xorist | 653127bdb00397483a3499db51337471a19f4b272b14c924a0bd7596d0a78302

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Size

48KB
MD5

36ae7ab4c205b2a13ac7b8da908d4390
SHA1

f2319b4e446ed2eccb27f6126bd83701238bdf90
SHA256

653127bdb00397483a3499db51337471a19f4b272b14c924a0bd7596d0a78302
SHA512

527475409452e3032f98f3eca8bb58fcb7b08d0bb6d391ed2060f3915449dde2b6ef5be251368c8675d44284c3a91bbdeb6d647ed6b4cbe160087d740651a5d7
SSDEEP

384:TebFNw4Pk1itKkpAjjGF5rmDpwqYvjSDkDCgSLWbgo1aDRBxc9z/qB:T0FmBkpKjGaD9Y7LDCbSw3yg

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2192-0-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral1/memory/2192-8767-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral1/memory/2192-9186-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sgMDim889MuwdnC.exe"	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netvg62a.inf_amd64_neutral_5817ae5135655364\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_neutral_cfffa4143b3c4592\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_If.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_objects.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Arithmetic_Operators.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_do.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Command_Syntax.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_neutral_024281c0e4e954e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_providers.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_neutral_ecd233d7cabbdebf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_neutral_8e3809aa77440c37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-DTC-Setup-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky307.inf_amd64_ja-jp_e40bd14f18e8ff7d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_neutral_5b48c4b1b49ca54a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_neutral_1975687236603184\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_neutral_59c2a018fe2cf0b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky309.inf_amd64_ja-jp_afbb421e3dc1cb6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\imekr8\dicts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_regular_expressions.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_If.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\arc.inf_amd64_neutral_11b52dec8e94d9aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-PerformanceCounterInfrastructure-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_neutral_d42522943de68905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2swtv_x64.inf_amd64_neutral_24a71cdaabc7f783\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pssessions.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_methods.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdm3com.inf_amd64_neutral_11abcf129a29fb9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_neutral_7c300346e830b2dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnok002.inf_amd64_neutral_616c1e9b7df7d5a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pssessions.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_output.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_properties.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-8767-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2192-9186-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Google\Update\Install\{C650E966-B14F-4E38-8E3C-8BE886B090A9}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01562U.BMP	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15272_.GIF	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15275_.GIF	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macGrey.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_VideoInset.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\11.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_down.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-crescent_partly-cloudy.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\currency.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\THMBNAIL.PNG	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302953.JPG	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14792_.GIF	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR46B.GIF	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePage.gif	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-gibbous.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_disabled.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02085_.GIF	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..figurator.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a96dc7644906146d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1044\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_ddores.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b860e3728a94f310\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..protection-statusui_31bf3856ad364e35_6.1.7600.16385_none_998ff5c741ae3fb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_objects.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..extension.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3c76f7a2d9674148\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_6.1.7601.17514_es-es_10055a63a716b00a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mobsync.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d761dac9339ff88c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Core_Commands.help.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_ds-ui-ext.resources_31bf3856ad364e35_6.1.7600.16385_de-de_751b92146cb548c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..filercore.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_ace9374689c7e25d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ribbons.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ae6e8472b208da12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_megasas.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f6ecf0336b269e73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..sframework-inputdll_31bf3856ad364e35_6.1.7600.16385_none_b88be45adf067b29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-ntshrui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5e99205161cab09a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f7ac452b5a04955b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.2.9600.16428_none_7b0d6f67c2d3f97a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershel..hicalhost.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_ecc5634fdd6d44e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..oldertool.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1326ac88fbb14d64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-autoplay.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ed7f07959ef02f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-r..nt-v1-api.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_5f06d0e6bda42d9e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-winver.resources_31bf3856ad364e35_6.1.7600.16385_it-it_038f935c6c1f0aea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-getmac.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0ff099de0f3ac8f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c0f3ce4bd4138c17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_msmouse.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2d30036eafefaeb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_6.1.7600.16385_none_b45109ec45a678fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-icsigd.resources_31bf3856ad364e35_6.1.7600.16385_en-us_145a0fe137565c9d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wsd-challengecomponent_31bf3856ad364e35_6.1.7601.17514_none_267f132f01972084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-708_31bf3856ad364e35_6.1.7600.16385_none_2ae246a0b4dfd97e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.nap.resources_31bf3856ad364e35_6.1.7600.16385_de-de_821d94e46283e8d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_reachframework.resources_31bf3856ad364e35_6.1.7601.17514_es-es_b5d5945242b09514\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-rpc-http.resources_31bf3856ad364e35_6.1.7601.17514_en-us_5524f6957e36bbf4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-secpol.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8d538626cc9863b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnrc006.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_680656cd53a5dd85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.cmak_ops.resources_31bf3856ad364e35_6.1.7600.16385_de-de_99066deca32dab79\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_376bf74662a3c1b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\Performance\WinSAT\Clip_1080_5sec_10mbps_h264.mp4	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnky009.inf_31bf3856ad364e35_6.1.7600.16385_none_4082e69c83f69105\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.resmon.resources_31bf3856ad364e35_6.1.7600.16385_de-de_197c4fa8054ead08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershell.security_31bf3856ad364e35_6.1.7601.17514_none_798013fa5b3040fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..ionrecord.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6a017060345946dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..-admfiles.resources_31bf3856ad364e35_6.1.7600.16385_it-it_477403893ec49004\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..kstvtuner.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_eede0e15732a55e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\system_m.png	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..almanager.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_26906a340e967570\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..maker-mof.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2af540362d6e5473\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-medexp2.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1f16d54e15f81a5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Bears.jpg	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sysprep-spopk_31bf3856ad364e35_6.1.7601.17514_none_75d7ba2e6407eabf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-whhelper.resources_31bf3856ad364e35_6.1.7600.16385_it-it_cec32720b1130226\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\inf\TermService\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_faxca003.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_03df1be1120b3a1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer.resources_31bf3856ad364e35_6.1.7600.16385_de-de_658ad4c6e1804870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_desktop_shell-gettingstarted.resources_31bf3856ad364e35_6.1.7600.16385_en-us_985b8b2af38a6a1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.tpm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c6759e4f8a082727\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_f55dd110912e81b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mystify.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4dbf5d7248062fe1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..converter.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e68c9d3fc84d6309\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ostic-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51a64269f04431a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\ = "CRYPTED!"	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\shell\open\command	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\shell	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\shell\open	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sgMDim889MuwdnC.exe"	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "PBTSQNNJTWCTJMW"	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\DefaultIcon	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PBTSQNNJTWCTJMW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sgMDim889MuwdnC.exe,0"	36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\36ae7ab4c205b2a13ac7b8da908d4390_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
545B

MD5
a3b599ed8cc9ae80160f587d6eb64bfe

SHA1
e5351a1f356c39da53ca4cf9d759d3a72ad5370c

SHA256
18fe7a615dcb6222591095b5e9a71f5f49c20c012a84f7b353ea752312cb0b80

SHA512
a966fe7012a492e2cfe8b00a697ebafeffc526cfc1e0a552e183cabbf5bb63a7bc3edc56a1d689f5e80616fdd715c61a4f20a030938240fa0e3fec440f3dcb8e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
2e9f2a62109381ffad902c11bf4af608

SHA1
7fb4174b51b63b2677d4c2a084c41a154cba9735

SHA256
1d87533e1c3edd79fb8ca8d66777807d814bc77c79ecac7b3dbe0e25cc05fcb6

SHA512
441340b80992a32ff8403382ba6d0aec3977adc9dcd42d1223d3e7ff032ac9fbb1b202cbf538e527819b27561014c59685202e5d5b652f6a638e995c90be7d12

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
6ceab84b294963211973393d4592f675

SHA1
d521d81915ff6403bf12724da7d0f47176961e91

SHA256
6fcd4a14d04a6b7c2db31450bf609e526f00dde8b1dc6e23a3f315e9e6202bf0

SHA512
139095c59d4cc404e75ff865ef901bd144da8901b43de4b3a71c1919d658468ff2f823bf4e390582acfd93b4bf3ce38705754e37f012f073103804f0c079abac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
03255ce91b456a28c9d1fc9a98bd547d

SHA1
a91000c6dd5cbf3a197b89ea3b5327fc5093d517

SHA256
6679d855a527cd843786218c995f93cf0520a5dbb9405e1e1f6c72b147998e4e

SHA512
1575737b6fa8d03d323eec87505007757279bab93de05ee27439bad2c1c0c7170085667877f060a85af61ad4b43d3fc7f542d883fd415b91714c22640590119b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
3726b1d2b86921b29a8360459e60f942

SHA1
7a8706f8ee3ad4552537239b86815727c8eb822a

SHA256
42c00f695621a55cf776cad9dcee0b6c2ce2f33266aa04572e8330c7dabcf61c

SHA512
e2011a3d6e844c654a593331549ee7c35201a9bc9ac737823a0e74e97a40fa1c5a07ad962f57427f32802b1a8660aad26efc0403183e35e435d36ad6771287fa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
7bc4e5abb2007cfde629bea12d9489d3

SHA1
9248d34ccf2e3182a2f621483d2e2d72faf62225

SHA256
298f799a6f97261bfb375ef6a7820d16b38dbe3d46db43da14f6c8bc6d2a50d2

SHA512
720458f8f3c8f0758d6728f396d43d0ff54940ce0ce959fc546b3996f9097d79e9042a2737de8af37215cd91db644e2a3ae25b14ccb3601a0b4c05a28ed46826

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
bd30b4417b6b8ae18e11ff3fe1b3ec47

SHA1
01bfe94341c3b4efe831d6bda0f5e396407f0cdb

SHA256
ac24e505177f58f1c7bccc143836658d5a1e93bcb24e7b6c2edecaa9696b4b7e

SHA512
dfbbc936a3956527328f1f963161118d425caf0370d0c03a35748f8bff8a482ce0b75ba802ad6b7d33b2a66f15f4e7c1d3177e1607b68f21acc7bd209e6aec8a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
7486954b87c0a32113f06b75538c3953

SHA1
6b603fce46fc9e8bdb87e01e1273208797950437

SHA256
056669d8d8922489ba9d5aa617d3fe5ac7b154292f28fc7c2cf50c5e339a3040

SHA512
92d4cd381e82fcbdf25210f02b4f77cc2b239e30b2a28c776edbace90c895c3564a87160e8229ee4a8fd055dcc1f4c21f8b0751d632dd4ae3ed54ae23d2db92f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
dcb72472cdef84218c3c5c55c3a8b317

SHA1
9324277b5a2a5ff386706c201b821678afdbcf7d

SHA256
9d716cd22f63730c365665826d2e1bd091c8b37924f7265e490daa9b5ee80d39

SHA512
7d9e776891c4b91ccea3c083376be3ecccc16817a5dfa64ca802fc0f5c3db478ccba84f1e607617809eb8669363b76eca8d4f09aba3c916e843481c60113217d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
7d4bd32746c5fbdd3d96438f6eba10de

SHA1
8d91aaca081a1269d5f19d49aa337d8ec8668f68

SHA256
bfa82131ed5c1b88f196e748d8f5d264e9f16089e4b91675edc99ab65914e91f

SHA512
990f448b0336bb7400c4fa673b335a86958cab4c63075e09e4c948f68a83a08349064ea58274dc3e22f33af0ae2b34b885ef7cc25cc559bf5adc41d80675c9da

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
65719022ae37905aded7cebd6cebd96b

SHA1
1f55c11e20829d30b532d82bed62e30b5a2a21fe

SHA256
531367a4f70543b4cc16c7a8eddc890796bf023a2b514a0614092bfa0c4a93ec

SHA512
e2fc057f6e07d880c598a136af3f00778e22af6ac15ba3f135873b883514b23fea0f0c45f086db5b292da88c7a6014d8b40f70852edb34535bfcb5aa85f498fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
cbb6ecc23a55ac7844da46e29b7685b2

SHA1
937c7ed5d9e3c1443dd1027b10afd61ff6ff2835

SHA256
d1b2570a3c3e427956f1d3600fd92c48eb22cf2570b5680224e7ca549e3ed684

SHA512
20113a0c6a03a9684285a464a0c8efdf48098381790d4ff45fbfc505467170436a14745e931db205ce47192129680217ef6e8697854df22934ca7b9ef7739463

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
74ec4a90303fbe535f935c47d81b2809

