ca3de1ceb19213fb7a0f369e779f3eb972c89b352ee87a436e79d6567b24f98c

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Size

12KB
MD5

6eeaa0404f1f4f3ba2f2d6b80daa4471
SHA1

f7cea6726016cba51087377f75d74c6266514a2c
SHA256

ca3de1ceb19213fb7a0f369e779f3eb972c89b352ee87a436e79d6567b24f98c
SHA512

2b9b30dbfeb4b8debdfa4c11a18135151c4308563d7e82a1890c551cac3f4a3e2a0599907a6239deb1fc62c56199002fb8b293a42d3c42b303b033b786ee5c12
SSDEEP

192:Z/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMDS55e:ZebFNw4Pk1itKkpAjjJs6B40WDCe

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2216) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fp5yhPeo6V0DUB9.exe"	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\wd.inf_amd64_neutral_759109899b486d47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_For.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_PSSnapins.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_neutral_49212f5920298e45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin002.inf_amd64_neutral_977d40799168c216\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_cmdletbindingattribute.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_neutral_7a0a0b166f55e1aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Throw.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bth.inf_amd64_neutral_e54666f6a3e5af91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\erofflps.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_neutral_6e97842bb8d9e6a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_neutral_6611a858035bf482\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_neutral_9d0740f32ce81d24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_neutral_d7409fccc5ef4078\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Automatic_Variables.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx006.inf_amd64_neutral_cc725426972d1293\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_wildcards.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_modules.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fdc.inf_amd64_neutral_bbcfca39fdc02275\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ras\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\imekr8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_requires.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_parameters.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock5.inf_amd64_neutral_cadd97421d121ebb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\qd3x64.inf_amd64_neutral_e8903726d63a3f07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_neutral_4443b423d18c3ffc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky306.inf_amd64_ja-jp_97f0de39317f6837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_aliases.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_2.0.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_parameters.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netw5v64.inf_amd64_neutral_a6b778ba802632cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky004.inf_amd64_neutral_5db759db19acd3ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_specialocc_Thumbnail.bmp	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_ButtonGraphic.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_down.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\THMBNAIL.PNG	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right_disable.gif	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\softedges.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_right.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_windy.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\LASER.WAV	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\33.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\PREVIEW.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_hail.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\SectionHeading.jpg	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\3082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Lime\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101861.BMP	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_right.gif	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14829_.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14580_.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIcon.jpg	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mousedown.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\IRIS\PREVIEW.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382958.JPG	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\drag.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\logo.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02750G.GIF	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\msil_system.io.log.resources_b03f5f7f11d50a3a_6.1.7600.16385_de-de_4d131f2a43685c8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..legacyole.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dc27035732ffe791\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-20106_31bf3856ad364e35_6.1.7600.16385_none_51393d2b48111e2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\Help\Help\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\Clip_1080_5sec_10mbps_h264.mp4	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ds-ce-rll.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_3ef098493ce4294a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..tion-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_571b54d35324c6ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_eb9f068d79867b24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_preference_variables.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-fsutil_31bf3856ad364e35_6.1.7600.16385_none_cc3a6a9c514031a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\Gadget_Star_Half.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4a4b188d86270b21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netmyk00.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ffe3cef97b18e5ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_regasm.resources_b03f5f7f11d50a3a_6.1.7600.16385_it-it_6c6c5d3529826387\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-hardware-policy_31bf3856ad364e35_6.1.7601.17514_none_604653a7c0745b40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00010439_31bf3856ad364e35_6.1.7601.17514_none_f6670d2d9f81941a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4500db6c6927212c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..panel-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b93c50773c13ce44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-onlineidcpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ddd395e1e8e85db6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_net44amd.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_398cbec1ca988774\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000453_31bf3856ad364e35_6.1.7600.16385_none_4419b2667d574964\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..itycenter.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fe72a73ade7cf590\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1ce65a8a5424fac2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..rding-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2828f39a6ecfd138\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nlasvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fa3980eb2a11d283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..smenttool.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9728b91b875690eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_presentationcore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b66b6e0d1a3c9d54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8dcb8bb83ef0bc47\settings.html	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..edstorage.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_71755af76007c973\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnca00e.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_19fc3a42da001251\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_wildcards.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_1d6cc00f7f128cc9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-whoami_31bf3856ad364e35_6.1.7600.16385_none_ce52d479e329be32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-resampledmo_31bf3856ad364e35_6.1.7600.16385_none_fb60e757f221f37e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_981164b3f9ab2ac9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-trkwks.resources_31bf3856ad364e35_6.1.7600.16385_en-us_41942cf49c3060e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-mmsys_31bf3856ad364e35_6.1.7601.17514_none_c6ea7a022a2b6909\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-csrsrv.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_2282739ee61d7ea8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_c3afa97fae99bbe4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-shimgvw.resources_31bf3856ad364e35_6.1.7600.16385_en-us_11cb45e722a8368f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-zipfldr.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fc17744762284726\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..ets-clock.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0c889693e4e0f25f\clock.html	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\0010\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..35wpfcomp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1c792e5cadcd4c36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\inf\TAPISRV\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-taskkill.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a2a1edd47287b12e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft.grouppolicy.interop_31bf3856ad364e35_6.1.7601.17514_none_c3e31e3d1b53bd5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_avmx64c.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dbf401ef754f3dd6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..-inputdll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0acafd5f31780a89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_infocard_b77a5c561934e089_6.1.7601.17514_none_583a8c60c0b305a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..untimeapi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ebfecd79b9eecb5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ification.resources_31bf3856ad364e35_6.1.7600.16385_it-it_46603102dd3e440f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiabr009.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d14194710772af5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\play_down.png	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msdt-adm_31bf3856ad364e35_6.1.7600.16385_none_e965a2516d26a704\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-rpc-ping.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dbf3efde2dcc956a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Comparison_Operators.help.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-gdi32_31bf3856ad364e35_6.1.7601.17514_none_c1f959bd9451d7a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..henticationbinaries_31bf3856ad364e35_6.1.7601.17514_none_0844da926677dc8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\ = "CRYPTED!"	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\DefaultIcon	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\shell	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.block\ = "IZFNHUDIZWXVJPH"	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fp5yhPeo6V0DUB9.exe,0"	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\shell\open\command	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\shell\open	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IZFNHUDIZWXVJPH\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fp5yhPeo6V0DUB9.exe"	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.block	6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6eeaa0404f1f4f3ba2f2d6b80daa4471_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
f0d1c97ecec33f3ff9d295c073bb790c

SHA1
d5b3d2e6303a8c56428438a223a8f6f1203b2b40

SHA256
b4b1ff45871d260d6b75140a588f866692644dd7ab44d247dd034e4c7c81d6fd

SHA512
9cdf59b51246517628526bf3bf56a4048b504ba78ca1ef8c42839b87e984dd3f74f1495e921ef0b398bc49b6f38b2eb8e2d8331b27226e5cafb3ff6ade345c96

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
7e6b17ab9ba4e271c0ceea8bf554115c

SHA1
cf552ef860023e3f6928c4d6cbc433ad4026a9db

SHA256
6db5e365fa32587920d0360ac8023b6a39b7adecb4426df3b977f3e1f45446ec

SHA512
a9f048ee0175c3e62c18acda7ed4ef33116d711e6ebcb377dcb30467b080ae5ae19d107f0d7c0fff355a64935a54933298b98e5c3780f660d27cd409a3a160e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
7013372f85d706bd255608ede8ea85dd

SHA1
6edccae97400ad4202cb2e8a2ad6f79e1af8e022

SHA256
7258cb232d0076dd614c0cba2c5e32b1129ea8661ce47e381aa2ed2300d4509f

SHA512
3ca3df0d030ab7bc7d3eb8160e7c17b31df7960b77aeff9bbfd53ca977548366ff258e614e4d6b0f27998510047277b3c3b0e01948acc505bd2684bd02e2ed81

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
c4184a57fc031f877ab431f972ddf89d

SHA1
17b9c32b1076be4ee37a4e48047dbbcf9f418d61

SHA256
7cb2872a9e79fcde4154603d7b8bee90327c5608cc73b5e55f92e6d81f75ff71

SHA512
dfc5bf350e0b1ce996818cc8e4ede7aa5249aa21349b186e5a7e949a300ac8e6d2f9cbac2ebdfdfbca43ab0341ae162ff2076d04bb8cc1e11a4d444b8cce8bce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
c1e8858b519027f712c3311b99eef485

SHA1
989dcd2aa2bbbec1700fd34899c69d81edb1a9f4

SHA256
5b342f10d6a04827e8ab72b446553910ad8785a318d40bf10caa54c7056f2e05

SHA512
dfd531d49475c5b2a307dbe289c3fb72b2db0ce9bde15d2f78ae235849cb6bd3ed59625da8e7aac957769490ef1bf3d549b9526bfeab8bdcf17b15a91a76ba4b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
25b820fd89c698fe90f6a38bd6efcfc7

SHA1
4e525ba9231a6f97cfafe460b84c2ec49468b30a

SHA256
5a6bc13440d967fbb0b45f88709620e31d822aaff268a49a9b7eed782e413bbc

SHA512
238926316bab850896c4dd7c718bba8cc4aaf577214979fa02cb88b10067b548a18b5878363c7bf47e22bd1cf89072b09aedd784730d3b5ab4dbf14120bbc8ca

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
4f601d8832018298d8d616e04ac5d704

SHA1
c02c54246897851ca717779901bbd780ed1e4e66

SHA256
4c2a4a3c89b0c18987ed5d373fadb86da0e1bef584845eb2586c641498b3b065

SHA512
4eb91a3ef0abcda9242320e72de3f263af819c5c3673d578def7a3bd4b462e56e7b546ac0bad61e4ed75020ccedd99d9c55e2851453e3a950fbb51eafdc139b8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
8b544e206b78dfbc71d9b626e700d8b9

SHA1
b7f83cf01909f3d10d37680498ffe620994d8467

SHA256
57e00e48515e96c11e7faf2e155285c789003c354ede276f1e3c18e49b5ebf89

SHA512
f6c52f624b644c8472478f8dc22abcf39bcac97f1ac7617176ee307e08246a51ce5ec9a5cbc2481cadeca1293b21f44d346cf0ba967681bd6b2d69361eeb3f3c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
1662e1cd131b9821aa9db36d91b022fe

SHA1
8f407ff9a43e54b8cd32828c2baa508f01f39b6e

SHA256
039e9d7882807b38a101dbddbc935b00765e0b801083ef9495a592a8ac64f3c1

SHA512
859029c83166fb3d4080357d04e0d88137dc6b366363a44ea0599403bc4781494dcc55810ff9cc6372336af868f66208a18cb45ee9caa1d00bc7108dca93a156

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
9376e50bc90fa15ff4eebf792054df90

SHA1
78397b9cdd2236217840949a9c1905026afee2d3

SHA256
be20722e3a3beb7b3f63be7af6432c14d29156fbd3480d3b4300ea63d540720f

SHA512
80beb75d3845027daaf62768055f228acc7ccbd9648fd18fe5c70694f881306639d17a98af77f99f67b4689b024b6e71a6e8ac2127a0ffc971a6a58ed8e25727

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
b4654df254521cb3cd1d2ca8e1cd2131

SHA1
e51a5f7287896e49d398317b2bcd613510b06463

SHA256
cc99a147a95ba40ff235693aab3ff2c19154277173be190cf075e22b8f3eeaed

SHA512
60ba274fa1638652b9a7d45adceceb7ecd2c460dcc5006669de2adf3cc426048357896b1798f0ae72ccc04c89db6912e10dc6b24d67f26a1f97c816e3b4448c9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
2caf1671d722c1b03fc2fc39c5044579

SHA1
cddfe4411932e17d56f83fe44654a24a29a58d7b

SHA256
7ab84c8aea50a246ea5f3a387350530b43bf284fefddb1828776c29a14f7040c

SHA512
d7af97c4c685e6505151d3fd5c6ea7b32a864af26b443da859b0fa96653028d69a31d9587e00db82b5bb001c82b51fa1946fae93689c9018454d90a22207f66c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
b557135e49e7652751262c90164e9ea5

SHA1
2c2cb57600bf960134543b95590dc160dce805f1

SHA256
2d6929b4536aaf6677aa4a88e59da01f42bb1a8be1464f985a384fcfdd2b2c0e

SHA512
307d86a4d08f25e28d9b0d03ecaade0ec3bf36103facde3a7b4619b453a9bc7a199ca0b462139978358361dcc45c7231ab393a0c7b9cfb0a2bf8d0a0622a5985

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
cb5611552fce36d4ca4cb04844429359

SHA1
7381f0bb5e8546606b4554720d08fe845a32c2af

SHA256
7585e2af48c33a7b654e549b66d9dc2922f188c9a1a535557ef42badb0e34610

SHA512
7763740d7079ad7713c57e50d332043a5731ce0ac0c4e671eaf3b60c4d7b373172aa026edca2dc4db39f04c88266b42e2b46737258b8dd36c970a4e751f5897c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
5dc2433f5ecead11cf360858f476062e

SHA1
9278cd81eeed6063225aaed53de89b72de275cbf

SHA256
a1e030534168883f6b7c0668a374bf639256e46a24e91536338869531d0b088a

SHA512
7d25bb252c4deb27ae5b86339e74945811f1c08f97e0956c2c9d734a61656a62b0eae287216c94885a0a00d95dc0a4bec2fec9b67f387b662bec13189aaa9bcd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
ee56cf4ebee4cce830a89eafe74a8d0d

SHA1
d44881b6366f449e822e60e5570187296fed50eb

SHA256
bc9005254e08c61801237cc1f07630173e9f69d879afaf464230b71942b82c86

SHA512
8e616aaa4e7a0597ee1542733fd21090d4a1fcc86531481ce3b6c68279f3cb015088dccda742f969101af55435e86b2e53ea8ec0831e2b513b42f1df37f12672

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
d8bc437559f5bfe983f01b9a5705d4d2

SHA1
95f973c122c60c17c27b710a7cb8fae9a681a737

SHA256
2061ea8072f51007db90a7f3a3272be6a3572bd73a3c935217e8c3551e327dad

SHA512
3284b5500183f86f45eea6ff55e30c0f1bf4d4456b85072ebd7aa50cfc9753746ae1e182ed1d6162cfac4d3a153d402c41c6c17660bfb4a0224298c22a6e3d66

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
efc6197c84bf44721df5d46849c62c9f

SHA1
345d0569edcdb1ab745b21fb90dca2eda97f64d4

SHA256
a4dddd23c29029f310c17d2062b2126ad95582e29204888599aeb85c7e998043

SHA512
fbb13c859b3e0ee118bbb89685f00a4a29589cca691d910831ef3c1cae8638c4c9c944482d415a6ced6009816a9d20ab728d95037ac45897532fc3550d8eec76

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
dcddf5f678c16053be6d22fb17be4355

SHA1
d66436e22949a72a3410220fdd83818a18e61fd0

SHA256
6f9228056e4c6ca19507416726ce6960579bbe630cabbd8000cc563f8409e9a1

SHA512
2155af4be37e31d5aa093bb97758f648af3e3a103ea8a98ce2c81ca09a420cc7a01a137de6a053a510450da5c3bef269958cfc94f9d9b3970f1995d6b06d20c1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
4b151784abd605d9296463143e282c3e

SHA1
7b6522fdc1ccd12025a4757b14c60b1787e203c8

SHA256
504c54a401f89c64fd0359996ecbf1017a3c9ca67dc2a9b8f168ab65f48ff65c

SHA512
a383e2e250ccc085b400fd03d708263efe45cefb18dcde44ef2880e681dff200f9604cdcf2750be653670a4cb4342c6fd4cde87b898b0a28e20c4614fea6371f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
74fd070bbfb455b03c4526cce2dffc07

SHA1
fb231f3e8a182af46312cb58044973405e886265

SHA256
6e69ff77f8f136b789ecdf57d3ab583313df12fc38e92ac00726900df8d48f25

SHA512
c0a0646a99eee38769f06203d0c27048c95c06c3113c65ee084ada44e6304975b88cbe932c231093191a616c61aa56f2921b380f518bd7f82738869927aa0993

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
b15e7175c61dddca069002e1102856a4

SHA1
2249564e63c64f004330a1401f48fea04f629b99

SHA256
a3a6578b82b008b94a0447b1b35ad78c0db00ae52974314ff07e72b698da93ce

SHA512
9012009fbde3ba954df8a41a4e07aa93ee92ce541328f116c993db6e0ea4323044534d4d4eead5dde120359f39769664aedfb7b1429b8ae74a4c40dae0fbb135

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
06175b79006427f7935442b609344b99

SHA1
b8039cf7f36c59cbeb8c8b3d0aa43c08dbb531a1

SHA256
2c0db2ff4a2079a5402075eb70bbe3eac01d19a5d3289dc62780f44e5944cfdd

SHA512
d81c90818b44efb17bbac01ecf36d93266c10d0ebeecc4136278faa49e0ee91e6c3931475127408fdb3209366ee003b6537869fcaeee7d3e82ef8e5040e712f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
4fe5056805ba38aa587285f0be165de2

SHA1
125de0a7c73d271078d88660f113998cc911f317

SHA256
bdb9cde2e237742014273a976bf97dba21a844e3803d34283e3c4d025f8e2ab9

SHA512
83b29c299c45493dac398ff5a31e20f8e018571a5f0a010aff8ee756a1c0d9e198417e96ff8acd2ee8d01c0ac789cf18ebeb2c215d5c4ca6c436fe8b576b70f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
db1e3c54046970be55dfe1117461e851

SHA1
dc1f7708444f180bbd986a86cadb14a4c4bc2fb9

SHA256
993829afd8ccfab8df96b3972db82f13eb0c3812497f0ebf66eb012d41d46789

SHA512
02dbac1784725d983e90118a399ba4c9dae1f123b759425cded9cb4758c79b9e0cd330c98aa09260c7b56c4fac7a72e57844393317484a4c63a760ab2e0fcd60

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
0306cc771d22385f0384276655b7b08d

SHA1
27e283e9fc768eab8da40071e4554b9501cf9fe0

SHA256
c351a914cb3a796d7837a28ecbdfbfeb9cb5ea8afd26a007fb1404e4434a62bc

SHA512
c4776cc9c5b4c1d3e3e0022af1c9e6e7be81a40c73bf393a11ec5846c169bb9901cee84c41b436b2c07bb7bdb2c83f5ab58da3fd56e124b4a4806b430ac32c6a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
8df46b8c8d88f64673aa7d5b152331ac

SHA1
21807d5a068ab3ca44a58dcec2bd8fd1369469aa

SHA256
e723f830bbde3f769d4c96a682c5485600e3e6126113a132d05d100f2465d64d

SHA512
a24bb95b6760876052d558f8ea7f984421af46f6738aea4fb4b68af06ee960b21515e871f8a9410c870dac803b4f8b1aadf01814af6b219afb6eafa7f1eedb17

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
089af17749242d0085ea928cc8ccf368

SHA1
445399ed6cf90f7cf82cb892ee39bcc7d3023fd1

SHA256
375fc4b324dcf61a2c4a4890fb68d4cd80c83d2296574b025e889a16fc8ae55e

SHA512
5b0d4e894290d986cf0ddc423cfd26df71d1a4b9f72bf9cc5a9e35ade89ab94cb02e1594b6ce1d820245332364af266bdbe8a403d943eafb796d644a20fd786b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
b3be4af8c11fd2c0b9f4141c4320712e

SHA1
ab37c512939a357daa6ef84b64416ab01487d48f

SHA256
c9a0abad63c4341759f40ddf29c1c7a88ae5d9dfa2b0fc3d316e51bbec0c2873

SHA512
14bfb1dcd399b7793c5c6261c9507a8ba3684c08477dd791a20b899bc55234e0b1d53d06b6c889a99da75aa40f262a6ff373d1ca5bb371ab0ea3538dda68681f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
814cdeafcc3d648a823d48daf15733c3

SHA1
f1e80ffb361cfa9b2b9f8592260393b1d507c2c9

SHA256
5743614dc3d7d3da65f54b8e60502d26e19954ab1354b7ef3c237722422610ab

SHA512
b4aa699543994b63aa3c17c45a9a684f1601bdd5c76279c21c401cc21e2270b418389313501823e9a947efb3cf9ffe1d03d3d2df501967a2b0c4bc74196f25f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
71243d1cbb293519b56ad1e5b7bedae8

SHA1
d03856e12589dd62ef2f1dd0aad3b073540891a9

SHA256
17e80399e6e08d89cb41b57188f508c257c46d763cda59fda61a6ddac2206b80

SHA512
d43d642c66738a79f7fb8567bb3881e631013588e76dbcc597ab77245a745559b882c2bde230452b4a6ac3f06f4e1fbabae1215a582ee9b8719eb4bcff684823

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
4a37f479695335fb30a3359b15061232

SHA1
5df882fe28a66428a54e1f5aaad078f91c151ce6

SHA256
e06709a085283dda58875bb42d7b60765693e16cf6034f8aa87ea4131a2daf85

SHA512
afbdd0dd182f70831fa80e7eb3567f720b6f53c062798776eda6df1a89e5610e3a585c8207c8d0ad00af1e6a178cbecbc23a893522f72f972c75ae3a49df7e90

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
5ece40a0b22795a6937531a18f90331e

SHA1
6b735981dcd3395814024c9c5827373abc3c34e6

SHA256
645e52925cc34fa2c643d432a3c820b10c7227f5d6cb138754e60e3a5b6aff0c

SHA512
b926c2f811d7ea62c70125c01205c4a255f6e47f8b6d46f6642310d912798d0fb5e7b6990491b4d088719b94e5d5d1b8e9a962ef183567683fd231de2ace9d09

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
a27c0c0cd27ab7b2c094423429e05e3f

SHA1
141df4d10d62e5abbec7cf7ad2cb03eec67db7ed

SHA256
16d374c95b66202cbbbe993b1f81cf9418668df268abbbf3a0ef1d0bf275acbd

SHA512
a6925d9a49d3650b935c7ef85a3a6e120e03b0f2e715afb642706701b4be9cc8e9de6d2133a8d8c0834d2bc450b3b6f0afae1f477491d0c51a8ebb19b9c52077

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
fb9510c10c545089077c25db881b5c10

SHA1
bb2e305b8dc39731e92e7f3639fca9c2a56a54ef

SHA256
aa4b1f00608469be3a0f0d8326a39963fb82dfbf6f9c4d87ec26cb35f773f15e

SHA512
4655854e3d09f4b9158fa5c2744f7c52b4e13e603e7f4105d8ae3d53a0f9e674c6a93a54ff2b1be6b5a6b5211c676730745388b4961ea8b6f9f5e63ae2dd8db4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
0a32d9c40c0ced18f52fdd6bb0477220

SHA1
0d7df63bbc8beb5526b518272f332126fa80cd2b

SHA256
59dcc4dcd3e669dfa40040d7eee028107f0b2f21f60bd0ca69260a96de5b69e0

SHA512
a0f9cb73ebc190fcd0298a640d1b57a180480278ed28f35a5584a836067c71c4e85dd6617a8b8ea2b30f7b149624a7faa6f2435dbfaaed5d0658dcb9dd290c1e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
e22e37dddb68922f05c18fa4d70ab9c8

SHA1
004c487a08c2f807209ba31c793ba2b52651dd90

SHA256
b424860e1d51c45219d930b866ecd09bf3f1faf07ab08d656d8187ff04ff50cb

SHA512
99b9e46650c7df1d4922d321594d48daa322891adfff33038b256c23dce988d7778613815c1fc25028d5fc2cbbfbe39465af85382d500009cc3fa40dbfb0fdd5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
ff1784fe18b7f883174601f047dfa97a

SHA1
0067453f6ae0b9816c27f0f6b0509b25a5267c52

SHA256
b673ef2cd2676adc4b7810c72afa2ca5f9b27bbfd4c0681595958155d5050731

SHA512
5cc8fdc4b4437590324d584d4fce2c6eac8abeb86427562e946507e1838fcc7eeb7f2941be6672cad2d8c061d9c13bf2c57fabbe2a55eabcd4bd34e0deb90e63

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
5dbfee7d40725e4db989f37d341aa76f

SHA1
778647d21eca8b66973e996de5b94c35c1f1f05d

SHA256
c28c1cc344cb32584ba81178e56cc2ef280a53651b31a79a04337775d4805b4c

SHA512
8a63b86198e7976b59a737d74d5cf6692c441a43bb4a43ac6423c9f47b3c4c6b8fc15b750851fda6b5c61adec681b76e3a01ed108eb5171b253caf29a4dd67f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
869de0a3c36b339642f6b0c9cf841a43

SHA1
54b51b3c309de288d414b026c547058e23c29ff9

SHA256
fb766777eee9750e3ca89279836b46321152c0dffd5937087eb74f8c5ff45bce

SHA512
ec304ad1f69b80ddb6fee460c4aa7db64093619dab42826bc3f271d3ce37760307a7f4591af2648077b92d5d2a2f6bc82fc8d15102b25b9a8e226fc8315fca7c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
fa553d351f83ea046632eca780259914

SHA1
ee3ee777d8ee028026f1ad65c3a266fa911779f7

SHA256
b089064e8b8df710635391cd588d3166f5ae529dd408669f96c3b4d8a26c37e8

SHA512
5bc03b38cd9e425637bc76993f2c245c4a98f7278321ef3a067165e07278f8d4d519388f18b8a3eed23c8357a735078f08317ee04b1dce18315274d876dfad37

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif.block

Filesize
852B

MD5
5568f8ed2309d8e22c3068c6c21312ed

SHA1
a8d96c4a7472ade7b1df56a2ac92107bac821928

SHA256
3b61158e1e3e8db5ef5efe2ed3cbf5b210c5e1fd686c79eccd5a4c29e5a4f6e8

SHA512
2f9af05eb1ad6d430641010e8aa4cbb8846e6cf2cdbadac23dab12404740bc7a8ed6a9cf758231db5d138ae22267a3678c35119888c33f81b4733f35acc2355e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
9a8dec5b0eb0d3b00ffa2e0132634b19

SHA1
acaba7a87a6b5a0a826d426d36a1e52157999642

SHA256
301357bc63d49262c7f9216443952f16565b4611635e8bedb68a3449597bbc79

SHA512
aff1668cf163bd3980a89c754e3689a0a85c528866dfbc49705d4e33382b09b7843bc715e7d9940e73c268ecabed37632909a51076b8246bfa9961a53d61d544

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
fbe7cfe8360350ae818fae27acb7d149

SHA1
aa5f2aca38be34839b81a7b86b9cec04e6d74ec0

SHA256
36d814dbd3c00c58249637c025637957d920305a9697cfb2a798ddfa0d282e5e

SHA512
e8507dda00d353f4ceac18ba2cc5d9a809eae9a1d81b7c71e97dbafd17017a8a6fddb5f5615a8752c443b4fd252c516d79ff345f2f1cb0f40f35d5174920b3a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
0def80c340886a8c13e68c22b9bbe5af

SHA1
b05ff123bc2cbf4735592891bb9fe6a737bcbdb8

SHA256
6363f1e2021fd227bb56f20906dbb35dd8a36859345b6913296515b3fe2699b7

SHA512
b6a4802909e63748d0f13224e5fc7a22127961695299c687a8fe00e0cc106d3d64fb7021d5f77fb722490899412784c9acf43f92cbd0fedeb70864f9bfbd5376

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
87699c491b2f62bda71531b8ffad5084

SHA1
e423877e27f6bd07a9bfd7c2e98ae1b5450c4681

SHA256
729327ac2bbbd95555bbcac01f04f526ede25581581fdbaf0be160ade9d00ff4

SHA512
7abfb03157a38bf61ddfd6bea57926aa631dac408f4f96ffde1074289ff4e952da4e25a5cf490067b4b9517df8ad969992877e399a78cc6109ba9c9d6faf3f80

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
51a2d7afc8a612a8ab4d81f3299fc1ea

SHA1
dab78bef1f1f195ff2c09e758c6a8b6c7a3fe790

SHA256
d78df93c181a04f028b9929652119fff4d826ffcab6cfa6a22c1beeeea9cf3b5

SHA512
d72a143b6f7bfb2eadddebc1124d9ed6cf51be44c04f8822bd15b1f7f5a39e14e08ccc255f02f6877e2529a2481abd1e729c4479d6ea14662e1fddefbe6ad844

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
860b95052d35a6906725453fb1c7c5e6

SHA1
84ce0f054e96b59913d3074c4e53e6a27d06cce0

SHA256
09d84809d97ce78c764eaffcabcbc5d64ebeb51e7747f34e13617860393845a8

SHA512
0ac25ff2405dcba0e5253d00995eef85eb810690f348b60f15c33a70f491fc91c9bf047a4d6a2d221c236c9a9eeebbbd8f1f4c8c7ef7f62749ffdc9f29dbcdc2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
57764e7998375c5500df016e6aedfc8c

SHA1
15b84ccfd698ac72a9c9edf3ad97783e5fa83cb1

SHA256
3a81f9715834ce0ab8f4f5304460e8ba39cea6a7e693e3b9df19f526bf0648fb

SHA512
9fe236728c142bea23f9e3ea097cf6d333ddc631b5efdb59a75fb0c1f17f1a9fb8b141dc19615ac61a18572ad0e5cad9e724ed1b9c9acee2b10ca6dfc8c4495c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
0035e4176d3d6f9971f3bfa7f7f9dd83

SHA1
6b889528a1884ff37a4da1cb33ed29d3a88204da

SHA256
42671a126cd4ce481e364ee0650b290457013df559a6358dd9d7cd3f9262d4e3

SHA512
436dcbf068881b2e126eb6e694f1ddedb1ced820e8ba7835487354b0b222621ef35674c56275cded43ece33ccaa76f8fcbad3c10fc59e1104cb3e4300c8e1bf0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
0c5f3da9f8087e93269ff4841ddccb84

SHA1
accceaa1a2c5e03b798224347f66eaef35544620

SHA256
da6c35c4628c1e2456fa40efe0c2a39efe03c85f32ef6fd3d0e925a5e2a0810d

SHA512
670521bb791247c4dc81ed99e520ab253c0b828247f7b287d3f399436d07899650c82fe5ea0bf5f516df2c482b7a851d8d5a9df7cb89b3507396ef121b925d2f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
70afd2674d14c23ce2cb4a9a3214ca8a

SHA1
b9610c8d6b10d155d3da31c945ed21998efc616f

SHA256
49e46846905a5c7a51cc9358c99fd80e3845c2deb28176296651d20fdf94245d

SHA512
39f5a48c15b0f4d59df593bccf788c4eab8354e1811e7fc57ab54ad64655952f8eb1b79f3f2e387c8caa83678c95c19d59d8326d9dd2e8e5b7045504dfd79bc3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
79f3b493a132adb0a1db61dccadfb345

SHA1
542352e0f3d41607b4142ba14153534128f40ad0

SHA256
6dda341e502e97b3c99cf8d34a8f403e78bab8efa0346d0a82da720dd2f7a07b

SHA512
11d8943e17602c46475a49b0b722119f5c8eee88265c046fd722c683af1018e8602b497d9567982cf2800962b1a4ff875382ba024ec1923335f5828431c9ba40

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
c82f1e6d6339560630aeb00821318fb6

SHA1
43f9d67f0763f5a73699452851851d9340a79a74

SHA256
a953f41fd9941f78889976182e2870f2ca722d31b338d85979ad92f5bbed3e12

SHA512
0a13d74d1f0a17687c769e3b8bf5bd49eec787d8de7d027f87e9a4e6e1dded9be9f53e876847555d7ed48366de1f63464e4d6e26070624fc83ea34e7b2e1e03a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
d7c3d2783d00f74f88092dfb6f93e93a

SHA1
9178d8dc43af9f3ba24b6b6d2b7ce601493eb636

SHA256
e310305f9a22a066901dcdd322ee85cd55b82e1cddd169b022f5072681b46850

SHA512
4b17d4d24f25f192159657b6f59ef3f1b9035e19ddf87185f7f8896088aa0e195abd04174ef16100fbbe2f3d9ce8071f1bb367f929379801cbd325d32523e44b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
189d7ece65bf3fce5e2ddf79af40ec34

SHA1
a02a4def883a341932f4ce2e44102614e3a25a01

SHA256
6ba496f99b6dfb2a3a932916997db427daae1344c9b16ebb9af5ac096372e0ae

SHA512
983d09c7979d89df03e9d4a9c305408b414a6849a75400411533993f7734bb0b0428238833fac29e6749ffc8b09c56f6cdba85bf6d7a69f3ee7a76a318f3e837

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
4ac7ec82c3ce1b752369aa209d93b3af

SHA1
f61e652a5c45b3dc33b2bd653414ffefc4a9ad18

SHA256
a7a9bce37045d72a96035eba6b1b522259691778feb326769c2df291fb98b301

SHA512
748b0600a4bc8f8be425638d13ddbae48dc6531a6bad41cc0402516c1584f72124bc08edeb3356c9495c78b11404a05ef0dad07126769b22fe0483544591114b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
98ef087c2409f96b6647fa58d180166b

SHA1
229a0bafb1c7e22e07a4710c08b92a7e132aa2d6

SHA256
e2d5871c8ca0c1d0df42aaadaa5bbc2a3f531aea22bc9b3dd5dba0279ecab4b8

SHA512
55c6ee631c490545ef073a8c28519d2c8e725a797cf8019c0cccc78e54e8c3390a658c404fb34c177be62e45b11c986a28b8d6e9cd8796fa4af029346ad8ede1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
b2207e72ff53b593d4b7546afeb612ae

SHA1
65e9d16b1b11ed90d4ca67919173c2d29232063e

SHA256
70c422b4d26501bbd12d9d0cbaba9afcae195c049064fe7598af1e3a6c91851f

SHA512
ed3eb43070ebd0e9f9c16711e425cad81cd28fd3279b9246a76776f9ac2d9c17206361987823c6c549fa38715414aef86460a69e820da586bbe76d57c7cf0658

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
65e5862fc40d79eda53fb82e7a97f12b

SHA1
4a16b66f6a24e52e3ede7814c949df160301aaba

SHA256
1c14bec75ab24471544d07d3adf124dad7c39ac0e619bc29a128ff08c390a369

SHA512
34774a22711bbc3a58aac12e0644c0a29b1c201983c8c385664fbc4c8aebb2f0a4d3105204fd6ac4a496958a800517201aed510495e0f26d5d68363e1381b260

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
e6b28cccd9d077e04e42d3b23cd01700

SHA1
b5f9be433b32d19d4211ceb6f07b5bb9c361f199

SHA256
77e0f66ff55d3ad1db82038218eaea8e4cbce71d20fb77ff0a7eea868e1dceab

SHA512
d824ae38028954e7975b7f4130d0e22c8c5bea73a5f5f28183c07c0f61ec25f782d9dc761651a543204c369caf5573c39b725365423d0e9928fdb2bcefef5357

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
1d43572b159a284075713107809fe9f6

SHA1
6227e13493141b50183c0e29b5eef51b9f923e66

SHA256
543b2827464317654b9ffbdd8d293480c63681d0530b7296b7ce7816883bdc4e

SHA512
df5046cd6155350db0e3be0bee7da09b58ed25434cc74f011fbfdd76ffb9376c06812595c090085c2015623ac0523dfc5076795a99a4addb1cac4e571d8bd573

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
d34ca08b0f72f1909d7816a43cfe94b5

SHA1
4cf6f38ef799635e358283646b07ca0dbcdbb232

SHA256
e266c56f73aa2d766087181ab1b6d85b83c6e4a7abeb74620a6fd41fb9e70524

SHA512
113642bf6ab744cfdb71611981f2d7d61b9c1d18c7cf0ff2059f53b885253cf1119c9eac9c52d74589d21560897beaf3bdc1fe2d5f0d5905aa5d55869c7af7b8

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
8a036e8d7faa45c9e76d2b7b359b6161

SHA1
b88944ffba76adc523e4c09e0e14a1413775b5e7

SHA256
b2f991b2e3265e070d2c1df73d724038fdfc1230aa76d09ffac2251fac83a307

SHA512
b7a4a9a18535aa3212cc3bce87f648d25ecda6bf8aee1fc02d6261104081e67569c0d56f77ae3f52c4f08db87943247a7d02e3aab63f6bf3d9bc998b383acc77

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
f94c7b25eb694dd5bdfa617fbfa38ee3

SHA1
f63e8bbb257e0443070865d2dbe31690e976115b

SHA256
9ed573d857a047d04af00666ef4c38cc1cf21374b6774995294821248cfae3e8

SHA512
51a9a24260beb52bae731bdfde7efcd48d672cd33f46787c35cfa8b38e6340ef076fa6f25a7fef848193ad417a2d5cb490cc756902895c35ec0b97303b31aa0e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
d7a01bf076c6d87836f890d35e27eb8d

SHA1
5d0d14700fd4e826b7fdfc1bf3fe5eb9ec384629

SHA256
5bd561f60c3d65ef163edce7d31c376a06594a59a606db9ca502e4d66d33ee89

SHA512
7be7cac94e31a57c5cf6b60db564fbe79ec009b0626ac6419b8acfd5363df0532ee58daffee9f12d2c56b0ee4aa6f05e83782eee3fc9569d22d67fedd12ba9be

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
e99cd4dc8c748696f216f0d06f0c8584

SHA1
b544f0598c64bf9fe86db07fded378e682839d2a

SHA256
e373577eee34db3414b103f0257c5d9cc545abbf64c34445d32b7082d3058fda

SHA512
dc67785eefbfe8c7726d3a0f1180591341461d0c690c2871c5da0e45007c8c16e8262845f0b024a1a82516c363f74db7d6ee7deb104b8bf364cb6e3c592c85b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
7a39da52559cf68041cc43671d425a73

SHA1
fdc8a23ee33975026a632c96c8020c626a4868d7

SHA256
f4b879f0a461197ba589896fd7e9c9f3c33b03306eb906d8730619b5af28ddbe

SHA512
e61843ab45a51826d8e457a746691dbd824cb8f5321799011945451bba947bb91829cbf5b3d4e8e158842c9677b48363a71916154149da749656ef4152c4b131

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
fc2ab923312c8d6cc21b686bdc24f95f

SHA1
27b958881d51e9d008976c3cf49f5a019f3ad5b9

SHA256
fd6c5c5512c13ee183c340bae62d8462ca6a061716ef8ec5e2d6422959509099

SHA512
a22f99df19057c4bd09679037dc3aead1af4cd60200acf7da8fd26f8b2e599148098b7aa75b011a4c08c21601dee6eafa915300f209662bf2b3378de39fff89b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
e57d0ccb65d4d69e35168103deec1abb

SHA1
114ccf1e7a82e118edb2ae0e33f9da500cab15ff

SHA256
441165ce0e713952fa7f92e7b3e7a139befb4af7909d14df314746982a116384

SHA512
b3e503a005e3914f643b07581e086c8be936b2f9374b5ced164ff829364689512c964afb8471669f19a79f58581c79da2ca828eb1153ef11b2a4da59db7042ba

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
75110233c18c90ee80fc3826796e9761

SHA1
2c1efcb9caa788e1ef8c1ff207f10bd7a35a71a1

SHA256
1fab2f11807aa4e5cbdeef6f31a3db0e56729314ac11774ac52c147635a041e9

SHA512
7ecd9ba909c0d75cdd123ef7f500ffaf6e169664805a602b483c55061ca198526a19c416ca7229a1352f6a115cfe54f93919ef35f19f13001744b5d41de86041

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
a20dfe1276c3f7a39631b663a68315e4

SHA1
6676e803cb755356e2f2341e31a00ebcdfdd1623

SHA256
2360c70641605e221ed8757ac1028facb4a6e3afd0faa222ba3a128c10452b82

SHA512
6dfee0fa1d4af1564efb43497ae47bf27ab4a4416e416c87d07dc79af00270a3f1b6ed713599bafed88d0e580925bee6d7a7ed9f2897baa8521bea0a68bb277a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
f41dfc747b06645a92b2845af6856492

SHA1
503a48344904dba6073b3ffb8e4f273b18113684

SHA256
8685a7a365d495ac447d7998060395fe8587da8ae96690ba736740d582ef2e8e

SHA512
25e3743a18b7ecbe439bd38c4d22f2cfe3fae86516b2eb9531c71319933504137afb22bd8d8b6cb4e5ea66e295dea7f66aad6cb5dab9d47336e6146e476fffb9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
339efb284fbf45dea86a994a3aa1be54

SHA1
5489718e260857e3690bfd477f94027e20ee0535

SHA256
a10a7b191982c470cc1910dbacb4c07e2e275a6e45abc8f41391c8052b302ee9

SHA512
3a77f0beebd4d45d4f6a35751f6a802b4050ffed691eea824db0f81df04af2dd270660c83cc7a5ce01437f31675ba018ec6e32ccec4f034291a32a2ec0195c6f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
26e9e7951fd645d2a7c8eab0caa0dda2

SHA1
c9bf7b6d36c2b4e7ced09d97a4b883031095c0a9

SHA256
f58ef88e5420430aafc1662e8362f3ce59541444cb41e512a21e55158373675d

SHA512
a3e1ebaed08e878d52c9a6366055256e637b8364585cb97d9d034591ef661b9fc83a08493b283bf658f2b7dce72c70e76ebdc356c4c3ea69801e52e22a2397c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
ef2bbbf72d1dead6d13df18eda784ad2

SHA1
c68724083f8495f0af7d47b7cd366ca50f56574d

SHA256
18ac85ec42324d151fe244678ad5c655ac1e73ffcf44070bfc6cd0c6a9f1527f

SHA512
d3b66a7a418e6b43d2647ce969a00cc24cef6aa56adf2a28845b403573e402fa7b1102ca5f9f740c45eee9351514408cb3f4c5a30970f3a9a22b9fd077193f26

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
101a5996b94e53dae33b8e27736c7d49

SHA1
4d3e56661dd168a9024b8277ce2d4603b1307b8e

SHA256
883628b3e74b936ab056eeb69cf45372020930429438dd9b0ab249c12ba94ce8

SHA512
45783bd81cf15f5e83a8f08cb2b4f2941b7cb3c039520c72b458ef26336c19288090b673980963b5739840b84dbb5ce5374b6d65c6990890e5cffd0e424c46a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
bf679f9e817f416ca66600e1ed0ab9c1

SHA1
85664308e55e115a1bda7427445267847fb96433

SHA256
6af7b1a51e8901b5c3303b3ff491ce2816267954c653bb441eaa6659884f00cb

SHA512
5848f3e86f22c83a1033964ff3a716edad8f150fcd4956c9f75c7ccfba861e1ceb309b1714f52e278fbb7f1dfa07e2e955929eb40f7586a720503e7bb268e63f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
a05d9a5d85f78cbaf56078b07d51e1f5

SHA1
7646c30fed9a2bbf14ad2ab5e567e783995edae2

SHA256
5a99c6920657d60b22564fea98be21137c662acaefd445450dd67393e641235f

SHA512
c5ca88fe425dc9f7620268917bb403d233219da8eea9f6ca8348686755b899dd96a1067be03779b9072d5ef76a73e194e46558faf3a679c8699fd8a09862bd54

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads