fantom | f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

Analysis

max time kernel
447s
max time network
449s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

10^/10

fantom evasion ransomware spyware stealer

Malware Config

Signatures

Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
ransomware fantom
Renames multiple (4977) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\gmreadme.txt	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\UMDF\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\drivers\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Executes dropped EXE 1 IoCs

pid	Process
1176	WindowsUpdate.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\displayoverride.inf_amd64_2a9c012705b571c0\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nvdimm.inf_amd64_ccd884280893585c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_59f44e80eef3e979\Amd64\MSMPS.xml	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield\setupdir\0c0c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\slmgr\0409\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_c99b59b6582a4fb9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardreader.inf_amd64_f67fbcc0a7a69ec9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp.inf_amd64_356c20e729017a77\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\wsmanconfig_schema.xml	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_d0a32e9741bbe0f8\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgip.inf_amd64_3e25c04e2c3d6613\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsquotamgmt.inf_amd64_9205d32800f02b4c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_36e645b6749c2fb1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_31092e2836f773f4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_144351277838b429\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_ceeb330db4f96bf3\Amd64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbser.inf_amd64_940939d942638594\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_8baa0e78bc8cb374\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\sk-SK\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Tasks\Microsoft\Windows\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\arcsas.inf_amd64_b3d75f82c617ac6a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdcm6.inf_amd64_9e04b558f824ccda\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_fb34902231ab4844\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_2518575b045d267b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Engines\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\SMI\Store\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsCodecsRaw.txt	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\chargearbitration.inf_amd64_eaca9802ec3564dc\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_modem.inf_amd64_0f21dba342ab7880\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\nb-NO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\Com\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicrender.inf_amd64_e1a5502a3a50be4e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnova.inf_amd64_20a757541647917a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_4380e2aed0a6937a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\F12\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\InputMethod\CHS\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_84ea762c0a90c362\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsundelete.inf_amd64_f76708e3678e38a9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_cnl.inf_amd64_a60833fda31e9831\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_skl.inf_amd64_b68199ad84607c21\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_21e2506ffb3ca7c4\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_46a3b42507e9d29e\VSTProf.cty	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmega.inf_amd64_761da296768138a1\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_818cb7538a240b3c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netip6.inf_amd64_35eb4f6b0a600ef7\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\Recovery\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VMDirectStorage\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP\APPLETS\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\CimCmdlets\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_usbfn.inf_amd64_0738ec68935305c2\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\2d5s8g4ed.jpg"	Fantom.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WideTile.scale-200.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover_2x.png	Fantom.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\BHO\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-125_altform-colorful_theme-light.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-16.png	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreSplashScreen.scale-125.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherAppList.targetsize-48_altform-lightunplated_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-lightunplated.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nb-no\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\zh-cn\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Photo_SunlitForest_Thumbnail.jpg	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-black\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_contrast-black.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sortedby_up_hover_18.svg	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\tr-tr\ui-strings.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-30_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintMedTile.scale-150.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-96.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-16.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\ComboBox\VirtualizedComboBox.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsStoreLogo.scale-100_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintStoreLogo.scale-400.png	Fantom.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxLargeTile.scale-200.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-100.png	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.42251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-125_contrast-white.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nl-nl\ui-strings.js	Fantom.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Getstarted_10.2.41172.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TipsStoreLogo.scale-125_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-60_contrast-white.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\contrast-black\FeedbackHubAppList.targetsize-40.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare150x150Logo.scale-100.png	Fantom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\rt.jar	Fantom.exe
File created	C:\Program Files\Windows NT\TableTextService\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\WeatherWideTile.scale-100.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\plugin.js	Fantom.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ExpenseReport.xltx	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\lib-commonjs\DeepPartial.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib-commonjs\initializeFocusRects.js	Fantom.exe
File created	C:\Program Files (x86)\Google\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\AppxManifest.xml	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadMedTile.scale-100.png	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\Text.js	Fantom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-cn\ui-strings.js	Fantom.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SnipSketchAppList.targetsize-72_altform-unplated.png	Fantom.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib\components\DetailsList\DetailsRowFields.types.js	Fantom.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Icons\StickyNotesMedTile.scale-100.png	Fantom.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..teryusage.resources_31bf3856ad364e35_10.0.22000.184_ca-es_74c144366299b198\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.469_none_fdfb724cd2e5c0ff\oobeactivitysyncconsent-page.js	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..cemanagement-dmcsps_31bf3856ad364e35_10.0.22000.348_none_74e5312fc75569c2\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.management.extensions_31bf3856ad364e35_10.0.22000.1_none_4e331728b3866e71\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-newsandinterests-adm_31bf3856ad364e35_10.0.22000.37_none_bf26bcf5cbfcd35b\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.22000.282_en-gb_5d490b163dc33ca4\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..oem-coren.resources_31bf3856ad364e35_10.0.22000.493_ar-sa_39060799fa5fa9d5\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\js\appObjectFactory.js	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.22000.1_none_320485a967710068\SIMLockToast.scale-100.png	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.22000.493_sk-sk_40e8499c24b46839\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..ty-aadcloudapplugin_31bf3856ad364e35_10.0.22000.282_none_1dd6d9a4902dc143\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-msauditevtlog_31bf3856ad364e35_10.0.22000.434_none_ccf58c6d32002f41\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.22000.493_cs-cz_1c9f509dc84bf306\f\license.rtf	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.22000.184_ar-sa_76cfe06e685a8fd9\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_10.0.22000.493_es-mx_5df4537807644bf4\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_tenantrestrictions-policy.resources_31bf3856ad364e35_10.0.22000.1_en-us_a8b87dab420d682c\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\windows.selectioncheckboxes.svg	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\InputApp\Assets\Fonts\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.22000.1_none_52f20556dd84fc53\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.22000.1_en-us_57b4a762a59d95c9\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service.resources_31bf3856ad364e35_10.0.22000.348_ja-jp_df2b7e465e190fcd\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..-oem-core.resources_31bf3856ad364e35_10.0.22000.493_pl-pl_948411caa0461c38\f\license.rtf	Fantom.exe
File created	C:\Windows\SystemResources\Windows.UI.SettingsAdminFlowUIThreshold\SystemSettingsThresholdAdminFlowUI\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pcshellcommonproxystub_31bf3856ad364e35_10.0.22000.71_none_8ca57456c5039439\r\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-wmi_31bf3856ad364e35_10.0.22000.1_none_b6c5f3788a182dd2\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..omponents.resources_31bf3856ad364e35_10.0.22000.132_it-it_21c1dd696de0fb3f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-wsp-health_31bf3856ad364e35_10.0.22000.493_none_604ac73f390c94bf\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\badgeBreak.png	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bind-filter_31bf3856ad364e35_10.0.22000.282_none_d2214a785a038c6b\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\Temp\InFlight\e67b0f8f4235da01a01400005c0c0418\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Install\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\v4.0_2.0.0.0_en_31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-256_altform-unplated_contrast-black.png	Fantom.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-s..-installers-onecore_31bf3856ad364e35_10.0.22000.469_none_8ae0ce8a724ec41e\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\Public\wsxpacks\Account\assets\__\lib-localization\dist\resources\mt-MT.json	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.22000.493_bg-bg_cdb4758693218811\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service.resources_31bf3856ad364e35_10.0.22000.348_fr-ca_4b54533c98a47e9a\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ime-korean-padresource_31bf3856ad364e35_10.0.22000.1_none_990ebb338e5225f2\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tartup-filterdriver_31bf3856ad364e35_10.0.22000.376_none_29b99e46653e4b72\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_tr-tr_f9b1ca750fa11341\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.22000.493_ro-ro_e89477064cc5ee80\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\js\autopilot\troubleshootingdiagnostics-vm.js	Fantom.exe
File created	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FileExplorerExtensions\Assets\images\contrast-standard\theme-light\windows.bitlocker.manage.svg	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_10.0.22000.1_en-us_b45b2eebba6a701a\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\FileExplorerExtensions\Assets\images\contrast-standard\theme-dark\windows.copy.svg	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..erprisesn.resources_31bf3856ad364e35_10.0.22000.493_el-gr_1b0be1fea955691a\f\license.rtf	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..complus-eventsystem_31bf3856ad364e35_10.0.22000.434_none_084c06e9d6ef98b3\f\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..edia-base.resources_31bf3856ad364e35_10.0.22000.120_fr-fr_5ac0fd4419c08013\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..trolpoint.resources_31bf3856ad364e35_10.0.22000.1_en-us_aea5809bcdf17d05\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft.configci.commands_31bf3856ad364e35_10.0.22000.348_none_a84f00b3682204eb\f\AllowAll.xml	Fantom.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_10.0.22000.1_en-us_2721528996045cef\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rpc-kernel_31bf3856ad364e35_10.0.22000.258_none_ba59492607252f69\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.22000.1_hr-hr_f1dfd608d5a21c06\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_code_b03f5f7f11d50a3a_10.0.22000.1_none_19801c95782af357\PasswordValueTextBox.cs	Fantom.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\en\SqlPersistenceService_Schema.sql	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\InputApp\Assets\SquareLogo71x71.scale-200.png	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..nt-uevwow.resources_31bf3856ad364e35_10.0.22000.1_en-us_92275cb8a5ac7a35\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Policy.1.0.Microsoft.PowerShell.Commands.Utility\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Generic.Theme-Light_Scale-150.png	Fantom.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\DECRYPT_YOUR_FILES.HTML	Fantom.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\Public\wsxpacks\Account\assets\__\lib-account-assets\dist\assets\theme-dark\DECRYPT_YOUR_FILES.HTML	Fantom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000_Classes\Local Settings	Fantom.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4564	Fantom.exe
4564	Fantom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	Fantom.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 1176	4564	Fantom.exe	83
PID 4564 wrote to memory of 1176	4564	Fantom.exe	83
PID 4564 wrote to memory of 3220	4564	Fantom.exe	98
PID 4564 wrote to memory of 3220	4564	Fantom.exe	98
PID 4564 wrote to memory of 3220	4564	Fantom.exe	98
PID 4564 wrote to memory of 4624	4564	Fantom.exe	96
PID 4564 wrote to memory of 4624	4564	Fantom.exe	96
PID 4564 wrote to memory of 4624	4564	Fantom.exe	96
PID 4564 wrote to memory of 3644	4564	Fantom.exe	93
PID 4564 wrote to memory of 3644	4564	Fantom.exe	93
PID 4564 wrote to memory of 3644	4564	Fantom.exe	93