SHA1
12d5c2d73f4556d6e857616d3dde6d7d14b6f6a9

SHA256
b0e3f6cc99b997312b78eb72dd3f19bdce441ebe4b11c0e04b1df491553fa66d

SHA512
58c0498f07e5bed9334963f904d419e5c242d6c3a74785b67739c50aa4f41658700e746ee64ca45a2a58768fa3f0d290728f2c9f85db40c7c8a70399be91be67

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
d7fb02311ba2d13db8d2bdf87d04f42e

SHA1
94963f43cbc8e357b2774738c30b52a181e62c2e

SHA256
4cc94e0d2e0686111ffe5b93ad13d735a7b233f682ae9ba84ac7964f9141547c

SHA512
71395c8a31d460355b737c151dd051b7600492bbaf4adeb2cfaa828aa0542ca1256404523fd31e0295b443b16ead2325170d7d0625ce124564ecc26c1ce09bb5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
8d9bc1336e3bd88b4b43a1bbf42574cb

SHA1
f4b1b9889e9843a6a09fb82d0b9a0916a8c981fa

SHA256
e38f9a5eee6ddd86ea8e7898170ad46cae7f77372ee0297e58855c0c56db3e0e

SHA512
78edfa6383294f66ba8a58b3dbc35089521dda5764d06a2454b76f012b3b321495402fa739e302f66d0ed690d456a1085dd4b3b90d6b3dcc69fce0cffa6ec3a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
44cf85cb29f80f0c9f9d641b0708b6fd

SHA1
b5e4d2d2a278799821351180ad65ec6f1e09db94

SHA256
ed151cc25b9c94fa5be2937ce84597108c7bb4398e9cd6b3770a41372d79af84

SHA512
d77504d06041d7eda3b9fd9f08b1f261b548bd2e2281202f3d10d9c77c3d6aeb35930cb04b42b00926ffd593f034813b2fc4c7733f2e56eeca69b09da5812b2f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
889c5fef7016894bdeeb7d3f09086a16

SHA1
405524c0a7b9df7234b6e6e9f2cff38ba36dee76

SHA256
0b0e41be745dcd5961ae561c6975a6c5cee5811e4bc7bf9c620c7051435bb418

SHA512
96889d6a3e193abb62be09a6b4155a277f3f82b8f9fb610e8fc794b3b3df58f1e93c137c280cca777f6909a35eceb98d4a0b42155982c1282c768318ef8e33e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
7be85bba18d81f230f1bbe8a4ae99fd9

SHA1
ce0a76b46600f9a0b9005cdf3e75b24004226a50

SHA256
91eefab3ea6de0a5ec4aa5ff7c9beab8ffa1848a7ca1a006730bc2cba439d472

SHA512
e69fb57910e6ef5c2649cbb6473f16b11050a222f167c9b53ed956b8d23a178529ba20a3c061c440f3a0da950678defbc6b8d42535463a46b71ccf28f46a7d36

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
2d978c9e78945c06c6def045ea3c60e8

SHA1
090a39d532e7d71ecd3934e7ac52808af54279a6

SHA256
9d72c861afbd6722a751028ec75cba5bc167c9f75b1a4977a14987b3186b7a70

SHA512
97607c06329a7a1e357d9dd2c5e7b67387baa0e60fa9415c8641e11312d4420a2f32438141f6a2d153ad378877994109f0dfb21f2224eed34d5c0f7f25b1ffda

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
d4b0a866862a424cfa17a492aad65e0c

SHA1
8ea02344778f9286285cb085fca553b70c2be18f

SHA256
b19979edafa93402b238c8a3db59d901fefc677355746c4ca9ee075de6211af8

SHA512
af3bb42711eeb92274605dd1580d7e223f4de4b8c694465d885dec0c74086878498792b8f4c9e5986550139838135ba20ae542d41bef6bee6b3888eaa523f5dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
7976dacb70c092b0ef6756b0708841e4

SHA1
d72af19e657d96b13daebcb7e698c4bbc583c50e

SHA256
1ae7f4343edf10f7ecd5c81475ddd1eb3a1ecea33988595bdaadbfdec6f729bc

SHA512
99511aae33fac997c3023914ea44e81107b91966f7499a5f5db8f4d8fe085ad871ce009a6c016a1a71cc4f373f14537b6336e08ac4a62e31ec0f5dc7dc714a65

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
08d3dcd610650cb834dbc396a716cf44

SHA1
e02f4ef074c254e9579980e50c48b16484cfe846

SHA256
fc1dd029361c5221a7d0731b2ae89c92656e5cd97a4eb4c3e8346b57ecd3a40f

SHA512
34a1d37b1fe4277d8c3cc000c8face3c09da542a0b1450dcad0f8f5b27621a3ebd446e7c01ee69c215f9944710945bed15a7999eec51d9c5eb75849c9b510fce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
57ba9fcc441390876cfbd0e6a284426a

SHA1
3b585c64e95d4c708af1fcc58693a3ce5ba82897

SHA256
0a1fa41dd9daa869c38535b9e2f07e53bbbcbfb2751d08d1ebf77f0e9b763eba

SHA512
7ed258178ecda7aae346e5f7fd83eafe32232ad7652946ec2d96111dcfdba36dc72d2501fe0ecd91f949afb51961d513fa608d3195f395bdf2fe0867dd2d5967

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
f8159128c51b4e8c2068afc8ecd5621f

SHA1
c80908e3460b6a957c05e8e32092cffbfdef4e75

SHA256
e37cbf159a377667941af65f78bd6fa3211211bcefcfbeadec2fb1d0777a9ef5

SHA512
9dbf9932f7c844c6c36bf1e991364ea6e7b17ba105fa841676dad46dd500be0056016611b47e930f6d9e4f8d237948996e1e2cf4ed0061b41ce8178034abaa6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
fe126881325a3062cae2f24a3365fdef

SHA1
7392044147e29d15f94a9b1b992bd882b6731e30

SHA256
d5edd230688ee43e5ba889c95c574dc05220409dfc69a85ae3c95c93a7a816cf

SHA512
dd36d445a0c4a2f0ae138a567bdd1acb772eb5a577e4118b1f201eda5ac7f01e6d1800ee52b2c0c84238a5feff2da641b71336c526f091cfec6ba46e60dfce84

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
7b9269da3cfbe01131fdac33eaf7abd4

SHA1
415e8d964f48cda1f35495765341db0cd8987395

SHA256
e2d23af4c2a7a2fd74a610911ab23cd822f4e080a664bcf01886c378d7a7f87d

SHA512
4feabdcc99cebe089d347ae9732a8a93c3b146b9a7df555d456824ab744e2dc177d8ba5f69215d705c7a82aa96a505529e1938c4c08ae4a5309ae8c532e67e41

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
4978188791618fefd473cc99b0dcfc7c

SHA1
d575b27e5bda8eca063a78bcda89873ce6462b88

SHA256
f2e5159831c025699f41120aafdd91660ebc65a6d69a3e53a310d4057b7b5ede

SHA512
701b52f3947339b953467fb12eec286f0435536c59d05a9a9dfd260dcc312b8270aaf59b40abd162e3c205baf929c1e4c76002193ca370ff892fc9d1264b75c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
78ba074630f3bfdd5ac17128e9bb1566

SHA1
4ba8e6b82415a2e82640a8e91d14260129161300

SHA256
041439ff3236f64fc757583db0b1b95dbed2a22b376dd1db6407968a0bc92dab

SHA512
b67f65eabcb93b0d152c6c04498dee1712af64d1f9ccec88a6ab466cd23e0098e8744d93881531d6878ed524aad97076d31fbe642976f1dacd9c458ea7611d31

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
53fb214543cd2b79afcf5c2c9b094036

SHA1
713219c8c930d1c44794d9fbe88f9d17547d75af

SHA256
45169ae4931075234308848ee84930064a967e9bd7e80269b6a386c93da26eb2

SHA512
02bc0172be10cbd15a5cbb0c9da6a90b2c0a7fdb7f0bea54a388548dfc814dfd469c6668d808d20548644a2a0c79512c23f3d3d9338196925018eed11ffd23f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
a0f081fac3338695c655f1c81f9ceedd

SHA1
ea6dd64e18ad73c93bf6551b17314728b2c23323

SHA256
d0f1083a5aa1ee91c5123056baa7e913ff20b523fda2224c36853e02e42da141

SHA512
5bb5fadd012887096120ad302937ce4b94501853374277081168c94079e8c0b0c09b7988af79eb234882759c59cd96b218472c23f9f461c9b8451adbfb260cd1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
462B

MD5
c6c23559c415b6f023519906ad1dc949

SHA1
542b10dafbd01700703491a4e5122fd86ff7dfb6

SHA256
a354e6260ab5df422b8f3a3d8a39ec9520d51a95d9ec661ee8c57dd2d93209b0

SHA512
c53b73edba71d572d5fb5282ef69359bad66b358d8decc8ec0d4740e792cac57072325d4b67b66cfc4ef4dc0ac6576ba067b6316c3bc58b273477b0c497185d5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
264B

MD5
e4a0c94cf639e489982325bcfa219fc8

SHA1
6d22337f8d79b2c765bcde14ce1b6dc0dfdcd16d

SHA256
31a21f94ba2d628ca922b1d1df8919b9ea9b1bc5e38a7ffeaa5e7b64b8f71067

SHA512
7ed57c3c654a92284ac480a32a787e0c5ef682eb0084813adf2c4c028f2526660c0cb002e2d26d71071847d25b9b11fb26079c12f08d01aec0a8a4e7b57fdfb6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
c9be4b95f72690fd27328185935b81fa

SHA1
9bbd934fde88365cd5084fa866c84b08451f2ec3

SHA256
5cf6004883617c30d733974a20e4e1908509492437929ee838c86f46fac2a749

SHA512
95807c2c87fe6c6dda3726019806bf9cfdddd8386148cea8b2e38ac1db6d29d23cecdaff69c05e91bb9cd90486eb3c9a2c3331012efecc8aad27fde039e80509

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
50f586efd2b7c48b4a65dbf0fdaf4aa2

SHA1
efd86fccb11cd7951081e683b4a99ad23051b0e3

SHA256
54e4813222bd5d5474b10e579fe301b1262b1d62f4e0739ee75be404bd6459ae

SHA512
06d5b66488802544c1881035af4166c0c2da5039d43744d07800d1ac61ad771dd81990c08cff46ee0d7253445f560d48fff72573b451b27f9a47549604ee2963

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
4f2a47654b97f20e98660aab026b407a

SHA1
f863ba005ca363c504efbe5a3a0d3715059b4a79

SHA256
84c6dd4677b89cbae8c2eb13d10edce7e8a33d18dd4300c5e6c8cc25e808fd91

SHA512
287a9811e0772f9c2cabdfb8d6bcdfaeae5ba177a23a53d9d86e08135411cefb81099eb0b734259477f9c4a8d3dee27f20caa10ee1d81bd0839cd9d74c93111d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
6e2c2a58235eb6cbd161ef64f2c56677

SHA1
821599cc33137b477a249ea8fbea4d37c9f8bc47

SHA256
bc5152e189db6297b0e692ffa69bd34a0846dfde20e96500ce8d6234ef6154b2

SHA512
34e8588205fff2c8a57aba48c7c3bbfe1e005f9750a894b81e20bedfdafd749ba35fb94ed3d1bbf6a718c11dfdc8082f222f84b633f66e6d179d7e4f8550e2b8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
e1b25a51b50e9f6e57c29709a75f25d7

SHA1
bf88a0efb832834b1a6cd91ef8d5e7d1b8955904

SHA256
6a91229e281864ceb3eadf99c27c1262e696f34fe65ae6193968c09bace01ece

SHA512
02e32d98a594a1c63330f1f26fe865a54ed56ff52d04df82d41c7a50446b310f6dc564c4544cf0fa453d3c813325e3b06224cd230bb324a8296a78a230ee0f7c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
ab62f6c2231a6be42959fa3370125fc4

SHA1
79e093ac64cbbfd0782cc8a66edd5969555b3dda

SHA256
00868ea0d760187d4eee2a7100bd6e8d81e33a12e18d86eb9d3ef20d7c81e651

SHA512
8073add57ff07182596a10ead94e56cc45e28a27768e8841f348e946e5275428bf78d202a9e190d9571cfe00e8e7682bbeb1c069b9e75ada6efa5dd5b63e0119

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
337be41db26ecdcdc7687224e59bafa2

