xorist | b8868d9b80874e8841ca97766a4dea8200553c1f86b57d143b092c22697945e2

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Size

39KB
MD5

994c8cd78ade26404561afe1bac27f5a
SHA1

9607890068a1efc39ea7d23a3747dea70ed79655
SHA256

b8868d9b80874e8841ca97766a4dea8200553c1f86b57d143b092c22697945e2
SHA512

d02f4525031951cbc9ed9e3d6010e3f7fd4b48dd542a51d4ae5465115dfa5e41b90cca6c210e05c5aa616d05d0262ba5cf88e88f642c0b612a3ea55bb125c0ed
SSDEEP

384:cebFNw4Pk1itKkpAjjalr2DydqYvjS3kDCgSkAMB:c0FmBkpKjQkY7fDC0V

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2624-7994-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2624-9119-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

Drops startup file 1 IoCs

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LVKrw1gGpie4Aim.exe"	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Throw.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Comment_Based_Help.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttte.inf_amd64_neutral_16d100fb6ba2e40f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_hash_tables.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_jobs.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_neutral_f77725472d91b1d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_neutral_65ab84e9830f6f4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\imekr8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_hash_tables.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_neutral_12aaf5742a9969da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_objects.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Foreach.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_operators.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_script_internationalization.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sffdisk.inf_amd64_neutral_d2425e60845d17d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_objects.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Variables.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_neutral_1874f16002601f78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_neutral_4c228493af8567bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMESC5\applets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Continue.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_wildcards.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cxfalcon_ibv64.inf_amd64_neutral_d065aec3fcf4ec4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc664.inf_amd64_neutral_673d3dfb961e9b17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc0.inf_amd64_neutral_c24bcc939e6dfc23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdvgwddm.inf_amd64_neutral_dd691eae66f3032d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\about_BITS_Cmdlets.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_prompts.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1kx64.inf_amd64_neutral_1f62482fbb9e52a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0009\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2624-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2624-7994-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2624-9119-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ado\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01751_.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Library\SOLVER\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Form.zip	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMaskRTL.bmp	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_SelectionSubpicture.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01253_.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21303_.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10256_.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14710_.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR26F.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ADD.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6B.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR38F.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_left.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\25.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\Windows Journal\Templates\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\ALARM.WAV	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImageMask.bmp	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01247U.BMP	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\47.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01242_.GIF	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-cryptsvc-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d668ed3da68376c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ngine-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_92ae7bc7fccaab93\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnca00f.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5db44e360374aa3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..legacyole.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dc27035732ffe791\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_17013cbdbd7efe45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnlx00v.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ad4ac6158ec3af55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationBuildTa#\c0a8f3f379d7a62a032783cc4e04a4dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmbr006.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7737d227a0161a7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..sh-helper.resources_31bf3856ad364e35_6.1.7601.17514_en-us_6e53e888c0db38ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smartcardksp_31bf3856ad364e35_6.1.7601.17514_none_1416746c99f84fc0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cryptxml.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6c3dcc9d051bd1d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\Boot\PCAT\zh-HK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\inf\usbhub\0000\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..dlinetool.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a8567c41ca9a8cc1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\1.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_desktop_shell-search-srchadmin.resources_31bf3856ad364e35_7.0.7600.16385_it-it_0d0562f18d10755a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-medexp2.resources_31bf3856ad364e35_6.1.7600.16385_it-it_54b27470cf0113a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..edirector.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_58e8b1bdbfaa569d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_rawsilo.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a026d78a5b0b2e88\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.managementconsole.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_a724e6819edbc021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-vgx_31bf3856ad364e35_11.2.9600.16428_none_cf8e2478fdc92928\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e121001d2df929ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ive-blackbox-driver_31bf3856ad364e35_6.1.7600.16385_none_656773dac187bca2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_06a50238f37ce6dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-eventcreate.resources_31bf3856ad364e35_6.1.7600.16385_es-es_181808c228b5f879\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-healthcenter.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eef450c9582e4bfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..s-service.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b44416c7e9e09699\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ces-theme.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2df1d63c5b9f964e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wsdscdrv.inf_31bf3856ad364e35_6.1.7600.16385_none_2c33389ae33260ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\inf\MSDTC Bridge 4.0.0.0\0009\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rasapi_31bf3856ad364e35_6.1.7601.17514_none_cb5d84d96624bcbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_de-de_34a4f72aa1dd0bf7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_srpuxnativesnapin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_dd46e0fcdc432842\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iis-adsicompatibility_31bf3856ad364e35_6.1.7600.16385_none_439022b0fb0c8466\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\settings_box_top.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..tional-codepage-708_31bf3856ad364e35_6.1.7600.16385_none_cec3ab1cfc826848\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_tr-tr_4c9a1ccb0f799b38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-getuname.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1d305cd009b24d39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mspaint.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bc3d05c5f545b326\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-photoacquire.resources_31bf3856ad364e35_6.1.7600.16385_de-de_391ee1fb79b65b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-keyiso.resources_31bf3856ad364e35_6.1.7600.16385_en-us_667ff2e88dc1b9c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-babygirl_31bf3856ad364e35_6.1.7600.16385_none_b2bd01695c9021fd\16_9-frame-highlight.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..vices-configbackend_31bf3856ad364e35_6.1.7600.16385_none_d66b4dbb52eb8cae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Calligraphy\Windows User Account Control.wav	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\38.png	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ehstor-api.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ad5a7223ef097d7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-fontview.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d3e26e65ef2564ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_miguicontrols.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c4e9124dc5d37d42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\Column.bmp	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5e6a23443d69bea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmhayes.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8f77064e151b8495\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..cy-engine.resources_31bf3856ad364e35_6.1.7600.16385_en-us_21bf86a74f104022\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..xtensions.resources_31bf3856ad364e35_6.1.7600.16385_de-de_505b0e4404119781\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-appwiz.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8c81a76a2858632d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Windows_PowerShell_ISE.help.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-upnpssdp_31bf3856ad364e35_6.1.7600.16385_none_e6130ee51f4a1257\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ehome-services-ehsched_31bf3856ad364e35_6.1.7600.16385_none_0167f08155bf1c81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..store-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7be3a24301ca4901\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e59f39d49b771384\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

Modifies registry class 10 IoCs

Processes:

994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\shell\open	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\ = "CRYPTED!"	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\DefaultIcon	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LVKrw1gGpie4Aim.exe,0"	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\shell\open\command	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\shell	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GKWFVSVTOVYMISB\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LVKrw1gGpie4Aim.exe"	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "GKWFVSVTOVYMISB"	994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\994c8cd78ade26404561afe1bac27f5a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
6d933852dffac2af4f7dd5e1968f2390

SHA1
c127dbc532b11efa1ca07c5c563e33c4641aef9b

SHA256
526821bbe177aa1c54a70bd8c8bcdbcf442f109638fe9fd1c62fe03c7fef86d7

SHA512
f0c4a0ad2ad90c334130c086fa064b646aaadc1d3d91005dea524d124c6ec40a0b3900a54826a4a57c8f821cc5011717824145d935f9a433600f0325afb4d57c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
a9acd487d192dca8664deb3521fba723

SHA1
66ae9cf6e3567a546a5d984ef510daaa13daf62b

SHA256
ff0106d7341f6c9e0d260728d786961b049f758691990c9169d537ee40aa6d8c

SHA512
5422f561563fd07d7cd8580cf7d8594b00b932f2781c3e808f9913f8739520e1944d439f7df7287c5dacdd7b4eeee87d170e05594ccecb8941b1e72fa76d06d5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
56f8f83210b2d039ac24b87817fbc53b

SHA1
b89230f7bf8181ce914fb89a8eb3f976c93b16d3

SHA256
2aab9fd75985b6805d2160e484b9544b0fda37c27c9d46660a4a2aed16c608b5

SHA512
f4d7c773a0c919e4f3d201cc254e0fedb1caf506318c61290058973617d428fdd3cd584542a4713f4a235c16a4f5bf97577cf4c55d072af8de6af5964ab32f29

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
663215a5db0ed8145eafd907e4003c44

SHA1
a4a95f49a7b1b26e82984dfdd0c9c2a4b52041b5

SHA256
dc9dc35a7f2853a99c3e22ba7d40ccdbcf79ed73e9530013193b1e2daa654762

SHA512
c8583c75af8f14fe254877f5645faa812f6eee1f1a9b4cbd631c507fc3e46ea7f3be12f06620034e6f8739b9e7d07c4f5ea16d384b0cdf61f9fbfe030fbe9d69

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
e6470f94fa154011941435783e4c7e4c

SHA1
435abfa7587668736353a6772c5c0d9e99ccce49

SHA256
2026678fdbda264e4dcf625d17bbe23aa5392514d010edc08aeebda0c25e2e84

SHA512
d0a91360a944553b9ad56633ab5d26fd37eafa00d58320981470bd57aaf7b4724477cecbd447f786636282276d9332ece8ce27ab84eb95910fb286f00093a982

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
c99ce82c1c35debb66fbd4033e471d2a

SHA1
0f84db3a69fe6731444406074171d2b666d80aa6

SHA256
a1f53cf7f801768a190b2fa0bb96619cfd9873da6051c764092784b10d4a591c

SHA512
7b511aad9c7d05c6a1fb3116243b3c653466327d6940c70950c35f47c5b8c7a1d707a5e31f2f1ad0e168c96e52546cfc62077702a66bae4b6993d22ba829c790

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
b1ef5baac52ee1f2522c6d2c0129affe

SHA1
69819344de21fcc33a02886732bee7eb6422540b

SHA256
d4f1116273b436d862838368d7cf7df3ff2105019905570917264132a1283d5b

SHA512
1e180b33501627f4d54c3887a3d1c5761b4967b9b1ff96912696ec3d828b6bef93373f1a6a33a263a9c044ac16d2c9acd645d851bef1a06498211c1b966bb00d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
dfedcfdfc28ddfc37188aab031ed072e

SHA1
7aa1fbb3e55eb11446d564650a5b22d53bbf1d9c

SHA256
01ad3229bbabd1b920ea8b3f31883b1d9e327f24305530b920467772a54ab023

SHA512
09e37903d794c81f140e1c441bf742e36e290518098550a6f036df38936c9916f2b7512896156f77ef3bae93068bb4b31bdfb41f9a37627d9428fb7a2a49d011

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
2c5881faa7f51b0755052cfcab757e08

SHA1
f6a6dfe6992381e40b628a6a9966431d48483da5

SHA256
b151097854167ab639d1b76079d430c57439a27a4e0a68dd18bad231f39c0736

SHA512
229f9934e3fd2e40cb93275e19bae7202af8793499f20f7adf68dc7c2986299acb389a8dfcf7bb0a11ecd6b82915b0960a22294f425c8748192d864a28040c2f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
48207db5f8dfcdab9a4525953fcfe9e1

SHA1
dcacc87aa620cb65768361542a4a3911f20293d6

SHA256
91c952e47c1f8759039568f44970496835ebeb16ec05c68a41ad1fc536f5c238

SHA512
50886c566c0a25060ab47cb3ec4867653b04a459e90c2c6fc0c3f7eea9ad3039c2fe15eab71aa93335fed6812c67cd4d335c31d43f14b87a660b77ee2b3fa750

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
6e60ef81e01dcd99a14d24747cb25154

SHA1
de22741c9bb857b97b3142c4df4b4215859513d6

SHA256
45d86577574b23bc8b3fed208800a57ede12c1cb10b6ad82d20453f4a04d9df1

SHA512
00ca8953a4c848bea203050258c50471ac52d5f840dd3c9f21e800c1d4b30a910412ae025c126e7a4f226c7e34ea494740e750a70c7c3fd532ca22a26453ded1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
0b726bc713661f2c362b09bcbaaddafa

SHA1
225e1a2042c6811d97e15f7ff6c7e55d2e032f89

SHA256
5e8fbd833e6746a399622bf59d0053b9426005c50f83da962f68fe36840e963a

SHA512
8c1a98453349927ce5b9ef8eeed553d2043fd38aa76a21bd020ade005ec204b3c8a9ae949495d8a968745f0a6b4e32a878b62a5cebf57dbafaed76b721e0f2f5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
6f0d64c0da84c21eb667a4d1b4ea2bbe

SHA1
47c1450c89687115ac7be6f6e142dee00071e73a

SHA256
c5a92425990425ee8f21851d7f6f4b19eb53b75d6b259943aa28211121cdb095

SHA512
c9a7b39b1e4c837be0405ae3090da48239daa75dc67c4db3d677b77210cc0246b29e88f8ef4bbe7126424ac64ac8617cb9cce1cc63b49389ece114f7fe363484

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
378299bbfc086de8b3fcf88b2f3f692c

SHA1
5915093418cbb7de8d482ace0c5a0ae2ae990064

SHA256
f5b6c021bb4bfc4659636a3775b59e8f8aea73db6bc7300ba0c7b68a92f2162e

SHA512
4bb3fd799ddb8472f2dd49d6ac8b3ec658c536b0ea0a7789fedbac8aa037e86436f9cd4b993eb49fa752911f6b144335c068834e3ac5f9c35b6bf321e2985b4d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
154989ea498167554ca0270389a49d04

SHA1
3b9d174d4e6024486e095fb2e45f1466eb8946ab

SHA256
88caf06fba93dc73461675016339d893816a1221b7d904d3d211370e56976f2c

SHA512
a11233fa0072635ed564266bf8e30e2643e52e28cc4fe3e00c431d3f65f9b9f54fc6bdea7680517a095a1efc5bd23857f7123ffa52d50ea2a5a0c24ea071a2ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
5957060129d5309c8c6c3c7db7b5745a

SHA1
d203b8bc1b4d00c915b9d9e7fc2bb365df978f72

SHA256
dbb8a30de52227ae3303e6c06df4ed48a8a1263e157f3433acf3dc332e53c2d0

SHA512
9c12fd47d7e7dc2f957840eb2c04febae7773bde489bbb8307b1ec3e3603ba499a04823754a82e3a78385de9960e89895b3100e8fbc350ff96e8a34247515e53

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
b70922cb74849fb8b757ea7573e28ed7

SHA1
a214109b4ab854e390c774f8dceb9e9ea7450d2e

SHA256
4c3c8f15b4fb1ba1c386237a9110dc3cce8ae7442b030ac246ee96a22c273a3b

SHA512
d75e1dd863bff7a4edcf60df42cfa33c153a268f29105886390011a32c78a222269135ce597ea2dbc897f6bf5098c012c1a35bb84f882adc60273d61506ea132

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
a5ace4cc78360e27c63ab3ab36583263

SHA1
13d9ee5612b8cca9669ce27fa9e4752a5a6e301c

SHA256
67a997a5b183b79f28dab6176f643959090796c4029c65fc3e4e95babb92f40d

SHA512
0aae6079afe12b2405362c9fd2352dedac2ed58aec44831a3216ac21c17eecda85a9e95993dfc250a8abd36421d0fff9ceea46e5f8d51f3926aa6b8a9443184a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
ebbc52f6aa4ade8d90a3d7f5705c6d7d

SHA1
ffe98f2f921a888b1b71e41de10465a78b612ef0

SHA256
aaa78e2d76af7b0827a05dcfc8ad27c42f1b47dee6728c0aecac720348a06038

SHA512
40d08aa12321cca64ace71ac8c789fe889eaaf6a1877b5a73ff005b0a1d94f8ad320601315f7a6acfdb738c7f542881a8478508ace349a2a5bbb4c17b3de48bf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
38d28bbbb76250134c65c503734ae07e

SHA1
3df71bba9915d93d0f18377d6d2706163ee9def3

SHA256
0611a86fbe950f771a4dc8f59bb750fdeae0e9ae11423e84d1a8ad5b3e3327bc

SHA512
37620dfb1ac0062720978b43a1259afb1adb53a4380add5ecb7905dbeaca1e9102f167f118a017f351335604d9dabe944be342cc37d1bf5bbde97d6bd0eec3e3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
c0ddc639a02f85464755e26141d34068

SHA1
070b16d318290f8378ab9e1634afb0fce6c43dde

SHA256
b7552050571bc064a6e1c6bc6c0334156984e81d5e217c9d785192627a18bbba

SHA512
cbd9369d5f2dc17ff904cf283f0f2de0ebb73950332f43dc18fb8346d92176eb2c4e2d099fd61afcf41b4274aeba98f08e10f529a3de6c590a19383fd8f60761

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
e379f01727249e0a1a71231cbd994599

SHA1
4d2be164b505b08bcd15efbf5e6c15394c1014ab

SHA256
95cfbf6cce373a2da1e023ed04148141b617026ba3be8efc4977245daaae0d68

SHA512
7343c6c6c198fc16719cc40d0a582a1636ec03c9519f6bfc4654a2d567b481841c1356cc947c3fc7a15d41a4bdf8e068b54cd4fa62d01ef1b6be3f1926ea9570

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
fe43a30bb0c954ac5d1babb37847623f

SHA1
1d1bba3d93cd7b6ea8cabfdb11dc2444d98439dd

SHA256
896c8f232615bc21c41fdaca9877ed94ef640676f71dce2ed20f99075893e6cc

SHA512
0d88e1eb5381491ad4f3bcabc00316f63d8f58ebed94d1495904bd8d02161655714a63e7c257c753f13b7721c4592dfee874d34272adfe4681ca80b423d01ee1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
faed17344404429e264b4d71c60305c1

SHA1
86a2b8652aaafb34fc32b9533d28b93a6c95ddb1

SHA256
1fc833319512f86586461a1a6899aa6a2992c43d0e94ba08d6764a42a3d6b711

SHA512
eafe1710f8f55628d44c2ab9b07073b2b282e3e3af3b495bb24882b1c7c5a569f9e36f33b46f44ef3b7ee7fdc4affa246c7c88c0a4bbd29b0d67a0848973575f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
57315a4bc73213d86bbee92790b147e1

SHA1
a3f1522cf8337d9f168e035ea87a8f3d2fb39b94

SHA256
01d630d05897a9182cc3b6c730c21039d484c0b12f5ea28f7e4adf1bf6878671

SHA512
c71a223bbeb8bf8f74f745e893ba7355033bd99dd53fdc83827cfcb982634447b96089e2a7c235640c7420f56d0105706b76be0f3d71eb0a8e7fd7693227c027

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
e3f5834029997535fdc5e44b00c729ed

SHA1
afd541f92f85bff9b9ddd554a168e0bf46cb836c

SHA256
53d2718ef13e9ea314ca20e1cf022dcf10da0fe7170504230b87cbaa0436baaf

SHA512
5766e55e13b2f76a43b313777fbd546f3d767f8e488aa25949c7d66f02a59f3ff6c70c608ddda73a7f19001bcad35d821d29ba16f237b0f896e5d49459993ef8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
20c0681d43875e1d9bb27480667ecdb2

SHA1
bfd80ef6a66ce3c4ceebf3c0078eaba8fb0ca50c

SHA256
02370d1070c62b118ab9c0de5f92fbf65c799215142512e4881df3c2fe1e1cc0

SHA512
b2b9258da7a746d9f86b11441f9fb06898e5e77de60dcf4aaa71fdf72103c8ff01a09908632572893749e2e6aac26435cafe0819c6ba85f1bb60f121ea606608

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
7a05f5018bc3cddb1894cfd052b52f7e

SHA1
b43f671ca05df8d37859fe9d2d6492b9f4c5b0a7

SHA256
b5cb3992e4308df98dbb5e500575f2842066819db4f232622d73875e590fc21e

SHA512
a596b5a5231fb7df4cd848c04a27b54285fe687f7e0d7d3dd6cd56bd331976f3732ee566339e306ff4d7ef1d783b0b93b3dd244f798d4593f836f798ed0dcd1b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
e256185e3211630bb33cb30f0d48e034

SHA1
95610be6ba615049d07c2538682004803275723a

SHA256
3404d4b089975e53130ec2653b4cf2168473ab21d20fd635432445d8422d42ac

SHA512
a30756146e1f397ec4dae3dc5de9f8f523f195ee33e218acb7d916abe370f359786dd9b0f1261ec33eecbf1603dd3999aaf6782ab37b5798a4ef2149db621e2b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
653baa5d611bc3aef2542bab2744f518

SHA1
ebfa233ca52bd816201b06fd2eebae5939fbe931

SHA256
0ab345c02f16fc4c8cd4743f2ff7b404c42c5e98f9845b359c46dacf1464e72a

SHA512
ecfc2bdfe14ec95a2d3e62aba70a0c7c26ac99881d1b0363d36da01f75097dd9d80b55ab943ec897a2b30a179d251f80173a4044a81b64e335d96442c94769b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
809bb18e42c9a0093e0db47873e05689

SHA1
bc5a427264a45ed04064e03cf912a39ec07fb5d0

SHA256
8135bbbcfc6c3d9d5677a7331f6531a6cc291f6e22f665be91e0b680791fcc40

SHA512
2ea56b939886b0423d86f2daf7ba47067f8c23d6faf7bcd04dd4784aec444184d6d5de5da858bb66c8b0a8f977f59c0a6a477332720d637355a0fb3498c38dba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
a08cd949db4bcc93f01d7b9c5e172605

SHA1
5d5f27d38ef7c594cecd59d9fbd8904e227f907c

SHA256
65a614720220ce725b56cf61162c49a3d46fa5cdc7d46d733424fea390bc21fa

SHA512
465f33dc43234591e2f40ac202f5528e99fd392c21669408c7e86839376c1c4ede6c2ce22d5df9fe9d895286f9fe63a75ab9bfaddc129f1ad5f0c51cedfccacb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
a102cbd2fc5f602624909ba91f1a124c

SHA1
03ec36f100bf05a2803a1548227060602a892c01

SHA256
17d060663bf315c58428e9c153859aa9f52b62a73960bf1ac28e92404a14c49e

SHA512
4943abb23c00205a509faf35f707d2ee1b4d66bcc76f50a457da46dc9a021e899bcbcb7588188afa73d2246089f94d8e4db9e0a3b99713fb2fc752bb081e4db1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
685f8cb92c280cdf318b267ad3cf4d9f

SHA1
9198fe091bd7f9a94a110b21bb14d5cfc0cd68a5

SHA256
2752e5550e4447552cc362ffa3a9cfb6766ba2a970e9cf5c4be99f134c089038

SHA512
8a37660d9db3c1bfcde0cdf56ed775e8b8e1563904aa5e0f231689d15c31d729c2ee6382f25ad5a634f56709a2033febdb28aeca9b61def850ce54bd87998452

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
f106a382214606c2dbf613a5b988de6f

SHA1
4bc1c71c62470e0aa39aab03571a24ba38b66e95

SHA256
6a56116e68183f0ece2ffd9ff788b0c0f2ab65cde62b03af3e22cf030d64b39d

SHA512
0c58689168e86014dd0125f982c94c7a78dcf083ec85b3ca7b9f02bbe3082476918da7aae39dc541b975819cdb08e505e84ead28d5f8fd5cbb50d3ee7af81e0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
ed58208dc3d657d89c9b6004e21c322d

SHA1
26d49ab84995e3c0cfb9ea245e1bca43c24c5d42

SHA256
c8b5f9ee12ecf0ee116a49cb16b2fd47b4cb2bdbb9dbd34d9116b3da362fd09a

SHA512
fb75f809a770f5d09443c9dcecdfb668186c22cd7ac81f6a9bfc96dd4bd37f1b145b0e1c31ab2d1e10a8f436ed7d40b93698fa34581806a580d04569465cbc48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
e00cd930e33d5fc0f269785187f892c6

SHA1
0c66253ccf44e3626b531d23efada871e5e555fe

SHA256
9b49d43cfce8886309fa6f81635ad7d3f0e13f0de5a2aaa7a8fc79ac73e96664

SHA512
805c653cdc0d89c5f047cd03c8c3774ab973b2523b0be095b1113545c19c43dd9fbc49b4e374e3b0b5c45225a2f6158a1cb238870e3789ca503f4716c6d07b0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
6d5588fa9e3e43d8939a72b7e4deca26

SHA1
0a3a3d0bc2c74a5c658bca6505eece9173a9448a

SHA256
822378932286bad1cf8319c6cec1667fffe99881361a420c28a30101903ced63

SHA512
98c38cce6174448e326126066d1b92a8798c323ff7f4d12fc356d2510119cc943ba8340b698d1ea6e52f7e9591dd483e71099e0e75339b252e87cdf6d8bef2e2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
8915c809d37e2497ef2b5e49097a3409

SHA1
d501e769b0c0804ded061acd0ff41721102a1bad

SHA256
41eb16ff5d4a7557dbaa531fc4555825b6123e2c98e7402a047178369e36e566

SHA512
aae44c4a51ad1181bad2a07fc41fa74c17ace7fe12a717c8bd667cb012cefba47c8c230ad1a4a593a6847bdc7579d9442227990b79e4056690614485e9b115cd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
2c292d20fe03a877cd7b5316690bbc0c

SHA1
b70e2d50c670b080cc4b2d0ed7d7868b9cc1f2bc

SHA256
02712062d63d799a03c4b908c4949da329912a6d0544e82ddb2ff1484c9e93a0

SHA512
04505383129b69aac87c87ea89116b89200aa440ad800454559ad362b166c806fa99ff0c5086415fd391a850cee11afa9440a87c8f39313b3feea4a87eda49e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
e32e45b39e0c6ef8dae2ca21412935b8

SHA1
e92341db97dfc3a33bb02787010fa351b4c8916d

SHA256
e023af8aa46ec2aecf58728bffce8f374077d33701360e0dcbee8ac2d1d13d92

SHA512
cb68ab3a5ca693d2b3fafc4585fdd744ca58ca4dce14822287d04e56e3816e2abcfb879c2f1cd3e958788677f4d6626ee3e35dc9e689bb75f089ca724606c03b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
253c0d3e17fd11ec4b51ca6579ac3c2c

SHA1
7a089ac4f9562559b8011a58d063dcfe828fa770

SHA256
142c1baff564c915acfcbdb6f4054c3c4e8fa0a29cdefd40b8c1b49383bed685

SHA512
69ca7e761a56b471e18b2f3a07f7e1072d0a7823ccd5238d464a3a04717042815e9d9746761d05b703f80ec1023df4ff0e6d932eda4c525f8d86fed49d59f2b5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
c2398ed7569f10635de75b32533f3604

SHA1
1674a0c39a71999ae751a1653dbfc616764ba1bf

SHA256
3ae8a0f7f4e2123874f2e9c90f6f9709af95d8c147516343cc11e0ef0c6c3a37

SHA512
78792a02aba925c2f77c3fbbf1dcf5b2a52b95924afb57129893b03845369c3724a6e593b33c6c2efc0f738f77702d8196eb0d14f42b37c274d55d4aeb6ceae0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
ca491e2265840460af9bf3c8430d9f84

SHA1
de2fae00af9c983cc6c736ef44b04902e4ef635a

SHA256
ebcf3b16bc72aa003de7a99fe9a0d7498c0d8427e64fa6248b5a358e155dfdf7

SHA512
d07bf0a7f5427a7a5e669d48a77f582c3dd56d9f5e80c8897ffd35ee352226a19b74e986d3a0d182454002dea2737a8895654e1a149e83964e717f58615d69e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
8317cccf37349345276dab2c237fe3c1

SHA1
8048e6adbafaac8f805f770bfe4c05ed285b930d

SHA256
b81ed2552922ff561807705d2177bbd237054a5b7bd0784f3a69cf6383632cb9

SHA512
38a33e98e9c2a02078eea5247a3114e61c3b671ba92a0f620bfdb8764ab7ac5f9daedf4fa4f072a139a06be61be04bc9f77fc932ea67aa41f83b510a778097fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
fa683e4f0c6e16038c955d69d9b2c144

SHA1
3ae5c0814389c4b1074ea4388967089a659d7b06

SHA256
a0a2df81c68909509cbc977e8ceb177f6d4d23fc67604e49f44962ed74d37f28

SHA512
4f247ac8f76de94455173f0fb7ab60b26cd787d99ecd30e180f3bac90b57b32d090a5f8a499adb8289217ffd12b95b2e93ecde078ef4d835c4b53ee0ee286719

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
6604673783daa68e06ff66f0bd393d75

SHA1
48b09947826c2fbd73f4785036cfe64c213b97a4

SHA256
30c326cbec77443e6fc8861ceb6305a3021b709aae1c87383f8627ed0f6585af

SHA512
286ebea3d519d9ee1ce69dddd9e9235b7300e5c76b72af2c20d4f70a1a4a9407455d4067ccd89f123ba7ae1df94bdc6bb929e9240cdf7846ef3920239fd6cf88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
6bcae9fb00afb166ca2bd97d67967a83

SHA1
03a5fa48670608e9c01d7c3ba4c86d2312fe42ea

SHA256
67d6d2bd52336f85d7de90860ae763bc254ddd318d89e6990b7531cbcdde717b

SHA512
bdd2fd649e4da6c2b182b4f96e37736d6bb6e83311d4875da1f1ca556c41f35b89af3099dc1fc26c422b5222e1a9ffb2939aa835a75cdf9b06b20939d435dea2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
5b13262dd4ea4f798ab1fd834152f51a

SHA1
386bbf5a777d6ab1292f559ff4b34f27dfcbbbf0

SHA256
65ee2d2ffdf6e297d87778984a615e88a202c6b7a44ad1ac89f05e8454a23bb4

SHA512
6952e966ae276ebe67c5c24e170d5f55f40b7179acae9171900f6e10808137449c9304d2996ace8910212af014a756567c125020d2868b5c73518c54e14ec5f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
a88d8bf9fd4f5aa12c3dc4dbd1676d6c

SHA1
eeb48e61fe23d71ad3a9ef77fa6eaf824b4a93c1

SHA256
ca92809d1de8b1a6b231f49f3938f3d9b0ed7c0536fb3e2f3f2dd4240a79bb51

SHA512
380bc07183ed83da57ddec56b32703a0cf4fda9620333d4a347ff0bc1cd17b6f65317b3115449453e6b3ad41e6dc1930ae50a5d57c41523659f2ec05593301fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
746b9b0d9b485e37626fbfca4802b653

SHA1
f13557f0b36f42b0d5705594b30c34207ecdf8b3

SHA256
13565b625911052f0b8e07614dac254ad428b54c1832b58e58327aa8394c7398

SHA512
3fa7c116e64896ea529800fd7b8c72490944200cec9fea8ee79953bf593b0662ec184cb49c219685811aa8b7ae513c80105e8068a55db40f45e7236920c11222

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
1a2a775dd4699efd92bfbd0f759b7fec

SHA1
5447aa276cb2b20cf6d72e4b1c024bdc4c48ac19

SHA256
5e5626c48c9f738cb34f3d0c11968d4e5ba87a66fafb3ac8dccafe09c8f8a26d

SHA512
35fc15f9bdc1ffc4dd9a21b1ab2b4247b13303d089495e47ebfd19869f089f22f97b8ba932fea119c8dfbe06c310b26164ad2f8ca2498dab2c9f77f394098a18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
ac28276afa74ea9e5feb3d0479fb91b1

SHA1
61be4dddcb5612a16bebebdbfc770c0fdd45aa68

SHA256
a0f42500491aa9edaa864dff2b9267296b1b3a40c8ba58220b5cef10d4f4d91d

SHA512
ea7968dcbbdd3fe91e93cd4de5aa33c731c85ab4bba75f4e844815a18829e026be8e083b2b92d454168f93786555e0773f8d8978fd5700b4a72975980df59ca9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
4f86c0cdf6244f58d24d673729fc5c4b

SHA1
ff9969bc4468cdba02f93bd3716066c2f3866256

SHA256
9db070c7d4850f0a61b5ea2ace60d32464a800b8892bd680ddb03e00891b348f

SHA512
b272abc4aac444ffe334c29b3d769419a2fdfc623773b5ea4d13b0f0a81af58bf5e1f4440bc558ff111b9fc167ce0e8c4f0a2801744ed9e366fb65b20c451c9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
8ece127c0b60f1615493e1315ab49db6

SHA1
d5d098d2cbfd3921695d7aef53114646a8007870

SHA256
50eee4649073b86f3b15d7bf536b90cfe53e94a45b84002107bf275891b1e4ce

SHA512
9cc72f42e32c1593b1afa634d1dd7b68540c8d610bdd301d05b94a14152aa131190755055b5db4f2f1a9ad0a27ece726f06372918e083147270ea9907b4996c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
746ada63ae99f2122562e69a7ce56bfb

SHA1
f086a69bd3be395f1ffa0b024b0525a1798f0c0d

SHA256
4a07faec4ef29c7ec4c1b140619901e4ef35bdfee198768b0cb9accee27f0301

SHA512
2f2693408781b27a78f3e71d62f453a1bfed4b1a94cab5eb97ca0ad56c04ac7461c8d265ba93503be19a330a62d6add4c3f7ca81265890013b8fb5d29614960c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
a870a26deecfdb9da5f62c26f88bd42c

SHA1
c0d9bb0652e8db0e57cb5f8eca010892e7c473b6

SHA256
00afefcf99418738032df9e877abe8fc1b568d1de8a99ad01846a94d3c96e57f

SHA512
9f700f3336d47b955afee17099c04650472f9cb09ac6543984b7c31d29e7e52233e32a4949fcdbca3a4b3b287e7ddaaaf827909e95782d912131adbc41e2f5a8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
920b114aeb9921db55115f57470c32c9

SHA1
6ac846c0a118278da3f66038021f97cc2be57b33

SHA256
b27144d4c081143f24d6354113a486b84decfc5ac0ccbd7d9d0fc993e8d66409

SHA512
ee3b25ee34201e643b4131a851fd7eec382d683b8c142a8150c406ce0bd43f8e9ee890dbfcd62a329d336c3e73f90e3d857034bcc7241bc49e37a530c1edf610

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
3c7e13a7a062b1e1953f38408688f6a1

SHA1
0d893144dd99a12cd7ee79b1ce0dcf4135c1fbb1

SHA256
f8e4751d4974dc881d7252698edbfc84cdb662fbeaca60eefe1ec1821414afe9

SHA512
63ed35f91787b1aeff93bb1160f71dc2c04bf0e7d4f019b1e020a67ec74d2810da8973f0715f2ecb663aa823a1f98216cc1af0d5837d02c6b7f75aa9cbe1c6f1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
f4bac8a6f4f9f2c808fce4f5c36bdffd

SHA1
964f629c5ade401b8ca4217bcc4024d22d293816

SHA256
4ac484ce2d0bed1c766a7263d1f52d0bc2d54138d34f53f993d6afde0f124d44

SHA512
14e7872e0ed17d212d92996855abf188fa5e67ed4f7c3de116c756d82c62065aa55933c612cd650a568b0375e24b96445212e54075b3e91fc48d162817138c3e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
454ec8527be3463a551f46b4fad605de

SHA1
024ea00d921591688101f5aef51a9461f0bdfeee

SHA256
d1e74997f18efc353afcb121e9088f0f280ce4b540e62782b8b834fde2407774

SHA512
810e7f15f20ccdab579ec0ce24df4e386dc729cd0032bd0efc729735a1232080e863c3880a357c3e34ed9ad298e3b3c07d48b6d99f1846c8d27046ecab0024e9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
e917641435b162626592608bf9eb93aa

SHA1
7ac2ab8e39d16fb7245f599fc69cda9c2c58cbc2

SHA256
b5732a5e415f52b4f7f300095f421ae99e30d7ffeed3fcc6310a1b406ad02787

SHA512
5258113e06bc16e4896da1fdf33e9b3310f5c09f44d026e3ac175d56384345c3e6385b044d5f94267e6e4698bda879d9cea96f56866cd9b1315ad39bf77f39c8

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
6dac8c86d3efef302ff85f7dc80881c9

SHA1
f65419b5844b73e5152dbf18ba556cb0760f5c92

SHA256
2b43ab2a19b3df087cafa432b3a43f300f5b75bea58c9863509de2b3d74ab75c

SHA512
90a1d62a42fc0390afbfb774db6508703cde23533536c34868c469470c3d072502c32346215ad6bae7034ee718e78c93e3d57008d54895262473f5d183f9b4cb

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
156a8444120f21aa9590038c9c04a773

SHA1
22bfcb764a66273d8de299c7bb3eb5cec7ef361e

SHA256
28675389a2536226bfc0404dc777fcf05107bcde98b8529a62701676234e66e6

SHA512
2131e49ebeb99028a3de523578394aae43b95e84df35ecb9999ffb97250c59369281a9e87cd6e8c37df15a1f7405ad8fb88c7a2b879275e27686c9a7fe87e6f4

Download Submit
C:\Users\Admin\Documents\CloseDismount.xlsx

Filesize
12KB

MD5
b6cb2b7d7573fb2b74c1b999e359cdb1

SHA1
939f34c57c46786fca79a34150b1656752fd6ee9

SHA256
d1a26b4a00a7b06b1fcfe5fe1a29bd3793148f9285d9f1f2f0dffe9713579391

SHA512
8eb3221413aacfd1bb6f92959499fd4e1e2c55ac508ecad76780beb61f613c95a70394966487bb5e39e23ae2a2bf17a6bb9cbace16c6aade4b2327bbefc1d80e

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
bde3afba482eab04b6e224c3216ac97b

SHA1
672f523c05a2726f8e4c3f3ddcb01c09d49eec7a

SHA256
2d63a76e8f8f89ec7e83f6991f8283c0735f1c557b889420b861d11bb66874ed

SHA512
6acaab2baf8b7b7454a1d63be63f0a6057824c77a0eb9262fbad44517536460ed568483bddd3c71397c3e4c81d4314db5bbe917d3b7e094987651369ee470805

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
5708b378025b018d66a5b6df48c5c444

SHA1
4707cef2320695e5b5b23497bb32ac788f509c1f

SHA256
f28a036aea710acafead179e4a73aae0211977089670ed340dacf19bd2c31b7a

SHA512
d997ed59f519d0bbd856ee03badf6afbceaf82cd0b73cf00efd8085ca6ff85398575b393dcae14c38c040fe8ee47ce236dde608693f4f40ed802582ce6dbb154

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
a19857b55ffd0067051d4cc3461af6fc

SHA1
5009d9afe38baaeebbe7f158718fbd0a48d1c22b

SHA256
84287044e9607710b187fb91d2c62e3348f6c4a9a9591b4d18e52814b96e5931

SHA512
f6552036d93b23cb3c80c2b9722d14b58df7979337b07ffa2e8d5e87950b92aff169da434d236287a8733b5a32e148d30931620f218fa0e72f46bfef95dbb3c6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
51a391d22768e052c1464b1d3c9e1a3b

SHA1
08643f0bff684aaa6e1d76c7c472546b4c99993d

SHA256
c1cdb7f9978f323eafd058c54bb47eba433ec051c5bb24284d96b23458d31a2d

SHA512
4dcae1a56d9bbe503e62beac3077d1e5f9b53d3ffc53c739ebdaf99d5207293475e0e4463010136b5c9a0c6497d57ba77a0ee52a094c7e112770eaa36ece0b77

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
60ce37071d6b45436aa89f01fa7ad313

SHA1
758280f8f6c8ed7f885c7485d0edf582b2677d15

SHA256
46ae19a1c04a73fd18d74ae748a210171065b4f9ef96e1fa6fcbb9a3c638415d

SHA512
34285fd308fbe98e3def073b96556876469e7e49d78ab0e126e5fa97b70fb27fa5d00b806006aa1d5b5f4654c4b49de20d74de5fd3249f89d63b4185ae7363e4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
8fbf9076132d3dcb3c0ccb02724e2ef8

SHA1
f5f0bcd6aa3aec4c07620f399ec48080627e2ca2

SHA256
d47834637eaccbe92a3894a8d8c050db03264bcd6c3bdf8a46ca1fd56a0f9033

SHA512
15562e3c17e686e1f4f245934839394961b085afa5979a6fcfc7d04d70db7bb94299a2570cf2573ebc02754e9f8daef5772b935ca95ed5ab61075b5713d7ec64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
21eddd02f49ef84246ddda6a71f5950b

SHA1
5a54dbc42e38dfc8bd7cb5630d36292dd04a365c

SHA256
b1bdd0829133a187cff27efaf842addab2649dbf24a0c34d1c04d59782b15d1e

SHA512
5f16d21eef3fdb25b60282a9f8b205b21fe9c59510703230089a951d59b7faa2bd1057db3186ca9912ebfa8527a5899e6c262644eb622a25501da27e7b2d92d2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
0f8636dd8ade5d28781b9f5b21d279c6

SHA1
3a83fec25152806b1e56a81162bc0195a35e05bb

SHA256
bab17574b18e288c1ecfa5a024ea5a9fcdc0d2a4f7f155ed5ee653a504ab2509

SHA512
fd4c1e53d19a49ca16e4571d5b4ae381bddfb4f099182aea106a8b15faf987e936ef4b10ec924efe7c0e792e9c4fc0c7acf1403bc7a7e2eafc96e76ad6b376c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
823f4fa12008603fc4b961065b4f6a26

SHA1
fa3447472ea22212795548d53f8b5e120fedafd4

SHA256
29b2998cea681a0c9946f8849debd5060821ef064729a76ba7e54fb3e8310f69

SHA512
45bf7a7df25f44421a742d44fe9f0f0d5afefb73ab0b646701dd2a48cbc9c47acaeed1782d8828df5644eb35727c01ce7ee82b495544a855e163aa2a1cbdcbe9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
e8cfc9820d9f10b646e52d8e0b8e8a2c

SHA1
75006d292211b3ecaf57cf6f921038a7ada89c22

SHA256
262d79afe093776c8733fc1f2f67ba34adf2779748de77ca3beaa4d2a16166ea

SHA512
43af2f4706927e8e7e5756731c5e0306b64865f4a81ded7382eab6ac82e57d0e17301a095ae927050627b2c643f296110fbacab01d892bdf4e4df6bd92e6a79f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
d56360c0f635c04a91990682f4c3db04

SHA1
0b0665c20df39248542f8a81431c07fd31b3dc80

SHA256
bde1dff73c3a8615fceea7cbefb95a5c49eba553dc500081aeb1b217b82bf1f0

SHA512
76e927d326acb23f75cd2c4126ca8078e925b671a6092565b6be954fedf52102693a8fbbe3d89b280f0e8ef1e89e3fc78e2b55361778c4c6f42ca91048de82ab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
c6687e7dfe2e687a16ca5b713a25adb5

SHA1
cc243193ddefbcd00e824a80878b37e4eb8fcc75

SHA256
5e54759105ea8258814ef857d936cbd0dae767192ef923ff9a36dfd7567eab99

SHA512
00dbd85709d5bce4e17542f3f7428fc007e53643a9b1864e87954a35b5615a69ff22421165b90b872744a2a8f80fec5880431b5a4f029c03ef65be6600cb9027

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
0f8ad33aba2df422b6d101a9f7c7dee8

SHA1
5d64aff79b855f5d02c1a1292787dfd58f21654e

SHA256
6fe51a010c0f08c69be3b84f114e7b4e79b8b42fe4d74eba24c36eed35babbfb

SHA512
2b981a22209e278c29bdef1e7f7bcf9542bcbc27cf21a414e8f04848b95abf9b8323197f0b0c464104a17ab4ce0443c06c62a2cc151ed063293f5ddd9f34e03a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
64235cb9f62848d6010d390bb07e4ffa

SHA1
da0082372d80393839e2c945227775fd6a7cfeaf

SHA256
c22cb1aee90bd1724d54500eccd8e2fa2f0db99213c6071278b207bfcf9eae9a

SHA512
132832c4a49104993b0bc672287f55260a38b9320a8722a26f50904abdb91fc8573b177f2b4e90441fcc7b8e5f142a139cd5ce9ee3ff85c9d3c8801fc42a1881

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
469a4bdb37c1f039f74f3c8c9e64ec11

SHA1
9a4d761bd4171906f66efda63fb9bb3a6b0834ba

SHA256
46034485cb23ff0bf77514c59ad02a36a95d4014f48a5243213523b8e7340006

SHA512
f351d595b2e1f235baa9465492ed33aa7b853ba21245a6cbea66ab71e48bd8af88248a4079865390624f353a17b9be82e60a678c13a4c967dfda2cd539e85d2e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
788d8d5a316209a85667e50a55cbbc09

SHA1
3be536276db7122ce26a76bf179e53944070b448

SHA256
c71ebb551ba49a67fd4d1d0fcda21d3f9b5e917a56342a442564cad3068e96d6

SHA512
96530fcf0c51a19e92a6360e6ef30e2f96466ab219985456a642274e25898e7be4c39e2eaeac49d1a8785d193d08e87f982fd1e53efaf4b5125a8ceac93305cc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
da079b623742e13545a75d4b7df78b37

SHA1
a9af1b2f5e6bc69079a6f5c10e4c1b2675f2abe2

SHA256
61158850c7d8fa06b41204ae1439b1d95d8b8146dd0c2d0c28ccb8a8b962ff71

SHA512
473a7c0340e7d04bd617da511821dc96e5cf50a499cdbfc7c3cf8762385114699cfbaf186258b0984af09d022dae5e23c6f25ef64ea924931367f84269745183

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
b79da84aa1269f522e0edb3a3498bd99

SHA1
388ab15589f4201cffd9227fc9bbe16e6a4ac504

SHA256
4cb6fc2eff576844d8928d5acc1015bac06cda9b45cb037a8b7cbbf756d70355

SHA512
490351b70e644d9b8625ffafc766a1af0ff8389c93d529d48d169e403628c3daaefca2195ecf0756e34f9caed61464b62b458f13528481c933febdc6c3de1c46

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
e5d75f7234aee9164c86a69569645e34

SHA1
c1663ea6dd5fee4e6be65be73b6ff76b510327e0

SHA256
dc504efacc180a96d59ce5aaa9c5e646e888655dbcd35f7d342b6201b35031a7

SHA512
41c425394ec1d878b6879c793201aaea77fcfdfd16dc98f68c077084911fb924a901f9501589dd6abc476debd6b084900f3c5d518e283b9c140ff8a0a15fe57b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
45a5d4d266939775610f760c1ddb914e

SHA1
4c0ba64332fee104d6d17576d735b2bd90e95445

SHA256
db37e4b34f5de1a0becccc9ea888abb7f131a9eb395139d6477b57029c17aac8

SHA512
cf250a268bc5727542f5cac42ef81d2c049de64f1e6d0c996a7b61493ed0df90544bfe30639ddf5a40cd28c0e634ff2135225fe40bd2c2f8747d00808820c55b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
a397e827bd7f0a25111accc36c59f106

SHA1
7a97a925975c3c217936aebfe53f176cdd94c775

SHA256
9694bdcd446e587b4e63addda2dd5708d005ab61e9d90c4926d9431a10044f84

SHA512
92ad139a980bf9932fa2e672ac2224a304b92b72f08f95d131a80b1a86ab1096b74baa0946988d19483c2844bd81fa5003421906c8dd0af78325bfd4049213ff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
b17070abea08b984c5e8f6f49c18959d

SHA1
0bce3e7c91110ae33abb91afc6ea20413753e2b5

SHA256
743f5c89773ca430be101007d3eb82747806f5a6e79f181cb79acff7b33f52d4

SHA512
5520e920640f28181ae3c5f1cdb5723be209c193b92f8dfd73c454475ed2f04dc9929d1c6d2b25d9aa577d0371227803823c85417421d85bcd018a2fdcc0d667

Download Submit
memory/2624-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2624-7994-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2624-9119-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download