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update.bat" "
  2⤵
  PID:3644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\update0.bat" "
  2⤵
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\delback.bat"
  2⤵
  PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
e0d7c8e0d85723dbf462fd7791876974

SHA1
ab190536c13a813598fb1c7409a77627724b0b02

SHA256
280105a13e7135c54a5010b0c9a06b9f12e5527e1d8f9c33b0fae5c63ad0107e

SHA512
9ffff32a2a453362b29e13081a749c3fac990418b108ca83a647906e64573f7d658621aa9bc9c1d0f878775dbf11e0fc1906958cffb4dfbc6026123bf50dc302

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
565a338309cde28b7326a464af019c13

SHA1
5f18807709d4cc55454a58d232a5cc82eeaca625

SHA256
694281ad3143881a144290071b358d34f1c747189230b46e51fe79fd31dae4c5

SHA512
295fb1d4e89c7aaed310321cfefd09493b0fc2438efb08f6b51fc5528ce509cc605c2ec6743615d77ea67788f6d45810ae4c33d74f8723a5eba179e21cf0905d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
3fa54306fa6ceadebe7388624b8461e0

SHA1
9db1f0c111b2169db551a41b6ff090548ec724ce

SHA256
91de67b8938badaf6d0e29bda84cf3659ae6932b8c74b96268aa7e952ad6a2d5

SHA512
002888ec378864afd8a0d48ccae223cc76d1214e72940d4ba5b363492160ffd70682a5b06a010a49ad2354ca921cfeaff8030968a780d4b67ee9d36c106ba429

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
320B

MD5
34d0edb7cb4c21bdc157335359902106

SHA1
2641090d8bba81778c966893eeb9e379a665f583

SHA256
d80a4b78ccafcc51fc982bc05dcb68ba31b99a4afb78e2e98d3be73ffcba30e8

SHA512
96d2dc3a4570bfa1e15da68dbf5eb2c0953184fd59f6b9688c582134dd69f395eab33e11c3cc77e04e63d4035237c42d052e983a4c0073eca056f1283a22e85b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
fab8bb3e61313e20ebdeb317df76306c

SHA1
06f3c46ebd52f063d9fd39ba2c149cad984c2da2

SHA256
a889ced821130a2cbf7c9173e5ead6f6858b587aebf72e1e7ded527463de69f9

SHA512
0f88fa95da40181639f467cbef5944e978863a908d58aea8353ea5e124ddc7c1e5336e4d601422a2a8bce593cb1276255d1a67fb7d59b93f4b5a291ddef91bd6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
ebd63c98c6e72e0c1a7fd8b229bc6466

SHA1
308be9835359483e0f4aea84e4bf9ef1a271562b

SHA256
ecd658dc2fcd623f075bc3cff482eb14eb2278813afd7570f551bcc2db87f58c

SHA512
548ad80969dfb04f6a124422dce5cc5fade1f2430b60cd83513b45dc3257e9aa97ee5c42bf4575dcdf2a66e1a42247441de8b1c000a375fa3b6aacfe5020b175

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
960B

MD5
7eec3c316e2ef4ec55432f78e97f50cb

SHA1
0613aace2a97ac20ed2c9a838771a5e90fb49ec7

SHA256
dc7f9cad1d94aa953ad418b6a9c6f43bcf0d08c81c5a2a829383a4a5db056825

SHA512
4fd61788cca95b0bd7c3fd968a8ca8c58ed9410b9b67c28ba937ff5e8546a0d30d9b0897f65d91686220c86bb36adf0f730c4aadd9847d6ba9c268d2fda1a167

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
128B

MD5
06e8e0baa483f2763478607f501a7498

SHA1
9ac6f3b7bf56bacdd472b41593c49eae548ed248

SHA256
dd2a0cefeeb026253aafec958f80d862dd6f31ba557c20636e53ead49a7ae6e2

SHA512
25056efc7d36ce1e0f7404a7b2ef36494dedcd67ac07257ae1c1523a5adb7c374f81b719c915903914c9d8df1c0cb24cf4f18569461214588d6dd9560d0229c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
30e6efae66dd0fb978dfb862fa1347ec

SHA1
d51426f967ce79dcf1259a4b7b162b6bf6d4bb5e

SHA256
37255e1993b25b9cd312cb2b09547d9850d78eda0fdcc081d52e1551d8cc2472

SHA512
e8addbde7e3e5e66655311e28e1c1ca6db77a1063548f186a1fe2a4ebe0a1917174bc3d911848611301629d5b1b18ffd7614aefca16fcde102ab5daaf9a6270f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
777e222e25471e1a7127db6e260ab110

SHA1
ebb162607e6fa6b976da440d2902513320d90dd5

SHA256
1136c9bc7ca7532d161c2d058186ff4344378b74c8f35ed92dab95bf8aba1a3b

SHA512
a318d791b786b3db1700c7b69ff001fb0c0f44c6bf3fbbd3a4598ae168fa3371beb0d7cb73365b1f25facd666bb538db654cea49b960ec92e86329f689b9b43d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
64B

MD5
58bae24a8d31f078ac038aae83236a61

SHA1
75df4efc87ec58ba362a8a92affbd622b0f05c99

SHA256
713f7b90c6af814ee90c4fe91f105613ce50950fcb023af042e9c2a0511d762c

SHA512
b26cdd2b573d647430c29d29d1beb45bf1aaf8f067f397486071444dc03be59556b2d8caf4003ce90b1f562678d919e066a2808b50c7b24d9e8c437bd1f30a37

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
928B

MD5
1ea4e3c28290b50b781c781cad43b35e

SHA1
33db511c3f66e694cc2804127288c9780749e98f

SHA256
a597ed8c478d3c0041d350b8a6fc6ec181c5676eb0c88f75d00f59ce7610ca1b

SHA512
8d2a0daef52acd6e683fac8936900c1694c2e6f03957765d4e0d91da4e9f192da74fd57be5283c653c79d58335d75ca284cb8f6a4fcb49e5743a5e80cb6f8096

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
96B

MD5
a00780e823ac9433bc6164cd52ad859b

SHA1
7213cc0724269c58e6a26f6f9ad5e1ade436f158

SHA256
cb9b51bf7efb9a9796e48546f3384322424a808fb911a7bc92d2dea6128b9586

SHA512
a419842b66b2bd013017176e2875196ed6f01fdb9f687cb50838c8b1a72ad45aa47dff62af1d924b90854cc1e02810c61a8a1a82d2fdce3fadf6c193ccc2171e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
96B

MD5
9a636b762062d6c8cbfe9f1e26b26488

SHA1
8d73f9beb30cfb464dfbe29a79831d7737749069

SHA256
dd81d6fbc9575b05802dffc255305e59b4a66cbb4394cf19c58a0366c5086079

SHA512
5ddc4a15a373b2ca3f79c16efeb373c733012ea98c2cd394bb7384d9233bb0a3929ab87b6fa6acdaaa11ca16bec36fdfa82aa8e0e096f9b880f7b8e4e45d77a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
336B

MD5
163f1c4a7e08d95d7bcc1ed402d86ed0

SHA1
d92765ab69abe408a3cefca522a1b84cfa5de1a7

SHA256
8cc48c5ddcefbed297cafc078a4dac3b220b4d35189a5ac1538bc6e01cee760a

SHA512
d1c6d93ddf651be5a3e577c2e3f07a367422835d2512dbb1d495cceff7b793448d3f903873e586762999c9dd9d402c96108747dbbdf9c10825a4fde3de69ffd8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
f1ed82291e5a4dbb51ff091e41a6a973

SHA1
019c1d908e54da344c8b77b0a9ca19886dbe963d

SHA256
9b4b01551a3a4f7cf06588c404e7a840475bb67cef9865fe1645b999daf19d26

SHA512
e3b9c0af7648188a29955754a6183d866a938938f39f4b4228748b31625dd4c550d09ccdcba0dbf81ba576b961c1efc9e7f2c35f7c97d48fd4d1de97a24b1026

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
176B

MD5
1c6256beb5e8b940226d8db60ed0888c

SHA1
8d1c4f9100cf91c705345d655cbe568669a19338

SHA256
69429da428b3a429103020cad543bd643e939478ae8f079323376b14e4f9cf3d

SHA512
8bf39b10a7f6b00ac0c812539a56d53063eea950b3a61932c82255663aad4e35fb7e50b2b65b7916a895b89b29f54f512bcdeef1d0f95880e37722a6a361a6be

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
592B

MD5
1a53c8551336c7de1ad3f5d575a59ab0

SHA1
b0053e226ca5d0ef949b51b99cb093d919e92b5c

SHA256
d16fed307d609df1e5e8ebda5040e2ee6b0dcba9671dfa479f2629734bb160a9

SHA512
e6632b626b3bf0a73dd7aa439d82427baab055f86ee9a76ad268623eb136b4ed3e32bb2197c1f558798f5560ef865ce60c8d88e1af2a62508bdfe555f623cf68

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
128B

MD5
b4607111491ffeda57a13549f841d329

SHA1
a5162e2d1f824398fd9981778f441fe1bc173b5b

SHA256
5c007476c37ef4e559f43fee855184024c2be66c0af5cb8f8aede3c3adae2e9c

SHA512
a02d2a2b4a9751b05964201f4d3c2fe73450dbafc018f1806ac31dd29a303a259e49d604cd05d0c2e8a3933771bc1e0ca4b1daa359f930dda970c2ca5ac16a59

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
be2a1984b37702acbd01bcb0fd26e815

SHA1
aa07544d4c1a326a8c39649c19f520f96ebd556e

SHA256
88338b4d1da393b40051fd4f9011add4fca4b8d28dfb17e0398db76de010739b

SHA512
05d5afad077149ff8fb9c20bfe4cd7e3c1687b803ad703a0e313d7dcd3a1b4871a2dc8971d073bbaa534480fc1a246e03cedd824463ab68e8c110fa8102a0104

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
896B

MD5
635d22f4d33bbe373dab3ec4127ab993

SHA1
9278ccdf22c8915d8e64ff7ae2c61b7ddad7c7c8

SHA256
4e54140c5054190994c68e73bff02bf5986f78a01aa13b0a0959047112e746c4

SHA512
d67d45053b215ee98aaf2a74aee508ec16fcc1206162302bbc1fa258fd37adec0c00393433ec68566c29c4e9cbf960171f6e667f8ef1d423dcc21964bd22edb6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageConsolidatedProviders.aspx

Filesize
12KB

MD5
eca73c3f7a23371e49e51cbded60633e

SHA1
6f34a38bf47eccf570d18c457a68464b1176635e

SHA256
9262f1da79a84d70626fec4169b7970f65904b2e8315610898904db63097d02d

SHA512
95e9b6e7a1bc253b9787c5f7ee51f62be5748e607af1ca0dda96c6ee91b29669751408f9170aedda105b7fb96daaa43b32b5f800d7cee512646a076d0475b562

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ManageProviders.aspx

Filesize
9KB

MD5
a89178630a452215a6e0372eadfbb9a2

SHA1
b0317e47f41d64246d81848154efded505df046b

SHA256
052b89762c5b3db1c4d509e6c30b22d1689aa613239c9643b026b922b43e0bab

SHA512
c686ba8d25e307dada32971ed9b1dc4f8d9d50bb135dc42134277a8ce69ac659bf318df67bbe514879cfd3394f9ff03a1b24be690f23bd9c9515eb4f4a9208d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\ProviderList.ascx

Filesize
8KB

MD5
b2a96381f6a728dfef1783c8d3e83706

SHA1
e7f251736460c1f0c010050522b4f4ea6265bf08

SHA256
7a3d3ca2d3e0456fb77bdd6bb76efd5d0ecdb5b303f4e13db4c9ade37468a8d4

SHA512
ad6763aec8650a512c1a6ec22c09e43d38823215004a669c0f22fd3d611adf4dac2ea05d2d6d5870b185daf4a300f4ba2f4829d6faa9279d8da28a1b3fb53978

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\chooseProviderManagement.aspx

Filesize
2KB

MD5
f3b40d8ee1863f2f8b7504248f275d4f

SHA1
b790a594049166365c9e9308f1dc325b6b178661

SHA256
b1d5251ae9650790b1f5420df78914319af5322051b38d70425be8711d5a2d63

SHA512
9d664c458fe286c9753094842e35b881c0064a028b44156a2ed96b314980b5cb8163d3f069249e9e37b835f949357ff34bfcf27e173fdcc539dff998094d6903

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx

Filesize
10KB

MD5
8c8b8341ae0b1a8edf5ed3805d0dfee7

SHA1
3c436672925614e81568e8f0f0c0d229c4b1d459

SHA256
7bfa40f893827df1c22ff00139578938c02b1b57b042757ada4bd4a89db0682e

SHA512
c3f7d502df7302ff00f5162849b4141183ae840ca14dadf30413401bd5390c7dfa274f2e58e429cade746edd289a87cff0c2fd456508cc29995b9774ffab1f54

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\managePermissions.aspx

Filesize
21KB

MD5
33b337036d2ce2557c78561d02c8eee3

SHA1
6a3015dc340f5beeae945f2d0f0b0d8b1a70fb10

SHA256
672e06eb60c2ba2767f79aa9efca815fa834bd41418e768a2eb9c1dc9a42b405

SHA512
14d7538d3659e9e88073b305f7a15d7323a8d6ff6a3b1dbfedbbe2e548f0ecc81c2136272e9ddb8a0afb5d6b8e552e0c7ff406205f43669aa0b9249716cf8a99

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Users\editUser.aspx

Filesize
11KB

MD5
438bba48c5809b4757ea5c12f551abb7

SHA1
9fbb43fc563754266ca577a327a34d3585cc0ada

SHA256
bf83e64af96f22819517aec2bbc68f0e169d869195b19ac372638b69a8085e54

SHA512
5b7c07206ffd63dd41848f6488be5a42a363e026495723225a6a3a34173165d263367294575fc379be0257319d8785993dc7df13216d84d9a8689ced0f7791af

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizard.aspx

Filesize
10KB

MD5
f102b90829e8241c950be5cc7ea0f98b

SHA1
c9d1baec96a0139cc999c568878d832d0ff1814b

SHA256
ae4f6b42107ad2dff52497a864240f04ca826360b56b4c8d02ea9178db2ac7c7

SHA512
9190e823dba00c04e02e6254d1efcc4c429e566a758db1780c9940c68bad565296fbd590b68b801b82c72923d0f47746f0b1a76eb32a72d5c96e891167387a19

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx

Filesize
2KB

MD5
b806e47c5c3eb46b8994a4299e697fb7

SHA1
9bbccd5e5a331f45eb42884693c1bc1d219fa9f0

SHA256
8631c5b35ff634d637d5cd3f9085b2eeb8d7f0e3dbff0f6495b19fdf34fc5c02

SHA512
73e18ad6ada38d8f9b0782b499d80e6f943afbbc553f7b3cb6e0f5dc2fe7b2603f581406f56cba972bb0f770c0e02b5c73cbfb610934412ec9bbc1d4128b445d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardCreateRoles.ascx

Filesize
7KB

MD5
0a1bedeaa3bce0bd54ef0dc057c65dad

SHA1
41d6714dc84ef985d40c6afa638895fb60b3ac09

SHA256
2cf1cd9f813831f8f48d038c352009b44d0ee8b742fe5e8c64af502a4729b87d

SHA512
c9f983abe4d40452ba67e8e7cea72b90023df6703613c3f243598e0e43529b8b704fb9b4d8505fe783b73e17eef2b5a98f0d3ae2b379c869b19c5a1419bd120d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardFinish.ascx

Filesize
272B

MD5
9630275b4b9ba7baeabc93df8bde54b0

SHA1
8950d71acbae80da9a9cc987991ec38574eb8ec8

SHA256
71f08b530bd771d361640e1bbe9fff24cef6221ea62319769a0d53b9bd9935c8

SHA512
dc9cf15553e578ef4dd09f162875c33dbdcdf8496058de6c261bee098c697fd8663bd02944814d093c4ea15397a1f90c53c0a90c04a08193a07ffdfd8dea495a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardInit.ascx

Filesize
496B

MD5
aae4a84a02573d169861041f940a063f

SHA1
7b9d123e4660b105852156a7d53613b51ce4f02c

SHA256
5ace7f695f1f0ff23f7cc86d1ae9cd171b3445eaaf8388b46b7310ff57508c06

SHA512
e5a1d43f1d066d2a61af5986bcf50c7e685520fac47bfc494d0f6fac1bff0c3dca676534a0e84d048f311b693692275487ab1a9a96d56343eb363f62a692c0a1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardPermission.ascx

Filesize
24KB

MD5
77d5d429d4d075894716c37660979052

SHA1
57ee334b401ea3c5cb591bcfebed1834e9a66651

SHA256
1ab0b11651cfe152c91f13f2b7d997c0540660bdbbd040816ab86b784cd0448d

SHA512
e7ca7d93df8374c63ae693973c5712247dc88170d1ff6392f81982969cc9ac5429cf89c7d27274fd387721c3c90c2b4711074a640a5a747dcd93e7bb4cf6c593

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\wizardProviderInfo.ascx

Filesize
1KB

MD5
277d17a5d5292dc5a308223f50c43007

SHA1
ba46df94166fb4a0ae847368d2fab9dcad614e08

SHA256
2d3e6b697efdcdb6a82b230a9c097ea9a4668102cd5d13f7cd5f02170b5082e1

SHA512
42d07af1358e1105cc21292897fd961c4eda12d7465a334ef8209d28c2b62ee2a35985551f5c43fb1dd59c942b99d6ab90c23beed44ed9689c982bd88fde6c39

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security.aspx

Filesize
9KB

MD5
e3675aa904f59f923429dfc24e1918eb

SHA1
a177aec70fd49c9498286645d2861de16eda5dc6

SHA256
bc5d8a0ad27f54996cd9e6e63537b6b3f4f33ed692a63508d1f3c15b4783ed71

SHA512
10b02ad44f6c28d1f1d73bd9e6721c544d48b38764474a960084e2eb463f7ec62769e62f597dcebdc6e6cbf19c0587769a3722856c7707337cd796c284b755c3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\security0.aspx

Filesize
1KB

MD5
dea7394a13f8b482f983262553f75e5d

SHA1
ae277af61842765d3d9823af519357843ab4d534

SHA256
d0c2019cc1fc4e598fa3fa3f8fbf8e0c48e16bf7f32a7a101267b271fcde9223

SHA512
070dd3e64c64aeb70bc3415bf732b116dc5639c8f1ee4a83f6783015e8a4487ae5866b0d59cd6e0e42d8706c69787abbba0b4524d8917c6d980f877d60a3551e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\setUpAuthentication.aspx

Filesize
2KB

MD5
729da56e26c37f0ef54222c85d7ef5d1

SHA1
ff68966958694ed68699182e0a9a6b25cc416082

SHA256
34777197c5f3b1936fa2524b1fc2aa901d4dae24be0f63703aad788dc185cbaa

SHA512
a86c67f39032948579a00ce054f8252fdb6ea07ab5d06f72e25e500bad01ed80c3ea68886840819ee22bcdf938473d9ebc76401d22576e78aaff2832d53c9200

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp.aspx

Filesize
6KB

MD5
68792df484c0e7280c90697df9a97dd8

SHA1
e4f10f413e6330abbe8d5a1dceca37b4fd213ec4

SHA256
121c798587a4648a982812e3341d5afc8e731b1477dd7cb2722b588d24a5cea2

SHA512
370bea448be816ab16c4a4ef254b6552455acd5183776cedab78c9e29f2b0559ab9b485dc6930e95427e978aab4d35861182f96cc3d6f8c687046adea73773d6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx

Filesize
13KB

MD5
7ceb9184badb7b194e068ab5d3a11dcc

SHA1
96fbab11b906eef0778407f91c635ab15b02f293

SHA256
67c765c63b7bf5808db9aa87862ed267fc437aa18d7cedc4d41c5b627ac12bb2

SHA512
4201e3837aa05704841ee03f8a2db0c98d2bbf34853accad8574ebc27e8ea6696a5ba1bea59e2ade30e90435c688937f1bec4cbcde2e506223612fdfefd1f6fd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Internals.aspx

Filesize
3KB

MD5
40b90beb2fd4a2dfbf0289c402dc4cec

SHA1
c1e816ec0582bf218f4c655eed549fb0b4bd6527

SHA256
50336b1e901f434d24c215249f087467e15a21913036e89426f0e31f545f0313

SHA512
4710e29bc075751a6aff5c9ee651953b59e399be32907d1debb9030a88926039d590b90e87a02408d7bfb138df75f8a4a46e15f5310c5dac66a07225a98d412b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Provider.aspx

Filesize
6KB

MD5
0b58136541d69a9d8ec55b40aeb975c4

SHA1
b851251233c1903aeb698025919f48160f64a86f

SHA256
6729654b25c0e6f6eb90ac452868e1a45a4676210a038ad01ff26bfc81984368

SHA512
e25ffb2602257d6f4627f24014ba9d42e01ca300df47d88d6bbbe17474e97de3f5aa76a046e06d19baa9e9666aa76f723fa893167bff3eef3ef1a93b2763cfce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Security.aspx

Filesize
10KB

MD5
0b1d8f44e7ad9915c9be66802d25fff3

SHA1
591777e2b1b92f305bfeb440d1fae6a1356f80bf

SHA256
b3848f17dc64d65d7f47eba0709592407e1639fdfec70eb492a1d3fb2fa48271

SHA512
9f093459c2ff27a77bff179e64c638991bf8682a3662c597cea219b66c112bff97b778a7ef7691087faee07390dd487eeff4b1ebc10ee9072c4485b60d852278

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
937a3d2cedc19d74386aa0332b02ae1c

SHA1
4749bae4f69a4038bdeafafcfaf5e8a45ddb1e1f

SHA256
21e0b413cf139d5ce8dc74a18dc1e4c85c05beda3ed40ae4f2d4d26185a8ed6b

SHA512
17a1718f31e72ad8b460d2e7a3c79d914eabfe97b6e95f7e80e1225dad907327ae5ee3c41e532059034aa334e92d73415db6e2ff50b5b089439d31c7d7e054c8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
421829de0e478cf2dc05ab3d5e8580d4

SHA1
77818b04e32d69d28daba41603c87c4dc7267403

SHA256
79666e74f6c20b0cef81bc07ee5e6cccab655c1e2b53188754d90cc2120608ac

SHA512
0cc585c390d640b7ce2581789c368cad95fe50fe990611925f305a41b3e1d96fcb972914d2b811e2e2fda2b71c42a0e53b3d7b2f15e2567317dee15d34abe9c3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
bc524097dd33229febfe35616bdcd519

SHA1
0701889ee1780643464092f8ec339d24ab152364

SHA256
0eb7ffc3d79e10781f523d1f03d1d7a42e5b1b6ce3c045ba0a1d50b6e8091d70

SHA512
585e55e059f4cd4dcff021d85cfd3bf3a9d2d9dbb1a600e6df4df0c393baba89fd07d2501e41dcb66e701ad0c050e3050f30d9d5a5422225e56668b10ad93304

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx

Filesize
752B

MD5
35ff2556c3923061942d42310b5b36dd

SHA1
64914c0d67a656283ea2be2ae961494e3ba520e9

SHA256
7edd90286daf8111b9bc2652f574895016dc2a8cd1136bccb4c83c278720d35c

SHA512
7db5c2eae155d6fd9b7ccbb9d190bc0a39802fd0194572cee1f2094e64fec96ad4205068f2a785d666a2c9f1a582f033f46d9b94b8b0fbad424eb3596d3bb5a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
36d59358b95a433ca36e63d46ced84bf

SHA1
1301c1ab5be5991ad0e47b554cf8d0f95f487d55

SHA256
66570062a293c05bae4b63384e26f02d13206b2b2b2ad3feb58e4fedb950c345

SHA512
140f0b61aabae5e9bb82089bce0226aca6a85dc7e498fa5145e03d0a35f3d5e3a8283ee78b7e1a7284cd08e51e2cbbefe1efc2e95940be62f2c3d10a8e3325de

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\navigationBar.ascx

Filesize
8KB

MD5
a7527393abe8403b93fa139770c58d73

SHA1
0aafe74e0ec607d5d9b6e90dfdfe07ddbdde0ee6

SHA256
39b657c84ab4e36251206a8c0b38f04e388cb192a6d3e3faf683aed08bb23913

SHA512
119ec306a42c9f7e505522e9924a7df9fabf6581eed1082135905836c80c25902f794509b9cebd1e4d54176fe56d3a61a2033b91e0da1fb8aef8eeb8860926d8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\DefaultWsdlHelpGenerator.aspx

Filesize
68KB

MD5
26da3126bb3af1d9fa606b25c51d58f9

SHA1
61484e878ecd81c5a6f09c44b308caf0c2e45007

SHA256
a0e7af0c6172c4ef514314d3dad478abc3ff97a7b2634c9ca7dbc007e380e5c2

SHA512
564c4fe2bc67fc85162afee19adc883431845b892dd6a666e27f14107cd9d1708f97a8cc228e0c25f2ed976b66dc5f4964cc330094b98773442f722202e488d6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
31604c7c44f08b63980373ffd41f0377

SHA1
41e1642a4d523e264116e3350b514a5dbf57a1b0

SHA256
32cc16223defa8cbbfed0f580b9fab618a3e38915e87f7173961793e17d5ba14

SHA512
f585222aabe77607e608b5476d512ce7a343b662b4f0039a9d4763113c88e4f0dd4ecdffbd9f8e4ac129c30f194d77706545b2910e53435dea6721363386a40a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
71b6f5527dd3a566f1256cffaea45416

SHA1
a053ad94b59e91727a052e658b77c0592d1650a4

SHA256
3b0a1c3b87b894d32b2d4f7e4fba4b8abaff913befe031ab20af7e0051330d9b

SHA512
82628f91f42bad3dc97663d03da1cdafea0dd2e51fd6f67832b9823859454c89c4ad62e14ea952143c45fae9bb57d81ca58c392dd373f88510f602e9cc700b67

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
cf00edb8830b2cfaf60ba253f6dd9e61

SHA1
7502d609861a0dcc379eba0b6dc9356db6f856d9

SHA256
9c115904b63ed4f4ee0aff2ea88d42ba881b3885e2add34290e8c24b273426de

SHA512
ab9d0911ca39cffcdabb30e1af943e2a5c6773d28a7d46e73fbe05a000dfb62df6ec02d4065a48c6cd70da4fbe340b599af6d6c2fbbb6a16ac707db9ed1bfb50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
08a080577529fcf9147c649492086301

SHA1
8d643dc40bd978fe3e5d923c7af4a6d2c0648a1e

SHA256
cbdf3dc0264169be9ce2fc65448a9d18300b6b590ba6b570b2971dfb6f78d8fa

SHA512
37c120f2d66582fc78ba165508c1683a1fcc6d412c7d97eee43a8e373956724342c9088e258cc04c2acd68498df8ba4ea0c4756bcae7f485cd260ac170b05a6c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
6dcf2186e1be29a629c72b179392085b

SHA1
defa4653c20811968d081e34e8b6631e935b0e92

SHA256
69636b28e24bf38f03f6e562f228adc732102ebd3c41752a40b4ee926c3dcc22

SHA512
742b117ce1703d200ff1fb5f17090cf4e1f9daeaebf02d3a661dc1d35b5d38dd21cdd39325fb1ff89e97973d99abbaa3e66732f961e4ce86510535f441b87c24

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
14a12592ee788ab97a79e3ea9c727572

SHA1
83d60abc6941c131293d2e289ec918a875998780

SHA256
9f5a22fbff7038f4a51f71c5d04f2e4c3343fc43813f7c4619f6dcb0ab3806b0

SHA512
ea33a4b2278f55ca6309a49a7024f1bca89c505dfe5badf021b5606d2b9c36011b8f04fb3405070aa4cf0f57fe74ed5f9ba071c6de72f7f7c888b1ac924bb317

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
1ba4082392530a30d2a7f1b2fc8f8b78

SHA1
5997e816ba79e5e3376fe9604ddf3f491bd18f82

SHA256
22a2ee29dd2199f8ad596e39a75802aa6a74c1b655314e00761fd88fdf545fae

SHA512
867f740e3b70b46ab035f7c0edce69cb571456edca7e93f07857a82d142406aab9c22c1901e12e5ec38e29530c78de020b0aa2d1e43b1c6d4b07264abaa31b10

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
c4a12dd4f2c9602654851e6b03b160c7

SHA1
532a1c4a08408cc7bcb1851d168fcd12c5584d5a

SHA256
8ead900beb6fcd5cd47f51db7e130a857ff61d02a44d5a267dc4899aaf40c60a

SHA512
bfd862ea63e47559d2add793f10a4ac04a208df26bf1166b254709397907baec7f58dfcccf08eab18d0f977ce7a12ac4fc1e6c9a08505deef45fb253a97c20db

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
30939e81fc4305bb729374fedb2fa1b5

SHA1
cd02d0f560be97cf87b63d8042a81e7217c6c20f

SHA256
9c8ff1e712918feb9cc709771368be5aab0012afe0d958612caf00d6b054fc9f

SHA512
4e2d718ee0c760b0743eca6803ab8a48ece469a6b014153396df47a2e756188fab72e9a496036d60615d1e1858e68021f145a4cadea265188bce2858382fdad4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
cb4946ba681b99b4d1c388b6c2aef7af

SHA1
7e07ae2012d75bcde8f4f44fe462da027e7c5efb

SHA256
5ec84837a75a4027d60be8b3a912389e071baa2cbef6925e09e6ce3a15048bc5

SHA512
4694f39d09e229cdebb07f14186049dfd5975a0cd775931d70eeb82e1f2a48bbe2fdbd06ec3106f36b8991433da293d7924e7e56ac80e280951db364c19a477a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
abdc61e2887a0baaca3d487442b5dd09

SHA1
bb711103ca8208902eb1c287e15ecdbf7bfd29c3

SHA256
a31230e9af5139b9f6db7fcaaf1f5ad3ed855681af0d8eaa5e6f005fa842253e

SHA512
2ea05360a30f1ed89f4923a81fd1e9f25f2d2d87365bc3ab7d1c56dfd0c62e21eac60cb993f7b3e2abed290dc623792bd81a2fcafb26a10db3be420312f418d8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
f967a20a00512d3e1f3eb95b659a6ada

SHA1
225adc1cbeeb7fb7ee4ea69145b5d148166a1abe

SHA256
9fd79be9aacdee46bf218b7c3d84a18d28df0718313ffde3dab50a12fa04208f

SHA512
fcc0fb054e00a6be4df51a455344240676264d4e81e5505a87bb773866259507876c8ed37509e38dbdc8c756aa75111b55cfe1f690bdffc5f4649b22d0e2d5c7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
5818248e887d30847d02d099b3756197

SHA1
276ff983c84b72e7c4f784fdb1e27e7c8280993d

SHA256
3498ae4208111fab3a60f83fd861497532ea2b67d840f4ffe2a6e5b37a5edfa0

SHA512
e007fde5e68ee072e1ced8f389f59ce96f39a0a7ec9f185609b89a055bfad8127aa6da72f3afd64fb747444f661df7e40e365ae5153447ef53b84137786f483c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
5a2361713ef0d31dace5d2abdbec7d30

SHA1
030ea92f4780602d6eb9d75cf69ba2e63ec25c88

SHA256
d07a62b0956a86887bc377dd14ecef868d3b8a7eb342c67fc1b786302e2213b4

SHA512
0e2362f2e6dbc5ea187ac3601197c34c274c77a92b101b68208ba49d21b3a985e3ffe08ffeb9f7d038222bef21babcd2646b2473d28d5b8aa4070b3d60b21c7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
82adcab9124ffe4f2c63489501ffa931

SHA1
ada3124f8f564e6b6c3ed383e41078388c81eba2

SHA256
c4a267ee0fe791e81cc64e06985eb2bf2d5aa89771fb9cebc3a1e32a5e41e901

SHA512
51c6dfed1cdd80613465dd0cf54f4890703f5d47e1ecbb4060f282542faf39ac44feab95c569d0dd85fa0adee4504fa59ea4b6b0f3afbb9097f924db866f9e48

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
3128628bc11286db0420dcfb929f39b1

SHA1
cde2f3fc04a92e5f774b44d33d1ee30bbdc40506

SHA256
c0656cbc232a4ee6ca9b2f37b4985e96dd524465dce3ebbb23b78d18ef14b76a

SHA512
0fdf77b6946809dbf428240771aee4beb670a6fc39cf83d5947a1c8340e8a682f23ba8ec677a50ffd26aa856378b4e990099aff986bceb582e1472dce9b70401

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Filesize
62KB

MD5
4706f70911e807d9c4c1c65171150e86

SHA1
4672b906c55eb5beac1f640aee9bb8fb1074d09c

SHA256
0113ac645c343ddb1ca45c88a7396eec9517c94bd8f199911cb2ee51a93f3139

SHA512
6e632f8ef97d83bd04673953483099a4a8900610f6372e955698145b1ad3e01a483b69d9c48f01a95d6082f3141358b101c7c1ebd8f680857a046a8dd1756601

Download Submit
memory/1176-2871-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/1176-1507-0x00007FFA87430000-0x00007FFA87EF2000-memory.dmp

Filesize
10.8MB

Download
memory/1176-150-0x00007FFA87430000-0x00007FFA87EF2000-memory.dmp

Filesize
10.8MB

Download
memory/1176-151-0x00000000008F0000-0x0000000000900000-memory.dmp

Filesize
64KB

Download
memory/1176-149-0x00000000000A0000-0x00000000000AC000-memory.dmp

Filesize
48KB

Download
memory/1176-18837-0x00007FFA87430000-0x00007FFA87EF2000-memory.dmp

Filesize
10.8MB

Download
memory/4564-34-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-50-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-5-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-6-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-8-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-10-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-12-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-14-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-16-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-20-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-22-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-24-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-26-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-28-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-30-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-32-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-0-0x0000000002520000-0x0000000002552000-memory.dmp

Filesize
200KB

Download
memory/4564-36-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-38-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-40-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-42-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-46-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-48-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-1-0x0000000074410000-0x0000000074BC1000-memory.dmp

Filesize
7.7MB

Download
memory/4564-52-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-54-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-56-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-58-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-60-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-132-0x0000000005420000-0x000000000542A000-memory.dmp

Filesize
40KB

Download
memory/4564-62-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-64-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-130-0x0000000004CA0000-0x0000000005246000-memory.dmp

Filesize
5.6MB

Download
memory/4564-131-0x0000000005250000-0x00000000052E2000-memory.dmp

Filesize
584KB

Download
memory/4564-129-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/4564-66-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-68-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-44-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-18-0x0000000002680000-0x00000000026AB000-memory.dmp

Filesize
172KB

Download
memory/4564-3-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/4564-4-0x0000000002680000-0x00000000026B2000-memory.dmp

Filesize
200KB

Download
memory/4564-133-0x0000000074410000-0x0000000074BC1000-memory.dmp

Filesize
7.7MB

Download
memory/4564-134-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/4564-136-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/4564-135-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/4564-137-0x00000000060C0000-0x00000000060CE000-memory.dmp

Filesize
56KB

Download
memory/4564-18845-0x0000000074410000-0x0000000074BC1000-memory.dmp

Filesize
7.7MB

Download
memory/4564-2-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download