SHA1
733854c1d371f5620b0bf8f43d1dc015c0f9ff0f

SHA256
a43f6345427736c3ad122d9f9d8011b8acb0b9571111c130ed2ffffffca48ea7

SHA512
ef1f0a526c06c02c4fcba2b6cca1d70f8c40e9cbe11b8c50e925588285be44a84b784510b53a54e1c2f493b8a3bcbb08270e952af9a54816455c99494acd3c64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
3aab77a487d79bde3b9ea3634dce789d

SHA1
7999fd4141db45f6a0a47e3d81f4c1cc44acf931

SHA256
3944cb554345d1ce6771ea6e472c2d0b009a958e99c22bdaba5510c342f4c073

SHA512
4fd8fe4d2123cef5aac963b49a6c01dc52e915c30e67625df1ca707eedb38190d774d1321c75b0b09096ebe08f492c7107928d9ef4ac661d0436022541da961c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
f71fa1aea58c599b91bb3c901c2bcfa5

SHA1
9353b2e00ab21f799c95466878742411db2f311e

SHA256
8af3c74fd7c610981f845b5c8ad31c82d6deefc96b86ee70b9837c0e92916bc8

SHA512
1496cfcb4e87c341c899286119bbd9f4dc61f21135e82c7fda6e6646d90731af934f204ec3af1e312db8d971d9c401ce3356449e1f48c129d19c90aa397498f1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
ef40eff7c39f584cde0f24a4a6cff770

SHA1
70634d70a2b45a786adbe21106da02bab9b2a39b

SHA256
126f79ba83a5814f36328b4b72bb97a24a08ca10152c85760af2f42e6c8134af

SHA512
91ddbadde66f8d2e11cdb578ce6d8b53aadd68f658ed14eb277e4376a354f33a4f09db9ede8970f1ac08dd92754b97a5644e5b1a496f274e7cf6a510ba94b2c4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
e92fd45ded5f99cf201c259bd411674f

SHA1
cfa7fe2d1b74b6714542ec26f90e14157dea092d

SHA256
1855828f3ac951052ed4a869f5932020a452998f7da294d05b961e92348e9f31

SHA512
947d616d74308a0c222a765e70e1097f7d491b00d23787b0b3a1f27fd2389e661262f67cb14b7c97a80164fcc17445616cca9da7611d8c382f546aca200eced6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
40801546438625f828c6542dab3b740a

SHA1
49d955ea9e88a73e31340731a8b0032ca4493a16

SHA256
9269b7e2561bd19e155ac206db9f8c918be26f6f5cb7686efb94c26134acedbc

SHA512
7ae3c9eeac68f78b2118eb14969a4e8829d4ea02b00cdf18b2f6e0fc92c073345c2f8301c9550f9998ac1a9e17d81737a5535fb082d332caa4b08023a68ebbd1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
ea013ca0ebddfeafa127fd6a1047f130

SHA1
805d781038f562e43c20bb265af93017fb043093

SHA256
cb07f00440167d20778a46aa35ed32fd6e2ab0cd57d152d7a337408054429e19

SHA512
a5c1cf0e8692bb9ea779f43bb3c5bd63734c6df1ab4da6f92d543f2c15421fa8ba526e0ff69a762b22ae0162593d62e2cad90b16f34c757539a1732efc5de3be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
3c796ee4a70ad0ebf682f4d002b48ffd

SHA1
ee2b8b22bf780bf0f05656e36bfde3a47ebb47f1

SHA256
a845e0bf258aac2e69c5631c6b4c5bb9fdc91a0b48adda3e082494bd9bd999c7

SHA512
bec87d04c413d515f7c93769c4c8cc13d925ad4cb163b2f23876bd349a3bd55dc286ee039b53f1a203f19c95dd1faed6c97b50ee6e4ca4846047100b4fb4901c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
927aaadbba3f3a8920ea0a1d33520b3a

SHA1
48e4f4401deeaeb3b699926b056e5a99b75addbc

SHA256
0a5c7c6478da298a29759a0dc251ae81be18f7968fd610c23a4f433671293a3f

SHA512
d65d38350058ebe95431b1776155d320bf62fa82de8e12af2511b991730fad1ffc620afb2093fbe5acf708d52778fd7df833e8501e5234994dd8582c900e162e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
57487fcd9a82f755b61a048625f3d7eb

SHA1
8ff8e7e2e00032e3bd65dc172c5f67579493ff8c

SHA256
34cb66ec191d7e64ccfffd4eb6e30d93c69d5154aad9e136ee00763e60d5c68d

SHA512
1ac1fffc8c1505668f6d8326d9e3b413c13bc97c173ef373d09f3a98ccc13db8ae270916a5bc0cc61795873b7567cdfe09ef6ce3a41137bfc281077e4b2a8fec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
2d24ee9eb0259ac6c818d100ef06fe94

SHA1
1cc624b88094040f0aa53b50a11cda143c71784f

SHA256
b0d28f599de3f0103ac0190dc95d63b2740b64a12a39d8a46512bf80a6966a06

SHA512
73bc54308c5c02e8753714a647a9ec34f4e0a5b67fb943ca7e36796842903874b2ed3d865f38214307227c7844423057b64fcf8e3ecb1cc22ad89de9abacaf1e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
fb6ac089df68f91e7dae94cbc4c9f3e0

SHA1
73ca7350a11053d535551a445032659db5247e19

SHA256
30550654fab3021142d9c374b7426c4668d2bb2578881b30c503260fd2bf1585

SHA512
90de89b60e0a799c18e46facfca8f963eef9212941faaeba25127e3663f68ac68882929f9950b986e3bb6685ba98f0a0ef3d4de6853f6d6cf2c4fbbd23301513

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
257626415c390fda1ee397e5d0760860

SHA1
edb479baf872edd7730e798ca2449881fca847e0

SHA256
c7f519d45ce3987b6d591cf6ffb072fea18b9230f2ba389e76920e60f51cac9e

SHA512
aac4c5acca452332fa0bbaedb9873320817324636abc491599ce58a82bd530557e8e5bb73e70b0d4507ef1c2383a61fdf6611442a0a132b6e6c42bc274d623ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
1337082a4e314a489f0ab153a7dc64fb

SHA1
ee691501a4567626db89a2a61bab23c21256d191

SHA256
5148a67608626fe3cbf1cb82478a6bec1100810a40fd8a85b43bd9d40ed39c3d

SHA512
b2519b8872e920d1937d62cf46835182cc8c547d1f657dccff1cb8804e4f944ac171fdb71b0fb2f00333f0bff9f2c2aefd900c92c296e79eca58392099ea2f94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
0652707166267c32c02d27c155d7a7f0

SHA1
96b07e5c4e648512d975ea619f83e72f663bb305

SHA256
972843e7d9b69e5af1e49947774090cc982c47e30f0e4acd1965b5dbf4bdb1a2

SHA512
6c13fe2e4dd124bff133253790a9811aa4ec8e0904ba95b5b5adde35f550ef0f9f30ad0f8f9f0b5333d722d92e1836d07b1045526da690fadeb75389937fcc39

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
38d8bf01297129057a52169616ac3678

SHA1
e8aded46e2e2e5633d7c68596377b7bffab43869

SHA256
aefae55ba00f7ce0fef94ad5da360e11583a3fcfaacc4709e30f72efc4a89a69

SHA512
842ce2605f5af6dd5d3787e0e398e75d97dbc1d7525d2f1c3307cee9bcb0bc7dc1b81075f00e47cb94905afabe28dce91a0945046fb95ada74072086b8cbbb03

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
313a7ccce3e157190099e1e501e9082a

SHA1
23884db0166889c06ecb058dfdeb4442de75f3d8

SHA256
fe8a1eff3970c5f78704ca8aabb83f6f8083548962eb72b179f4355988d7b040

SHA512
ce07d67c7b8835a1c3f1dff5b7e1895e46fa0e847a047baedbe8a5e144d18e123a06151df57d18f76cdfb02bf696e0114ec960229555eaaa0aefd923bd4e145c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
ae6a1d0922066774516d421504e994dc

SHA1
cfe06d61aaab6d8ac7a68045f3d7186596ce9e72

SHA256
8c22daac0eb0f9bbc9dc68350bbf91a551d04d8f6a52889695f4d0b6fb98fd3f

SHA512
aa0a3bdfbf2c838e6a44cffbf510dd2ca6fab77cf40ce07ba8f505cdb28101455051fc0916088fbd8260759be44c50e7c116e01e86904c6c5995536b304f7d17

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
a98e94a3315ac956192af7cf17427f79

SHA1
d4859b9bfec98ef5ec35d5866774e0d03fe56299

SHA256
685a65199c50e4c5dd69e6b98f903b05aac2b7633170783c60718b2f90279140

SHA512
7bb3841dcfea0b30e3da63c4bb93c6f290f71a59669f15a561c0f14b6ff445e571163714d807a45ceb9fc364e9d38fc0b4d4b99d952334e2a788026d6a2e71c0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
b5e3b61db98f34081665c18328515f37

SHA1
1323e768529794c72fb7aefcc942cb0d860738ee

SHA256
15b530667ca04fa50bea1f022b6669b3cac9eecc52225d4767ec7ec34243cf97

SHA512
763e41e3e8710c897f78ab70163b36653807e7dbea4f1c9b2e886b30e9f3ee7dea78bbc518cead62e83384e5babbe5b39062b4263397d647b75898b53667ec6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
dde246a3b99094191c81c23166f8e166

SHA1
6c4061cb09d6dff7e25c6adebb438bedd5bf94a2

SHA256
5cc27104f58b0cc2a82aa8fd6d91596de665ebc6e157b67cdcaa7c05ad725549

SHA512
46a89e79f3cbadd77e6786a4c3b84b9fb6bfa48e2f9fd7ef96141dfc33c0adbf7741928ce271e4f3b93ca20fb8bcbfd211c75a9b8024769dcb35740612132bde

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
23d2960267d9a03d0c4ac54f8ea09295

SHA1
cc3f346be1aac61cdff55345e3ba5890ceea1acb

SHA256
8a266b000407bfb318080145f8e073c4c5730c02ebc7e1163e0c86a0b8ad23d7

SHA512
5d37b5fea99b62d554f07828575d817ec5f47951f60f85897be353b9a57e8605ee8ef7b5df709bb6522872f92796bc5f5c197c8fb0df5fff5b3a99f2c19e5339

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
10b61a44b40a73830c3f3af64842098a

SHA1
5ec8c27aa27d7f33d7eb259f9d57f25036c66d8f

SHA256
b9204c05a513ae4fbb24c9b853724eabacb951e0ca1a6fd1925c450639204a6d

SHA512
2d941f7b0dbf3275d79a2399076bd6e7eacc068af8bba4386abf8e9f856a90026881a492a15a09a1b9a72bfb5dff23c0551dc01cb22afc02876a9d0408b93f3c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
4ee7944d570ac8c2db87430243ca4fee

SHA1
b8fa42771abaf229542689ebf5ec250b3770679b

SHA256
99ac3246cf0830629aeff8bbd9728e5cc09bb909e865ddfd5667d977bbc7c946

SHA512
659d4161830beb4e4d0aff70bcba92b3d9b7e781a514ef5ef767eb325470c7409fdd5a0702728b36ced30c3447ebbdd83e2b8970c1b15a42ff57830b9bf194f9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
f01665d84f85fed01763bb390fc5a41a

SHA1
92108963dee4e6ba85ff660cfaca6619ab58bf0b

SHA256
3254d993ad4464cee84b33a5a1dc3d95c63f8fa9da273591902fbee15f3d272d

SHA512
e5f5ecb3497b0555a7d50888a8ea5a1174e58d79818b510e4f943dddb67fd7a4f440ddf22a2f8750f05eb597f34be9e18d673f997e141be3b7f405be29142d4f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
7567b3e3aba10cf6bfa7b3802c1ff6cd

SHA1
3129ff073a44581ddd0bc9019ef99fadd5b5cec9

SHA256
b87c728a9d188e96a669321d72e3dca3c501c89bd23068a3049979d228f8e8f2

SHA512
ff6b8b9d1c27e85c9c0106f63a40d1f0cc879143ec265fe3e91ec864ef4b797021cd190be5ce7d24f4387513e440709f106db052e88b961502546846cd869d9e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
063e558eb6980c3f2024470a85d78fa4

SHA1
e7eddf51336cfe650d6c5950a03f67d3d4c867ca

SHA256
e01af2d8e96787cd0f7f6dbbb6ecc4ea1763ebb8252a6819ac96debfb5d52800

SHA512
4fc2476e77641cca41c81c89a5e56f05ac56b2f79f324caacd1a47ce19b8ae7b049052627e4599cc9da1a2970dc16f7f16ee5bab187425569ca43a02504fc2ee

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
f01c40866946dc61a226b6f992819ed3

SHA1
c9d14beebc17660809fd25ddfaa7878a522d4afb

SHA256
933d67f5c3ac9238dfe3257e4ca8d0c1bdf769606694990b02ddc7cdc7abda7e

SHA512
7a1292154cb1d806c708f7d61a96dcb2046ff315a3b9c3c10bb88606cc6bc619eadf07f107e51e2414139934efa49af31e3b290fec4ed0ee408612cd1592ba3b

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
3154f5a57a021dbd430bbc774c268350

SHA1
b1c56add65f364ea911244e326c98c3455e7834b

SHA256
9a83c1ce8fceb05ed4a000af15a4aa82cd1b4d5722c55028e01163db3a40e92c

SHA512
8d323f9d96888ae26be2b23eec18a8f03e3346af4ddc5d9c6b95d57b15bbbc92a69179c6514c4bbb561e5537d9b2bd2e5138b8d4a5e99bf993b4b47c5719d819

Download Submit
C:\Users\Admin\Desktop\ResolveExpand.xlsx

Filesize
12KB

MD5
029238aa2b92a02268ee3d86ef3f77be

SHA1
739a2e559fade003d39f4b32de9cc893ca08ddcd

SHA256
e8fe4e03d3a39d105252fb99fe6b7eb58605e2423cd42bf5169614bd0fbb2217

SHA512
86aa40c966fc2f4653a238447c6f184a124ca611cadd9af680119f64d06999c65b0fa576bccfca74d36ad28dfafa73bb2ff6987df7913d7cac9b994242400725

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
1d9704ba8855f72986d18c61ab9ca8f8

SHA1
3bb41c0e729527375d63c2ada28ddd5d8eadcae6

SHA256
58bd99b94b36c54fd2ba575512b6902cd24b98bcf12d7becccab2de4dbbb21d7

SHA512
b03e757ec591c072e5efe9e03e4c5b5c636024d84ee8d617b7ff2873b79429be91bba7da3f837aedd68e217db73c3d01bb27f94cf31ed1be55a8c709be311457

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
49B

MD5
c77728bf68337a765152c9a55f1d7c5f

SHA1
26aabae4ce6a7e9652884367d7d8050bd1ae7719

SHA256
8d783cef26214a749b11cb23537913c0399b4690196a8d185a0a27c7d7196312

SHA512
4b6ad64d0eccde2b47ed43e274b4f2716634e0627894fba7efb7e9d95ae937bef1b9e13279eb0db8a67fb38eade4e76cd278711494b73d034a70315743988de5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
a87812b8bdfdb3f3701c778c7431238c

SHA1
fe89d3bff35a8e147de86ad52d9967f8d7deeefe

SHA256
c4215bddcb1d131dd290d285605b51ba2069616bb59a3abaf577129d9efbc38a

SHA512
4abb707c577d0c59e7b0b77b9ad33116ee267efecc0502c23e00b558d1d1e0eea24b3ba29e0c02dc29bbd3b441feee7e2b6599e7126afa1dbd894268b4a5fa81

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
59573eedfc4048dc30fb2dd5c72c054c

SHA1
bd0bbd5285533e0a25393cb5d1a847bdc7ce53eb

SHA256
d3518e83b0311eb6e03400baec33663e153dfdb49867922472e95732ac150f69

SHA512
66913e8f3a35e1709aace5a61c0dc5e902a481e65f8d71d595059218c78a4b739d89a0c0d4489e113722ddc61bcf19724fc20b58ddcd849795c73b243ea1f162

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
fade8673033dc04b45b2fc5dea6d5797

SHA1
e090fff81b2009e6968c8b5580b0c77bf3ab7cbb

SHA256
c9f4b37417fa647d10f8ced0cfcf1f035609a3dc4c81c2ca7d9df902a20c96e9

SHA512
409e65c9d1b13b4c683618bc1303eca40a6ff0545b72cca19e26b5ccbe4ac3f9bfe1c9b63c46b08becabef8472ec1e3c46353da4c4d3924755b4ece6509d093e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
3eaf29344f277551c28da02893381d10

SHA1
8483c1d86688a2e306e998d783a0287dfb59104f

SHA256
13a907b36b04ad1f32ee61da9912888f79ff7ff2ce907422284f48a3fdd124c2

SHA512
bee0736809a751422d754ec823d3f310d074afd352dd73730a4254e105ffeb61bf11a0fc5ca0cb9e9c1f332e441a5bd4f5216b9a0f7b1864219facbeb3e90b1e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
d97d7de2fc49de121997b011b4c1a296

SHA1
b205371614809ba4f192aba26bbfed324fdbc1fa

SHA256
adecf4f6fb58702a6d4633016ed952de8b97aae557d94476387d0128c2325fa0

SHA512
f3b1bb359c962f807ee91d2905a9d0f9de7b74652d1637348427e03fb68437a3b4dcf154787930db3e6a3df478e188ae223920978dabab8687b5178e301b40fe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
3f7f12ff5a6ba335874fc248b994b33c

SHA1
601b92790295f710de92bbe25a251f72c489806b

SHA256
de74292bcc5f513d8ea84c8ea990f0fd526fb2b32e6c76925ed1410bbe2fa889

SHA512
8540dd0c2245732a622b5f04eb8cab3d612094da3c9f4491a81c9d6f06d2ea58f2d9423c726ec11b9dc6a88404587b42d301eee8cb2b9952547288c3e4353c0b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
c0257b310f2d7aa15f6d4e551fad529f

SHA1
b65025ca0addb4bb9f43b304fd13d248ab743071

SHA256
7d135dfc2c31ccbb2fda8965f9099149c24400871fb1ec8857e1414275329333

SHA512
c75b21ba198038ef0a33af1c3c7ac2cc654b46495ef41e5122c8bb6025f5820665e96f96f212fe8e627d7889f39ea4ee8f09c0245f4f7286c562028b963fb7aa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
c4d05c70a01544dcad644a4faac23ca1

SHA1
a62854599bda3664e9e835d703c3a4e4d6c4449a

SHA256
1ae0eb4167d563d313d1061bff4bba77bbb04ebc6a410a03e0856ebb56544b27

SHA512
b50c9abb3dfc9e033a532f03882adf6de6b64eb7c8c1f0009ef028218b4134cf569819a7e588be5c0fa587cbc29fc89df16aab3e96ec9bad54a2805b06f26742

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
17c84087682be8597575aa123089054c

SHA1
cdf47ade57b607e0333f4f31be7d69ff2492d237

SHA256
82207176ec4395cb525aca2cee53dcda5d6438d9afeecfd0100ad4bb8359b5e5

SHA512
5c6d4514a68debda19b968338d46882916a1ccf6ed6c619cc01c9d2f660ff31321b878bb4596a6020a32d19ff56ef00c59d0107ba35cf715e2fa4db2432d05fa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
b40aab03d97d6d3bec2c8e8d2b0e8092

SHA1
e4f053c2c615e750d81ef03d2289513add7f3e89

SHA256
89cb288bdfa492ce657c95bf9f146dc284fac2798305b41f107a0670c11c99ec

SHA512
0e1e14a90bc4165610d7d26aa67e697f39a2629ce2ca909e90e4086ed6710178092882749da3ff0676f30f956e95a1c99d4d4384341de6076bec3842f7c019e3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
decfea146dac5f5ceedc2f5727bef53b

SHA1
070ce7d4d2ed54a4e787ee08f89005a87cee7f8e

SHA256
ca227c79742aa8cb24254ab2a641f045f72d06875fa60a86b918a7af45c23617

SHA512
d6c918e18e28d1f07093d600ad895c3805c4f27487aa19d92e2dcc49cf3f0a1261b149e6d7e7c20e4d9207f4e9312a3bc620018164759184f1a244986919d2df

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
51b72bd852c4d427baf792a30f6e761e

SHA1
f463e459a84aa4ffddb58ba0937f684cdf5b3f10

SHA256
6e525ff03f992a5bfd6746b67f6267998e64c7ac241c4bb45f93ea5f51059638

SHA512
210d820dfc0493fb8690520324f18b2566ea4e91249734900654c3826113c0ef2494db0c188cf77181b4fd0ee939cb463d8bcd5e167f1ca6bacb03c14b18edfd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
884bac37e35e6da1d7bbf9534f6b038e

SHA1
51ce8c44eb9969b114915f82eeeae38298893a37

SHA256
5952d3dda762603531d5bbbb1814ff4cd2ae9f4087cff21a1cc3c1dab7b2386a

SHA512
0583702db6089ed3254dc380902cab64f0297587f0afcb5249d6662376874875446411e316e8966882d4d7b38b1961fa89f5d733829b225ab7c8cd59bb42973e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
3d6bca262bfda7ed56fe6c1ab48ceef4

SHA1
b6fb983f43b60fe250cebf192f8433892e13ef96

SHA256
44cf251ed17e37ff6daacbf051c5a56b16eb0f6f84fafb0dc78f2b928388751f

SHA512
a91689684dffcfac1743b128e3be10e379d74d5869c825a2ea201d16f29299693dafea3b5a0105679386df92bd880263e9591cdad3fd16d980e036d25f069c9c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
f0cd7070a3a1dc18068f93e3a241ccaa

SHA1
84b93ec5e9965f522b2a95c80ba148b0e4c9b680

SHA256
5baa59e8872320185014825ea27c1f53fc82b0203d28f8bf5ba0b19c6c308851

SHA512
27f7b91ec0d8a4e7d111844516b68cad9e045089339a77585e9fb658aed15dd15175a13b438833835cdb41a8baaa590227a367014af2f54825109173827425ad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif.EnCiPhErEd

Filesize
586B

MD5
c516a35599c5600749bebcf038e1bf4b

SHA1
98796eab9c3a794aa1447ed41d1438c8725e0426

SHA256
6c2f1ed3d308f1216ac996b8028a25357e065020133fb791917c99e3a0cf0271

SHA512
1e7b9e817c09580646e27eed643ea235f2011260a861a2cf49bdace4a0031a4a3f12f4cc628048d166ec222f38de9b7535a3ca7bf116e8ad39cad32c2669071b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
43e0679f014498d05ae83d540d081e89

SHA1
afcc9ffaf7d7595a7adf2e53e360085324426d7a

SHA256
b1c2f5a1b28111c1764abc9be9f4ead82277b11ed996eb827d48bffa28a3dffa

SHA512
c478c8ddf8ce507f89c8cc1c5ea20fbb96aea06f55fcd8b9bb639c8d54255c4ba63a9468517f80fbdeea11168d28e149fae23c3291c656415263baefa0223553

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
cf9ab52cb3414473bcfa92b44594ba3a

SHA1
365c67e890135e09232c306b4a0e31add43ba4f9

SHA256
e00f088b0c4eebf0a21290b2a4e9837d01c45d26a14618982c92771142869af4

SHA512
36f935141d068faa24774f02bfe709a7a2c987b97f6003351ef4bb66e7d678bbc8bf19dae3b88a5d965fa7cd9d83a107c5b3e30af7d19efc24d74a69c6289a7c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
f086bbb037c8ffab39ad285085237f11

SHA1
10b474fa9ab4f5cadea1681f92707584abf2a022

SHA256
38be0d46bbdba83904810c7a936bdb6d765406b14695a34c560a0062bfde0203

SHA512
a4e7fa87d72bd885c4a75c0c3134bfb4b2d65ef021ae4bb9fc4507cc55a7ff5a6161eda613878b2d1f47e4db7cc4d07cf169810872a098031b26fba41a0043da

Download Submit
C:\vcredist2010_x86.log.html

Filesize
80KB

MD5
156cca41e606b6d6fb42eed1cb4d56f4

SHA1
51d7d18a45e3aa7272be12f1d89afba9cec38cbc

SHA256
22bdc25f22e9c8f87e2387c4ff12f422c2aeb083a9d25738bbac6b4477479797

SHA512
0f6a8dbd8d543f6f68a09fefe16aafd2e4bfdc743e49ea6e1fb174b448974316d997e06b05f35c3a6b6d387ad75f5c272559708c4d8f4d2a8e999a5067636bde

Download Submit
memory/2192-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-8767-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2192-9186-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads