e5ca48b24fa821addd11a64d1e672e62a4bb5b56f4ad9116d9ee8a51da2831c9

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-10-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Size

12KB
MD5

190ed4fc7d9bfb3d7e3d4185f349b950
SHA1

52ca77fb5a95ef33442e970975796bf41693ccfe
SHA256

e5ca48b24fa821addd11a64d1e672e62a4bb5b56f4ad9116d9ee8a51da2831c9
SHA512

ae7194b4c51b581509b5b49a658a194484871cd06be3f481c140de5b2ebf1657c569d6c246157da174dbe4d95681cbf27a58acfe5185cacbaec6fa695467fefa
SSDEEP

192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRM6cgNJ:JebFNw4Pk1itKkpAjjJs6B40W6fJ

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53wTw1Ft9rFZ5YX.exe"	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxhv6.inf_amd64_neutral_81ba64c5b6150dd3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql40xx2.inf_amd64_neutral_b95932400326817e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_neutral_8b1e6b55729c3283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\background.bmp	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Switch.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_cmdletbindingattribute.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Path_Syntax.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_2.0.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\com\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsgenericusbdriver.inf_amd64_neutral_24c807694f614911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_job_details.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pipelines.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzoom.inf_amd64_neutral_dd07287cee791f3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_providers.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pipelines.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_neutral_f5caca1789a3c28b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Redirection.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_debuggers.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmetech.inf_amd64_neutral_230358eeb58f0b3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_neutral_df8bea40ac96ca21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Break.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_locations.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_neutral_22118b1072f57433\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_logical_operators.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_neutral_856142fd87f1c21a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\com\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_objects.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_neutral_34624840c3163a38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr008.inf_amd64_neutral_0540370b0b1e348e\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_neutral_82f4c743c8996d67\amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_logical_operators.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_transactions.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_neutral_547edd894d7c19d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_For.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR4F.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6F.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01179J.JPG	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21324_.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\TAB_OFF.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ZoomIcons.jpg	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14985_.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_left.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\BG_ADOBE.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR5B.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15169_.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..lprinting.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cbac995d886cf4fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_srpuxsnapin.resources_31bf3856ad364e35_6.1.7601.17514_de-de_5245d157c99819ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..linetools.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2093f5f4d1e0f348\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_de44258d81747ce2\flyout.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\43.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-mail.resources_31bf3856ad364e35_6.1.7600.16385_de-de_00ed58017fd687e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ic-module.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fb393f53b1512e58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-memories_31bf3856ad364e35_6.1.7600.16385_none_51190840a935f980\16_9-frame-highlight.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\settings_right_rest.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-u..evicehost.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0d95a376735c4590\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wlanpref.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4bb16e0f59e5ccfa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Publisher\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.mediacenter.sports_31bf3856ad364e35_6.1.7601.17514_none_e7db1fde0e47a515\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..river-wmi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_02c952f0fb621d63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..cognition.resources_31bf3856ad364e35_6.1.7600.16385_de-de_90e2e552510bf577\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..xtensions.resources_31bf3856ad364e35_6.1.7600.16385_it-it_85f6ad66bd1a90cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..henticationbinaries_31bf3856ad364e35_6.1.7601.17514_none_0844da926677dc8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Return.help.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eb5ec32f73606acf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_cdrom.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_215a88533b6cb696\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnca00c.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e99d09b59838d6ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-28595_31bf3856ad364e35_6.1.7600.16385_none_554974e545715c34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smbserver.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7f7f1dbea0773732\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ce-common.resources_31bf3856ad364e35_6.1.7600.16385_it-it_903f1f30e9abb911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_networking-mpssvc-netsh.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3d768ba88496e3d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..stant-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d159b756bd047a32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dhcpds_31bf3856ad364e35_6.1.7601.17514_none_1c77be6ebf25c03d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..ecore-acm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0cb3073d2ecf8808\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..services-sam-netapi_31bf3856ad364e35_6.1.7601.17514_none_e4e845f8dcca9f23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_57b2acb0891ad7f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-dssec.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6eeb10037d176959\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_narrator.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9a8d9cf3d005048\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnlx00y.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cfb41b171c1c79a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\settings_divider_left.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_b4d76dc2a0a2a6d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_11b913172f0cb26f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\4to3Squareframe_SelectionSubpicture.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tunnel.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d275b3b482a27ab7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-20420_31bf3856ad364e35_6.1.7600.16385_none_525ce6b7474ecc75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..randprintui-printui_31bf3856ad364e35_6.1.7601.17514_none_de3cba55d23c9ac7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..rityzones.resources_31bf3856ad364e35_8.0.7600.16385_es-es_e4fd476272535913\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mprmsg.resources_31bf3856ad364e35_6.1.7600.16385_de-de_37e3f297f894f855\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..c-style-performance_31bf3856ad364e35_6.1.7600.16385_none_1d8aecb671a2bda5\performance.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..ginworker.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b88732508e157123\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-28598_31bf3856ad364e35_6.1.7600.16385_none_552905214589b007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmnttd6.inf_31bf3856ad364e35_6.1.7600.16385_none_114b74bce3bf356e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_40be65277919565f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netloop.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4d52c352b5c38bf4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.runtime.serialization.ref_b77a5c561934e089_6.1.7601.17514_none_a67f221874da7f4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2b166002b7f51771\RSSFeeds.html	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_3f223e118fdfe4d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.applocker_help.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c49c1f7ba28e2952\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\ipdmctrl\11.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\inf\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_amdsata.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3ea4ad375858b344\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\settings_left_hover.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..henticationbinaries_31bf3856ad364e35_6.1.7601.17514_none_7ec36f4d129aab09\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sysprep-spopk_31bf3856ad364e35_6.1.7601.17514_none_75d7ba2e6407eabf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.certmgr.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9307421bd6b8b49d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-diskpart.resources_31bf3856ad364e35_6.1.7600.16385_de-de_277d1b6cb03cbe8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_6.1.7600.16385_en-us_cef2e308cfaf44a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-tapicore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5ffd1c0faa410a61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_ab6782291b0ca7be\rss_headline_glow_floating.png	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "LIOLPNPCITEKZMF"	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\DefaultIcon	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\shell\open\command	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\ = "CRYPTED!"	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53wTw1Ft9rFZ5YX.exe,0"	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\shell	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\shell\open	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LIOLPNPCITEKZMF\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\53wTw1Ft9rFZ5YX.exe"	190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\190ed4fc7d9bfb3d7e3d4185f349b950_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
cf1068cb75d17c65bbd01bfdc5a24ce3

SHA1
fcdddf8a6e0003adea8c0a7c903e4faa81241c87

SHA256
f714df26f64889655ef611764e5b1fcf7eceb6c60aca826465a6ebb8d0b5b0a0

SHA512
9a46d325f93235998426a413ddc1e4e3beba48cd7774d4aa5a1bbe1c7c8057c648bb0bb74994fb94ee5bbaeeff67370bb19076661d2d7114fcfaaf3ea782bd63

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
b3c8eaf93dc62616aab426947251fb8c

SHA1
dcb3290bc535088f9d60d6db99f826673bbc3d6e

SHA256
ea6d315b1636ae01416cc6fccf95e4059fc7bed19e0c6eaac8c646c2870ccd72

SHA512
71d7425cc952d2307a5fe8b14dcebdd54f8476d6d5577b311b2245470065de6e3ee5e30fae70b7695249d55ad55659fb620a2e7619b7e639fdd7c134f90c44b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
c310c7f7767b18176e7b792f95784ebc

SHA1
6db6c1f2975d3bd101939ca0660a67c6f85b9059

SHA256
f7d4066869198458dba89593763373879dff8faeae96e90cc6a66865b8376327

SHA512
a1aa1dda8944f35203e59c6821e71a81b54a00383284e93fa9119de1bd172fc8a4b89d53ea198c2565abf8ec9663d36d8d3ac16d1a52f8fca1a2edb8e2847721

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
c70689e1d9fb78bda00399c753282efc

SHA1
d97233ec95fb25c212ec8fa5ff5d52082aedf8f6

SHA256
5a34e24e1c701dbd9a060f4683fc032c87c20b51ba68cbf586aff828a7e99a70

SHA512
bc5cf6c2274988b5b54251e82f5f76f6564d76d716bc037e63ba09b015762f9f8b046cd11afff11be7f9f92b0642e49c93064754880580b07d53d56d9a584cee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
1611f5adbe35886eae96b34b1974ae10

SHA1
1090d73ebd7e0d6b951999c5484531b579fbc6bf

SHA256
74e77e80b67d514867f5027ad35fbd26f0a2e5f380bee0c5506e66ebf37219a8

SHA512
25c187ebe04a0b66c4a6205744e9508856a5cb4e5c3d530555144d26eadf7b31f15cbdf86c7d0d096df7284899d8d55c4044ff83168917e03564d935024b701b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
0e00dc0fef70cb953f11d35b6c95902f

SHA1
e137d33e5c87627572e2751370e709f71ea6b49f

SHA256
68f87d3f004e5612ad2f00459e775c20a8654c392cb3b2967c63bf286ffeeb7f

SHA512
90c8a0c505affee68ce30d21e2626e2624bd5ce37fbff33aedea270c0dc3490daaf3af0e51e8b36cc0d128fabadcf6bbe3d854531b4a4ab19614382ddb8652ce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
c68606f5a72d41f7cb3b1b763ceb86b8

SHA1
ad4185891408c29cb4e85b970a24665f22137932

SHA256
9385101d4f117c9a7eff25a2f24e738cacb9684bc051e07054355aad5d20848d

SHA512
31e2d93e032422d6da516605261724c68c4c234ab45731f0d10d0b21e9c463e2160e981e3d6340e8c1a7b717f94c85f1b0ade117029d1c756478deaa1439add7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
19347b2a2302e8fe5b734106e063cc73

SHA1
bca32ac053466877c025c647e579203a17f2cc6c

SHA256
9a1a91f98dc3d9f18d353c387e2a186f339647d0223f1bf7f80461535e591d28

SHA512
db0f7f4c23fd503dee5e224377636df71b64f546d4edabbe911d1727a7559ebdaab84e23c35cfe6dcc71722b6f7d1cf04a30cbd917d78c1e198c9b413571c065

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
4717d579df9f3876c3b6ec338fff0a85

SHA1
9794605bda35dff427fa65d009880eb302d91409

SHA256
e6f3ba6e6a493c57c7e44cff0acec43c0471eaf269cac6b78fc32b60e95410b2

SHA512
1933c23d05047964568ee2e1fd38ee5d2b826e3fb4c046d01562ae1f1cf9d47a73be5319fc5064dbb254e1d606af9fd474ef4e569ea9b4a844fef14b31e7d5d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
d3c6757ae9d68e6726cf6177bdc68d53

SHA1
752223053b96d5e4f5a8d2213f92a67599aa0921

SHA256
12dc1cdd50eb5c85555abfd60ac19915c3b4243b1f3c088c41fdc0f8da87f05b

SHA512
4dde827b8e5dde16d13b34953afd3f6bb8c6dc676d4b43b3493e6dfb334a1d4f3b8c8b5951398cc217ddddc8fa1ca18f2b4202d761f0f3bb50d3f333ca6384ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
208ff8edb539c946f265f637d984ad42

SHA1
1c3397f8e1a556e19fecf23d1afc93c1b816a680

SHA256
7185e2a7546257d50621ecdc632d07f2428e01a8473973e6145796f327f3ab72

SHA512
794c2d28332cc7423bcd38dd13d1402a1efc66bdc72a2c06ec104b67b445b116005b1b8252d47b6bea44343195191fa0b8e7401155c8775ef120fb353549cabe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
132d35abe30edd187468ce627e0cb0fd

SHA1
05603ff1e96ac0e27cd8fef25af5cad790e576dc

SHA256
6898614db7d88cf226e77d8db08b29dd3039427d174902bbe35d82d6ba25e7b3

SHA512
ac46b1d92c804782e519a7ca48a8c59b146df95806b49afa51c3219852dd45e4041fd06f0941a0095ca70a3b14522c0e03f9e6a166b132091a863b8492db1b50

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
80ff55caac2f824a45c43eec1812943e

SHA1
4626de060cc01dfcabd0789427ea5f9c323510cc

SHA256
cbae4dd50fc1a9e4fc87f8dd3b6016bfad7a88a624aa5b00b656248b3fe4bfea

SHA512
a10569121344ee315a4026b7eae0ede553fec68529aadc9b0f864a8d39f97dada61e373d2751332c01a8f92c000e8b35e777f1ab667ef8834a21b48552818dd6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
8314af45f96e2e6222690fb1a0adefb7

SHA1
6dbaff81859c988f2fce1863945327a884052dbf

SHA256
44b212c8e374cc401703ebd76fe8086d80c5bd9f566b163722923176ec36da10

SHA512
71f0c066667ccb6d1d0461819ef47681b8efa532c3e701bbdb1b52c69b2e675fb6e8dc45a4042f891e3d3d3e83bb563c421a33ccbaaa092257935b7d1883ff0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
b202846c63ad1fb749e07effa56e7ce5

SHA1
ba546fac8eb269d9f5b095d0c0f141fe26d8a8bb

SHA256
e48d6f601109f1e9049d0dcad386ef4ec0ebdaff0c1df14991ff88025a6d2fd7

SHA512
ec2307475ce3a5c1337a27fb57a29487a4a961d6e201bb968c504eea3775f6559d014bd136e95befff704f83467c279f0b1fb107a8976fa932e6bf559012962f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
8e632006dfe404ea6e569386ad3a999d

SHA1
a2af194d6f9f0d7b7abbb3016bf7aa43f9e2407d

SHA256
41560cddaa29e62c60cd8c8b3ee1b2059aa8a5fa1fe95e07f398c06590fd34a1

SHA512
a332f67c3526213214a7240d5d7f7da77586dcb1861f62a0a5a48e64eeaab941b66dced0e9b608d4499e4dad5f08a8b4aee23283d8c893b83d8f991a1588c115

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
0914e02313af4bb34f104a949f63c6bc

SHA1
cb6e2e3f5d82d111ea99fea5ae0bd9d5ef593062

SHA256
adf78a0fee74c1f0ec8a677946d45a18b74441904e552031fe88b45dacfd6c73

SHA512
4c42ff9b51aff8be38ab830d492a5bfb9923afc6dfbaa2eca33deabd9793e89b6db020a26589929aae40e96519bb400a74cf19b90f2629f9bc19b639fc6334c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
4550e37a62a16494503f4f0b0f40fb84

SHA1
4cb1b7a2fecad0eed0625ebd11b5a66b4087611e

SHA256
47001995556b9899b41870db8411b7919c4dee43c15d0dcf3db6f0edb8979ecb

SHA512
df762d91f83bb1b2e83971afca53f8f7b0e055897ddf0436d26e517e417778e331d8c83cc7c2e747f9618474f36bfb515f4111e1df94374ebcccea42a876716e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
9122443d3ac1509bdee3ef0fd0ae2416

SHA1
9902df4a95213099b2b1c8609675eb9c9b9d65a0

SHA256
9550387068fde2236b4a8c140c438a4a1ea443bfa890ca9be592e26e9fbce596

SHA512
f608988121a2d87269d0ddad65dceea3d517ae7390ccf82685d7f11bb05078039ea6f91152d2ac56ba6ff6595fc85ca883384386c96bf777ea048e517a5cb070

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
a07a40a554876f2b6bb1bbcea2d523aa

SHA1
1b7f1d2a8bfaad7e266e2fde6b498ba52b39e7f6

SHA256
37e103679960486617e91db75e1dbf4992cb2b26c17c10c15b20b4fa31d63028

SHA512
31679616fd6e687ffd7f0517e4a5aea0d0b33db4eb4da3e4405d6cef880d17aeec4e023d0d60cbecd90761f0200682fa21baa1bddc2a28a8c8024672a22fa5a6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
bd75707c290327b1adbb73fb3fc0f606

SHA1
21d5f43245888535f6eef8325ffe531d25609d9b

SHA256
c28c7c36410a917c2b253b795b1f66504940744990e7ed7c351a58426ef6035a

SHA512
f43f00ea8ca1af714c8174d9b13bb08607c430c886bb845cd6ccf7e7e147ebdbf5ffbba2b83d70465904e904e69d0da04050fa419719787fa5fa93058f6dcf65

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
55acb62bcb3310059aceae984a3c4c37

SHA1
ff6fdb962989c9b6eac07c314e3a4a9e1fc84ece

SHA256
dc8d628b3cc8de6140c05cbac7526547c08b54c52c39bf8899175de5ab847979

SHA512
3dc81714ce16bbc5ccc5d4ef5e268705b17924e5f8e8a5a94a57eb9d676ddd68d9f9bec2a1d6131b21d7d4d2348255e247db6e22d50e9a52741a5fae872c4eb2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
cef5640c5b42a81ad860be5bb48e73f2

SHA1
569c3b11e5deddf34dc78ecadd4acd0ffbe49e24

SHA256
28a2a35709edeecf668e6800312e2e08d47c82a1a2d424c8e728c1c76c44c513

SHA512
964a7bb646d8772c1d5651d6d05b2fd55254a288671c877c2532af713a0c3e065466e5a8c706017f014d16cf31d00143730a85aeb42ea888e150cf67da5be46c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
9ca1949f9501dbb0fe0063a564e454c5

SHA1
da1a8c0e91e7f21e0b0a874c43b6f101da15347e

SHA256
11a6d815c3a1c0a0c687dab1ac3b94a788af35bc54b3a8558c686bf35641fda4

SHA512
b96b62d12f4560e789009ef721d677340604ce12d8f07e85ff4cee8bb9c9e53c05303bdcb01b5d3e620767c434340ba2f8b90f663c606b986991bf396e59849d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
4de5ae87dd83f23b7489da5c2447e576

SHA1
ded4359faf1e3984b707683e480f9b988c52ced8

SHA256
122c78903b3fa757c0d3b2890ca894626a10a3326eb9e743b2636906fb1591fe

SHA512
fd76125f96e530b889c06758e5af63f1f3e53257c3d0264b88eae4d6b4bc6e7b65b36e154d9000b49bca68ded04ef23688a33f65bca274407411f2dfe468179e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
89317069a9a30967ef03b5fa0800901c

SHA1
a0b53613495ff1a1d104147b526e72d29c8fa420

SHA256
55bf18adbba7db1e9bb1d725352ee100d5c884bbf65e7e7b2f14b66ae1eaa4b0

SHA512
b8758f6d177e0c04360f8d3eb285955fb6e311b2a5d4fb1894c7829c0818f61f0ec25e604385545014c01e54db186062a83b1b009a8958f27cdb9cce2fcf4dd1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
3e8c3addd5bebe7b8dae176edee55d53

SHA1
f8791f1d0a600a550d07e21b25e1839427684e75

SHA256
d4900f4361ff572f34a7bf065719d0d227ee011406a4736d92e09667cbf7dee5

SHA512
f04990ee1273d818ca29b6bb1db967f519818ceea4ea773e73e28319718a6f405a81f39b1c1de9cc27d438daf100e4bada107857aa6c09d2d979f18ce2589fa8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
884ba671c252d4b6cc0009e76c7d257e

SHA1
3f363327d4999471784d62cd23b494fed29fe18f

SHA256
740f203fc14c3586e91623f34e6484f5db688e1846ea9f808dc0acd8cc051047

SHA512
d5a5e272c916ab050e4c242b745e3082a344646a19d3d7b782c8d8a770dab58a2fc4f59bb3da94a2af46af9de4e8260e7df2a28742fc627a33c1d0477a4a773f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
e931b0e6c1b9a78de8de7de96ba884b8

SHA1
0b6f2da1ca966b663d188e621b0eea041924128b

SHA256
9e49bb57e6fb42e1a582f63aa2fd16f6216d4309e57496430af27bf08d1d7777

SHA512
d6fd2929d623e24ce2499b3ed01182642bc553753ac05d57fcdd21eb14fe5389eee971d922ba420adc67f4dee4b1da2b4248d2991e6dc259898f9b90ba025f5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
462B

MD5
7f251a0409d7c41af7bc6ec35858cd90

SHA1
f433d4b68b8dea1e38026c953a420ef855dd72cc

SHA256
9dc8e1d9809bbd327e450a0c16b659d1e67b4bffd7fb3b1565c0e9ad620fe003

SHA512
7da162fa0032550b934901495fe244197d61280275f9f314a87ce359386d9aca0f53d2a3d63efd46ea532268116d4589494d9f1a33cf1e5b364d12224aa0da6a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
264B

MD5
a687b56d5980a2d01e6ee3b784a4f04a

SHA1
cfffe1a700f341536426f094ac3afb394ce0cc8d

SHA256
c8e5f635b4a2d7927684055bcba1061466a5c50b85f52307a04624262b19e457

SHA512
901b0a2c2b90636d9ef7c7ef1a7e173d1380c5ae16c66bc16d821d76631d16021fda169c0a654fc10763455f8d76b08a641e36a36ce7e09b350630b0ba961a10

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
c0e6c3545ea6576a1825b1d0c09b9c2f

SHA1
9cf4ec0fc1872568ca327c423956317e25c579b9

SHA256
3f8a162e5067feee9f967cf0bb38442a0bf38484ffa1b58782263d7def583d64

SHA512
5681eb35652af9162aa2df31122ba1991a711d46557da53e00dbb571e348fb68d47d77bb53b1d0511799fa94b521239a69e48788a952385d96f55a450c7eb56a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
18f48bc3b40895c6c24af5669d350e11

SHA1
beea7535326b0d79e853e5c2f87c7589db825b79

SHA256
879cfd78b30ad0bcd9d5113d6ed14a9b189689b23680a0d578336000f9c45587

SHA512
e301b19472fee9c49ec20a218b4b4fbd8c5620e12caa8b951b80f43b0dda9d25820e804726a6216e0ddf387e5a79d8ba2af1b4d93e5c58cd813e8152cb6f88e2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
4de2ab6258b27ba97491c347aa8ba252

SHA1
831ac2bf1e9f7e4c1ffd50fb1199e889534521d6

SHA256
7b5bc0b173a13959bf8ac46eb861058fed75ac4397c3ab58dcfd4fd7d2e84fe1

SHA512
b502c886e74a702cff967c417a343b4f819b89f15e8345877e14237d70daa14255c8fbc2f2e5f8bf507c2528965d0906d9fd7f7db32eb169b915f7eeb8e8f805

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
e102c8385024115d53bcec542b2425bd

SHA1
0f5d5b31334f1f0e8635020619f3b17cec964d70

SHA256
b6f452d33cdddfba861b34b3488bfcec9fe8c5f6f89ef4b6dc30a707696b87f3

SHA512
3f813d165d10589e5b34e74d966f7412b107011791618f25d6d23f43466a3372405bf14053931daab560689f921c286f27946dba1eea0cc2a9024b3c559bae3f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
2469cdcbb1e3ba3e0a2e657e1c2b872d

SHA1
c35f812b6681bff78ab6cdc67572b1fc887c332e

SHA256
cd7f306cfc217d6f63e830e968e59e44115e14c9d8aa956ac9a7befe247f196a

SHA512
365ad71d571357f3908dc0e7df79211f450b3ca1a0280d5429f378b6a1e23bc4007e91ca79260d9cdbb9ae655f4963521ef2e74bce77565453c6a56f7061c2a9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
f386e17e1f24303da1619890782275be

SHA1
9b1223f61578ce63050024a79a0facdde867035c

SHA256
a28ba480fad1eb9ce09711ae76a8f87c283c88b2cdf0785f6468b60cd4a38b7a

SHA512
d18889f94d413a459637216a99424e65492d2169e2c136542734133da3b62159e75a6d55f2134fe37323e43ca5fdd50b891f9a12c0646af8b864b83ba7995fb7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
e7d980adc95bb1ca6b48d8513e84d27c

SHA1
51e1309227d9cb8f4977ec7898766529835e8b70

SHA256
80b6eca35026ce71de1168adf89bdd98cd73024e8758a9ef45fa7d9e4b538398

SHA512
8731dccd3055f46440900edefbf385250c8c2930d140ba46dd8127c549d5e28f313c0a93cc90e9439caae48a43e848e7ecbad3e22f3e968181a4dec038d65ad6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
066e5f6acdad8db0b6ba3eabbcd33fad

SHA1
e64a1c5b2219ff618fa8ce17672336aebf6501c2

SHA256
8e233e937eba23590d51645125f8f84f7e12c39a78b30c0d5355aa2e9e85527b

SHA512
111a0b6aca93ed199ef82eaf40868902594145620591a5a00fdbc3e1de22e1ff6804a97f143384fc7fd8dd2ef1341553453050982aff705c3022bb12bec88fc4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
870c5bb2d0f3463272ccd735cebd31d0

SHA1
b14ed16440497de601b209fa6d13352b9b96808b

SHA256
1a6023a18d06b16b10fee86ec64d381a90acf49216928cc953cb2d2139fa7988

SHA512
0ef79399719d3509782787f4b7a927aa76985697ab05b3ff170d67defbc5ef3d0315c55e3b25bde78ff64771dfb474cae76ade5d829605cb606c5d4034f5ccaa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
5cce0c9bca79ccadc62b786912731b14

SHA1
b0c3b376ffb5e7e2c461d3d89b188765a6787bce

SHA256
19093fcc48678ab892bf332d64905b6e5928bc22d2b0035f1fea3015e29a4a43

SHA512
8af9f5f24629352d44f46d12733762ac57144abf9d03bdcc6280d09956b1ab6d827c69ff5a647d0759cd01732228c10178c75d5f78be2ac053b95e39cdea9fee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
ac45470963a35f7c9e7fc0c0d12e62ec

SHA1
6e8eb903a0a9ae29bcd51ebd9b088d36a6ebe8bf

SHA256
7091bbfc1f15d019ec9bb36303361f212e37f1f43482c70ea475b5215346236c

SHA512
02790d454962ee77019896f7bd8558063a1f717e4f100030eff334ec2424bbf3042661e6f9301c3de9a25bce9f5c9dc2f09015d924496ad30e85d09f8c60df3e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
05bc63194175cadeabde6c72ee07301f

SHA1
9347507804718d3741d6d1e479d097aa4bdb0bf8

SHA256
c54c6ba78d5f87dac23b460fa7ffd898d7955f45a3035c8e95a7cc3ea221f2e8

SHA512
26ba4c230f41db351faf9292050678bb2fb767ea0f77356ad59f6d91e6cc716f0007430d1d392b24b4c0e5789010aa51a12dda6bfa824abc3ba6dfed93cdb9a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
a6fca84947068e834612ccbf320c179a

SHA1
f5e979862b1606313a2cd6dfdafae6fd5fb76806

SHA256
dbca4b32ab3456d4326ad766444bd972b904c2591bfc14931398667a51a668f1

SHA512
c7375d3c3333dda24d592edad39d305e7b597675bf942ddce10a0caf022f9181a6fdb1c3efa997083d3f974467aaaa3b5f88e814c1286432cc927c512586cc64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
4033c27ec002fb889e16b8704e147ceb

SHA1
b75cdbf6096894594b1339e7552aec803a92b1ba

SHA256
bb1e7ca0feca14415be0c5726ccff12f694808a8fe901d5c8d84970a5e8738b4

SHA512
c8703281fd3e25776d79a6f4bc06b830151da0cd9d96dd272af7b30c7e39f19b5936caa3d03128745ee46f64fca911a87050d3b449e8984c9ad93a0bce2c3fd6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
db69d5c34185ca5add114f4ebb5ccf47

SHA1
3a1a4b3a68e0b6b0407c0c7403df63094258f906

SHA256
7446c63145b4d412f4503b4afca486ba7ff2ec63125671cf25d2eb4e72e22f8d

SHA512
5df395d45eae3a114c0da761f416f68db94163e1acfe003e867b04bc58e6f156a0248bb73413d0d50b8008de4e4e8be871c3a42bbf304df45ef3d29028c8b9f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
631b4653d4a82926095de803f93c15dc

SHA1
d2ece15574b57d4bf3017ad7ad2ba8a337241086

SHA256
c9ec27d4e2db2cccec1303ee0b9a994b148fc852826f0be36eebb492262eac00

SHA512
3cc1693de437a71d6aeba76f0cde2804fee7b4e142a8a67f743d512f2a1fe9adcf3f20bae270c43b8cce8310f8490ec452bc8a3d578f90dcc87d4572f5034801

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
f42cd6fe3402c2d9f94b73fe373ea311

SHA1
2f3f4398e5a19b080e122ad68d8a09e952dd256b

SHA256
e1ab62b7e502b946ff468adb83b5a5224c3697479fedeaa5869349e6d6eff95b

SHA512
4b22f2b35ff9596db913d73e9913255f9e867ba89c79c74de3e299175afa5e7be3087490514202a64f8f271c726ea337511b1c7c2c9aa35500de0c77de08ed5e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
b08e097d0bd225cdbe2945b7c99493b9

SHA1
b785e3b0741a9744784adcf5bfffec8435c68e87

SHA256
99c6fcef3ecfed9fa12eae4d48222266768179b263832803bc2ad7be342c0595

SHA512
6c65598a8e1528c59ff70e2a43a5021dca851b83bca4bb2b802098fcaffbf5c6bf82f1e093aebe5cd98e7b18948b07df98d9f888c1532c65007c909e305687f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
3c9b86c21a69e531eff0398b97aa0f84

SHA1
eb70ea8e07ecba92672f141fe8705f8481f6768e

SHA256
8a7a5f631da653f765a0485570d70a4bb08125cf70bcd9bcc2a59ca394b9475c

SHA512
c8173f71e8f6ce9d99940ba6b2a569398790ae6a98ea62f3df10aa1d0da7987e1a944959166e9bbf2ec2dffd42b73c09d6021a4b3d94d23c06b36a8bf2583f52

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
d8b46abf973b67f2be6a422ce759e596

SHA1
99e5c2e0f83fe567a21d9639a752e7f11090ac93

SHA256
5e262b8131b899aebe15ae38fb26a5594cb7591a9c008a530b489854ae11be16

SHA512
510280557f4e86e4d5e2b7b7f3dd60919c58b473dbe69bbd3953543acd9840d2e023b42a3e5225ac4b707c9c5d3c106b62efd284484c2a53300ea471ed38181b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
a0f30839f73f4401b9c1ad1d8c97b983

SHA1
42a85684b561c4b11a2a9a228546f11f7b55e80d

SHA256
239637299bdc2aebea1c6ee39dce7495c9c8825c8dee3d3850804ed83224785f

SHA512
c4bb57654cc1cef3a93f4e5771ca3ae406eff82c93fd3293a583c39dd9989548684cf74ba5b0abb308f4e23f52fb18e727a12b1437c7fa00d527b74fd62cd687

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
4d89c404f424b882f058bc1325b5aaf9

SHA1
eadd46cc3b74103548546de3b03a33c2b167ffa7

SHA256
1fca643c813c643fefb99a969aa64f8e6bd2388748b49240040436d68d54a0f5

SHA512
f75c73da3d2b838ba0b8ebe702b9a8c7687ccc365f671d1892b94b2931933312507cabfac040a14cc66c3d94944925318645f9149e7ed59578760312fbe4c856

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
400b2389d9f78d5f888089b315600952

SHA1
5aad55ff9e28d3a857aad90d09631a9127e161e9

SHA256
c257b637629707cc7cada67e34012d33c8a2b3547c77fbce5e387a9935536ffd

SHA512
2c1162e9d6fef408fef9c5e9b0fa0186dc1f66479949fb9ebb2b3c027dc88c11bf9ace7ac1f1042503f9013aeefcad527624178ef5c7f2c64c3385cf7be610d9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
1d8f92372f120802867e89f405200119

SHA1
204f1c6ab20f92884817fe0e3920b2e99c75e223

SHA256
f4932cba51c3f9939f33fb9ce2d5caade3c2d6a587b421d301a6fe9bc0028506

SHA512
ded4a2c579d8aed9d07cefd326bfd859eb1459438133d96a7621e705cf5b97f34dc965424c3fe6e98380ba63b791ed608b5f4cc9dc6c0d6639795b0edd03beef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
0930139476df5677e44598d586530ab8

SHA1
8b39f605382659348f595c2cd5015e9bd843a43e

SHA256
6c47d5438cd8edf012a60e8caa193cfb5fc61e84aa7f20996bfdfaedb4c9ae6f

SHA512
893b512ce574af54959a90c34ec2044eac31d8016cfca1db8ffd5136154fd5d954ca42488d37572673d4268c099afb6105ff0c32265d486956f5cd3d28d00d0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
7240c6dbe1a3d0eb93394c748dc7d057

SHA1
77505eb8de7f690831f7540363ef50ae78a0129e

SHA256
0b589cdd7090474712211e2162bc30ccdad85663e646c69611d218b1ac0c62e8

SHA512
f0b81aed6aeba800e08058ce54d93ca7970942df0498a6703c5d6d6e04a481ce1c430a7f1a136abc6dc9d0783170e5418cf05dbf953449a0f45b3f6262e9ecb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
6892f0c757c376ee0227652a348c68a1

SHA1
61b68ffb74f5fc52a34f1fcd925a778ca8db65aa

SHA256
48268132b72be6fc06aac731c782d98e815012df0520b8bafea153b8e1a75149

SHA512
72013068dcb0995b0cc927e0a17fe3619402c72ba65fdcbfb82dfaccc4a043dbe91c1bf4978c3543b809d8750a396005b321740b1325a6f515676781b49c7227

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
740a90426c21d4701a8449ff33851d6a

SHA1
f5fed05717917c26b1d237489b7cdd51a18a36c3

SHA256
83f2befe52164c2390089aded60ced729ed2a976ac10c7c19095a382a2dfe26f

SHA512
d8a33f3888547e67959ee9cc454451b89840054031a9c897ebf04424aad88429b71a51b7f042753577609b2ec3dd7470eb706b8a678bd8835a83b76e73a164cb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
fdf84779ec79479407ba360815b590ac

SHA1
a5dffe14dda894412d9ec2a5966486e1c667de1d

SHA256
51161a40831b3c2d63f1942677f69b93bb689a511510d1fc16cbba01ea60e415

SHA512
c602f9c05022ae810b1a644e6ffbb14bc0d05cd462800ccd1b512c70e6a5bca2e4b5f54d666b1341e7ed12fc8ec047d5f977daa0440dde58b23fe4a8ce779cc8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
dbf3ded6b30bde13588a68f5d2ac717f

SHA1
ba43837d84cd13c80a18f8ed2f59be004acbb029

SHA256
1999691f3e1fafe86d14e0c2cea6ebc299a420e9fe880feb342163a9bdafe839

SHA512
a648ca50e97bbfad75ecc103330449d1cc2986b7cd229bedbf7aad5b78f3ae2cfe8478f6ee66af43da2754fcee4b41a44e7628734137066a76d9511fa7236c23

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
e4540bb0021999891f9b000dd2cb29c7

SHA1
b8076729b7338e626d8a6f00c4d1c22aeb34e4fe

SHA256
649aadea885947cd66b59619da969b05632aee426965b54def6d33854e7c74e6

SHA512
bb140d5a5382dc710f52ff25f5a86252064426f93fb830b7d2510702ee4843fb8929c3e0a537a84fab66029e1b2910653e3f524afa9e7eb9d3fb4f0c64168449

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
8ddb9fa07cd93b0d2fdd5aec24cd9218

SHA1
a0f0414079b9d15669d6376edbefc9b4abf9e881

SHA256
61e45a25335b2b2fa61fee8f2d978264b15b20d1c79912a1bead1f56fdfe0101

SHA512
376f7832b091d8d9014b73c25dd7e7203928d5f022aede643cafa896b963f34423e71fdd9bebe6e901db45fa43630b59ec6abac676459419ade6746e5710c4f7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
c5a9a5a56e17555b7cc3541f59cca886

SHA1
e8f16d6b620ff9e0f17aece5d6166966e8ff2a57

SHA256
719668e65491b04712937913d552200fe6a9c8a087e406512e10b36d5a749759

SHA512
4c817311220cdedea05d5340ad831d82a400e3f1e6cb0fc01fea710d17aa47152ccb0fd8547e1df34336b59df72a9c3a0034f422b09faab2829ef366db1bcb55

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
481ebb38ec5409dd696ea0017ed1deaa

SHA1
7062b479f13838518d8f8795c3ebfc8765acc78c

SHA256
42c84dee558c2b3ba3a101955b9341453f48366b14fc34d76fccd02cbffbd09f

SHA512
48c99257f4dd0c66645099c98007f620922c7152c46aa4014b8ba1328c87df790b2f100142db00d7bf67701b4a05839f082a06883cc44a649ac6b2dd9005e8e2

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
21d8a8dda10ecf56c5e42c42b2025c43

SHA1
d966814bc9b40c6e8d7a0ab299a8fc795eae5bbd

SHA256
10b1054249548ef6757fac7311a2fc0d7f7ea5de16d1facc17171bd762723cee

SHA512
ee437ba13fa9a888f44aa7e4158f4deb1107948d72a537fb7c60d659d1ced5e4b7cf704972898557e48be6d457db2d1501a9e90838b573e7f771e41818635d9e

Download Submit
C:\Users\Admin\Documents\InvokeUnprotect.xlsx

Filesize
12KB

MD5
4a0ad665bf72a11a2c0bf505dd3b3e2b

SHA1
b0d1b67c26e688b44e8bc1f3e3490cacac29ab85

SHA256
42af645c1e1638d25cccb1185b2c2b682712db811b9f1b8e76f497af57ce7211

SHA512
19a0f98cbf6448fb0c9c17f58d4933c4826cc03a14ef3c71a5ce7bd50eca18e69ebbbd59b1a80082934631c3ee005a1b237dd30ae323edd0c331f45f43dbf7b2

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
eb083270e62609cb84c1b542d6bcb429

SHA1
a030a269f9ecfd8430f1ad4502c99019f76df336

SHA256
61d8fe8c4445c4e7ced431aff9c9801585658bdfd3faf841bf6cd8552fb34a7d

SHA512
01660aba02b71412b1426c678f3f60df9a77cdefcc606df350dc38a2042754f70da52f5fab98298328585c97af1c00050f8f63bd75c61b59df058eea9e5a3652

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
49B

MD5
a5a992f7b3414999c1be60c59f7f9486

SHA1
1d3ce99ac047cffb3fefb1e31f69cd4e2d9c5c4a

SHA256
c8c744c9b8f6e7d68c9057cab37ff0f7819d9882531cd9b1fab5756bb2934f73

SHA512
3a18a405f9dbc94bd57d799ebbaf409523ccd16b83118e607fe95e46f9f37035102845e40e2c1a66fac4229ebf55947d385e82303ac35107e2a0301ab1ae6a0e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
343c55e2349e709de4795c210d9c5caf

SHA1
21bb5da9e3868692285cc8981edd66c906934b5e

SHA256
7141c0cbf2ef1f344c3b3d97875b8c900c02c662b2525367b79fd7072bacf91c

SHA512
b797d8d5bc441d07aae1400f2035796e3da5f8346a4f5bd0865c29838082966f4af1efbe925f6efbc25d3d8938c990837e77a3a1668be28e7c52cd991906ed80

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
7a5574706804dac0dc7aa67166045994

SHA1
9fb18504b989c2bb339515893cf7e08ccc4dd30a

SHA256
983ed68703f66cd6ab5a5bff72d2cec5bd11be4bc28d9a00b502d8b6261819f6

SHA512
ef3393f0b1ba943ac1e8bc9b1363aa6748c204239e55fec03a6f4041ed2cc184af06851956975d9fda68eda9bc7d382e9b781700d294dee23acc0695da98b071

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
31c667d5bf0501acfb2899e7aa2f0f70

SHA1
81e146c44b3bfbea8389d01acdcef22a8721cb3d

SHA256
afb52c4fc382b004f11532a54eb747f71988985392c5cef3f4412b6dedc7b21a

SHA512
bba842f0c926efa83a71c7542676ec55211cd78470800778dec05bcc74e315214bcee82ea8837dead4fbfe7fd018b317c1441f5f98b8bd38f0482be70d80244d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
7f10137d94d8c562836cd8b61edf66f5

SHA1
d7a3eabc7603c608ad6c3d212dc0f9624de1146a

SHA256
47af7b7d47458ec58c67c75f19c6a8441c4033d362869d7a8d29a69fd774813a

SHA512
ffb22a9e66381d76943bb418b311a26099d025a2167941f93c9efd74d5b9e8b8ea59cb49f16d4ec97ac7f7a9a834a62b13c9b2a22487d529d16761dd2b501f58

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
4b99a877d43c2c42ddc68568d56c0b09

SHA1
3fd8a6e43a640abebffcf7682db0aa11d026dbf7

SHA256
dc49c22112b3a6db935acf53d00aae7ddbc291bea66298625fa8ef2e5b104e16

SHA512
696f7a0b332e49d92312e60c1a94f32ce0f21faf99e73e5e59f324004c8e4b8eb6ae9529a329b3d755dabd5729d4bf3da40d60aecc838413e366c3d69eb00967

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
f53f1e363bc57142a7f87c109ee99050

SHA1
67bef5b25efd27090a2e9e3eff2e81144d41cf79

SHA256
0e60d5935dd9f07550e05f6c43970cbb1d0bc8e7d6da32f6fd40518eeefa69d0

SHA512
26569f9681cb2a212873ab808884fe1554ff1b37698aa2c682a2e45d6943825ca7b1afbe08532810e8039d5cea91e921a0bae911582b37162189b5d909bc9647

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
6b3c4eb937ef757b33ea87075d2f47c2

SHA1
ff8bc3388c8f3dcc681056f48c574e9fa7cef5b6

SHA256
e8fb2104ec333b65ae6423b0f42118436f6ce583269e0fa29986c6cc08250876

SHA512
f246714ef61187ced6c84c9eae4868d544c399b8157db3f32472056c6024e579adc356945cb86e1d98306893c21ede2c5995ca6e971c56f6869a85e46421832d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
309f989aa845850dd1e99890c05704a5

SHA1
6cdcf2683518e9119bf2b6000d85f2ee1a6b8000

SHA256
1265165239ebb25fdba52ede5df7d98a174a160bbc4112ef287e8da278d1f049

SHA512
2e0133d263477ea69f2336a49e6a8fedde10d2e15a363cefa958afb26ef3e823d617ba7e368882bed8951b550e93cf459398537be1446c81a1187c3d66466674

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
caa26e00d126a0db9631abaef7abfbc5

SHA1
0f9a16da8d1efa554d038a6d578878b457201a42

SHA256
05dfa943edb20f5e1a4381845eef239d736db66d31ba92097047471ec74d7ede

SHA512
27332145d03836efb99888941b499dad50016e7cb5bcc285526970d848ad27fe7de398b53e5787b0ee70a0798d5236e13b4e217febf5d1fb328e9d9a892b0275

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
0ab083ee570a828f344fcc2b5e18a6d5

SHA1
95b09c91b07ac1c648a3092d49f8815432ee99f8

SHA256
c488d43aff60dfe6a4bdfa421e34405024a8712ea4957da80818e3fea8e4f975

SHA512
4e3a5ec15f61e4462c42e4070f240119e0a0ba04cecccf7f97d640d8d403b483b321d454270adc44caa1cdc7d0bed06e975d81822f69ad9ba27c2697f3d00aa0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
ed1353f8ab63188a794c39fd8d9941e3

SHA1
b2a2bf17cf19f519e80195f8ee3670284527f02f

SHA256
30e67ed8c10b253209058426266a7bdd94123ad04181102de79a224e61a48862

SHA512
32c4dea9d3cb1e7dfc5825316bb1ce1fd582838f9433200d43b08941cf562246273e529e69178440ae7efa766ab13d975f43789a3e4ddbd23c9dd415dfdc4da9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
ba336e0745452747581bbf3d4a2438b3

SHA1
58c2a9a4888d8258fede8373212cd0624435b745

SHA256
b952ab91702224b1e7fa060eb26649ff808cca931aefe4b69e89fd186e125782

SHA512
377fb814a2cadb12df284e12e9cae8f159a282539fe9e5fcb30a5dbfc71037fcde32d25e9fa8feef22c9b6e7156a96bc948a24b4936bd54963980b0dd901bd66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
87272acda324b1ff670ccb939c330392

SHA1
6a7c506c22a2d79e212715e51ff8e86efb15083d

SHA256
dd556f56bd04b00388f82690f10d87e939243c0528da741d574cd7152451dfbc

SHA512
737846f9a955dbc4d4fac90300306314af7806ef8155b6ac0537ef974f012029477a9ed7a789559a03b367dc36e80355d2e9982ffa12143cdf9d1e01c46f0cd5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
817eb55e6b13ced0939d56268036706f

SHA1
d9e52c6af71ed4573af016189d7624f66db4438b

SHA256
fabda69505ec979799a646592b437779de3fb9dd6740c58351b45900291809ee

SHA512
c562aee47bb12afdf7b6bf0b84a463cb5e7c471e3613ac70f1d1036fc835c7c3c0fcc7f7c603edd88d0e83551db26a3120789313f587cc21cc7a04c6a0fec1a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
edaa4a897ed6f289af966e0b1c6e69fd

SHA1
86f001467d4febede26244b2299c74d36c6ab806

SHA256
1a6a1085d66b30991a65dcba90d69e08de6ffc4d6b89dbd54090b08949301c54

SHA512
a210ead15e51706337ff56906c26d93f4f9248514614c16fbc8ac26355ca30ebcef846933225b732f7cf232dec0c8054e50d776d9a4eb7e9ab2a7e64075caeee

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
1d61dcde05b2e5ee9abd4088e3acc111

SHA1
76f03a52d94f06d1438a08e260beb0e41962bf3f

SHA256
a42fb3ef14d2d2117bbb5a2a1c5c6ca0f9dd630991f160ab47827f18e4b44b31

SHA512
a386676bcf3ac65a5da459500336b1fa934bc4559848098e47712b865c0055f0cfe773467b6d05294aa78b3e155e64f56907066feefce131fd1bc909d2c37560

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
3ffda4097d704187ebd10af3ba0072fb

SHA1
5bc667811f126a59a278492c743f6627916a406f

SHA256
bc816e99224a93bf1478844aef2690d86385ab4bccfc2a3363f179bbc674bb52

SHA512
b3527f94b68c50681da942bb8f258fa5c2271fab785542d533bc029db02108f04d01ec7dae1d74d18b37901a4afb8d0f00ee1a928684b07cddc5421f5d7acb32

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
4ac76080c540734ae097789e91863524

SHA1
608a7f77d815264a29aaacca2d807f16910be1d0

SHA256
bcca634198485b1cf3cf8479c7237f4bd8e1dea73431a2eedd91d0f9d3942ddf

SHA512
48fc8ae167b3b1fdef016e248ce3d8051859e11f4743ba975169748f727638f0ecb133d06b029fe834080ac7086ee29db74ca944c6937a61cef325394de12aee

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
e4bd1ae20985bbfc106f991f16c2c353

SHA1
edef5864655819dc8bb5a0794b1abe81285c61a7

SHA256
886d38d984ed0fff3dcc5dc75ea8cd27d5c14057eb191567703f0b3c3846aad9

SHA512
f4ff850f619a16140071af969fff61fdb37e53c62516d66fb95949f5c28475aac6c9f51c7dc3a0a358b696f4a6fc34bcd63a0aab0a2171fcb77346e2c8a42e3f

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
6bd4d3fcc9614f5042d128765798e45a

SHA1
b33925130a795d9c52768f32e1ccad659e114fc3

SHA256
a28acb3ccf4331b9bf4cf7c5cf062c62ca79b94304cb98b917b4ec67baa59639

SHA512
8c54fcf70c94c031d830474e905ca57f32851899405e86212544a8e8645f202aea2c7c31601cea9805b324cef832beb5e80a1258cbda868aed4e6f90a9648178

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads