8a09f13c0893917c2d8281c91e7cbdaa7a15b6153c0e6f2844182333909d7793f97119f0e4a6dbb5e31bd1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
80B

MD5
c8ff85aa21dd1a7d795fbe637a7bbb15

SHA1
401007b3bede6fbcf4d9f335fddd12f7a05934d2

SHA256
d09e0a6294a3b66983fa9fa0970397e6939f8be873341791e2b434363b5fbdf7

SHA512
d78b8fa0dd671c72d05a7f19f68759df549fa3eadad41f65bc6a7c1c6a4d7e6392bc1f6ba8efb6fb128f3ff05d92182e4e8e9c297e2ee97d80d5805ba340503f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
49000eccf7569b6acf6353574640f341

SHA1
d17987244dea0ee1d6681e2caedffc6ef2b75ef9

SHA256
afac7c9da26ff1e46b2a76a7a7f223baa61d774826a89a89cb2872e0121d5b03

SHA512
71a2fbed5bbcbb952a5b3dd05604ee3f74141035d35358f56d3a31d0dfc3f1e7230c4a63d58d65a2412b5681d29c117b74401111efb326d114c0513777e03380

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
d88e61c9a12f048bf1081ba3134abeff

SHA1
5e60785a9fa3c6213e95cf820f27683e7c26ea38

SHA256
66d1e16ca321a8d97823e9539179eec87376bcf1f22a9c6c4c044ce829b20abe

SHA512
42fc9bf82c8956bef81f2b6249e7a4e161adccd2ba6de278fe2b49aa47af0cb21ccb94a19949cb1e3059d6ba9fc0d192073c631932aa97b9b59a460f31fc0f66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
3KB

MD5
e8e886c204583e506dbe2ba691a7ccca

SHA1
9b9b1b51ae890464b05bab567f9c0c5baa2f4eb5

SHA256
42bb3c8f493cac162bf053f6481d8733520308d8ea9f23658beb0609e9489d65

SHA512
8770ee9187367317167270cab37a453ffde8f9ce7c8d483c5374c92aa8cf62ca30d48932762af9ece9881eed970787632743cfb4d5bba23e4594d6f15b0699f3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
562766e703c8a5720dd7d27a9a2c3dab

SHA1
d7b9b8c03888ad8a538af4b5b941c51f942e7317

SHA256
07bd479ddb1ab04b40f0c63cd3a37c1d39816e88f60bae75964fc61192fc8179

SHA512
0a7fa05ccbb447a9c325fd2982f74d90a5b7b6a1c425749c07924d017d88364feec5172455043c7cab010434f170400c37c30f5b123f6a1aabcb6161df480433

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
41f9b8bbfe0a2fda28084b7fedb682a8

SHA1
186803686b5b5cff012b0090af63f3080dcf1758

SHA256
69c53380beea48d66d7ed53805a9df9b701570364555d5902b60e0bd37fe07a7

SHA512
12f332fd731d9685e20f8cad57f357fe36538303aa6f32bbd2e15d344d427aaf977290c38e5fcf071cba66cef54564c6db541c89f305e42280423d8adb0196c7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
3505dc8dcee5137c502689624fdaf1bd

SHA1
373b5429347cbb95bf60f976e864c3cfe905b8c4

SHA256
0a0092b34c445d7dc5656b73966f20ee9b3c786d05608885cc6ba85590937e1e

SHA512
5450d122c6cb6617839e9e0f2503d31dfafcfa4b748cd84087c81465606f023f80df2e25816f10ad2390facd2f22d9bc3764c9fad9bc1953b9eafd45d962ea65

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
7c076cebd0f822b470b11b37948970fd

SHA1
f559ecfa025b03f7b4bc1ff31dab7ed06d93fff1

SHA256
3c2f1bbe44a4d239f92dd36718514443dd93960089a1a3f5e21664c15b527d17

SHA512
2c13da5cf6f9bc81f648daa1968f277292c4bbb337443153765e77768924b878a68525057ad797c42ca723f1b4b72595cdd5a9fe2e760af0177773902294e2da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
1f6b27b337d734a273a250b8e712bd77

SHA1
b9465146853fea44da616e0fa1ffdafd0de9b416

SHA256
df30a8d69be803cba10c2a9701a02cf1bc790ee35906ea2db6d44ec46e3a0088

SHA512
d4b84827bc5370c4f38c54902e3e3fb31196d18b1d38587b9994e5e6f6f9e1578c80f8374ca9e1643917e7456f724d62863c065509a719b400519cb0971fa9a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
9612c8028787aa5864917b963865779f

SHA1
dc8840a2e41e6571056ce48639015a0a49f7dd09

SHA256
6d9b534637121b552b2ccf20f9fe895f6fd3d00281139bb8f566b5e7c0565d62

SHA512
8f658cb72d5f22a3ae6f75df15399e28d7e9a9dbe974be593dd38cebfa3eb99ebf41e347ca6a4d77b72f3f48e9ffa14b833ad59166088da922aee0c7ee5c8806

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
f341c8c98bfa3d6ab9ed8ace3e6203b2

SHA1
ab7cedb7eda5b3751bf0488f5aa7f6f90e573d14

SHA256
8b52a0c0e4349f2895c54bee165e5408a43eb4c03e24f55c8870227b76d24e0f

SHA512
ab910fc175e13484c67deae7a701e43135c52ac7c934cf7fad65abd13a68f06d762e24fcfb449116f691b7b779b99c117625a5f12525abe3ae3790c669efc256

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
217700fac67808e234c7fcf23c744875

SHA1
f68da8b75625e9fb62316841d902b7c4dddf7bf4

SHA256
3d55af0c132ae093b6e41451cce241c62fef2128844a76c65945a48bdd58c529

SHA512
abb0825000bc43ed7cfa2ab3fabbb5a9221e84eb0768da848c3af2b671c087bf70896ee92bbdfda9c24791511a22d593ee760683b42f63d780855cc6437d8384

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
46a58ef0d4bd3ca5eaf8f5067d54c5b0

SHA1
e25b13505b241bcab82bc2ff9887a6c1e7246da0

SHA256
206955239f77b922a6c1fd982ab09bbd24b965361ab74294c75cd5a234d8612b

SHA512
e1d40a11e19edcd29d573565a11bdaf81094062884afce403b9505ef094f85918bda2e2d64ff7a23a6a4996d7f1b9736a68a27f542f93c36fc1bbf1133ce57df

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
37bbfe2ce4efedeed2ffa9965fe9c927

SHA1
6f2e243b54055bd197f67a72f0a30f5a4b8658b9

SHA256
deb28c9bfc00ae3f87690a4b98f702ddad402afa7e6b622f95d2b2b972ea2930

SHA512
0f591f9d67782810f244c64fe86b19b41b48315135835348e6cbbacd955a943cc9bdfa70c2ca6ba94517c4b33742780dbda825759e91cb018fe59ca926d17190

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
f7ce12ebe55ae0befd170e66c77f6b12

SHA1
4e5dc6a093a1be80d27bea1213188e7213cc234b

SHA256
d1e8e34f7b2ff443f8135463338140292f0780417939a556b98aaecb970400d9

SHA512
393d7ac4de35f926ced04d3cda72bc3b258b19e9c0dec8b3267a6e1eda12e214d64469d357fe7e7decf2e4fd4e0d0dec7697faa83bcfae1417eb67a5ffc299a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
01fdc900fd99afb01fb586717b4e4f1c

SHA1
be3c62bc17791e8e2464679b3fd56eb93da6d2d1

SHA256
9b35461fbe74e3abe8c39d6cf480a3957532631a77dd661288dc89c3459b10d0

SHA512
1b3597519d38cada0932a6f27f4640824b9428684bfbcefbcfa5668cd80377bdebe3f13fa68583f4d4ec2ca53bfa75636b7781e3eb64a3d657c70310239735b5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
54b630b96b90f680ad48d08b71d8adc1

SHA1
82baac9271ebba713490be9579adab11f2572194

SHA256
50f261b086a7fcf92ec57d8f8ab2aeaa247932c271be094b777422dab41312e8

SHA512
abc0d4de86436c1aec8ba603b7079ae58f793f71bdd1fe60c234d59e3a4a4e08091b1cca41af32bd20cd1c801b814cc3960297db2dacdfbcd0aef7412d81bd8c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
930fb4110456e8dec12f7b78a3476e6f

SHA1
d3f220a83f96fa683b2e76b2e5e9fd066bbc5479

SHA256
6af0c7a3ee04d99137995ea8ae42530eaaa31bf605d7f44c1e6de7b47a1de1da

SHA512
be5d420e219fdc2a7bd5947c633be1db98ddbbf0f2ce905d30a64b46f4cbc255b5aba5b60f11a4683bc6ad58a9e372f47db216982d735ec621f59be0cc593621

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
a279bcb91b1edfa1feeda028fad15e72

SHA1
dc9bc25642a71d44494c0c8e3a24a746eb105f20

SHA256
f8e01a3998aeb49020ef244e7c8e473b3c894eae1b4b8759d0b98d3864ef80f6

SHA512
617d9e8471d9217f37a0824eedefe2b08bc3097a64d1773fadaf8bb8b9da166755bd758df355b2ff3572f2280533ae984bc8a86c5b2e26a33506539ad145aa43

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
8014e84492f01f9b30101e5200bc7a1d

SHA1
5afe72858ae91ac781666252652a21a672151141

SHA256
98d765b7976a96a6177a3f5da15df234190a5c80a34a0c518691b0addbad8e81

SHA512
a6a822ece601d06e9d3a90a4865d3a6c87a1d6cd8311fab21bcf457dbd86c8efba6655297050745f7f8c352df2b02771021adf5e36980b18ec843ac6370e0f87

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
ff6c3b52f53e485fe2b5112f6c522f5f

SHA1
c6ea2f518f707b7c1d171056405448a1d900fdf0

SHA256
fd38cf5472b5e10a69928f770d1be4e8fc7d978ef9c53d4da999dfe5b9c66701

SHA512
c03a7e099c6729c277b108bbc791cbd35cd36783cf7da4efaee54229a16fd6a89973be46358fe51358f62a928b34760b0e548db5bb7cf2c40b81bbfd65cd73ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
ca417a21f90b276bf9852aa0ed2bfbc1

SHA1
603921f6332d2040c008166b0b74d2d9a8e71363

SHA256
adcf8a108e8694356913838361f0c680f48f35af70982671900537a3eeb261fe

SHA512
b20131251fdcd1529cbc14b29bf810f747dbdb2b5f27966e029958eb2c7ffe8afceac7c8f6a5e3a6a432345a0ff1120a4ae0ccc3af7c97005156d0427b90a269

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
dfa40752ee9c4ee511ec6e28ce7ca518

SHA1
146fc42df6a60e5bb9558cabcbe2e8249cceedbc

SHA256
0c5ef3ae89b647df6c55fbe2da3262c07ce46f3006e61a055ed84ac6e98efdf4

SHA512
6723d4fc0fc420013c736f84d55e5c7437d4a453d1280a0b5f11f35bd97d1fa6174814c6b1e7096ad8ef40f15b41debc0d658290ef93efbca729df6c83ab1db3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
fc3a14141d4bef7454ba7aefb951738d

SHA1
3651bc2f74b052e5a95e27263c94a81ba5abf3ac

SHA256
6faee63ec928bc62a79074fd462d864093e218c0fc5b496a6ee76fdea6ecb97c

SHA512
9a8b0cff968e70ec4e24de649a145b9b3580cfe53a06b7ccc657ab7c4427e7407dc72a2cfc400340d38b6e23ff7b3fc636ad37fe96794d7f4b7c392c4b6b7b8c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
5cccfca71608c08791ef773d576e52b7

SHA1
365510ba8fea73f2842c6d4784b8caee98d9cbf2

SHA256
27d5556075bb115aa9f59aa49072c5015f8d250021beeb4c958ef8def1e06e89

SHA512
e7ce8aac7d7ff22c5871f33b42b068a15a15c84f8defef880cc3aa19c2bda3355ef6b480d7d1f584b507b9511a7a0083e388162345ec83d233e95db4ef425214

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
6088996b561f346db9a171ac01ca6191

SHA1
089b6ceeda6d71b623da62bcd5c2be03264f650c

SHA256
9f60b85998b4140e2e2978fcf75a21c18258100dd42a87b30e4977cb9782ed11

SHA512
fb5fcff76b3e35536dc66d780a597e9accc57af047f437f3df38da19651bf58ada2301fbcc035d1f1a71c308a4ba8bcf95be16285168a5d680f9035c91f5e97a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
320B

MD5
d1e3ae754e452b0150aa0385f9522b8b

SHA1
9f91b1aad1e71a3f70fb49ed646585ba7d7363f2

SHA256
8687cbc4dc79809fe741b5bbb5863073e0accf36e233b0238dc122fe8431a0c2

SHA512
1d5709194b6d1f607ee30d00f4f42d044581bb02aaf890682641e95028cbb71facb8919cda37b1fed68e87d8ea5c5eb58d68f6dada2fc206998cf2a658c62dbb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
f6e28e4f407e3b03c3a8a6e55a680e18

SHA1
1f4c88387add03223d8eb63548c7247255862ea0

SHA256
247123ac77394ad3363e77b0fcad9f7336935a88209ffff95e776a84a6095ff2

SHA512
4a8b2caa5484f4eb8b2680e2f17d56502b15ad843b7c4f49062d6a0cbba3dd69fa04cd665fdf18090b3c4b317a8261754054c04686307346c3df274a849bee3f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
af4927903bcb8b41e8a183e3d1af2577

SHA1
649d9d265a38f7b60191e41b18ee1c285881fcc0

SHA256
75e279fcac5fcd866cdb38574684a25313b60dfcbacfa207959e0bf2f2d31208

SHA512
ca8c38f5868c86fec248ee196d8ed12d89979d0d7178300378dc1ef28622523ce7283af7ab8496d4bff3e06fc974fbbd180d63f954182dee7d318f9ca48b3b00

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
960B

MD5
e6d953241bdd73a083b4a943b83f4617

SHA1
f86af092defdaa8c60004ed8ca751c7cbbede515

SHA256
ab9db7ab095d4c938365ccd912115e36aa60dbaa478cd9fdb130090043f22cb9

SHA512
6510fe81ec99fa158f7d0cbaef1897090f913b8aa6ea7c97456dedcfdf2887ddc7a6a721f28d2f18aeb9048d74125e23e983667ada2b9c05521233319b4472b2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
128B

MD5
8cd121b462749afe6e638b448cf72df8

SHA1
c31ef4cef37c0cf3dc887318997f0375fcb318e0

SHA256
9522d0436e20b81c4a0bcfd32fbd8c1014d04a7d3d7fca2aded2b9b1efc1b8ac

SHA512
5f6e9c1656cbbdc8f98ceb16e0acbdc1cb0f1c1e941d7607f44d36063edf8a27de6317b0c9a1f4fc64f281cfed0a7735475874f0c4a28dc1dded366ae717ee3a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d3bf2dc3d036601a35ad997d206f70e0

SHA1
a5a046c1811fed56b8a3fdb4578c6c0fa463b1c0

SHA256
77838ac9e651ecf3adca0ba3231be127fc7490f5c972f07e206b0a07d2b94de4

SHA512
15c62f2318bf804fdffcae1e829910f0e095129841b60bdd882387eb7dbf5ef0430aa211b8dbb4100352df4edf3fc89a86ce81db58f6304bf9db66b7395cb712

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
01c564cf749f6307fa2a33c9bfd69451

SHA1
2758949ebe4f2bf7c14ac94179065c1a781a8ae0

SHA256
3f8b49a7db16faeea909561703f1471b0d9b70f923338ef8b7a60f282ab0e12e

SHA512
f6439955793d194b244a5ea31fba2f8bfb4602756034b535daa235f46f5fbed0545de6dc211d1c0846e0550cac1a2adf0dc815cf8bbc61305414ee2cd8278b60

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
64B

MD5
90a35b416c05fb5784be97e1a4c4f733

SHA1
4464e1352619a79f2c4c5ca0b80d238471495787

SHA256
eb9bdfe2e762ed9ae4271e9114281d2016ee5b49fd0acbb1e65f718e1c5a2371

SHA512
41c9d88e25081de04a25c98119cd66a9f3c8aa450fc59578418eba62057d884ecb3a90488649a15bc11f2a54dcf4c85b39df2cc3cc8e126d70fe11255480391f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
928B

MD5
26faefc0fd9bcab62005444e133fcea4

SHA1
80fc9626f24cb415bbd4ca7af6d30e43582ae5d8

SHA256
ed2d585f3cbe66422a06e7356cafa7e370e06184faf173e27346f74415bced99

SHA512
02b584b9c37bd259b8a1280e9bbeab25ed6dc63e7c2a546d13b561c4c24e285ee5c1a1171dacb1177e6e1cbbf31e504be587d70f49e763d7b53f7c6ba1da59a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
96B

MD5
a7c0c22dfafc21ea382777a4d45a4604

SHA1
391d75f1cca2f2dd3663636724236daa8d02a2a1

SHA256
f471c13014d764f15527d031543887f50e705c4a2538847ef3639bbe2d5f313e

SHA512
7b22d9a60be4bc8f14104889983a11f596a337337c7a96319bb648674d2a1661dd4b2b8c7cc93210b50c2694c52eb084499ddcc376b9f51457a72296c9aa98a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
96B

MD5
e54562ef699be7988a04a834d0000e07

SHA1
92f3e8b0c1f4666ad432c06a80aa4961dcaca3de

SHA256
be43918cdd10ee8210576fe692b8d1feff45fac15f2a8b286e4a15f16648ab62

SHA512
676ce6b5c5554ac3a57c0745d7915d857e47c028df138141de58779075d2150bc692d454c718ec25a82c788c857c2de092c3e846d6d918d3f8c3e6355e0801c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
336B

MD5
791efcfd623b9080076b918cc0d4aa07

SHA1
05473092dcdb2fbbe59644a869289b21d0aaf5be

SHA256
60e4c3ade2dc544c097445fca22e73319edcbb3c968bb0bf911a0b10cae473d7

SHA512
8997dfb4528954655e8d4a2bdd2f7f0b1c33fbb8f09aa40e8b9a02c2ac425ecea07c02cc1ee9363049196b25b96eab6da5053ebb1a6bd425a0b74d2f02ae7633

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
c8b7e3783161ca0f16a03767600f57c2

SHA1
65537e56da7b11877a7f30a6a3cfb2f2b866473d

SHA256
1d59f7e2279ca502c3f55609567a981d9d3a19317ca8f1cdd6bd9c9cbc4f3d4a

SHA512
7bae80a6357a4d73696cd733411af50ae7688e72f1a610e410ab49b1019c057534d0453a464c9f3512dc0dc29178d892018c2547ae28700dcc2df9de98d17f7c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
176B

MD5
cbf0e1378aa8b2e619f4b646f6d1ec2b

SHA1
807e7ea56280a9c7a3300bde0ba451bc20107565

SHA256
6c7a9b4a98d804080cade33b01b97b28efc75e2dc4158d3d29f49b228e3de859

SHA512
b4828468b1f2244d4234e69c958ea71811e6b73e94dc9b7381f0c4e4b3357123768465241a6dd1ea4715680e89269d04f07d2874888c1c8cb9e6bf023ae2117c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
592B

MD5
e41886c49f3d5fc98da5a6f7f8bd4162

SHA1
ca7b6384275a2726530b021c2548763597a6e114

SHA256
59f8eeef6b8ce63b528ab640f32d803d1f87f23ca87ca0f5b1c58451efac8f8e

SHA512
a57c7ad641a19a2baae88d93988b9a21ca7b202817923e934d0e5c9124080225afcfc55715f9a9d8cb3c26841d3494f652f438e62641c3ed7092a6cfe8d1cc95

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
128B

MD5
e61fa01b91ba175e2963b6fb6c65efa0

SHA1
c6b8831074d83620fab45a58607bb6303b9195ab

SHA256
a3faabc17419f6956831941428fdafd43e960e01619139f19a92ca01f95fbe1d

SHA512
d416ae1dc519a45b8063e000b4f5a3ccbefcadf33840c05d12beb86746ad8a594b6923280814da3f5674c80c351c5561307b9d92ebb85150f6625be9be41aa51

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
4dd88ae402642cd3cc189f4898456e12

SHA1
78871531c1082dbd1428274837ecc9be9a21ea96

SHA256
ed0fe742ec713a565ae34b9077fb11049d402b572e24ebfe1231b27736d1c859

SHA512
ed4e63be7d7748597b14b0fd6a4f6dd45760fc0cb7ed42aff6eb212875a68a70516916fb781b1f56264928a15ba80feade918e2a29184a11b617d6791cd02313

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
896B

MD5
76b2d8b23b0a0701c54f817e1c8b8800

SHA1
5bbf58378a0f83ff35eb97a18db98585e55e2a4e

SHA256
308907d7ecab89341cb8eb4f63cae1be7c9fbcb4a546cbffc3717ef7ba4cef86

SHA512
6966e2fa6ade70cf14c50280449652d8dea4cbba7505b826ae8d61ea6231649eda6adbf0f0ea9e34dd8ca30d8560c9ebe9e69f2fb7d6367489d71adeb58b96c7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
89dfab0f53433fb140e057b125b900ce

SHA1
dbf5b1acf9678ed5bc6b411a82a449abc8f8fa4e

SHA256
d299948cf12407878c02a4c5fdf3b102fadebd95c9f6b64d45b808abdc9232a1

SHA512
5a5c890ad27cfa10d8541d07ff8d0961ebab84dcea3159d671049b86c8af8aa89966c94f46eb15288b2e2bec97de1899e1463239ec6b2a76db7161acc516b9cc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
3bf54dc06701e3d9e058c2692a6d3190

SHA1
35b507f3cc044241877f6094da43f9486e7a9a20

SHA256
112d35ad64b20a0cbd24021f787f91b6a0aa4e22010c0df2a46fedf23e160961

SHA512
d46cb4d6cdb6c90677833a8558ba82ef9704fdff463cd0fcce34507d80fdec192986b2ec03fc4122e854aa5127e5bc28e2e77413e0fcdf1b66fea3cef78ca93e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\ProviderList.ascx

Filesize
9KB

MD5
0db0e9e35dbce0050a4dfdf3b6b2f23d

SHA1
ec88de761636460da4f1f0ef5f3f58459687e031

SHA256
86daf50e548df1c92ec68e7e98e1f7dc7da0509d3b52151939071eaeea6397f6

SHA512
0b194d973813fbd4666e11b96ac28e7a69488d17f56dbe6dc4f8803584f865f6768410e5b1d2690a088ad46adf7401a21e32616dd1448a428c95567ab3f24ffc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
b6f708c0aa70ff0e033c48466cbbf9f1

SHA1
08c587f3fa83dcff097ed8567fece60d27745b9a

SHA256
c1a1e21e1557fe90582ad708459cc03a20be2ba04fe3935bde5a3210372a4b7b

SHA512
39360f0d24801c434dca5e1e4e95d99f765a0caf107d932621925800237e9c9950845f5664d8c72efdfbf6346a84a3f3b93de5f0440b8869e8a7e72a8233a7eb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
ec45c93ff64366fa29864c97c0134a18

SHA1
6845ba19515900de22dd58a3ee8d2fec81248fbe

SHA256
b0bf78f1f6976e65b02f56341df535793865499404e8b461b9653d1bd4068e39

SHA512
9378a680809abd7f1c55bc25d8de42af94fa578b24eea731f50be9a1a8f01a289a799bd18b4cf5537770c6a64fef6aebafa2b6cb62df0cb14818db30a7f01e88

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
169a8cec0f6bf53410d598e196af4652

SHA1
0e782616d62f156baaafc25f8bd33bc37396ff6e

SHA256
064ba2474e44722d27b9d9783ff7e7f65275256f513417e752a9eaa0506e1ba1

SHA512
d900610f9ab7c01b49ad3662d05dc491b95b3f2b6a8ec721418814da9b75850e2725bb45a5947b8742414466927f34a8ff2d3cef7a4f851fc3ce9c500de1add5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
dcbaa482098e94825b3527cbcf53ede3

SHA1
c5dddb31dc17442c241a9b3850a81547521074f6

SHA256
70a7056baecaa96eda11eaa0e11b8a0da6d2cd907567297bfba190604b9208b3

SHA512
09800cf8b5d72ab5671ac277cb11cc69c8c4df7af31c4e5c74a8f497202b11f5629faf1c5d208a9fac16da70b1a0862828be3690ef0d77f998fb4e246de38129

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
e603e882cdf01c9f433c12c520bd770d

SHA1
99a555df6c1b0d060f1965dbd572ce4e9f6f07a9

SHA256
94729987f653ae991cec1758f95e2ba3e8b1e1150ffa7758b09a4e4d912d0d70

SHA512
8b27e273e0d054b2c1349b223326fc0987be9cd1447638b146c513fe49b2f2dd79bd0ae3ead9537e1d826115cf1b858de5eb10102b63b837b6991c23f38ea104

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx

Filesize
2KB

MD5
9e692c0b3f71f32d9b7708576bcb40ed

SHA1
a145ce23441523cc61c1dc6538d682f0cfe2f7d9

SHA256
5ddc37824bc241a340a288d0115a8308d8988f11f79ede1427fc6702871d5738

SHA512
c1d7c2b73e634d9344cb342395d883dc88af673b372a7014e32dd2e8255ed54b32948c578bc549d7d27724fe6cd2c813d4d9faae08699e968165ee424a454d23

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx

Filesize
7KB

MD5
2af08c3f5f988c4d01ace73de942cdf2

SHA1
7e3cd7bf012aaa92ffb6b8d560e72e6c9ee77918

SHA256
7f132b865d541320a86a7f2e5198d59a94b33f1009bc3db81ff666ec248e47de

SHA512
2674fa4ec5ea3a8649c645b292004d12591bd942efe440214c03b6f32fb1bf8a32c3db7cd6b6c778ebeac15bcadc0312c8b4dd9bfd504d41e5d3b6d088e528a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx

Filesize
272B

MD5
52663b291ae30af49a8ed1279c8aeb4f

SHA1
54ca2f210791f59bda2364f14b697fd0d0f8eb27

SHA256
7fd6336f69e9c504bbe7d23eb2fae72fbaf1735a269fbf5f37967f07ad3ad61a

SHA512
0cfbbbb0438b32ea65af306575b88d6f56b18c6701f07d21183bcd37427fdead07ff406948bd985b71a0a056bb70c51eb930d0c0ca2cb0a488f04ee9e8ccb834

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx

Filesize
496B

MD5
5678b193ce78c4f6346e212fea8c622a

SHA1
5a27cb8eb6c814c514acfcd44a42e6df10f46744

SHA256
61671481486dd0632c6e99297677755435aeb66d303bc059838a75f2c4918549

SHA512
39a4cccc3aedb2a9f1965710c9cdde57481f14406c4d83eab0112ea2ab0d7a494f9db4c8ec5e891154c3ed29171e8f78aafd45e6afa7054ab4f2dc6f7df9a2b6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx

Filesize
24KB

MD5
d84a85a49bcb32b1d2c057604b206595

SHA1
c89cb0150065c764ffa4a061d1ff21a7545035b9

SHA256
a294cc0cf1d19c1a3e7f5dda1bee090212e01cba950e47dc4ac54ec5c13a5a86

SHA512
7efdd2f0c49298e8bf8cdd6780f035d65dd4e0ecb987aeacde3b00168ffc044a0cddf352ac1cf8b40f726e4c2bcf4bfbad88cf9347c16faa1571fcc5fab3c62d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx

Filesize
1KB

MD5
ae37bc86ffd9cdbaafef706d36da81e3

SHA1
07236ed8af42bfddf215085c22463e7b1f532611

SHA256
137cb9cd2968f62663efd3a565725be225f8a7b98bcd564b8e2e21ad6bff63f1

SHA512
aaef679029cb597df4eadda46aa0f78ca42184f7f2d214897de3b1d8e4caa9fe1a262ac168db5fbce89240198e7a5c532e0c68f597f019a95c24d5ee8b7945ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security.aspx.fantom

Filesize
9KB

MD5
c2bf78cd2a10e6de888cdf05521c564e

SHA1
831116e4608a211f962ad9928ddb57c73e438401

SHA256
28725f1e8d3f3e3c71fb4ac37c443a4853e87d54c8a2acdb850934cef52586c4

SHA512
fd8b4f6bfd5d675aebee54b21d1525b68f86f833f519ed9b4222f822a8f7ac98cdb99a535042fa5fcd3bf78ff2671c3e157b8c6060ed2259e1c6652dd4403ec1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
3bc83bea94226b7ca4a93266a445d1c5

SHA1
c90b44357d68338ff526a2baf39d872ac52cec61

SHA256
333a41aaa62aab078eee04f00777c91a646e729aef49584e663a1fe1e3e43931

SHA512
939e425465d13957461681cd2db8caffdd94aa956a63b7390ca54c7ce85bc7e950f9d9c5a84837f64889287743ac651b76c8f85d99d64253ee5f9683ccefab3b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
9263539ad47f23fb67361c040eef866b

SHA1
4cce996b78f4e27cc93584fe4f42586754a2dcb2

SHA256
dd3cf542a05d5c25c90b7a0689509d8f5ffd04215cc24eecbc6c7dca1084b8e3

SHA512
6d8d63dc81303e8a7442bbf3f2821d696e430a808b753f921900194882f1616f070e8c159cb35973915fc155d3a02bd9897287b51ca06f55a450a594221a8d03

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
a6e9b81fd64ed09c7862a02d34a9c10a

SHA1
80f0c3c7af942f3ebc37e717645d5cf3efd3b612

SHA256
a9c9afb5b2926ee36a9f1ed4d51c9328695ffb384281dfc701bdba2d11ca49bc

SHA512
55914287fe7a032d35e9ad3e87007ba9a1af15f82b0802903727af84a5af06fb0f68bcad61c2a3f23200e0be5224b71647124212f690a706ff4cd78c634416b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
6e9fe61443ab1f10135a7c05c6498abb

SHA1
c4a3bbfeff3e873d373c70e76aa047d7df2a42c6

SHA256
1e3aed55ffbacbdb59a5afe168bb305fef712af7f5ff74773c1b490156b4304e

SHA512
01d5fb9f675dea5f9176b63b3ca5d969ad8bf1acb05551f58c6c3e0989ee783a0640c9319f5075742972a4398a6f8fddd9e4654f1e9b1273919c620014adbdef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
2e15b92cd3a3a29948d2ce12713dda5c

SHA1
854f0b84c2fe528b37164fbaef989e044078cec6

SHA256
8e01a0906bef12afd21a08d4cd3bc46e92d0bdae9413d848306f93ee333db0f6

SHA512
23926c69b97b9b380c20fe6110ad4f14a7516e7aaf14dc1d8e8e02ad5dbc7bdb3bd81280cd335e678d50bf80e2a11ee4bd0c15a7d2114be531014815aae881e4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home1.aspx

Filesize
752B

MD5
5bc9690491efcba95b4e23d5f711cb2c

SHA1
33b2b5cffd8a03e615191fdf14348038ad4df8e5

SHA256
9010929791e8dfee8564357a4814f1eb94e6f9b9fbfff752f79b4ff0a9102118

SHA512
ed3f3065b85d34f019d41d423a68053321eea5f4f62eda40570de5ffa62bef89ca4fce7d4d8dc53fd36f369ab8fe63ab81a706cb3187c4e5b5272ada8b6fc6d6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
14f17eb5c01aeae1be61b00ce3ade17c

SHA1
fa848f4cb1cafc9394d2ffd88a5dc45b7bcb6f51

SHA256
294dad8e59e4a56d66452c7f3f40a6b59234c481e5b2bc4fae6122d3c5d6c9b8

SHA512
59993eb2b6141d390fc05618e0851497fdedbe0311239c0153390721e03f80966668d490bc0022f6e5c1ecf767284a19fc3d335414f5beaeac919b8dacf858f7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx

Filesize
8KB

MD5
84ffb3ab1b9748b27f17a6cf347a8644

SHA1
4f8f6e7aa4639646d648843dc09f8c25d485f313

SHA256
e066b7c351cd712959adf5626fe658f2629e44c488556f5f07075f956ae7715b

SHA512
8b741aaf35052563e9e2e1a9d68875e69e512df6710ac60dc3bf42bd1068da33b3a469046c8d1b8b54ab11d29af344932b95c2d257c8c73fd8f04cc28a7d7902

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
c9084ac56efa2ad1849e66e0014deb5a

SHA1
c9a9294fc62a403850c19e6eb34ac90141a9a532

SHA256
3563c20849f108ef1f1fda02a15b46c5d21e435413bd39908f2cbb736b5054f5

SHA512
427b12832285a3c1061fb93c2c421da8ee3a73acb9a5d0833bf1f58f1fc88e3fd30bd35f9528196bfd0200d0a97cc6a0c468f9abd136be4edbe1a17624680136

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
c78515a413d79f4c10cea2e671132d60

SHA1
27c9135e2e718d3b5a6c395b8e478ddf0fd32cbe

SHA256
41400628b1315c445b1d4598f0769b5250b0742ca574b8b924bc2fe5b1f47c84

SHA512
09f2a0801cc93a056ebe685067628a74078b64dba5aec7bb5e76b36e15887390501db8d7f5bde7fd336fa9f22f3c4b1c286c9350387ae153aa3d2904025ae91b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
6cbf63bc1f831b08b53e19a37aef6323

SHA1
fae382d67bc794cb09b535f102ad1b9a7e74ffef

SHA256
048988deb582c5ae53d29516c9baf37295f040b4cd0b8ddcf9fcb2c30eeb097c

SHA512
945d72dd0dc29bb7ab078887b88762d6980c1868f1fb21de423e5e9a8c92f90954dc4a66b636798efa7f552d624c3731883c87824a2aba0ba43e77a7c67a695d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
b9011b305cec58701a14c8343fea29b0

SHA1
7591eed5144f8caa31cc330ed5fd5537252a0311

SHA256
9f861f68182ebb15565b3fb45fd5e47956b761b0c4ef7473e4ebc144c76ff893

SHA512
f0c958c9f9f672c0b92b9fadc38f60f55c565c88c42e483dbffdb19ea68d4a8e2e8cfc11fa2c378ce3fb29e61c0e258e6f68643dc46652d35d7119b13859ef2b

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
78a103b0e03644209232eda177449938

SHA1
ea68faa8740f8848a2179aa191443bee8d535333

SHA256
6a16dcfd987ed7ef982b7275743cb843c2d045cc43c544226b67e99ff9ab257f

SHA512
e4cb131f6a99c581705c785cf4ab073fda392a830ffdbaa2f20974fd248a3a062b845194a8442ddbb1005b70575c23b303838b3682417243c4c1187de9c348e8

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
19060596919ab82d75a7189cf192d7fa

SHA1
57b3ccc0003803fd5de8e23d1abfd6ab121c3679

SHA256
50cf6960abea1b2a9a74826421c74e5a255602fb592e038c2ebb44652633b428

SHA512
2c224765e2284895f42f5a381e6db13cd728ff712dbde5ed75ea12006d4c25aaa5bf33cd76e494bd053fa938d9b50a25abb940762686c4dec34d0d717aaa695a

Download Submit
memory/1760-41-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-49-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-7-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-9-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-11-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-13-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-15-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-17-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-19-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-21-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-23-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-25-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-27-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-29-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-31-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-33-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-35-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-37-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-39-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-133-0x0000000004770000-0x000000000477E000-memory.dmp

Filesize
56KB

Download
memory/1760-43-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-45-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-47-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/1760-51-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-53-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-55-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-57-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-59-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-61-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-63-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-65-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-67-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-130-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/1760-69-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-5-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/1760-4-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/1760-3-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/1760-2-0x0000000002100000-0x0000000002132000-memory.dmp

Filesize
200KB

Download
memory/1760-1-0x00000000020D0000-0x0000000002102000-memory.dmp

Filesize
200KB

Download
memory/1760-6-0x0000000002100000-0x000000000212B000-memory.dmp

Filesize
172KB

Download
memory/1760-131-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/1760-132-0x00000000744B0000-0x0000000074B9E000-memory.dmp

Filesize
6.9MB

Download
memory/1956-634-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/1956-633-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download
memory/1956-142-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/1956-141-0x0000000000340000-0x000000000034C000-memory.dmp

Filesize
48KB

Download
memory/1956-140-0x000007FEF5E33000-0x000007FEF5E34000-memory.dmp

Filesize
4KB

Download