8e870b7eb6e79ea13819a32a54a80ca5df642527334ed5ad071428c052dd3d45

Analysis

max time kernel
38s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/12/2024, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Size 27KB
Sample241208-kbr7laykf1
SHA256 8e870b7eb6e79ea13819a32a54a80ca5df642527334ed5ad071428c052dd3d45
MD5 d61fa5b7780306578be845e7e7e00ed8
SHA1 cfaf94cc6003d99a22999a3345f764656f3dea64
SHA512 7e12e94aea2f986838687e20b428ea8ff661ced81aff44a5eaf8ed8354100e9eb9db30e7eee25ad0dbd5f3f74ca384636f68c51569d75e9751e510ed723fbbba
SSDEEP 384:uebFNw4Pk1itKkpAjjI2YpdmJYODNGiJnybY5QYTTszAg1ODq77xbxbo7Rzs:u0FmBkpKjPYpv+Vyb6Q4TRSOG7xxM7
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\G1s2XF2B09is2uP.exe"	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_trap.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2swtv_noavin_x64.inf_amd64_neutral_86943dd17860e449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr002.inf_amd64_neutral_37896c5e81c8d488\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer-DRM-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_scripts.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr00a.inf_amd64_neutral_6033065925bcc882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_format.ps1xml.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMESC5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Arithmetic_Operators.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_neutral_96c22c683482d8bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-AppServer-Licensing\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_pssession_details.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_neutral_df8bea40ac96ca21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ClickDownNormal.gif	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_format.ps1xml.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\he-IL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_preference_variables.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_For.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-WMI-Core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2hbtv_x64.inf_amd64_neutral_7216b6fb23536c40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtron.inf_amd64_neutral_1121c7f92e9e3001\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_neutral_65ab84e9830f6f4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_neutral_e853cea0022c059a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Parsing.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_command_precedence.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00x.inf_amd64_neutral_eb0842aa932d01ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Failure.gif	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Return.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_hash_tables.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_neutral_f2223e39f37c69f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00x.inf_amd64_neutral_808baf4e08594a59\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35B.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\THMBNAIL.PNG	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21534_.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00760L.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\PREVIEW.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01292_.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10336_.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg_orange.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationRight_ButtonGraphic.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01295_.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\CALENDAR.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Services\verisign.bmp	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-background.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Mahjong\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\grayStateIcon.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0302953.JPG	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_filter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\icon.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_pssessions.help.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-pnpibs.resources_31bf3856ad364e35_6.1.7600.16385_en-us_57823863b622b466\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ent-sku-homepremium_31bf3856ad364e35_6.1.7601.17514_none_8d32f6bc0f6a779e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-diagcpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_63daa472b9440b1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ng-oleprn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ea53b341a53f805\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..favorites.resources_31bf3856ad364e35_8.0.7600.16385_it-it_3838a63f071c9c41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ieinstal.resources_31bf3856ad364e35_8.0.7600.16385_it-it_fd37f0baad6af68f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClient\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-api.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9369fa08bb57d53b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-cityscape_31bf3856ad364e35_6.1.7600.16385_none_5b48f43248490503\Windows Ding.wav	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\Windows Print complete.wav	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-o..lfeatures.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d4faf89465aea390\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\btn_search_down.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_winusb.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5b39ae058f71f749\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-r..comserver.resources_31bf3856ad364e35_6.1.7600.16385_en-us_403d230b6e5b87e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_en-us_89701e1decba44ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8f32cc65923460d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\4to3Squareframe_VideoInset.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-bwcontexthandler_31bf3856ad364e35_6.1.7600.16385_none_decc6df4e44f2aa3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_36b997dc1006f298\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_454c741475b5380e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-f..utilities.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0feb9670fc01a02f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_brmfcumd.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ce2d4a737bddb767\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll001a_31bf3856ad364e35_6.1.7600.16385_none_48985de8cb1f7a14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_it-it_58c398a5f8a28193\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-ntlm_31bf3856ad364e35_6.1.7601.17514_none_e52d9c94ad8b0f54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-uiribbon.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d64d237e2b4016c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sysinfo.resources_31bf3856ad364e35_6.1.7600.16385_en-us_642db17f83414215\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Comp7dda8007#\4233efbee3de5f702340b1088df01439\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_pl-pl_1f641766a12e7c5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-hotpatchinstaller_1122334455667788_6.1.7600.16385_none_d12c619138ed9bbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-hotstart-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_640cccbf2e2ceefa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_sisraid2.inf_31bf3856ad364e35_6.1.7600.16385_none_832517589fa2d115\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..dlanguage_en-gb.ale_31bf3856ad364e35_6.1.7600.16385_en-gb_580d777d0ee38bd3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..idmanager.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d74bb9dc4ea86b7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..-wow64-setupdll0005_31bf3856ad364e35_6.1.7600.16385_none_4a02934aca03a821\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-r..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2dbe977664a0b5e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.resources\3.5.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ce-common.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_32649e3ddcc6caec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-winver_31bf3856ad364e35_6.1.7600.16385_none_b627d45ffdcc6f00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmi-filter.resources_31bf3856ad364e35_6.1.7600.16385_de-de_199a79fb26d4d837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Linq.resources\3.5.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.AddI3d71a354#\d8c41b9b493fc289758fc3f7f094df61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.mmc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6fe1f4a7f8512ee9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_df75cab8ff0bf002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..haringapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_993e1611cd45c734\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dataclen.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a5e778f500e50f21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_6.1.7601.17514_none_7a2ff57a626c29fd\Speech Off.wav	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnep002.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4748b24b19a6eee8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..tvratings.resources_31bf3856ad364e35_6.1.7600.16385_de-de_da67d42e60aaa0ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..converter.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_0821fb4c2461fee0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-diskmgt.resources_31bf3856ad364e35_6.1.7600.16385_es-es_840ea3b8b598d868\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_fd30fb074d73753b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_7df14b591094e7ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d7822f4fa214cd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..in-gpedit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_33d51b0128f1afeb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmbtmdm.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_af17a416dc74fd47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-qedit.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1b15fb8021971e80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6a84c19c1214b4c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_de-de_01cafd1aaa8ec853\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-shatter_31bf3856ad364e35_6.1.7600.16385_none_0cd72f8900478c68\NavigationRight_ButtonGraphic.png	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\G1s2XF2B09is2uP.exe"	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\G1s2XF2B09is2uP.exe,0"	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\shell	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\DefaultIcon	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\shell\open\command	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\shell\open	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.DURA	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.DURA\ = "DMMNYJYJBJCPRID"	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DMMNYJYJBJCPRID\ = "CRYPTED!"	d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d61fa5b7780306578be845e7e7e00ed8_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 125B
SHA256 6c09906367b9f3b17251a9587fe500426ed53ba85e282adbb1175a45b8c14dd5
MD5 ad136daffb0403d7adb1f96ec0ebdb76
SHA1 1a120e23149ae0b27f00c198295a5783e2a11d5f
SHA512 b6e1917226e385d1e9c4ee1fc0d14274db4346f23edd1320967b7aaa8f60f70ffa02bb3a9b69581d03353bf932a4dfeff880bb5aa59ba09a501020da202c2b20
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
Size 341B
SHA256 8d8b9dd0cc0069fa54ebd3fa92b37a3b55beb7b11a894e9be30038f4925a519b
MD5 b9e9e2fe22eb5d7a8f439d52d72f5c25
SHA1 77b9e5725c9c6da6e18a8daba3efcaf6f307f406
SHA512 63fafa853eca909ddf09e9f0c587a83d86acbdb26b7af95a4dd7d5e0095f9cd3a29a48e43cb5210574aefd80c5055017f723c67d578e7527374f99eb345810f2
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
Size 222B
SHA256 a5e9ac913ed98b540ad29ea1293467330eae12e0cef75186a138b683fb309f3e
MD5 d4403b631d50280f3372b1211efc588e
SHA1 9dd2d384e2743a61046e958a06950135da0f73d9
SHA512 5daaf757313c3778947f6fd7b3f7644cd4dbba7f0f9df75b7eb910a072f5e726b39a09b2a26093f0f8d3488837bc803920e4045fb51474e3bc2365258c98c5c0
MD5 SHA1 SHA512

Submit Download

BG_ADOBE.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
Size 24KB
SHA256 72967e4f8104ffed1c776b78db72a6c6f982bd8a8a62aa00c694ec645e473835
MD5 ea9ac19f74d61ae3c61e2067f175b102
SHA1 6257fe067918017feb8aa942534814f03431db1a
SHA512 f3b947216c48902219f3669a933e7298ac5dd762ec1679a31afaa60b529bebbe3b3b8fd6c82609cee3495416593ec086ff9be220fa279d21c2879a9ee89a8bf2
SSDEEP 768:Pky+6madvyVHWJwpH8Pbid6gjLIDDos/b0oBbwro:MyddKVHWJw58jiDHEuo9Go
MD5 SHA1 SHA512 SSDEEP

Submit Download

BUTTON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
Size 185B
SHA256 cf2be1321d285d96934d3f9db73705978633c553a2f2bf98e8449cee0d8440f2
MD5 0c006b6c5191d43686050fbe7fd3ec29
SHA1 4410652e721b2a3256ff365d61f293d6cdbbd9cc
SHA512 28fbadee0877a1d687a322b8f83f87c56b835aa204d81e09899ee122a638f6cbd48bf7abb16cd1563ee6da997d0b3fa9d830bf23a1f0a54a3bd7088f75d78f94
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
Size 496B
SHA256 d74570094b9f7e2b3e515ada37283d0516f88dd744be59b9651f09c34175dc89
MD5 36022a5085bac9b2e12314fac1ee6ea2
SHA1 1fe04c42c8e2c35de8b315d8635fc8803fcc90e4
SHA512 491186377341052612c898a9e10da17b4616c5763448b4615a259a0258967a9e267f1c9427b32774034e6bcac2fe18d8f03c36fe1bb9ff9ac786f5612c427515
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
Size 1KB
SHA256 1269153bcdcb874991c16b73d4bd7bffdf0e8d761ab40ba525a7b8ffc402f1f4
MD5 b918226d0a15d74a40bfd40535af1b3d
SHA1 9efba6e46655cbe04b33b94ed59bcf3909aa556d
SHA512 bb04389c9986b904021ee1c9921c927dd17829c7600b4e05ada68e6768a1a111552edf60b71a67653db6da55603770452628c77107709e6e5a03c351ccdd24a0
MD5 SHA1 SHA512

Submit Download

tab_off.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
Size 341B
SHA256 0e5ddc5e8fc65e36e5a6d9fcc49081e3947ef77aeee3bbad4ff9b04139546e5b
MD5 bcaf18131b438e51de4173d72c288029
SHA1 d60366bcb4579311a4e680e32bdfcb6150fb80b8
SHA512 8e3dba16e89dc55aaa0d0e43b793535677001f845e70157a3af774c2315d1159572eefbc2a621a46732f8b0fc5fd5bb2fb60cf7143db45f016474926273cdc43
MD5 SHA1 SHA512

Submit Download

tab_on.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
Size 222B
SHA256 8e1b1126d57c3a3d8f261c8c3ee2eb674084c8d29d69d586330c43badc35a86c
MD5 1760a8ab61d1d61e5662d88544ea38e1
SHA1 bd67c92b992ae6d59c66992b78a5a8cf0e72257a
SHA512 89080db8f7251c524e70748e1cac3bfacfdf2c4eb141d9bcbb913220176bc374f79c7b5497a7e1f4612a18be06af805e216a906fc729d5bcb73ff25f968cdb42
MD5 SHA1 SHA512

Submit Download

bg_Casual.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Size 5KB
SHA256 cfcb201ce02a8bcced668f28fb5c3cd0e0fa38db029a6a974396d2e6d783e49c
MD5 78e796ba9f24f141f2b911b40ec7482a
SHA1 5f58e92badead4188de1dab6b99c6a7c86b42efe
SHA512 e1a9244d1d1af086d830f47c74b998dacf018df7313faa92b6df60dd050b1bb64ff442239ceb51d2843bd2c1fe0ed9fcf65b275966c8b9bbacde3be8e5b4b36b
SSDEEP 96:2jGvJvRlULs5EPqU80TuCwun2tnwrLMPUy/GEmUq9qDXt9RQNrtu3DuLP:2ah8Ls6NjuYq6MPl+wq9q59Ryrtu3KL
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Country.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Size 31KB
SHA256 fda17106f53acbfc41598750fe1a9e9e589bac10146b3b4e1ed86d4b8ebf817c
MD5 0d224921355e4338a8d7740493a8e975
SHA1 d77dd1e4af71191a0c2b5919a424eabbc9ff7a79
SHA512 d44bd82e8a4d6ff47679203e145da7df1164a71cf673ea18d495b02466e64cbdf88ba245a9d23104a6a6a9b667046913971731a56d66861c14006358da68bdbd
SSDEEP 768:kUMbYgFnNiRpg/oIkGurbXrcghJkhsOr4Uz1RIJ:kUtknNjVktnkKs1RIJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Earthy.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Size 4KB
SHA256 f5ec18aebfd985b048e4f8a9461b85505809b7f9a61552c180a732add2e04d82
MD5 9e7662a842f3af15106a27ff1efbce1e
SHA1 e83bc9ca2ebc895a11cc063e7205a6241d14242b
SHA512 b63216fa85f76a8812a54771c49b5dc7249c19d3c49d243099e00e7e6371d8202c30bebd53e20ae745452aaa26f84b25c3cf691f33a25bdafc44045958aeecd8
SSDEEP 96:LTkOgLt7nQFHdnbZ+U9J0QgXiA54i0mKTflcahSQTXLLHkbYJMThdE6H4o:LDSt+HRAUvwXH6RdDMQaHEkx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_GreenTea.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Size 21KB
SHA256 c5d2cb257940db58dea089d3afe4810c4d6b781600a2eadfed1604b22950eb90
MD5 10e34b316e111cd8f80afe1fa11d7853
SHA1 9b508b7071e53bdecf6fc0537fb5ce1105546fa3
SHA512 fb858a6c65346476178a7397f26843bc124c8cbbbd562860abf158f6bac9804bbb7e38d2b6d43c96eb2eddadf39570413b15e46a84c93fc76b68fd66593b5a80
SSDEEP 384:usBXCjpmbNgYvZ+VweOH9EewrfuzczNacQSV3u6ENsyUyThoIECAZ:ujCBFeOdEewr2zczNeSV3LErUyi3f
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Groove.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
Size 106B
SHA256 0c4d15c50c816ba90e5a20ede81e924a6245e507b8d88ed1f280d63a4a145f67
MD5 c829eaef78b48dc8c7a42b23ff21a88d
SHA1 93598ae8d40bc2a03ae6a223e2674697e17b0d65
SHA512 32fede4af7b42efa76ced7a7744a3464ab9d52d5922c7b825f026e6fa5ef8fa37af0e8df7fbb19e3ab010c0b080b7de46176fe92ffbc922d6db7a62ad0e9c1b3
MD5 SHA1 SHA512

Submit Download

bg_LightSpirit.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Size 8KB
SHA256 1b07909105b4c6a3f34b9c5a78900f1cedb18a7459a13fc41b6e1b58946b8a45
MD5 98c2d5e2b114ea63e353c841f68dec57
SHA1 07d234c901b21af4e7bf7c10cef7b042acf3bbd8
SHA512 a17a7463ef9eb369651388d03acfe2c85509865529562cefc22ce2caffc5cf2535e3169e19371f9cebae4db9d3db03fe20562adea9cda77bd2ae6eb1a8baa102
SSDEEP 192:UpuP97rxPMpTQWvm4IYgatFjg87pwV7trejIER87J7mO9K5VRrWU:9P9PxUphgatFr7IsIEKV7mv5VRrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_OliveGreen.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Size 15KB
SHA256 88011dfbafbfc8184a12eaed8bdd0bf15fe418e6c63d9ccfb1995eddcb2c1547
MD5 bfff2b82a4040121901878102ede210a
SHA1 b03739baaf67c26a3d3486a99b6b11387e4d17c0
SHA512 1b1272c6c924976d1a61fb144a1bd9939b59e208264f2f5d5674b16d2d598147294ca1e5790a95587ff1bddda3a1d26bc05391d29dae7230db018ef7fb13b635
SSDEEP 384:KUVpnqwiA1DHJmzOvjWCFF27wRvsQ9KPN/h9J+tXt+w5AheXefni7:l8wmyDc7wRsQ9KPN/3gtXQ4weOfi7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Premium.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Size 6KB
SHA256 98819d14ba5f862e2ca3f43b67106d29d57569997b6a810149c3869594ff7515
MD5 bb996e9ab681fe382d081cd9ea375382
SHA1 26121a3b54db2601755a206f7428c90fd66acc9d
SHA512 04120479b53e8fe3a9e2b0742e72e04501a073c96dcced75260ce82959e1d6839e336bfc442f68b56bed7daa7c374f6ce2b4a339d9f72b80ed52831660889657
SSDEEP 192:KXczyeM9/dK3Urz0LR3w7Qzwkt3jl5AWy:Byes/dWpVwmtJun
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_SlateBlue.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Size 20KB
SHA256 4fd63753ebdb772f7c88ab63a7fef96de0bf41653aa1382cd65b3810dfccf005
MD5 ecc6e4fdc1ed63e048596d66f31df109
SHA1 936d5ea903d35441b4a70605d371e9911ad2e744
SHA512 e50d106d2fe22c70066fa71fe253f93d3810b17050a8160cf5400084b627e62bc7a1cee89b96d8c76c763321e1cda261b94b912fba6141d6d5aa1b4e495d1270
SSDEEP 384:kIL14biCt0lk9MFvX5gYhqz7Mo/3I9VZ6vOQUchr6LveUaW4Ce:k2Ob1t0lZX3cpAVZ6jUOr6LmVT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_TexturedBlue.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Size 6KB
SHA256 8ddf38a09d91095f6a60486407f5831899d6918e00eac31e3403cf82af88bf03
MD5 3441c49c84bff3d4ea5923afa8ae78e5
SHA1 72fdf22c03e509009966714329701f60bc3a5609
SHA512 7f4a4291c6cd3d0e91204cd7a2eece2f89544453eaa1f3605ca58546d63972a10d333f0c95df62562fda61bc1bf8912bcee18e8315731022f1c1d9d81f7de676
SSDEEP 192:iMaW8bFJ6velxh1Mk5W8joE5crmEyCEgHDJusUY:mtFJ6vel71MkBDzE4gHDYsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_VelvetRose.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Size 15KB
SHA256 7b159f303fc80dd4dcaf868e440d06d171ab8d4df825ce8562f9254b0d5cb26c
MD5 003cd39a4c6e9a7909a3411b2e3bc741
SHA1 0de4266ed7f91396be98ff7ffe3af05d18dd693d
SHA512 198d894775b13b0f4df0bfe96e3517a2105338a425b7c20173c04ff0bf96e0809dcf0530a6c5bf0be6b50c98d10c6a2dd1e6a5ae67acf128dc2c7c80c245c9eb
SSDEEP 384:ZChcmbQgYP6o3Vl6Bwet1GjbSB+iQtU8rUyNluXUF3+JR:M+mbQ6uz6BZybc+iQLYu4q3+JR
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddToViewArrow.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Size 2KB
SHA256 9b1e2a77fa6d74c95e390236f3564602b57665213e613fd1dbbe426d1c40a975
MD5 013fe7a0b60678746cd5af928ff62b19
SHA1 63adf7d86b74d9671d8d84853f6d94bb9a504347
SHA512 96cdf58864b6551f141a6a6589f573a4b111cd5fde3e4199c17653513c87e529d3ce1ccb927b2087d9606097e2995593241e2ec7e76748c9c58a5252184942c4
MD5 SHA1 SHA512

Submit Download

AddToViewArrowMask.bmp

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Size 2KB
SHA256 384da0efd32ee7e7cad7487687c262ffe6dc29811bad9117ed373f5331465abf
MD5 471f163da628eadb91d4da9b9bda54f0
SHA1 95449b93419d2ce3e174a70f4173e3bcab20d9a9
SHA512 9fa47e2b3d6e0f81d59b5162a63ac1df82e2b18bfb3174f38458482c7a28c027fcc89865bb5303cbdda3c6c21825f3a93f7dd2abb11a91b6683b869928fd2fff
MD5 SHA1 SHA512

Submit Download

FormToolImages.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Size 6KB
SHA256 bf09fe0aca0805e39e9382d210e56dc2c8b69ca82fae207b7e28a075ef3e89a8
MD5 9834cdf4e501220b7d5258ae9731385d
SHA1 025be57443628daaeb3ca63b5426c6ad49397fd1
SHA512 57f26547fb6d3544c130d7b2f7b103761fdbd4d9babef5527506ae43d16cb1b15435f2326e6cf38622759a315e3be92c9d8cd2eb9e792e3d52b7c57b8ea0811f
SSDEEP 192:CuG/7WJG5NNkk4P2RDZwXXHrUcKpSkzWkGZT4:C9G76+nH03qkAU
MD5 SHA1 SHA512 SSDEEP

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
Size 255B
SHA256 08f9348e639eab5c9c58f440de5a45fef80000f580aae6ede01948e502537aba
MD5 10bf521ee011ca8b4adb43994f8a384d
SHA1 49bf8040ab67ad28020cd811d1c14649c28a808c
SHA512 e815db38a2c8d57072dd5ac51b7c759adada6bd5bc192952c2ccc8fc55cba907f5bc5253932358d28478df16ea2cf7d1ce81fde5a756172b7ed091dfb5224277
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Size 323B
SHA256 e96015c3abb52181fb040b7da35592808ace9c1e8f5a0a3242e576db6d72c6f7
MD5 8e27e840efa4ce9336d5dc28af659d5d
SHA1 1e7b405999ba0d51242e6acdc31943863e122550
SHA512 b7cb5c3779674ded25938b945177edd822a2c25802ec7e3076f64b11b0b4ea264a26f5533a5deb83b0b0498105271a36913000e4bc42194a043db128d9027d29
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
Size 367B
SHA256 c4ba43aea361e955019004755477da952d99c4d44a9bcd2d52b3b2e7152d8f34
MD5 4fbe8008e364f3d94aa903fa3bd4c013
SHA1 3b742724eca9d2a03453c19567ead44c095cb1f0
SHA512 f958527da111455b9ef6ad196f6c2561c1c6f0fde7963d241b11adb7caf17b4ff1091ed355377caf1485ccef56389dd6a3fc32b0258f6eb2afabee1a80dca4f2
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
Size 148B
SHA256 42769153419a60a0b26c79a9ee5e82ac9d50e1fe75e16651233adc27992f0be5
MD5 9b0a3efa8e4713c55791a6a9b780e190
SHA1 8e7dac909fff817160369c0b2011fb843a46f384
SHA512 7828cf6c34f5d288e18cd07c4ba13da0b3bcea3af17f9e4155afd90f60c9994039dc437add96859220706b65eb36455a1d84be45d71ef569e04785ec0aed34bb
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
Size 440B
SHA256 7e845ebb199f967244b844be8330a9a34a4e4a3b1db4e1a704406f4ba662edeb
MD5 69c8e326d724d72e732a003c95dc9865
SHA1 e36efaf9a2f2f8f97b2fa72fe8cbce1de66d18d8
SHA512 6c6b4249d71b362161b6e7ec907a1a97236a6aef9f42c8f0c65ec5c28357fdf3abfe5a7e040f38390f4d1805bf766b33303c639301e4a400da8d510fca091988
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
Size 462B
SHA256 4eec95df2c686442f1e5e3cd3a2d0a65f726c172998d2e6f836151ebb2acc2fb
MD5 100a7d2021221bce987379745b6a685c
SHA1 2c54a4721eb630fb0f9672aed84d1dad76b46425
SHA512 38e9e748c0d69452632cd1acf4c6695005dc2a4f359e8d3aa026b026cfe769f021ac00d625631b21db4818d0dd612e9353ec2f294ae778c294d6f95034de5c49
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
Size 267B
SHA256 049857f796793da89eea4908a27d2926fc13758daeda5cc7d29dd23ce05a77a6
MD5 350b750cac15b809e7a749df27c56cda
SHA1 be8a402db9e3a166709df75227a36aca9afcc32d
SHA512 aed0529f990678c8d2ac60fd32acfbbea24a935e36ba0a52bcec4d65d70d2b71162715cf17103046284d354377be69b12efc569d130725c0d1bfcc20dbe359a4
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
Size 2KB
SHA256 ec7ee51099b8585759a3b151f78f6711b0783c4ca3ace3fff9dbc11be626b855
MD5 f79a26f67c9a7c3eb2f84172226aa2f9
SHA1 b229b2ec3b8cca7fa142c93008d490ba2f8dfa5c
SHA512 9a7247c1027f736f09d3a87cb6c6812b0e953851621f0b3b51e47f4848a75bfd706410b069707da3ebe142c34a9c39d9008f5dd08ff2ffe575828e992dada8df
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Size 233B
SHA256 3a437669d31c249be765d4ad71d7ed6577a3a5ed359603d77549dd2e0846b2dc
MD5 a9805f0820aee9acba5867a30762c76f
SHA1 f0b82c2769069a6ab4dc77ad3dc1715c21c8a721
SHA512 33595fe138e2e95f3bb514f2f9987413264786c0ba53e14db7449204036a67f448c9ca29292f5c424ba1b16fae4f1075c070ef361375e2997482d575b782b5d3
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
Size 364B
SHA256 64ea26c25c4acb05f8828fb5a072484365a2418266c9305d2d2efd4d8271684a
MD5 fcaf93600667404185671d141d3139aa
SHA1 a086a2b765f8ba70686aa444a8751c8266db6837
SHA512 686e37b44c509c98a049d21d2ebae624db74f5739f799ffd81f39e2c4c539b0a39e57e6eb5129709394899d406207f3d871335e77c9e76812c89ed35faf7b923
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
Size 364B
SHA256 23d0ea5f9b00fcbfbcbd8ed5964655a6ce48104eff3d84575a72d6c7d524d018
MD5 1563655929d18bfb82c7f83cf2df5b97
SHA1 9175d628954efe801da180d6b23e183620eec81d
SHA512 ca34b519dc760a46c63f190246b8348a9c948cde526329b2f8e46ec1239afd274b8d6ad10aab6f087f7e37c9fcfb2601ed558cc0b83471328110cf2a46a668ff
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Size 6KB
SHA256 27f74549f9c6784f4c0b97bf0ce163b6202968c3a81a6c9287345f8e0c617694
MD5 c6e1683b67b7031bba003763d4f85e40
SHA1 7daec48d49d0eea1a7843054cb8d57c2912749ba
SHA512 2b4fcf5aaf05b9ce6d87486444b0383d9418a03397c96a57569572f7427da437286a490a14f31ec35028bf97cdc3856cca542c1e594bd9d8379a7b71c3a4a9f4
SSDEEP 192:2qCDQwmNNE4JQTvSCCRPoLI2mm3ehAZbQFQCKu:23DQR5iGCCRwLIbmuGiFn
MD5 SHA1 SHA512 SSDEEP

Submit Download

BUTTON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
Size 428B
SHA256 5397b4931a462d0bb40794f1f2a6a607b172c7268896045531c8b1dbd7d4f7d1
MD5 f3ce526a90d68a9d1d7895cb5409d7c0
SHA1 13cda0ca549923652f1ef917695ef083308c524a
SHA512 6fc90df0a94985778fb2c8620f3ccadc3a6f2ff2ceaf10db2a0950640c4a404951a7b0a3a7c4707e4165d3544c0b9a168c55138448fa294812a70e111fb63033
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Size 815B
SHA256 08f65b87cbb72431ae43ab21decffccd19582a8941a067429cd4c3eb68299120
MD5 13a32c95789461685eb30cf4fba691e6
SHA1 d6587eb27219803136abb59b3d022ae540e9a8f8
SHA512 36c124df8c959fe0fe4aa112de5634570063ad2a8fd942cdb5ff160ed5492ccad17e50440031a90807a780d98e470e4f8fc5a40e0f11cca023397fecc7681324
MD5 SHA1 SHA512

Submit Download

RTF_BOLD.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
Size 870B
SHA256 9f11ff79e962faadd0dc3eb50291827f2d7f2b8cbf01e9c9b32c63b51ee8fc11
MD5 485431270eb019e4a4535dc283d656a8
SHA1 4f8d13bf4224a06c21c3e163ae66f2eec92e4f31
SHA512 29d2754193b47297db9394f9a5f989b1fe9414d3b060a3047f27ca534b18cca3e8cbe12f89c03919e71f9734361fa8e430f51194631d444958f3fd3dcf325eeb
MD5 SHA1 SHA512

Submit Download

ViewHeaderPreview.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Size 3KB
SHA256 e198a482f7c0f338a8c1a6a74d7202034f9a6fe2d140b5f4c6dabc1d96d46f06
MD5 5b832467a48d4394f8cf481e4c62e756
SHA1 20a7762a9c787494a4347bc64d65fca667767d95
SHA512 d62c898334dafd87260e20be1f502d7fe9235a8beae41bd5284082b4ffc4f6f42091645b5ed0c98604fce2f09d75278820ebb5b67c5c2d3c0bfa14d47506c5c6
MD5 SHA1 SHA512

Submit Download

attention.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
Size 2KB
SHA256 ab244aef2dbfb61c37ff866b20d04084e183c5b5f445a769380068028fa72d25
MD5 33e2bbc02c7d5db8b8274d0fd4f7f335
SHA1 193b29e3c397433793e03400fb94fcdaba4e12b5
SHA512 5d0c6a29dd1083016b92ef44547ddb89de21317b91a8c831a683b6ff3b16f0715b0918c21ea03be1c13f8cd7bdba7e859d18c9cf245d04bc2567c41c0cf07176
MD5 SHA1 SHA512

Submit Download

bg_FormsHomePageBlank.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Size 19KB
SHA256 8002b7213afd79135cc361a9c484fd66db2d5583b6256fb2de04c887db293d04
MD5 10b5361a92150a8c7155f7a16bdf5cb0
SHA1 ce0f33767dfda4b6e5f58fcb4e5cf1b877fe6eee
SHA512 728398711be662464bcf06a43afa870296cb517db77fb86eee7ec2807e42a4cc1ad2e9dbe41171e5c906729a48d9016d14505e26134f651c346f6b91bf7d3096
SSDEEP 384:P06CO+aNTOs7GFfyNMibqKFr01d+0AtF/fMPy7MFVPuX4t1LXzj:P0U1NxGFeMibqe0kMsuVPuX4t1rv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtf_choosefont.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Size 890B
SHA256 13e552ec30320ad461400e4e0a8c0410484a083e831ba98c50b644f52899f874
MD5 869a62e5a745e69b30847e4ea6d16da3
SHA1 cb5d3367f760c1489b054f1df2e386aa5eeea71a
SHA512 98e689eb56a5a96cace56e7e88e2bd55614f9e42d9b3f35548a33c3039056b0f77f1e289de280667ddfd68f9269bd69ed48f64495e152f9cf41c305a8e71784a
MD5 SHA1 SHA512

Submit Download

rtf_italic.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Size 852B
SHA256 8cab1fd50ba88d28a5636035850c536730194c20e0472d4e360449f2b84feb96
MD5 48542ace917dd16ab15bc80f1ed7332d
SHA1 cb4c54bf72536a4867ae1502a1f319b8627e7213
SHA512 6c209693692c48398654291d0a5e113fb0f810fe17b22b9c216cfbd553aba8892b82c22cdbea634a12940bb65f4ea82dc5cfaa9974bbe93460e816417dc678fb
MD5 SHA1 SHA512

Submit Download

rtf_underline.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Size 860B
SHA256 718461223cb61ff391f7e7e11fdb533a02875919726f2702839c99f7927e1ac6
MD5 bb4aa450d7381f7496a2decac061be03
SHA1 ab2043c5d75eb9e495fbe56ff90efd9a87ed9bff
SHA512 a9833500232f387cbcc56a34e317bac24c85c84efc0639f82d1a0d42b41c8a7a8726120946511e09f970a931cf9c932e80cccb129cc0499049513e36b5702de9
MD5 SHA1 SHA512

Submit Download

ADD.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
Size 580B
SHA256 f822e46075e928e30c705c63ca3d0f39f611a58e5639aabdb59a4bcec9aa5061
MD5 1b42ddd5708d6c837bc86b3597946a05
SHA1 6b199d1c3636991dc332e38a7fca430d07a11f77
SHA512 a3929dcf963240418e0ca8596d2a30610b7ee0a6822333004815fdf5516e180bb02548dc031a4859a76be573e8e0e3eb88fff1a45e84b67f1da09d7b2a76f59e
MD5 SHA1 SHA512

Submit Download

CALENDAR.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
Size 899B
SHA256 73be97ddbdcca1910b399420e08c739cfb40ae64eb5a59e340699d3f19a77d96
MD5 e9ea8daa22047d59478acac488207438
SHA1 ce83a2c6632e4f6ee334e442daba7743d10aa7a5
SHA512 f10014542f6a005504485f2bf555e32d8928aaad9f093934dd12c895f87df894cfdd36115f0d86901af910c8e8bbc153e02b21495b359c1f843cbc016f9eb8e5
MD5 SHA1 SHA512

Submit Download

DELETE.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
Size 625B
SHA256 cbbafbf449941121b6f3378f37255104fec5a6b48dc6c8f888d2422336790da5
MD5 71e963aff1bd3b8c1c2e3d6199ff3abb
SHA1 8d3a05893c03044c139e51257e08d7de4b184195
SHA512 d2f4b90fc7e4f7efd1156d75fbe4d734696c56a8fdde0ed8b33f2b355cfbbfe5f48b762aa197f4810db7019e086fa27632a797ce92f611d76b5c9ba1c519a034
MD5 SHA1 SHA512

Submit Download

ERROR.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
Size 873B
SHA256 05b2155e9f499d050c5cbcaf9a45fa5f9086256a2af703e8d3fe991a9fae0d5c
MD5 a02c4a003269b571f1f9e559f66b5814
SHA1 911c3c5faa8b66254efcd22acb8bd52c90044d0e
SHA512 a57073d264d786a14be0e316ce7d8bea56225fc749718baff68a457f7e47bb3acbd8bd20b7ec4f03953eb8f77775bed7848c124b6f46e0d2e873733438f4ca22
MD5 SHA1 SHA512

Submit Download

FormsViewAttachmentIcons.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Size 5KB
SHA256 0cd9654d074d953206f8516c9f508c57069fabe80b0c3751f95d6fcc73f88022
MD5 20dd06bfa9d385f88103933fe607a094
SHA1 12ec0960803f3e2cb0f57c53e72951429af56dc2
SHA512 2f372d8b89874f7afaf7da5d6a2718009a3d0cf36b8d6780b7fc5e8ad3fd6949f86dbce4eae68abc8db16bf66fad41a767d1800fa9be009ca720a693458bdcbe
SSDEEP 96:zG/S8uWJxh0zKfgkDJnSWk9XC/zy3QZ0P3QVlfpTQLWs1+Bb3UPuNC:zG/iecKfNJnSWIqlaQVRpTQWIPgC
MD5 SHA1 SHA512 SSDEEP

Submit Download

FormsViewAttachmentIconsMask.bmp

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Size 1KB
SHA256 bb188b3030ccaffe8d4ad9c4df169c4d2efd80eb1bf9315ffb0f3fad80a480ca
MD5 9ad1f44b80dab052a6472c3e4db334e9
SHA1 f726bc4b54d23729821290b855fd70a971f7d3d3
SHA512 d65ac5083481e04292737e8b93933b7289af81a8ac169536feeee7ed48c1f640fabbf55933234987f3f9d6d6fd6df129ff77ed22973c50c50c9f5ff79fba8bf0
MD5 SHA1 SHA512

Submit Download

LAUNCH.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
Size 615B
SHA256 9526c8bf804d4105740504d9de1c13f969359ecb44808e8918e70102c04bb1f5
MD5 8e48d1ea8d46db5af25b3b3425df43dd
SHA1 8719580dff3affee9fe3e108d5934bc1ac2880d1
SHA512 6dee891e579965da5fd3b73aa5b5adcc34f984ba0b748e530189275dfe6742839edc4da91471399d4c9a9ec7ee8e07b175b18177e05a8ead8ccf36b2cb477995
MD5 SHA1 SHA512

Submit Download

rtf_alignleft.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Size 848B
SHA256 ab732a14caf117c811961ea31e79d6a0d8ab1a86d1a3788ede8c0f7860a3b6e6
MD5 4d52c15ae8af3dc1e85f0d83a76362cd
SHA1 e4e7a5582481e507c5346db4e196a21e173f9c6a
SHA512 3a8dc12ed7378fbc2687b8796cd035dfea41de023a1503c055d96f176e4b8aa7d627d9c9010c36bb028bd3242f156a2312a564d1cfdd637f884a0829ed606fd4
MD5 SHA1 SHA512

Submit Download

rtf_alignright.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Size 847B
SHA256 6adf9cdec8a7061033b6e4074ddcf33445856f8dfbcecfa5d245c8f78677b1d7
MD5 b549ff9b71579af9642023201d00377a
SHA1 372cd16b3a9a58d23dde18706b7db633925376e1
SHA512 79fb5c1b3646c11d678fbebf1e4fd141108411dc17c8fba61f96cecf975a223d614eeeb9632a44c723cb5d4e710f2d34e092610e90cb89611115e5b40dc47a1c
MD5 SHA1 SHA512

Submit Download

rtf_bullets.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Size 869B
SHA256 186e59e35aa3708981ff7f666543144ef343990c3588033fe26f8167e056a1ee
MD5 ef0a2d028775afc5c44ec75e218226a7
SHA1 0fc985187665f149bdce3a6ca8a8872395232370
SHA512 8dff12b0f3f61fe14a57ee3c77689edb1b0a6ab9f8b10cd70a48e13955e431169f6fcd6b528f510095c638178cbcc24de1febe86e50f346722e146731a543bf1
MD5 SHA1 SHA512

Submit Download

rtf_center.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Size 847B
SHA256 76ad9a97dd19bf960f12d9bfbf1fe2a9dc0404d960989dea234527dc9a713b66
MD5 00e33c596794065033c93c881263a750
SHA1 6f9bb837ae8dadec9a892753a97ce9499d2e24ff
SHA512 f6e01a3b879f6e83ea1f7a685c01a558efaab6888671808d521afc1228e257463181bac777abd3d2eedaecb9cc1dec9cd9157a931efb14f5c67c0a285a97b637
MD5 SHA1 SHA512

Submit Download

rtf_decreaseindent.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Size 863B
SHA256 d35542f624ff1b8fd0a2557dcbb2f4de503be9002e2990368787818194ffd88c
MD5 9bb70dc50112d783d446827f3ecdcf6c
SHA1 5eb6193c988c130e5da91af5e9083a47602b0ffa
SHA512 5b98f1a57139bdfa8c3860dd2b1164f7e3fd39ea597829d6fb972a7bbd503d18c2f39e1821a33c91eb9912f2c21ae9aeb6aab08675c8c7537de93ef6c64799e4
MD5 SHA1 SHA512

Submit Download

rtf_increaseindent.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Size 861B
SHA256 00eebf96b03a4f3742e5842d709ad71fa9bae1b3f1320173b50c8d0b357017d3
MD5 928c308c0b7c94458878fd2d036962f3
SHA1 c1dcf84769d583c69ea721926a499f514dfb0f59
SHA512 ed819ff1eb9d847fb13abc6d524451bfda293276627e764219775ddb30e86b3e324f643fa482ef2d527c1dfd80e38a8a9a633b64f70fafa260fbbd699354c193
MD5 SHA1 SHA512

Submit Download

rtf_justify.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Size 850B
SHA256 46d97cf855b163409741a829115a0654c63c7d5f9fde725fa87f15b14b5a4692
MD5 54261b53ed9a99a461b91b4badcf2938
SHA1 adfa6f6e387fea3b9170bc03b8a328b0eb6a1cdf
SHA512 6d7c3da4a75b03477dd6dea008af8b2275f72e6a4455e644e2b67800d8d6b236f676088cc1cef16ab373bec5adc49cfe83e5b06ae2292a6b5f86e13f00c9b67c
MD5 SHA1 SHA512

Submit Download

rtf_pressed.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Size 883B
SHA256 b1558b49839ea1ae1c1c1bff3b4611fc30047bfc1d35856af90644c0f48cc0e6
MD5 df1d905e6872e91c7544d9f2a0f6a8c6
SHA1 58f2e7a2ceda4d2dfc02c7ae3673cdc729697a5e
SHA512 94fff556ebb775612ccb5ef40504d38d6f2510f5113010081d8e34af611cf9fbf6732f1abd80abafb61390b0e0b86e723d5beaa7f906b0fb5947a8ef0c8446f2
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 3231db480431a4cb157de5d6cb5eaa4773c9e2ff747e4449b24eb12aacea46ff
MD5 cfc385beac7f5434bfd6713d1332c4e6
SHA1 9b8c363d6bdd4341cf2ef6dfc5bde0df04b7187a
SHA512 92632ceb7a51b5761d76a9299a1f3189201ba76ca1c51a2bbb5fb111aeb3664715aa87711cb7a185274308b6c3c6613d3eb3655791066c4cdf6be75934a05b59
MD5 SHA1 SHA512

Submit Download

epl-v10.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Size 12KB
SHA256 f923abe0bfe73a601f94887fdcf7bdabae91706fd277a12aae564e117e01927a
MD5 7024c76fa7fa4ba12ef514ab33d2f0b4
SHA1 74c8bd28d1c10201fbf91dd68c1e7f9220c81a6f
SHA512 2d2c5c91278d59d7c2d6d316a183be2ce12a2796962f4e391be001dba087e020144f8c4d225437ff96f2ed26cd98e5e07976da8069612ed350c3f4ec9af7346d
SSDEEP 192:nj46RGxY+s37Cm7Lxtx/QtXU7spsvjuUnW5KSvk6j83WtX94DiXV7M2jCUto1:nj1eYTO6fx/QU74UnW5KX6j8SrZro1
MD5 SHA1 SHA512 SSDEEP

Submit Download

license.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Size 8KB
SHA256 42b78514c06649c62c9e4dccba657b8a07b00583fd04335640050bf720ffa2d8
MD5 ba724b5d8a9e65f2dfed2d2d537a80f2
SHA1 aecfe76cf7a5d12ef7b369c625bca42c7ca9f9e8
SHA512 672392c55d19f6be53302ddfd721078ab75ef544cf6dc3153423b06a57fec306cff847aa77273218ff9c632267d656f76376d1366220d1804410d41c7b132896
SSDEEP 192:0lvoCVUK7jTcjwpK8SSIi3F+9VnUYjFO0kYrQRLYZEuV:0zyAj9pKHSXGVUYJO0kYrSLo
MD5 SHA1 SHA512 SSDEEP

Submit Download

asl-v20.txt

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Size 11KB
SHA256 50cce3408d13b3ed3738cb4c6521b601ed82d3a629141d2cd5a2f68ffcec544d
MD5 24721a1db80c47dd39c5973a9b6ef464
SHA1 551dc461ccdba64bb22676b6c25e90b255e1fffe
SHA512 27ef616910c53f13069939a4ef06748465c813b7b9ecf2e8df90e09d87bb86ea17ea15cb61c41c85c4c19d9f1273d66cc079fce48e94738e6e6163a01b748b93
SSDEEP 192:yOQWjpKbZe6rE3gi7lUGjRBPTynLeT3iW0WVbkBMjyWCApYcTVuwLJiLi:JQspKbZeUr0UGjRVTyn+SW1VEM+WlmcD
MD5 SHA1 SHA512 SSDEEP

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 109KB
SHA256 7320d93248899b8838a543606f29362b0279547c1ee2972f5ca09e69509890c7
MD5 48a536136d689d58680d209903ff49e0
SHA1 ef4673aa9895ba38e19a96a581206633c2b2b3eb
SHA512 a5d3c0ef96aed86cf7e60d3751a15a426ff661a4fe6fa8eb2e190616769e90b47b0d06dcbb90448d8c96ad3fd8077677a7ccbb150348b66935f7f0e537c7c3dd
SSDEEP 1536:6Qy7Vd4OpfEqPKeKBP06J/eoP01FDoCsecXxy3r0Lx/unA08FznDrW7GIYywql0c:kgOBurv01FECKEMpunA/di7GowVoP
MD5 SHA1 SHA512 SSDEEP

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Size 172KB
SHA256 b6c7e579ed9fa0ecee5ac8e1f9d174bbbc5beca3dcd4f1be20ca3cb5de901c49
MD5 09728fa878594196f9f1a6859989361f
SHA1 c44a516ca435fd0037fd1743c997e7ea67daa6b1
SHA512 ec9661e0e4303b059f4d2ddeeb7fe0b696c7aa27b97e4e3701f2fca9e4eb5316044838827df44e9d5faad83515d4b19aabf73cfe81e72379d4107944aa477e4c
SSDEEP 3072:SOqiR15VYHvzrzDjnYkN8z5QbFI/2eF9kToREeSKVAnTx/aYH:jqiz7YPzvt2z5QpI/VF9kToRFVAnQYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
Size 1KB
SHA256 4f495c00f23c388b1a2a79f334134ca946d5c1143c74bede5c021d790c522f6b
MD5 b462313c79faf31ebea0a4e7cc7aca87
SHA1 71bc4abe2679a113289067a58aee8d74c82c6a5e
SHA512 cf079fdcee0fa898eac0ff3e3722ab3b6dc43b8e3f8b23859cfd6ee9aea86d677e6d15ff6ce0134a578287dbbe6c44d5f5475a32ba14d67a44907677fb454bbc
MD5 SHA1 SHA512

Submit Download

security_watermark.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
Size 49B
SHA256 cfd561c3c8f26f7dc7398196897ee383db2b198bb69584f6db6da9dbd3d6e030
MD5 0b6c8ae97f124e9875d27564dcc0ecf4
SHA1 4c84bf5c64120ea7acc508550d8c13eae79c60f5
SHA512 7c5f67947b9978ee00056620b26a677deda19e574852a324a9f6f4012b478b44325c507465eb845612527fed3617a5cd4ffd855126779ed3123602d023cb36b3
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 49a14f9917f3a8c0fb2342fafc61281e75d9ecc6f98b96d64ea227c5c60e7581
MD5 75b43460f50846b686a8742f22854a47
SHA1 8e06acc6679050085f4448176d7f5f7005a39a64
SHA512 8b84aa0cfbfe21382f68d862e59f7714ffbb1b7b52650ffafe3ee83339784bb5045a0650e17f2da8a31dfc04d906c525a47b739d680670c447853e32ddd209a1
SSDEEP 384:VOklwvjKJ4TBsvaQ5OE96kn+Jtrbu0Z/wEp7XKlO8p32QlKN335EbXp5Xq:VOywLuFQfbtKskX2PKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 5c9c78c0c41fa781a0be1c103361173f02d321c78dca1000f060c75dd22b3744
MD5 52d8d1bd36dbe2a24c01bc608651303a
SHA1 5d9d56877940a93dc3e989c3d1f7f1a5c5bc8d8a
SHA512 d94cbf2f3968f8433b2ea4b190bc7a3e156b72897f8a9b683670753bd7cff585e2192fc30612cefa1993ce93a9373cb9e630013a8d459824a6368f10bb2c2a39
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 ac693d4138ae7f78ac57590f95c570e42e5afa304db50b2e8135cc8308adbabd
MD5 62847d71635f39842e053af004597f7d
SHA1 ffb31261f5d0bf4b0b839b12666850f243de0c1e
SHA512 afacff400c901f86d7be708bfcf634f278ef3a02c629a61f10ee460a6d02f14edcf49fb24b03318abfec79c256c3a7b697f4bbdf1dfa67569c716289ce8a3254
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 200bc152c0abbc879ca964960ee3d2e8fce761d40e47bc87d404d7b7049c1813
MD5 fa98f9eae3cefa61cadeb10dbf722bba
SHA1 cb865773a1be8c026a039aef89b2faa697592708
SHA512 8dc3d522e9ff00d83e6df8a51a498901236181b92f3b5493396dbcdc0e91e92a441d7124b0a71ac547706d2d7a709b904b53c4e4b3bb982f91b015c9289e9d6d
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 83b78308d1c904c310b2813335ac0eaab0ac7f68102ac77721baf2069af5726b
MD5 a5a61724fdb88a7020ab3b50dbf2bb64
SHA1 02ac15e8c7bd6551311d1031d792f53dc34c9559
SHA512 7e8b49087c70820bd044a5475b0c2c4cade72dfc6e9bfabb3b4f54015377f53b409d876955b91baac4bdb18a800f04d2fa4e7d1a26445747ef81692bd29d86f3
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 52d011d9059fc326fc16979957955647ffa804f24b9ed31051d64c189c83f95f
MD5 63f4841854acf4e6ae7cc3e5158ca96b
SHA1 fd26a642499f8f58adf72afa743206413517c93c
SHA512 ad0b133c18efc9738ee454f92316edfd8b2b7075101a7bf16b319d34dfd10f45a5247e68e44583689cf1b21790273a8387af49e234d106ada1c1dddaec82f8a9
SSDEEP 96:kJRfhfLwP/uajAMlXO5+9SB7iKQRGSjwlE:kJRZM31OE9SB7iKQRrjIE
MD5 SHA1 SHA512 SSDEEP

Submit Download

deselectedTab_1x1.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Size 61B
SHA256 1b21a0a3303bd95044f19683d6488950b5479987441c7545d10a609a7c0f3059
MD5 b2c1184e7fd1dccbd27da645b4380da9
SHA1 30badd4571f375702e1ad91e0c0a0091f88442d0
SHA512 5fe9b27402d7440e3154b5954d1608c12aa7f46c338059b3f6ac113ee671a2d2a725aa18bf5018d0a65f17f3e1a9b92b248f27249a2769c2e25e643d2eb2965f
MD5 SHA1 SHA512

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 1674086cd4c1e20570a6f22f1c4136be5b57dbad39cd45e943c7f5b4f8cca39b
MD5 8752dad203d093efabc8fcde90bb33a7
SHA1 dd2f639ee6be8cce370cd3e625cc85fd60df7054
SHA512 97e881f5976ad661c7108d390f808cf7f06eb1677fbd2133a71c2889f635df55fd4076d6021d2034df66b1571baf84655356f20ec6d02f8daf1016ad7c291004
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 fdadc7a2263a6c59d55fbd60d5306c1b6e22e6881c003728b9f2d7c1fe00d55b
MD5 ae55b0d7f6db42451534ecbfbc08a620
SHA1 01883721d27e53edb773ebdbbd16471362798ab1
SHA512 1ee105af2b640dab244df8566173b06799d4911a98ecd81bc7c7717c9cd314f48c847e8114fb638a4300e1edda1d59b69f699ae6d6b3cad143942a43e81ea425
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 9997bd274c82c63118bf6aaf4afb173b0c3e0b8d932fab09cbe66495f476ff54
MD5 c78bc2ef6d81925bff54fa113a18ed4f
SHA1 10991ec46692fcb92d56fb39360cc6faeb20c33b
SHA512 ffccd11a2777d5c7eccd87c19b99847ad5563218578057a3c9c7eceb9f0e1bcada7817846d43de9dc26a489c1ac3a2db116af304b5a2634dffcf0637f44f3580
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 a210086bd8a479f92b0ce37f91a0a3d58c68e1d4aa0b098b36cb540f481d127a
MD5 2f02337e7c12701c0a53c008d21e23fc
SHA1 e33543a392152d4c3dc6185c13d451ebc9ebbdac
SHA512 7b6e77cd05b88fec1e4ece7ebb299e6a76852b96a0da0f4e0ad44189f8aa90c49b5d31f0cca8aa83421eac24fd7a1fadb52eca22d10ac6fb0e0599d47d82483e
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 3609eab7ad2d5275bdc974586df7af98b593a316fbbf49f3e0d4cfb8546232c9
MD5 2eb823c83a0846d4d0593ba3b639069e
SHA1 5d055b5ef912e0484d477ff2ebca3d3bbec8ed05
SHA512 acf33b59527b61c9a172b5952613c3c877be893c4616185ea0a56f6f6ba28bfe928b17265d019afb2e952b6a3eeba89d26ad8fd62c6db9c7ef96bc12c5ec69ea
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 e5db18e48ceea8e372e4efda6bade2b974abfba6f1032d5c0352dc37366738df
MD5 e9a2a71275987a87b7c5983fab2621c8
SHA1 d243ba959fa6e6e5cbdba813df74f39593b79d8d
SHA512 0c5269656e302046f32850efed4ca5f6d4be56bf01e247a23309db35c7bbdd50f27219a02e2aae83a37801024ccc090a2db468974c4ebb8e08e10d0776452b8e
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 2ff69d5724468368fa6a51cea3ef08ddcc6a1aacb454c9268738a5db696dd38f
MD5 17cede4723ef6d78b7c6c0084460eda9
SHA1 a74f205836097cbae757e3fdb5b76a7dbc087c5f
SHA512 6a19e9b321af5d06d4b922e3cfeaf5f185f233fe85cccc48ae1432630c4c992ca1c60147df0b3b6523890034ffc558484cb0d268e66e8a17ee59bf81065e2b01
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 ee5a3fdf11bf281225469afd0c46cf00195a3c964d7c80ab3dc9a120434fd465
MD5 9198f8109c21b7a0056a51a98b416ee0
SHA1 295be83288154320bf7c4cc0a89a4e0625555d26
SHA512 7d81ea6fddf3751a534e0d858f6f3e49effd53aa59229c72dc99c99f08a277b8747b0f0ffc41897a21d687259e9247790fab39ec2676766195c13bbd54c2680f
MD5 SHA1 SHA512

Submit Download

selectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Size 65B
SHA256 b8f669b9fbcc631bdb9398ab7e8d1d810de7a19e420047fad0e2c5234badbc98
MD5 f8cec8b372f6292d53888152fe68cc64
SHA1 aa9c341bbb50f368540abb34d05fa65667a38787
SHA512 47ea7dc2ec4888b9039cb86b21b1faaecfcdb20213f99d98696fd635db47e2a240a55d6bac3aeca97f81bd4abf2e43a7b57c25c35fd1ae58f0c780397a701ac3
MD5 SHA1 SHA512

Submit Download

selectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Size 65B
SHA256 fe36fc47b98c06394257f38bccf4cc95df201d9233408e5ec3f773bcf834a21c
MD5 b86a5658251dc236e7d4c4026a0238d1
SHA1 b0dfb83d25dcab7d803488c317cd60ce97b8b079
SHA512 fd19881f4bd43fbe1edabfb977867337bf5c15f7ce91b0e8eca4442d79fe9b017e4c32e934f459c8fce013792917fa2015d5361d7097b925110d0e748a43a027
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 f226c02009c2359602600e64b8feab279308c1698bc57a426861e7d5a4368c9f
MD5 726403849e45a9edb39e58d905009c47
SHA1 929fb20ea2dcdc17c6c28d29eca76343c4f649fa
SHA512 1df27a3321824248e58cb9319ca8e60ca9a482b3e26e27b0a91d960bbb8d9c1e4022efd1b9dbc6048f171188ef63171c5743175990368020c27072d979c9b1fa
SSDEEP 192:Zu0q6zJt6WyM67v7B68RRRRUUkMu1LRdCRE:U01SRBvFVRRRRNPAL/
MD5 SHA1 SHA512 SSDEEP

Submit Download

unSelectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Size 65B
SHA256 3924d719ac7d798230770a9af0c0884a824f96a7ec893317ca410ea5120d0fab
MD5 a9a2669e3482388891dd58adfe1d9764
SHA1 04326a5d7c3d0118409734f9245a46631435b667
SHA512 6621e4d4d7f7cde6d880e5ac1283467afa420f34c88271d8385c456dd4409f8c55e793a8360a780d8a2d80fe8e23f2e1fbbdb0c9e7f4129a8f50156f5aa473c9
MD5 SHA1 SHA512

Submit Download

unSelectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Size 65B
SHA256 7092d09295e072afa81e9495fbe665c50baf5200d2597de1d7e4ad78f1daa2bb
MD5 f93b53a2fc2ee036f37e7b51773e9688
SHA1 fe03bd8e9fc048fa4daad4063ec0357d445e541d
SHA512 478bad4d70bddc2e22955b2b633de6f01b10da025faf06c1199fc94fe51bc9d359951b7f82b7f9d014e44bcf151d9896e6d7574878ad5639008f3ac8c82290a8
MD5 SHA1 SHA512

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 fb4928ae6f3d318ae50cfab0bebd677a1ff7ec533f2d213c134def21bc099c39
MD5 afcea2db8d5abd95d8dd249583993eaa
SHA1 464072a6ecadf7360d8f4d44d9aba0e574d141b3
SHA512 0e769a9f07d886cb7ab47bb680ac0803637c7e007dafde256c54168a0ebfedb5f81671ead3b1e551a4beb0613a9b24ee5ecd4449dd68f77e3f75a26f3f0cfce5
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads