566942bc7ff74cca2b066a30883d51f68b7e66502f011fe93ab17aa4fe032918

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Size

12KB
MD5

60a43781da5d83dff9f52d7efec1ea22
SHA1

e0d6f116f75991d848335767d6ba14b01d7ceef1
SHA256

566942bc7ff74cca2b066a30883d51f68b7e66502f011fe93ab17aa4fe032918
SHA512

f81b2d8383826fe53cff8781329ac146e631ee692b3db961447cc357438be41de20c25fee0b5b6b97c3e1cb68e75523753fd996c21e0e7cbd2b353532b8ecb5c
SSDEEP

192:Yj7RW0nlABG/3Nfv8tiTV3HGc7EkpAqjEnTPu2q9C/YpXnAITZfPtRM1o:EWwB/3N38titKkpAqonTo2Ypdm1o

Score

9^/10

persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xB1g65Vp299yQj6.exe"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_properties.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_neutral_9b64397618841a19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced_methods.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_types.ps1xml.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_wildcards.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_neutral_e561157e16aa2357\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_neutral_328dabbf0aeed9bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Command_Syntax.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\atiilhag.inf_amd64_neutral_0a660e899f5038a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\avmx64c.inf_amd64_neutral_8ebb15bf548db022\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\WSMT\rras\replacementmanifests\Microsoft-Windows-RasApi-MigPlugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9b214cd9b78760aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_If.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_neutral_adc3e4acb1046b4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\AppInstalled.gif	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Parsing.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_parameters.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_transactions.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iirsp2.inf_amd64_neutral_9ed65fe0bab06b1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_preference_variables.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_neutral_34624840c3163a38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_neutral_2d4257afa2e35253\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Comment_Based_Help.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_neutral_5766736c47b90fff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_hash_tables.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\com\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_neutral_fe5c4f29488f121e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_methods.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cxraptor_fm1216mk5_ibv64.inf_amd64_neutral_3eaae75b591bd148\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10297_.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47B.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PREVIEW.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\THMBNAIL.PNG	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115868.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115876.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01240_.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21370_.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\RSSFeeds.html	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\cpu.html	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099156.JPG	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\3082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseover.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0300520.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15021_.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_MediumMAsk.bmp	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\EXPLODE.WAV	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR28B.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14531_.GIF	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sw\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Media\Raga\Windows Notify.wav	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MUI\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..utomation.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f9ac3a29318f2db0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.workflow.activities.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6c6ce62d99e18e42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d135e5661cc7d672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Core.resources\3.5.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\security_watermark.jpg	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Activities\bf808b9c0c44745fc6bf261c44003c7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..anagement.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c60dbf2e39f40d95\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ellextensionhandler_31bf3856ad364e35_6.1.7600.16385_none_fb76df1af3b240bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\PolicyDefinitions\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..atibility.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6ebe0b3168442679\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..erbox-isv.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_05b7fa9032648909\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-tapi3.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_60360171f3c02a56\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0e58d2a9d7ba751b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-14.htm	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ingwizard.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9bfc805bf0d8126f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..cy-gptext.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4f0f93a5acccab11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration.resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_207372147765c03a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..nmove-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ff4e4eb0a98b94e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netathrx.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_03bd5129c5e16bca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnkm004.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b1c9dcb2bae2a483\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..verecover.resources_31bf3856ad364e35_6.1.7600.16385_de-de_78232145b7110c01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiaky002.inf_31bf3856ad364e35_6.1.7600.16385_none_f9c4413b766f8371\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000807_31bf3856ad364e35_6.1.7601.17514_none_526a0048ad7e864c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-netplwiz.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d1b7d0f60f8787ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_6.1.7601.17514_none_b85a4f21afbb528a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\1041\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_faxcn002.inf_31bf3856ad364e35_6.1.7600.16385_none_a4f8cabfbd0f45e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_pl-pl_b99e8db1f2c9fd77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.security...t.cmdlets.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cbde052b5e31472c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmspdmod_31bf3856ad364e35_6.1.7601.17514_none_fc373979ce1f4e74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6108e585966fe0e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..baaupdate.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8b0b1f92c10cfc9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-scripto.resources_31bf3856ad364e35_6.1.7600.16385_it-it_56a3134670809cab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05129292ac22f63b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_msmouse.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ba0f6fb479f3aa94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ionengine.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8ba155016eda35d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmpdmccore-api_31bf3856ad364e35_6.1.7600.16385_none_f4c8b8631318b14f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..nt-sku-professional_31bf3856ad364e35_6.1.7601.17514_none_a8ea294e63b19921\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_srpuxnativesnapin_31bf3856ad364e35_6.1.7600.16385_none_447807b31b9d298e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wpd-shellextension_31bf3856ad364e35_6.1.7601.17514_none_13305696250bcb70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\ehiwmp\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\ipdmctrl\420437ab6e0cf36d94b29f00b3499ebe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ooler-ppc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f941ac75dc9d59c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smbserver.resources_31bf3856ad364e35_6.1.7600.16385_es-es_dcc7a7bfada520d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-btpanui-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_16522239f3afb3e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\play_rest.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..-inputdll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d52f5e3c786f113f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mfdvdec_31bf3856ad364e35_6.1.7600.16385_none_64a6ece3617cfb74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..esframework-softkbd_31bf3856ad364e35_6.1.7600.16385_none_0ea5105470d7098e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_script_blocks.help.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-security-spp-ux-sppcc_31bf3856ad364e35_6.1.7600.16385_none_91f3d310d6b20a5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.7600.16385_de-de_9450c441b822af1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ntfs.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e32a01076adf4ec2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..sc-style-rectangles_31bf3856ad364e35_6.1.7600.16385_none_258f1924c482b7a1\NavigationRight_ButtonGraphic.png	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_b8d26fe3a7b3fbfe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..rity-domain-clients_31bf3856ad364e35_6.1.7601.17514_none_1ce1e5c45077d5f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..admincore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1e8fd26c537882f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rasmontr.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d2e5fc1f76e81123\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..rk-ctfmon.resources_31bf3856ad364e35_6.1.7600.16385_de-de_497db0d760f776be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnca00g.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2e1644a9f7142fa8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell\open\command	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell\open	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xB1g65Vp299yQj6.exe"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\DefaultIcon	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xB1g65Vp299yQj6.exe,0"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\shell	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "XGPOOBFPYVCVCCV"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XGPOOBFPYVCVCCV\ = "CRYPTED!"	60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\60a43781da5d83dff9f52d7efec1ea22_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
283B

MD5
0798f82786161ca795dcd6a0999baf47

SHA1
d304ddfc3bee87e23a2a2ad8d4f08b8ee557234c

SHA256
a8e24865a0861f8281156eec1b3acb9e4a2e5b705923d39f07c860286510969b

SHA512
80b9d7fd8ce4b66494bd27eb0783c8acf832dd6c493a280e5e64cd2e8a9e0411c93015896fe965a01fad8c974fd2bbfa0d187e9fa1beddf4089d9046615edf26

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
2772ca5de52c23982aa648ce4790a49b

SHA1
4b04d175bc8ded2a590967c6ae5f5283844a81a3

SHA256
bb12f93693856c8bf928779c488a4407e05607ece169df5ff29d2383cf45b3dd

SHA512
2bd999e1fd7c26e7093512b9ff9c558c6f67009876c2d025f59479f8c0a0728ce611cdc50da2eb10550734e0aed8c71763ed346ed91272ac3ca6d15f6e4585bf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
8bac3ca17a4f249ddacd72e8f926e01c

SHA1
3074921732299584bda0a1172935e65b2ee78674

SHA256
daa382e99bbba5271779b98a04f46aee693a86ebf089e8fbccdc8ed8467a30f6

SHA512
28feeec691d8a6f2515959aa3f5d9d26c5f693eeccffea438dca5de68eed76eb8c02bd411055bda3f2e3202a8996081db892a4b0729a3aa7583da8a3ac56a54b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
77b792901995daa6951ab0a2479007db

SHA1
e7c7bae99b2c6fc4a69c3cd13c4484c0fcffdb50

SHA256
660cf8803e96c156cbb9006e38ab842acff7d6a247a5989c7d1d0f457a807043

SHA512
255cdf2215b6c19b7ef41ca92daaa4d49137de05e6447030808d02a5cfb31ecc565800fb2b3b09703a223ec42e25cd02734163dd810e9fc1072ff4619533721c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
4950f5a950a2834dfeb09f168b4c46a8

SHA1
964c14c86b21731d099bb9266102acec1ded6566

SHA256
3443193f95ad43248828a8a9885bde7ce54a42a8e0abcdd1950319f436366686

SHA512
c68562616348eba33269b79f756c19dad5bc849251764b5316b4fdd5fcc8bfff190dfbc73fe869b95f39cd7b745677c8174e76320b5b1cfb3bfc011896e59ebe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
896f5df3303edbb05df9e89cf599af7f

SHA1
a1b11047b3bd37cc3df581c1fa75b94b97471c9e

SHA256
3488a3c4e292580e66437904a41f7425b78d0bb40748c7b375b3c07125e7f9ec

SHA512
c2a8adc6c5dd0f3e927076bad12e6bf284350abc620a6762c707b34b8dfb9bb2b02c216f6380591599e815394357b67f9c810dfe390b0a05fe9af51a78e5af93

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
039dfd17dd41907ef3c8477e6e327513

SHA1
7a85f5e1e2d792cd01555ad8cdf031aaeb53fa40

SHA256
d48a105b8c560f21e27026b3596e03483104472d0201b947b7145888e42deea5

SHA512
fc57d0b531b1b7b416d53af26f432d7dd838fde4780a4328630314762f589e454cd502032ea24ddc777350a7b03234bf719c9cfa824b68aabe422a0516f013b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
2d5376018110dcc51276d260f1f86630

SHA1
5e0e4387e65202e5f60f2d42c6fe3029fd9164dd

SHA256
f2d6d5effb9d25d4839b56a1f28cf709428c298e744ac121d94a6c8a08ddc4b5

SHA512
3bef3f4d600bc1e2b89fcdf9acb16660c367f6bac2e283dd7acd5a10823defa1b58c0ffe1c3c551d333388cc7825c334469c682950e441c4e809562d326d610b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
0af53c659e2a92bc2caeb5a31178a319

SHA1
10885313c19be72315341623e8a42efecaecdd73

SHA256
d462587ccc3036252f240622d73eded02762470ccdee352cea130fcef3a4a276

SHA512
a90d581605dcd0bb814e8897480740b590d32281d90d50860cc755ea81c458fc785cd02f91e54811d943a9c4b149cb0b28579078f3180aa71320bfd4a54c8046

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
9a8c9ac6d0407a861897db1fb2deda11

SHA1
3f6d54e39fea78652a261b92a8e2bc51552938da

SHA256
757a4e6d4606e9e9eb53b4a4ed3f9e183e4348dc48ac019c89f2260cf7654818

SHA512
442ad298eaa4f75c7b59f2ea1fe01d001a2e52299942e92fd43cd773be247ac02e91987162b4278aa93eda2d4c1cc7a54d9402107849c5dc224c81ad859451a0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
7c15c4e61d9f31fa01f95c94a725b37b

SHA1
c401f58133c070ec281ac214303c1a408d735c47

SHA256
923bf4bcbfde950c9dd0ade8ea84ae315c78906766062469fb90b0d524153e74

SHA512
959d385dcb404cd5767ccd9df4aa4dd014cb680b20344f33eeabdaf750f280b760c831e698ecee6f159b1e9b87b6dd0440b6f084d2bf1d09101d1c9e93c6d457

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
f97f0b82cd2136285a3cea0cfe61b3d1

SHA1
806410cf2804742b265d202d9e596ce4d4311c4c

SHA256
5d0ec41c623bc851476b605e3f117dbc64cb48de738fa4b7b0603abea2b988c5

SHA512
62404e44d29016c3b008f7016002fd5a4906ee02bc5c346b51c960f39db3b9a9219c9aafd191a86ee3dfa4e1b87d155cf17351d73748398a33841871a4505946

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
d0e4a260ea94e1c61a380cea58746d41

SHA1
d97f8ebdc1a68af8365ba54dbf42d97a493bc6ba

SHA256
d33bed590d34de9f56da3e287e87b380b0b5f98019f029f9cff68cfcdef68aa1

SHA512
b29b1ae747588e3fb4d5c71a7889f8ca9a19035e0037674d4e580129b4c002bd6519481b1fb5fed81471d638a475bca1c6e849a9cf16e3c1adde387c5197c2ad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
ed099dcc7f4457f67bc67b4f12ff8642

SHA1
3d5a4021eb4ae19db08c337398a10e656915c84e

SHA256
e89f6a64b9234e1fef7df0674c2aadba5a3a06ee298973624384c956572ba9ee

SHA512
1708de92faae93709d28f754860f64bd98b5eab2f55048918c16230d58f8db9640a4dd6e41aa6b0afc4904cec6491c883176ebb8fd947e2b6072036f5653e8e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
21b1706560cb7f4bcd9e5c205b63934a

SHA1
d354238953b90006314d388e67c977a648185d93

SHA256
43245dbe605bd284e81ef98ae5efe187a52ec727f74e20536b2d0a77a338e8f2

SHA512
a38d07e4aa60502dff344cc287791b470e2e945382a83e2d7c3817c4e62c3aa60882ed95af122a38dcb4b530e02e4fac1707d6c9b0b3a8eb8423abc78c9925f8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
7c826e78220ab83d85c761c47a6afaeb

SHA1
3753875bf6b467c6c0771bb4732a61a4c2626d1f

SHA256
4f7fc30e097d66e2912c9fdf282ea18426ef77e9fc2f8c0fa5c47075cd09550c

SHA512
d49b49941755c56c3f934bd6d18bec7fbb8af996b2ec2cf4b5e58a4cf1044f63a84f720f5b2c8beeb1eb0e03271726573fcea45546a945ad7d04b9181c605b6a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
bde5409dfb4e2f95e3fa71c2bdc9e05e

SHA1
9fcea0033725df4d9098dab7aba98216db95931a

SHA256
37474857722211891ff2ad165d137bffdf49196580c3960aa773f0a5b5977758

SHA512
6e969d904a29485715989c3cb9387d2bf04639b1ccea8a9e5ab0e9dbe2638d75cfde7f9b6d194b56d7c7d05acb1a53196601f89288b7d03c6489a3636155255e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
e262ec3aa6371e321dceab9f022e66a8

SHA1
93186cc237897a61c5534e8ba73b1f1fb35ecdbd

SHA256
3f0d4a26bc72c1d5c025e13b61fb4e4889623b525c0221126e072eef81930c05

SHA512
1d14e7e129d1374785981d6166db99a8b0d4a438d68529a67ef6e82296e1eb2bcb81840e5373a4c3285af5d41fbe3d8cf379a7365258e5e64ffd37fe056f9689

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
424450a07f261d789b03370c9732208b

SHA1
d4265cfbb9807fbff4933a94ab7ddb84a7876f52

SHA256
ccccc9ab6ff03d4819d8c532ad1bf4afe8ab268b7c4049c4b387f8ce4894f6d6

SHA512
d8ddb28668d777d855a1a00e7d703e872ca975377c07c10bf21dc137546a154c91cb830b96f48c2a84fbeb74e922e37611e522d8521ed651d8b01e937e535d1d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
1ac7b8277acaa95ca50097338e759643

SHA1
617d93a8c0376611f3c6d2c5a8a631069e16b374

SHA256
0241759ce97d6232cd3edc24fad371f7c82dcf8ffa71fc1d76ab402dd3547743

SHA512
736e70e3a97c4d8599cda7c01d10d6bc35e2895e8892bb712dbc45373e0b348ed0a4e2e83eddbef62ddb349f295a7fc9d27c0054075c0a7124b2f9022d9e775e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
d4da5257ba1fb753dfc5cb3a51751f29

SHA1
9f306e50050d00f8f3295c4ed2b4302d08bd15f8

SHA256
d9f5e329298e361dba85eb5f1efd6f6fbfb0d001bc679f7be8f6ad2a6dcae515

SHA512
3abfef8f7bc59a329485d6f3a20e3c6d656d5fe687591d84b1f03e2a233ea7e9d844b82b0f3b731b89cc700c8c8fdec24adf59d00f5d4385afa0b85e814ba674

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
b00e9175c3de327762b77e4b64133d23

SHA1
cc27aee761b121139af3eb104a79f620fa2fe07e

SHA256
710544aa897c44b4ba83732eb87b2bd2123ac5ff9ad72cff4134bca348526866

SHA512
3501548f06d38bcb27b8cb20c49529d7d8201981af9c349e7ede33c502a1dbac2db8f3b1168794b54e67d5ba7411cedb2f660f5d626eb1d69637879fd85171b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
84a1b3ff28b41faf3e34dbcfde246a6c

SHA1
e776ab9a3069a668d2cecd30dcb81331b5f1be9e

SHA256
82344828cd8c7ee754bfc22002ec228686d47e69ef794be806f20b6818cccce2

SHA512
89191bcd5ad28a2d10f13814275f03365b9ac6a511f55bd98145a0b9902435ef5123156616ef2c6a86cb37e0318ed19ef81dbad660536f7b462d7229d32ad07f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
75e3e3114e168dfbdbf579867d427774

SHA1
ca6a14614ae867c24c37bc3eed670cb0f414c0d9

SHA256
b40c1187f2450ea7eaffb58b4cb30fb9d51ace8f9f4b1632da99c810af9303ee

SHA512
c3fa2fae9f6d43948cafaa3211d1fd37977e57bd7f9e0038bab34bd12c7dad5baab2c624f27161815eff31c7b17903e262897875cd8c30979905f217909840d5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
b3add7ba430fdd21d954ac41195dfda8

SHA1
e233cb7121ba1dea2cbe5c07a6bc2b8493845960

SHA256
223ab300c1a845afc184de93882a12a44c6306777cd97560c98bea4fe28b17fc

SHA512
84163af82d4b0776def5dabadeda7d3643d7bc84d1fd734ce29a88c08cad888e1cbeb042e925c924eb9d0a95bd1092d179a9a3495c01f287df005d9aa12e68f0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
501e615fed6141465bbc7216823db1b7

SHA1
bd1a761ba5a8f059c3f96e82ac666a684d392e99

SHA256
f1d09e7cd29c1bce53b4f0323bff752c96b7a04a2e5a045af6e78bc12a8fbddc

SHA512
9463282469296658d167bf8d539a67e19faf50c44fd31f71a598accb398a82cf324e1390217f5933d281fa986e9c3ff0a22602f6215ed98aee9f10c3d2021cc6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
1e847cff3ac0789198680179f6bb4da6

SHA1
4623a2e230af885caf468995b7b64dc53df8a37f

SHA256
0c45bb32edad97503dd3a100126044b08791798d1a27bd1555d29fe4b3cd46f4

SHA512
1b677cace23614472f7b2f1484c56257de3fc24a0cd89aaf58c7646c4121581dfa101bb6c1120738a95801caec41acfa72784968846353adb2dd0741a9b7d779

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
7a9ba7cf7a0fc3bd830b2b6d2866b2d5

SHA1
c43747ac27baff8f99737f7d1a763dd11d3d5ef8

SHA256
537eed7b7e7d510749286d969188d00219ccae333baebcaff08740688a1881b7

SHA512
d4c81d6614089a22ff9f245b1cc095ad5ace96776f8ac653318cda8a710e498a7437cfb889249018f497d76572ae949acda5496b4b3146e0a54543d964fc6520

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
b82306a35a7b742973d3f3560eb29bf8

SHA1
1f1c3466c784c53e4604eb1792938a95ee6694ee

SHA256
d4471a8915c2ff4493970d98d5901adf4474185288e03d686e738e069e945242

SHA512
87311cf7bd5a1b386d81bb54eb504f206178d2e215fe76f55f7ce2786c365505f9a0cf66b04b5f86d73c5f95d41d55acc61b39bbe9f3c49d9e1eaecf9d1976ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
70938ab0a1d4f92cc854e3975f2310c7

SHA1
55982ab465e44683a849312c58feab09bd6e4f23

SHA256
94856344c35c44bdfd16efc0e6b370cb9fe3e191b1ea03f274addf06f9a1e359

SHA512
d554bf901c8b51e201ffaf9f88415585a1955e631662b3dd5c26a010fe53baa4c5d63a6cd31a544aa04fe6d441ad96a9a5100228ad53e9c6f44eff4f9beecab4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
f70af8345013f15c1064f32bbc1f9cc7

SHA1
9ff48b0aedad625b22597f7daeedd828f4e8d30a

SHA256
8641cecfff9e1d953d00db0ab81e989d2587b4a3ac95c0985bfaacbba2f875dc

SHA512
4d914362e207467cfda741c22e8c68d2f6a6ecd9f3ef8ff86939179c2be98f75cb1b4eb20812e1bb090eb93c6010f9933744bce0b9aabfc92f94a0049708d400

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
ba3a24dd94d26f2fb5fc88c80b89367a

SHA1
4ba0f1e600edec12864f0b19d8ac0133eab2ffa8

SHA256
2d724ce374f9eb9e12aec307107b02c080deb991fc83ba58ed910c62ff2ceefb

SHA512
1d5a97d578c6f6fa52c58e6649bf132f067a97c396449497ef97b0bf2a827b6adb2135f6d21557d9ec05318b07c421b4aff4d025bca985244643cd0ffc92c9c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
e8952015381961c2797146a84f812f60

SHA1
b140f8988c77c5c17d5361816affae96d3a43af4

SHA256
c5ea3638af27aab4d68abfc60ac0e746799095921c7c7a9de4c5f8761ce06d0f

SHA512
ae889cb3e1a0a549b08f48fd7a18b747b51113f21d27a3f9d74f855144afbf3bfe5437955e11471ca363f360959a8609686811f7f0bac346527a163b3c1ccad9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
6b4aee891b988a0a6ddbe5632726b93a

SHA1
ea34d41c571921b1954aaa7100d0c8a016547b0a

SHA256
b9f4864eedef19bc35166b2f6efab94ed93fbb7718d9e1c398a56435426660f4

SHA512
7e5fd2be8bbc20e88f8a399f4c634ce680c0eb74ca4050e6b04a5b48cf0b7b1369cee1f6887f8c2cb4dc517c3303011b77d2dd4e947e2262596dcc218c99dbd0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
347f6270f15bd7d0b857edbdf0bcdf99

SHA1
bbb1422d2d8cacb13ea0a71118aab6eaa18f9edf

SHA256
deea03aaa5e7be4e5b0d5cd8379bba07885122ac4b6df5001b82ed0d56f368bd

SHA512
853f4d534e75ec7adc878d97e7469abc9030fcbc13c12e6984571381ff88883b44be0286a2a9c7f288fe5c0b92680bbbbe11b7d471545781cd59eb12a13d584e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
e3fa9bdc26a72a1f29b3b01ca502e930

SHA1
aef407e1bcc8622c4090c9ec7896a5bfe8bf3bd5

SHA256
eb617156c3a22d8e5377a294d7bb33ccb5233f28ceeea796b4bd4fda73105bc1

SHA512
32f0feb816358b408820cfd425460018149e5a0123da0e33c8c51fa32dc7b96cfa084b0db86f8b75e3202d778bbf73310761b67d939d1084c6741e3e2da9a71d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
0a2ed393afa885391c874b62166ed63a

SHA1
8b3674d6125627a1eb01a502ad9968fd94d83eeb

SHA256
1f186d093728d906c3c822e0b6cc5aef754bc126042ee1452734b009af36f487

SHA512
f6a29c56c810cbb3b223d27e07b2b8b03d9653810ed572a0ff1d26af7101fdce188bdbb6ce2c46717cc8a9a41e09f14f224c073c8eb19333af503275d17be7b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
0f9ab14612f76e89c856299b04b0a726

SHA1
ad2d94a78136dab3e2d5ce9728a61a942bcea56d

SHA256
36960e04dac124208ad0cdccfed9bda5860263159bbd515d18599e31a3eeb845

SHA512
6f4bfbcdf2f3796f86fcb736bade3920073199a5a035344df20cd53fcc9cdf76a2bb8649d79d085be2604a0681315a06986510dd20c6d3aab5826b29d790dcde

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
0588701e7f9004f5d593b011fec7eca9

SHA1
5bbc7bdb940b7396b18157adfe6da11812bc790a

SHA256
8b4fc206cd681d8958f4eaa7a4da49c244223057a83af491940396e2dbbb9de4

SHA512
baaf62b14056b7fa34219c257e0646f92c73c0d953e5eb21b2e08d8d96c8d34ae9e3300459f705e222a549c74840c0b8b9e9575246570858741419e08d4074ad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
b0d8216adb61d033ce1c2a0c35b729fd

SHA1
f5b42c5be80419e1cf7e96e68d6bc3a230df84e9

SHA256
59dfc0214a88fc91923d7ee38fdb3b56791aee0c249ba104851a596fb163be11

SHA512
76c6f4b37d686347f2cd49be4e1b39e8709d25fd2194a05f23b601110cf02496b992b9bec378f4fdabd38cc978b5f003218f11acdaad0f21ad3f0349c027f8ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
c79e1e003e5c877cec8437c00cdae47a

SHA1
81713e5ae81b3ac8758d525dc034523995143e86

SHA256
2e20801c81ee63ba1070b92f0c40f10c4c6f5fc6203e83d2b0ba65bcee474de9

SHA512
eeb634ac7591f92b341cb5dc1498cdd59aef071095b002d51e448d16d96c5093629dd6636aa1396537928c017d98d482e4675ed54eefcd235d719aa0be234fda

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
aaf4b9656d061ce201adebbb782a65aa

SHA1
3ec940842399487071d4cccfe40ce3a524a8b340

SHA256
785cb838ed21874f06e62ee32dd092021e121af7cd107750c3e9c0c2471dcfcc

SHA512
ca0bb7843cf2b7dd3400aa141f2f0152afb4ac85056f60067b7af63ec148828215b888594ae1ba6ed78f8820d09c30f38ddda87e70c94ffe0dfc49f65c47cac0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
641614b5c6e5858193b760d999d955cf

SHA1
5092bf01e921822ba926677b06a9d617ba5cf509

SHA256
046161e1aac3268d69737174dc0dc0a2a015920e1b96bb9c50a40379addb1357

SHA512
595fbc25810d0f07cee900be5c7e52266a4fe3f83429f68205f831146929ea32b11fc6091126410a44607236128e8f1eb846577b3bfc0a26ecc6812fbbd2e99b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
68852d159dc6851e458e10e0c60d86bb

SHA1
1663c6344dba9284339fa96b4c499e11e1bfe40c

SHA256
3a3680a7644f2d12ac3bcbeb92100d6ebeb8c3af499c93bb98025d4ed38383e0

SHA512
afb3bb66ab68e93db11aaada6d54b8e2832c0db0d05bad9e459657b01d8a61ca013f3e4fb60d0df8d67f274d62f9125f6e4b8d2c9d404640ee1ef3ac0736a794

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
d39a10c533fa92261f5882c5892f5bbc

SHA1
a2b0872c8382c0c7d555b6afec789d97c8152ba2

SHA256
8fd4f227d61946e10bd3fd56a8577d0e50da1ac205d2b1595ac489d3dcca4017

SHA512
9a6765723f2e3177558253282d5a04fa94252b5501ff234b3a9abdafa9c8578d0b0b2439da0145609634638d9c29010c1b8e5e781484b4ac3a0add4c3d7aed55

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
85bc91d0cea8f0689b2bf5047754d270

SHA1
70bb04bd683177dbc0150ff4fb76c79b6c65dbc5

SHA256
b06cd26989d06761116a1e2537b78fd2a13c5588e80695763a79f3510e495ed2

SHA512
3b3c50fcd2e373cb61cab1220302b6fb4ce0f55c5e807e4f331ded8f01a1419e2c8c1e096e23b2e67935d329b131e0bbb8307dde11c28a1cba50ae396aa8c811

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
f2eda59934ac616ed33fcd311b63f308

SHA1
490aa540f622d74d02b64a2b368c2235b5afa1af

SHA256
c8df06d109a62f734c6faadc5f6daadf88c09f2139a341341f15fa3f3e92313d

SHA512
c73d9a080d6af4e0e6fe30f26ab34473530cbc321d3f3c9030d79399f42f55a78ba145b60029a2deb2759be6400a74320122ace6dbb0b1f5a8e192ba12abd66c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
da5ccba973c6dd46d810976eba9d3c20

SHA1
7fd03a52f021b6314702e1aa08061a2c06184487

SHA256
7bd57dc3287e727232c26d4647296ef07909f40987394f82b62d3de1162e6680

SHA512
4e6b747456364382e5763ad3344c5497b3791d6b09a1bb66d4f4f08f26e55492dc588f5b1db9ad59d7d04594e0f3c24deb30ec217a592f68da7b8ef3e970deb2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
29c2c361f5bc32dc4d2be703db50bcf7

SHA1
5baf0c2b21186c68f93a5bca77734a9ab518dffc

SHA256
88eaf214b5c7d46e020e558fe2ecc737fdf25da9d2c64cc08903e3a75377e6d8

SHA512
bcda958b308aad455c9f1611029a33564f1bbe2960d3c600d99cb7fab461b768fff86e2c78edf343c3ff671ad3a4cb9c3dbd987cab5f4edc279c6697638cb416

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
229c56499ec5c021537779a5506cfd2c

SHA1
5a8f05e36d470ac1a249e2a015ddee02282f68cf

SHA256
4ef0164b4768a3d6385606bc6f1eb5e870a31e54e52e9a3ee1232fdefd197acf

SHA512
67f3f38753898b8086e61aa4c51f404ebc996d00de23aec1390aa23cf8f0e3c66fd578a01337297b9bea92ae31f3ca4fc5db234cf761cfe6bb6624a640fcb319

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
738efd985246cb76270a50a5f6f49f19

SHA1
7e7d26abac590d20915fd276c91000393b2d74a6

SHA256
aca26045c560ae793dcb7eb9c0eaad46101242f69cf3f418bd8485bcd65fbcc7

SHA512
06cee902a4d7272c1ff6e52116d21deb92a49296849bf1b72225abee24eb6ffa6fbcfcac7def15494dac0478a56fa60487287862c30647d2411b0c0885e7d2e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
5dbb62976453b5aff62da285f390e93f

SHA1
76042822ed47b30816642bc7248286bd609111fc

SHA256
a7301ed91861fcef4179c9b03738e5f307c17c42bfcf40a06c472f9344819344

SHA512
f86a9d7940109d6bf9ea5199fd607c940324d1dd758ea804916d606d47ff18f3345069ff0fc1f3a3ed6e978b48a3bfed9d55f5d8c06628f3d9ca5864b2296077

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
6e3e13e7f876b1fe231a9a9a9c7b09f4

SHA1
43bdb19e84a325e4c2361ffeb6f5c55d3c121af7

SHA256
5f8df4e4f06d2b2c7ec3d03e062b49d23442395c0dc7d99012bc767d1c1fba69

SHA512
2fed63dc7b8871f3c56ab56b350bc8f0217206bbaa91f502304b514f6a350f05524bd5fbafd2af7fd2aaafa9d5393417923d23cfc9fed46d491da95e9ea1e306

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
30e0b99a6354a8e91e30c2159a036459

SHA1
7b762a3bf5ebe4d65a72d428f6cd9e1396a450e9

SHA256
7ef1256bba8be46d9feaf52795a06e89b99fd595c0fdad5210c274cfcaa38c6a

SHA512
c7002b4e8dde528b0ba22c18b1b9cce694dfec537e4900713f8fe69858bc38de25222d0b9180b4b50c029cfc4badb24f2d37452bf7da8b33aa08df3f20be7d05

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
b8296f3549b1d1559e8d87269153bea0

SHA1
e9f6e54649dfc28726bc44955ffbaa2dc5293e13

SHA256
c123934676f47ba8d0ce1490473fdf0bebe0422502e9a61dd754065c67b8727a

SHA512
cd3b458b0d2e30ab47df61cb0149a0296251d5f89ed7ac4f3921b9a79fc71c1d4c6a16df6a25e5650a8283d2a62a5efda03030f85cb0f8e07198de842860e4c2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
17f85775b800c01a747a564561251fc5

SHA1
1d48d4d92e8e605f443738d2a06115e78388f99e

SHA256
01199cb0bbe8f892992e7c4b7dfe6c44e46ef31861a4f9d21ad1a7d61f9350ec

SHA512
c6b918a03e342197ed8e13e456067753eeb1fe5d4d3d716553fe9b71d5cfdff26a64f0a3ffcb8cc3847cd730cdd35491aff7d3489d92b0c63a6dd5fd54ff96f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
4d08cd92472ee933d372d55ea7837645

SHA1
01ed2cd58c411fd8fbd433d775674002d7247ed8

SHA256
8a68eb8a53cec1e2d7f32c6c74151a68ddbf8ce29d89527fac023673f24592a0

SHA512
cba1f79218001273dd9603de3e993341896f4935247873dbc20c160159b31c59c96c18c40b98425a448a53aff987aa854081414e8fcef13848c6b2b2b4e143a9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
d8d48d8032dfebbaadffbdfb1bddd370

SHA1
693991cdf34f3e03252715b43e05a346d1e37ab5

SHA256
7527cdcb57e41310b6a9a90cfd569ae366d972b2c99d61b319d81c4016728d9e

SHA512
fcc252d344dceb1222cb6b655dbf71dcab152a9cd45d90a427104cae5d49aab4170cdafe3173e3e901dab01bccd5a3798d67979469ff6521fd4c8c03a1b91c42

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
4f48987d9529087adeeb07e6e72663cb

SHA1
85a949a77bcd54cfc92a24dcf43b9f79ffb32a5c

SHA256
1ab57e52f0767b93cb017f45d2d50a95103489333ca81ad2b4134d406942015b

SHA512
f9d2121777ad042666c3a32fee1b24f875836f55f273257b0448b2d01e1bf4d372b04b7ad107c567462a2660abb9c7ef6feff680fc048941d8efdc197866c096

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
20da76efef9c2d389b9b6f53eb76b460

SHA1
31c590ae4ec88fae1a5aa34d32d8f0ee718d49ca

SHA256
70ee333efab07206c599b903ebe166af2a252c54ecd47826b7973e2ecb4daeda

SHA512
821b9218c895219454f35d581f92c0734a95fdccf68fe4a210231ac50b5644c2efef079f4f6aaaad19b1b867120ae4565f9e7afbe0c65e15234297a1cf87f87a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
417afbbdaa9f6aaf1bdddf3338a8f07a

SHA1
761b29edfb66da968decbafb20756f768d5b88ba

SHA256
b927cb50bf5f86fb52dc9830948c495ea7f456d18c8c2a8012571250a3a86464

SHA512
35d0499348e3a7832fd918f03d643f4b73074dd3eb89ba5fdd06000fedb33f0fbf9208111282ada0c66d9b8d16de5ed1d9bb8c81401afa8b628058c24b3a141b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
f0860ed38caae6c884b0514862807ebf

SHA1
22e2947132a0d72cc4e97a2aca14b37c5723cb9c

SHA256
dff59a4da187a3e1e00b60879cf374065685e07cdb91f3aaca09530bbfbded3c

SHA512
ed246cf6104bc319a3d519945c82c29abb6e8ee53b97bce3e0f7a5424be80a42c23f9cb58e1a58a21910a784bfe1fa8e9ff0f4c49b8496a1f561bd3d65d48154

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
8a39e0e23d9f914436de1ca0aaef187f

SHA1
36b9cb2bc5cdebc07cfdc67b76035f6605858a2d

SHA256
834ffadfcef490828148879bc194aae74ea4e7348518583e4e54649a89dd8c7a

SHA512
9c808cbffe91af4699744f86890b87bd7a6a4d98aaa98d488c058c81a3ca41c1804eae02be5eeb7be6e804e2726ed83654231ca47ed90e7567e3620dbb544cb4

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
1b673f58d547578c55d8bf71481ee1e0

SHA1
9bee480549ef5d51570d8435881cc38cc0ed4bed

SHA256
89247d3a911a7491156979fc64197d9cc15fa66fa0ab27230d67d915edc6ee2a

SHA512
7d1ada66bbdd6081c66a5f03d7a7ea47e1375d680238d16b01e00cecf5ba19fd1e7b63d982035f4712cae4b43b4c474f92a545b125272a504fa795ae368f952f

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
6115f61cb8c77986d9d32075c0dee927

SHA1
6c552500f0df8554ce47ad9671c9cc2fd3baa270

SHA256
d0a78defedac259809cd3cb5f41a390587e353bfe18a07c01b2319d3218b2332

SHA512
4b384f058b55a38487e720360b02cc218d2a1fc8d0a619915708d0a905fa1478d2cb0a7ad8d66678acd8aef36b0a786f11b4ca48e2cb294733c46f97b02ff391

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
8705da9078e97345548d490e1201c836

SHA1
2185c44681f3bbe850f3b2e89f296122cee9f5fc

SHA256
f6585036ad1a85e63f0acc458035fe53eed22ca76d4a702ac0699a60332968e1

SHA512
aabc1cad1076c6575034ad09a296441115507d96481f709a2297762d88ecfe0c08b0ab1843f077eda97ef175222ff26a30ea09b84ec6eca10a42fe516d6a4e54

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
a5221ff2e02aff7a133ea546ac537246

SHA1
fd1c88dfb957447529c9427a08041cf5a9f4b348

SHA256
338385d91d6e3e537d965a425b8a4e5f87e57a063f6646c0fdd7bcc57a4dabd0

SHA512
2970ff8a54407c24e08c1e953817e7e21edbcefc515730f90415b1427d3aa889a70c98db8a967f07fbd32546cd94b1c6e2016a8afab62e520adaa7e8b1d89487

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
373191b0193289d8d3831987246b8206

SHA1
6f3c30807d13ebf6c78eb6f6e8489d5114a624cc

SHA256
9af3b12020c841ee03661886281c774c9a5a35055bad821792a593e8ed98c2b0

SHA512
f3351fbbd86455cab17c98abdd15efa264fdb0c61a57f9af6a973e0c62a80060a91f4f5d2a569402c3ec60da2ead0906672235b92e5d295f18f302b19c1669e3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
28e1bcd4d60c3a62e5c57972242f0a2c

SHA1
91a5efc229dec23db964ccd84743c9a569500fab

SHA256
f7584cd18cbcc4df29ec5bd5bace5eb540bf2fd8b2247c6664a91b11484769ba

SHA512
70a085790aa8d39713ffa7c95c60fe12c2646fc443700532dc13b3fa322c8d5046e93f4099415d4d57d6ade4a362eeca042361094f8246929d856b1ab647b8b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
a2018a174a3a44ccf96d443d840e1055

SHA1
64a1cfefd0e654d9fffb1f1f84f6103c6dcc8a7a

SHA256
d1023fbc1bc19c34fafb233ee5c19018358cf6099079f38a0547217e167e541d

SHA512
40c6ef98bbdc4a8eff9d64aebc0b366e2cc760a303177f1e551d0c4bbc571c8ab6958ca5d8a3e5e7c5f5a3f31cccfb1a19864a0721ef24895a2035a7105a6e62

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
dd070b15d8e292e25ca67a034a46efbe

SHA1
4a64c583ddbbde8c7c88936bd9dc72b4912a25f2

SHA256
5ce00439dac4240ecf2d4f3a5c553ddf4baf2c8fe225e1839afe236197878c95

SHA512
4758dcedc19710a32b207dec03a8e1acce8b92b741571ac33c6b8ed5dfd3c906b850dc3e8e92e76de859fadad267adbbe7086a22844bd5326a21227264ec0377

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
b5e47e28586df04288f4b0cdcf1dc44c

SHA1
389ab0d5ce89842798cfbdbe09bb6c6b40c667d9

SHA256
fe2d20dde4cdc9e1447d847b9810e315abd6b94e16b9b1fcfbddd522aec243e2

SHA512
f9426abc1b21b830811a9264e2e1df38e2e562619a3ae1c21998cd454d527a47297b62a1be8fedcafc78d1dc8cccf41a55165b95c483fcf450d811656d8d0a64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
12ce6fb5e58a440abae336616ea53941

SHA1
55f24ece6c3335792c6a32eeedd7bb2f1975e0cb

SHA256
50c9332cc7f20a817c7cf1cb24a4b18a33f025fd46c6963b8e41f0d2aba54547

SHA512
adf28f0db10895f52ac86fd7e93f5c9e80345c8db9f05c2e1c2ce7e62597e4830938b9044beb180bcd474adad80bcc85f20db874e51998702c65cbd5792e3c63

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
d99817311ca43f6351b2c7365f2d1c8e

SHA1
87d87f7c6abd84f392961c0ed12d7c85d01c6578

SHA256
261317d3b0848c80bae251fe4359af60efc807b24d285ce91b6a117f6257745f

SHA512
20b97bb7fb7ef36f42a8d4b339144a26863ef49c8bd5e1f64a373b5f906485be01eed823ea97ca6f8baa7c3347b011b8ad253f2525919a7ec3f3bcc877757fb2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
b6375aea5b3687390731be08aff1881f

SHA1
5994a29956af7f964bbc3cba39daeb9bd6dd6d6f

SHA256
196cff09b193fe392aeae8322e1f1d056eb974c066432cdd1f99003b218f3e08

SHA512
b74c39c1b752d4610aba9bfe0f963ab7ea8f9e3eb6a7b46cffabe53a063862f5ce2f2db045c3103ca26c00797419c9156ff7e95e4207192da77b56779de02b57

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
06bae1481577dc2b690187bcdd51f208

SHA1
2c9abb8ad3f78d773871b7b4c5031cd2fcf38331

SHA256
533d9ee043c650ba8f4ca5fcdab94bfa9ce4956d2f466a2102bfd679dc543669

SHA512
6d4cb1ecfe5084d21900a02d5a597922986f8a54202f2db17cd8d5bea502b69454cae0e19e39db847b4c77d0b27a7dd9076842a6ab97fdaa1e3e50a4aaf7f055

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
d71522f6d324cbe19e464d2a73bfd2d4

SHA1
373586a120d6a51dab204e4c7d2dec231f2d91e4

SHA256
626236e8289c0b3bcd2079ffb635a0cb49a45d5bb8e0d1f98fe181e0c90d2fcb

SHA512
d47e0500c186cccb2c7baf82d2196a3999481c6c0b02ac1a19e43bae5818261018eaf50a584e6530fb67765248567a10281956630d563af0098f79d80d6be0f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
cb94a7177fa2ea599ef8d3a7f70ed345

SHA1
f90e8e361edbe8e9e971b687cd58c749d9912473

SHA256
c4a4adccde1bb1b5086922556493675191c0030633f57cbe13e3f5936db59b57

SHA512
f8a9b3b1847369c3dd48b99eefe340193aebf9ebc8fd6dab83dceb6e7bc5f36fbb7fef2ffd5791994425aa2ffe4ff3ee7528c55d6aa4025d972b171b4b86c3b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
4decab8e1a579c3bf63eafeb3f674809

SHA1
6acf4b234b604d3d615f2b483f806e0e084c5ed7

SHA256
134dfae0ce3e5f5ac9a93635afdf621402f7df8a397f52682238556541dae116

SHA512
a8d74ff6a045fd1273845f06e0110b5f30a8877a1ba0c6d069906d024c968b059c9f4e8469d0776d87bf2076a93a75518f433df75bee70c1609fc94fc3a71f2c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
e43f3c14a33e7a2d1ff3a93d8ce39caa

SHA1
cc8eefa2db2db8625645cc19a4f292fad62285a7

SHA256
5b1b8b59750c26ae9f00f0da27f9fce33ff60a6ece79b542323325665388b106

SHA512
560d1b69a0671d69ebd7705cc24e8899bb6b2861dbe217befe1379cb2a2c672ea6f095c5d475a404189cde4bd136a2900de3742c6ff3b16f022ce544efe6e145

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
196f4de263b14007baa6dea269819fcf

SHA1
6ec97c14212ebe4b52ad827fd91b8b905ee1710c

SHA256
f8a8043c725aaae5ee489dd1f5fe74a6a8e952770965b759e7be7f9639767521

SHA512
49eb7ceaec7e4e1f616fffb26ad7ae7ae78508530d0f43e67cc97cee72b637a202f0be2b5b2a7e9b2552aa62d8b4f66b76954fe1b85b784dd78cf562e3134a97

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
fdf7eb3b1bbc883c173378ef79dc7675

SHA1
b84e000b1df47041aeb8f1d26fd465a6d92d5fd1

SHA256
10284aed46c1bec236fc0ab7a9963759513e2e4b57cfe6affad2e9ea7e561d7c

SHA512
32b39e446bc514f120f26cbdb07c8fbb74ec1ab45c54a2840eac1d3156187be2222af2027f687c60fa35a99ba04c3893e8473d5bbe79d3f1efbebc2efe36b522

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
3a3e2e5cab16e46c25c3cad8a684eedb

SHA1
37b57687977aa02966dbbb48a51cd1e15aae20af

SHA256
e4f1a45ef9c30d072795856927ef916332d8e799bd1dc57566a5fd7553b71f01

SHA512
56e912906ba37393e2a92a4c1325f5409b43af63aa04f57354cc0f571167c5b1bb24b70fd3ad29cdbaaacdb3aedea66a3162db817b34460c49f527671d4ab6b6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
5a2573a486b47a91092f093772d208c1

SHA1
226be1848d357e98234d6bf293c192ae7923d996

SHA256
cfc1c981403e00f46f9b641297b5fdb1db483731a220f66b2cf5f6348891991a

SHA512
11bfae77fb95a825584f34a614630860dec094b57ae10c2523617dd7a362d0e8dce2444a8b917f41db5063c986efac1d6db88ca64f7c0f2c3b80d90bb5c72d50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
3b576b26485f8335a6266379e01e17db

SHA1
b4ac4fc6375f3efdc69dd472e9d2060ebc3886ae

SHA256
8bde1307535e326f2fe65a4c96b32cfb6de1019be016b899e9c4924656191ecd

SHA512
d42cac3391f15e41f41f37282b99708978ae00d0e4393d8da1ff8ebb11649a12b68452a7c3547034a6bdc6b8f80b84727d1270011b362e0ff43a6503fe386c7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
8f2b5bc23310b0300eb0f9e9f70f1efe

SHA1
9d6daaa907f315e575a12197e7430ead8f5b19c7

SHA256
eeaf18b0a2a01a7bd17daedeca378879ddfac7eb2434836581dfd31638e44b42

SHA512
8f6d858e55a244ed60f3f68d105d71f2a46ff241eb82784fb10dbcd1ff2bdf981d8430acdc132b17f9dc6a31cd7da7f6812a896a09c4c95711e89fb2954646b3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
57bd182b1c493bc4ab471fd012d2ff26

SHA1
6694b9259c0e3a77c99ffcb1cad0d9430478523a

SHA256
e356d1825ab9abeb7e0fa93f6551fb7110bc380b84a7dc18248ee42527c6051f

SHA512
3e1330ac5178b454b1e6ba49a7a05442b55c29afd3f54cc3ac081c8a7315b0550850397a486c22ffc9a3438abc27ec83af0031a1f0563e4cf8f65cecb1d498d1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
41f57b3592731c029d97390f6e8034c1

SHA1
fe35130e6245050d7a511b6210787249be2f0062

SHA256
08f52261e99c2a751367f917c0542f8d21b5b10599e90bc8954cda7e7b1ce1d1

SHA512
9891474886269c3d9831b17718143b25e46c9e63665890cf2f5583d5ea0610cbaa3599fe210ba82de4257fa713972365e71de8d1bba7303ea12e5308670bd1aa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads