810535911f1639e0439ceb40b0e6ba4a26a9370dea266b04d925f0e5894ab435

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Size

12KB
MD5

aa11ff806d49e6095a7f980b0b16007a
SHA1

7aafd8bcad9d0b219e09a6336a220cc2736ce2eb
SHA256

810535911f1639e0439ceb40b0e6ba4a26a9370dea266b04d925f0e5894ab435
SHA512

05b66536b1e1ab96426b238a54bf5608bbb432ad2e6435983154a10342c77fcedc7b07ae384dd3731e25cfe6e9121be1dde37028cbb24d2da1837636b0ae4cac
SSDEEP

192:+/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMMzS:+ebFNw4Pk1itKkpAjjI2YpdmMW

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2209) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\H8PvUr149gbK0x3.exe"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmoptn.inf_amd64_neutral_be2f30f68f2a5567\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_neutral_492d4e047d14bde9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_providers.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_neutral_10ce25bbc5a9cc43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_aliases.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averhbh826_noaverir_x64.inf_amd64_neutral_2fe3b14136d6e46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_neutral_f5caca1789a3c28b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_methods.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_neutral_fe5c4f29488f121e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql2300.inf_amd64_neutral_ca8487daf77ff7cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdcm6.inf_amd64_neutral_b1db427ce3d2a1b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer-DRM-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_try_catch_finally.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_neutral_ded8f26cdee953c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00e.inf_amd64_neutral_651eeed98428be5e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\winusb.inf_amd64_neutral_6cb50ae9f480775b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_do.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_format.ps1xml.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Variables.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_History.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Reserved_Words.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\erofflps.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc664.inf_amd64_neutral_673d3dfb961e9b17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr006.inf_amd64_neutral_0232ca4f23224d01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Special_Characters.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ar-SA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq2.inf_amd64_neutral_e9784021af1f5e24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00x.inf_amd64_neutral_808baf4e08594a59\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\README.html	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145707.JPG	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14982_.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9B.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-disable.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.htm	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full_partly-cloudy.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02470U.BMP	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02757U.BMP	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR35F.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ff\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\WHITEBOX.JPG	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\InfoPath.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dialog.zip	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter_partly-cloudy.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01268_.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15060_.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\BOMB.WAV	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\REMINDER.WAV	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\oracle.gif	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\km\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\NETWORK\THMBNAIL.PNG	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01304G.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Generic.gif	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341439.JPG	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01235U.BMP	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_microsoft-windows-irprops.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e6c68f65d85269c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-deskmon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_719d68be15dfaf69\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..statement.resources_31bf3856ad364e35_6.1.7601.17514_de-de_e566a189254450cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1a624a2b23c3df32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..roperties.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6de9de974d6fca23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..on0viewer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9ccc8358c385840b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-artui3.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b15d2b24d52592d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_xnacc.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_eb15952b486dabc9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_eventviewer_31bf3856ad364e35_6.1.7601.17514_none_a7c7be940756e915\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.directoryser..protocols.resources_b03f5f7f11d50a3a_6.1.7600.16385_fr-fr_0931a75f6f974bcb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wudfusbcciddriver.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a416c75162437b0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_8.0.7600.16385_en-us_3e16230dfd28c743\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-j..buggeride.resources_31bf3856ad364e35_8.0.7600.16385_en-us_2e7ea77174070d34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_3d836f0e43551ce6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\Media\Characters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..truetype-meiryobold_31bf3856ad364e35_6.1.7600.16385_none_2942916491573830\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Reserved_Words.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..unddriver.resources_31bf3856ad364e35_6.1.7600.16385_it-it_56a9061d75dd19bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..store-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7be3a24301ca4901\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-nlasvc-mof_31bf3856ad364e35_6.1.7600.16385_none_6474f288b40fe46f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_2461659e78807255\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\Audio\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..ngconsole.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7acae5d4b206f7bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6c1ecf50d014f9d9\settings.html	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..readwrite.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_54958cbf87ad2335\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiacn001.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c0fcae0eb1f07965\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-alttab.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e22bc19b456a9019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ime-korean-skfpad_31bf3856ad364e35_6.1.7600.16385_none_a87e57e0764b0c4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_functions_advanced_parameters.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..-agilevpn.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7b400e7afb13d576\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..providers.resources_31bf3856ad364e35_6.1.7600.16385_it-it_44c34480a901c3f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-desktop-adm_31bf3856ad364e35_6.1.7600.16385_none_92d6e548a4d50982\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wcf-smsvchost_b03f5f7f11d50a3a_6.1.7600.16385_none_c7f13af70ac77b22\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..pulations.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b6d6b255e38b4c57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..s-regkeys-component_31bf3856ad364e35_6.1.7601.17514_none_7df14b591094e7ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..linetools.resources_31bf3856ad364e35_6.1.7601.17514_it-it_04209af3a39ab46a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_6.1.7601.17514_tr-tr_e55b2bd8fce5fac8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_14e136a34024f580\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..managerui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a027adcc2efe377d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..nmove-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a1d121939c849ce8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wcf-m_tx_bridge_perf_c_ini_31bf3856ad364e35_6.1.7600.16385_none_dc743a7047f5372e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-u..rsalcrt-apifwd-win7_31bf3856ad364e35_6.1.7601.23175_none_4e12eb8b85dd5f41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..consumers.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bc0f773a38ccd97f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_caspol.resources_b03f5f7f11d50a3a_6.1.7600.16385_ja-jp_656e055d38617be1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-shfolder_31bf3856ad364e35_6.1.7600.16385_none_eef3c430806831de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..ation-api.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac5a0be727fc1f82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Special_Characters.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8a11d6161cd73573\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_pssession_details.help.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ipconfig.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c7b3850f5f0c8825\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\WindowsUpdate\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-wer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_73188be86d322295\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-icacls.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a8d03be1b247f398\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..simple-provider-tlb_31bf3856ad364e35_6.1.7600.16385_none_22948175da1cfe5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.build.engine_b03f5f7f11d50a3a_3.5.7601.17514_none_d621e6a35e491e44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\modern.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-lmhsvc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_870d8ab95fee92b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..meworkapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f3897b7e29398bc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmbr00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6350318f60f895fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_cs-cz_05c5e84e9f9316bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_gray_foggy.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..ional-chinese-array_31bf3856ad364e35_6.1.7600.16385_none_64b02463c341f83d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\DefaultIcon	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\H8PvUr149gbK0x3.exe,0"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell\open\command	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Opiwe\ = "ZBMHOQHKLIITQTL"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\ = "CRYPTED!"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell\open	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\H8PvUr149gbK0x3.exe"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Opiwe	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
330B

MD5
5a703ae2e6deefb82cb979740399b42b

SHA1
f487db6b575be05cf13fd14ca84bd71a30d29678

SHA256
11973f804d51fb03df36d39c0d25c97c867ebd0db6d9f953fa49ac6a61b02576

SHA512
3b2853168fba54558ddf957b9b3ead44e50ef24d9ffd946acffb38f8e46373f14fa552b4e95748480570b7ec49bc6fd3fe99c8373431f7efe7e44ea0ea2e70c9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
c96b3e555b57f360712b105b8663aabf

SHA1
a8be08c3d34a3336ab232b6f5e57e021da1f1168

SHA256
a75e2a8e7fead9e2283dd4852d2c385373f72efbefb7d76b0e22e1975855f452

SHA512
b779f16c3f6ef5f441cef8bc47935bbf13e68d986795ab5310ee9863ca976bd82916303e94d00ce0f2a49c8e26c73da7baa75a9ab81ce660d3967097d50eea3c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
f5242c35adae0d81e4f2af537f1a3632

SHA1
1ec5f9a6ff2114ef40548d6f80746a0740c6f574

SHA256
6f25e77a4b1cf7aa47b13b7397f1286583d45d3986235e6c85135a073e4587ea

SHA512
443d7433acd31e3af326dcfd0da664db912e730ba43f05011324d78814656372723b71bf7203f85220a686efdfa12f47782e2823a0c023cb64a7c0d51882ef94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
e1a872a94f1b4153580a97e8ca8fad0b

SHA1
6b5c5c9c7ce8c62ba34ebb70ce1bc6dae586e568

SHA256
1583c58314c1b5dd396b2b670cb0c68cc39639c345973afbc2b9fe5baf9813cf

SHA512
a4b0f24db2634605d07e4ca5d8d11166fb75f2ea0aba994ef0ecae9635d5fc903176c18e39e2aecd143aff4f2e334749152c31b30e1c6bfeb892dcea7c00b6c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
e5c1fc136f789f7b653fde7499014bee

SHA1
6d50d1a46e8b31334c0fa969ba10d83fcf954581

SHA256
c5f228f3002886838cc5319033befcea22c091d0518707ee207d510a2b4fa493

SHA512
ae536025725f71a297505719f5582e5cedf54036177041565cf8f4864ff208736e22eeb53dbf68f8e3c990528d7837ac5f68bc6f79c712ac26659e8782aa5cbd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
27d308433b564e04caf5827db3c55bcc

SHA1
714f58046df439f83d5a027d0037be505e1a16b7

SHA256
d17250ae283b7fb448eea86d0e89c8606c85b799485113e8b915116dd5d3d178

SHA512
f656a31d87d8b271690242b57e506363bedbecca3092d03d4259bab6beaaee70aa9f0624be63433ad4deb236340fcbb3eeee23e6ea57d1eb942bc32ed87dca98

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
e4a3096d73560cc1d45bce58b9d7b624

SHA1
95e88898dece138385a788f82da445adc85ee37e

SHA256
56db951d96a506483c9d7092962ecf9091ab054ee8a3c75023ebc7630bb9e581

SHA512
fe59f174390da9343a32952b55f05748edd01b968cd2a5c53e859a0c46f127b1b6d2af8a34a24a113906fb8127de8c75eaaf8ccd07e87461f331e04019571b59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
7d5fbbe51693be0df2f21a62e200ec9c

SHA1
9011b439275a587e6c08be3e941867fe1b735556

SHA256
dfb94dfceb4d14ea74ca800f0145c6ec58a86af07f368b2e1a546afc1672f2df

SHA512
5f5f681f5347c989a6f6a4229b18474f40337ced1839998750696cf51af7232813a0b30fcbaf5df8fd630cba5fbc9abb0f5a8e7912d6282063004b9d11c27ca6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
1b836df3eae245f08f7a221ab249dfd9

SHA1
6e446b7e2ad32ab74a6c8413c320434abe0ed8a4

SHA256
c15fa2ce43cf304857bd2646b7ee920e3211d6f2f35c9f69b936ec7a4dfa369b

SHA512
4dcf866f595a9215c60f4e35bc8dbc26250aeb23183c58d3fb409281350068d36de7de01e0aac7441ce68a424f303970cf53f79ef853f478b91d4dc673fb3c48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
cb7fa62c190a4393493027822cf0e8c8

SHA1
11584a3acdc110f7421b0a79dcce0fb420c2af19

SHA256
1898433861d352c353ad820085f37bc934a80f8191dd93923d6181eebe90104b

SHA512
e1d9feec673610c7a5973580b21b47e07ea080630f16efbdfd4e5a3b157b4dc9ad1a991822371c182979c34034a0335aee93bffc9f09464b0d8d5ac9a3ee2834

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
afd2f85a6b8454bf941b6420fa47d17e

SHA1
38906172dede3f676aa9c2c188a98b9b73c9ca0f

SHA256
2098364590225346c8f23ba50a4399a37dafe464e1048783a78de3b757366da6

SHA512
815948ba9e24d2bbe947f69be74c647b8babb0cf9f2a8e6b406a0320f7cc31bb0c0f83161398e090d97d3eb06d957f3165e8c8b6aaafd9b26cc81208c8ac1c9e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
8a869c108b8c262b0f93ed31ea376fc0

SHA1
f0afb5fcb513d43dff61e8c74cf0d08c1afe30a7

SHA256
245d8c215949d6bc3d686d47e1d8139a5107340142351e30d0ebe3604bdcb984

SHA512
0ee6a35950e0573d0ab76d93c504c0cb1f854033c398436d85988b54fffd89bad90baedf95558af0a9bb2ab4db273ea12cff13907e1486603a2dda9b6673f45c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
a6deca1211cc739d2589df6796adf431

SHA1
9939a73a159f37e7dec73ce5d84dc5afcd38da47

SHA256
82b9763bd75b787774c01b3d7fe3637df136d6fea499d72dd808ecb33541430d

SHA512
a46450dc11bd7e335f5d91db7405365d01df14a7d6756d24e901ad06d356f553fa816f6e736732617997884bdb85cf69a826d227b1e96bc199f76b42b921c4c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
a9319bf4ecff77f46aad74774f99d47c

SHA1
f810f25948c2e9b5201407f286d45331de01e0eb

SHA256
411f55d21a738cdeddbf2de96fb5a107dbc9fa5afe827cbc2228600c8cbbde51

SHA512
1301ee06bbbb6e67a1c0c12a956b18e561831e5cf387c3c88c89a738d66fd32113cd2244ef6a1c3d0b5a891a26872ebee366fca5db2fdd89863001117147456f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
5e2ee12e8ce26a229b1326058ea7f3c8

SHA1
3b88b7535c82a23232f5947e2de80685d58b1a96

SHA256
a409430f39d4e470b43ac047e447551a16e250bb0553c4295981964fd0bd9f37

SHA512
e867ec8f77911d4b21a1e06d05830c6b1e5f6a464b24456259b9faed17d80642b23bb6cfd64c7fe8b4800c4fd20e38f9d1bf25e7b2bd6091ce5c119c822f5782

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
51612d65d67c58c55bd195c07dba3aec

SHA1
375f69a9d8215c5088d5088ef982bba3981813f4

SHA256
910e78c90601d8c9d99ab9870dcbfe0fe31b02f0d3ba7e7ca21b00ea4d348061

SHA512
2028647261802ec65b94fc0992b5c858d43579b5707695cdf6268eb2a880ce72d85c7c8f1430f8a8a34aa47b6266ef2745716fa1ab89375591f98c63240f44d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
44060d1f9cf8eb7463f3b053f7675343

SHA1
b0d7098805c5da3684a330c30e2b8fa966f0ec3b

SHA256
56fd5b6a5d222dafca8a191f455c7c994383ea976bf57f09c9efd77123e9ef9e

SHA512
c6d358421d5e4fce54f86d52105e3226526a7738fb9f43cafeff253caad2f70028c8c110238747fa4fcfe1c28c8c9b33bf1d54f602d909431d7ee0159ebb5404

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
83121c0c040cbb4f24e0e5f3716ecb6f

SHA1
3a20dadd99997e1ac1e7e903e5279cd77ea85ff2

SHA256
e5a0b797e443ab0f115e0ca0f80509ca6f7657d49050ab96614b8a794e9052d3

SHA512
747bf4331566ad2aeeb6710a79620278c3f310d9e0ec02b018f32675e58884809bd2228f10b806f70e3b9132f631e8cbbbcff45c155bba5311216bce6a56dd73

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
efa44470124049e63449f6de51fd814a

SHA1
ee777539fbfde4f76e3c5a7494d4624f8053e710

SHA256
56d864c4d89ac249d4754d8544ff9f5f0ae08c7c9bfa3fb5636fd3c9800f9958

SHA512
3376327bb5e2b84cb69633cb547bef503612b776bf575b45f364480f014906e88c4175c6cc626e5e789289e70e0b59a785c3924dfc23da68278a759497e08850

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
76bdd2cf7335463deea14a15a2c1bb62

SHA1
7fa6bece20a56ef1dee2ebe27b7f62b00d9b408b

SHA256
89a7e284074bf0a7028a705a743973e467ba3f38b16260197d955348d7f5474b

SHA512
eeb10226a39653b60c78624d4c3a8318a899d328b0ef9ce4e2c74a4e145b1f399be6eac7b1b2bce784718f2e813dcd602ec0555616a9051f4f6ec05ef9a2835b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
66b7c037629b468a7d952d3f8dd45c5f

SHA1
deaa60a7de0c3a3d44de2f4942272f46c8ea2939

SHA256
62f711c65f0da6fd14161d32091264216573c418e910cb8b2ee6fe08dd1ecab9

SHA512
f39992e0282ce8255ecb82d9ed93539c8590052f93d7c8404d7db0adefb0f9d3af73af02aa388b541d437a93c929a172f2af491269d177c134b0d3d26dadcfe1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
5bc0e5973de177fda2dc559d854d1001

SHA1
ba9d37b08c26f7f1ef0208f79fe07d9efb4c48d3

SHA256
542584d61f2fcc8f706eec73eb0712136849b5e0c75c2ce5ef4e4f2a113fb421

SHA512
64ee1688782067d6fe568201c18cfbf930689d44668149c2bc18335ca298121298e19f0302d960bc09a8d9462ee1709cb2346db4809fea6b0e186e1fa74bf567

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
fac07457c03aadd5c240aba6fe37b5bc

SHA1
1d91d867e18b4e8ef9430ef67bacc77f323c53c9

SHA256
5aafaa3a898bd68117d93a38cec88491ee773d2f5a0c6d8a0435b961c342b33b

SHA512
ab60cdc48eb676bc0e5ffad7926681bdbf9e3c7c373d5a4970d6a6390cd24e0e07a69a7a2e74c5526df655f86ef4b57f7d8211ecf151c46d0441437f208cba71

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
45249b4f4c205516db881f8528ea22d7

SHA1
02c734413be71a759bed8fbc19886b1b38d97f47

SHA256
d2c9f9011ee8946da02434c0926859d65c877b14587ca068e5e323269b31a021

SHA512
7dd22c0288c4bbaf6425f6446d1ae0918133dd2fa7cf3c87a7775d258400e3cb554392457e40c1ab6f0d2bb551b8d060cb9540ed813abe337192b77a7ad0ccfe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
56d36a26afd032b979a0b29873464e8d

SHA1
375652de0bd32dff0ce617454e23996bf1eea733

SHA256
c991f2688ec16658c56b60afe0aab793bc93362888d5f8993ee9f0b969650b56

SHA512
7ae4379c2b9cbb3537a753dc4ecda66f3e5567b3c91089e16553dbc7a8bf46fb08200b7d8af86a47afd218e15ce2245e1d2d61463743e98765063015563e1c46

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
aa3cecd336103b63961d43f8383610a3

SHA1
5d71e00e093c890748ecf869d6789c6bbd765435

SHA256
6d353f1025276b0dbe5861fb98e9ffdc07cfd346e4155fce61176880d1db43f7

SHA512
b90e442e007547d7cb2537dae6162dd842dee650b0cc4abacc2d7f254cf4a571353cdff7f0e65eb07c5aa0c01ed23845c6f09512a7861758b1a6828b7eb4c112

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
294b22339ef186370545a57523328b2d

SHA1
de633b3cb3a07965c4df6812c5963a38c3c15a02

SHA256
50245c5871b94a558e9ac7c58a73f1e722263cdb394325fe2e2f610d0421f90c

SHA512
d71e0924a087ffddeb5142cc8f3f2bcdb517b5d0d5557f9a669470b81cd5cb459bff9315b4869d9a8e147f44ea720396608fc28ee352bb2616df8830d263712a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
6ece7622d7b7c65a309f61ae3956fc51

SHA1
9e8141ad9d205b9d787e7f6a6ce03a22724365e6

SHA256
20bc05a72908e03c374f5deb52b1745158d096cd40185fce6efc2a53ac56f158

SHA512
03dd4c8ec31fedecb2510fc5f9d355e340c194bfb6241541804fd62fde18e4c5a7a20d34e0c81e02fe8a3402b6c097d8672df84caa471285d378239e59b5b25b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
4db86b764f417a9abe49b56a014a0c93

SHA1
624750e733c4fb9c2d49c737d4fa6bf22ce93c4a

SHA256
470cc06b35357f733ee0a6a3b481c2dd53c258f4cddc0bd04582f4589339f3fe

SHA512
ca115019565841c59ee2e3ad25b2db0811b459a6522ce9a512cb812a58ec07b535c38ac9ad075ac3f20ccafa7390f01261938997f2a9581cc9d4992a7846def3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
0cf75605e2bba30310731986f6dc16a6

SHA1
6bdc09e02e0b9e78c07116666ebea3c6d1da2a4a

SHA256
3b49713b14a3185de7fc99bc209f596e55ace362ea7f9204d09ef8273f56b387

SHA512
efacd77061cad5f2e912be054a999470bc8617497ee0d511e0065ee87beccf7f41613ad14d489bdddc41d74fecc8dd98c41b0c7f5b27e5b84f1cd1a96e847cde

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
6174cc748a6027e59852aec5f02b9f86

SHA1
d1c86cfb51be4ad9a43a7d346c4b1d1cfd3b74c6

SHA256
8fb3bad2f2d2b6df19b8e723a05435bdde970e8e6c9974a93176890efa51ebc2

SHA512
d82d9679ab706eff52c75ee67298dac02434c5db7b2814647579646c2ed505d3b055a02bd289e174f8db2e35b1bb0dae6a0ce490410ec89179f932decc8e2ea7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
797ff420874d0031f14b42a58ca4d064

SHA1
5a76a1eac8e41a2fbed824046b0ce4218d27c113

SHA256
ea9953c6ba2441815de9beb759d83ed2bef2deae74179713102995fbf730200b

SHA512
4bfa60d998652a20b2e8db2b408c243e36b86078baf1c1808f21cd578550007083516c34452e982ef038d32edba4bb34ccc0f5f3f898a3e3e38ab4284c01d22c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
cbae0a4b7e1fdba1154ce8696a95e575

SHA1
aab78d67d33283315e74858610cbb5fd820abd5f

SHA256
444fce372b2abf947bf11a8ee18fd7b95f90168586925e0f5cc104eadb6fd4c6

SHA512
2bc227fe0941da68d66bbddcded4240ccfadc05cc869988c72c9c0aa1a1ef758d004f835d729915096c8afd233eccb00986e0ea8f7798a5627fdcc3f138f53a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
8ad6ce4f9a13c97d4ba07f659df51904

SHA1
b9bf9212a48e07dfb5cdde96c5ef8059ef5b4217

SHA256
3bc7b4df3d5aa971191d4efe347aad6e4abe3bf65af415f075e0fb2ff37736e7

SHA512
e59efe2bc354e30c97146ac128184ff7cda64bb6a6a66be14decf4f2675cadd32bd30c6cd7df1871a8fc91d60ab0127589936e454bf382c4e2a2678e3b1a4726

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
ecc2933d4040a7b8359af2f8b9f53cf2

SHA1
9629fc5ade83f7de018e51359fb8297b34e52ba9

SHA256
41ed054e137aaced1529c8f7aafafffe7711c8329d787b271cc43fdc66b85190

SHA512
a0f2eb50afd9331333feb068bd33cc118320f2c375dd74902ce9698505195cb4fe8d119d34c903a424a0e998a697c0b9a70b673523037578ca3189e05f657451

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
e0c157d6b5c1336752542a29bca3ef1b

SHA1
ff7004ae68ed451344282eb7a117032f9e857d07

SHA256
7687772e72fa8685cc1bd93b5c41da8be9c75f54c60bb50a67d46ef58b727594

SHA512
2df7edff297efa774b6a2499fa14be43f3c0bc97d309cfdde30c45dbd33857996ffeb4f5da659520065c318ba84f1b9c6e801ec728f2c3dc1682cb9eceed0b99

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
fab4e1216a3196e847ceb4a3e5e412af

SHA1
c68629bed0a7f19571858b2f9097d078727e50a6

SHA256
b197f0634312fe471ca2c80531343655a9460dc22e9aedb4a195541eaa40e68f

SHA512
70809e6874375edb8cd2f3e08915c587a4ca6ee2df27a4c1c1285e0960ddd29aefa85990c49dbb77449822bd5d1861e370148f37b29dfbfa0c1b098ab3a9b25e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
a4305b4d793544886b3f1a9c18fc8f37

SHA1
4ae30eccb8d42025872c9318f163a936f69e8f64

SHA256
86c1fbc6300b02a1233dbf348275d6c1cd63df66e1ccdf7859e8e6ce1db2d1f7

SHA512
06bbf1b18d391b4c85e48953a690e41e02b275b9960654d2a3d6171a03cb8922e0bafaa2609c9952dde9de19abe21bbffb6e28a40328399ea200674532e734a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
28ba2f8bf3f0892ee65c129a8213f4a3

SHA1
4a25fd661c9a1bace561bc94ec71dcb4c39daa33

SHA256
fe6fd86ce39e78d194c3d97c5c2b04ff46c459066aeeee6a3a4a9fa1dd156190

SHA512
4d376ccb86e0b5e589da7f2f97f9f2917ab513821831ba49d3316f96c7d6030cf1fc9b5dbb808a8e09fb1eae6ad46557982ca93ea4e0806c6981ff71c2bec3a0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
912b026c9c9dda0af13419db0e0da8f1

SHA1
f5d337f339376ff3f4c9c24ff767a70efa72f3f8

SHA256
7815c12364fd056572d0d47ffa779596596ed23044075d51ce239d4fca5bfd1c

SHA512
b8581fe010585707fb5d74c3f22dec89821d0b09c77a940324439c1304e3e5b24ec35e1360c7534045b130328bf4ebc58c9285af4e569b08e31d8df4c0d479fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
3c6777df01cdb3a264d0cc5b3eece17e

SHA1
4b2067cb8144dbb96ca2f1a3e1c1d541cfbf0735

SHA256
2a53c33c66eee58954e57a64127fdee243844412e6f98a81deadd1b9282cfa0c

SHA512
6700d02c3f18e86f89524b93574a66b33bd125a0e83df390182f387044b0c5103c49cf87e65c3f7151099060d56e0faf35615ae96d0eb33e9bd7bcd3681452e4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
ee9395bbd1f04e7760532226a3231cf8

SHA1
62bc2d1197ab35c49f7e23738203279b5890796b

SHA256
fc1e810e622cecef6fd34f5421d99ec2cd4f375718fda03f0f8321e50ef83fa4

SHA512
b5fc1cb55a2ff4299c7a50b8b60e06a5df9a5703faea32ad72948b3791a3b0edf0d474bc2245e158467d5f4f9a67edc6372c032d4f063466d2f60a9f2b24bdd6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
d14ebc1fb89a1cb87e87c6de76fc151b

SHA1
1377960b2d604289140ab5261b95f2c89408d03a

SHA256
7889483b0ff4c7a7ffeb289e7b16a0bccbc3d7cc3f628774643a8caf44c3793e

SHA512
912ff4930633872e99dd6b7ad61a23b4e97deb9a42d794af9a48fbb7bd8e83ad2608b0af5812507b5909fca9673c67f12cfeade8e01190fd29b0b7bf32f919b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
872dcffc35951209ab4b4d19cf46e3be

SHA1
23754d4313d527a7d953a018f47ae24e1375efe7

SHA256
81ec5b2d7cddc79cc0ebc409c8e39b9e2a9bd884106f710f0511f81847598b52

SHA512
45607b8ca18ffdf46ebff692affb9f0c934b4619f4e85c5f4260feacb5ce5404eba556de12fe32655e6b657e5abf441a4a87d81dbfbd0639c8b88b7577300e15

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
26bd6667e578e6b99b1244ac89838472

SHA1
40f141669c51dd03d3264ef43887161b38cadf0c

SHA256
605f78431cf6f838c57b4de6a5c1102542ee3620c0ae9de4c4049c1f25617c59

SHA512
73548657d6a832e25d11c007316065713db4260cb602d537d7d068684cbd425a5eb129450ae6593a5167c13a08d5654a2d4f12f8113c10516655603961fbe974

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
c3515b9fd8177bd62f387e89be065d0f

SHA1
74b62d662944a884834a0fe49bc2340dac3a5983

SHA256
30afe50a430ca422d8d394d018fce09f7907b4de6a6a9c527235c88d93751782

SHA512
41b191b4e855b17395e241790b85f29409c659226a1db5ca79ac2e3d3d64648e90ebb2682885b6bdde5f74208c59c7ddbb028e6933940cde44a7dcb0974ba1b8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
e28728727c714580cc4053fe98910ce2

SHA1
6bb46ad194dd1ef9af8bc18d3bc60ca5d5133537

SHA256
0acebc66c6a600f2292f6e1926ec8f14e8a10ac020d7ffc0447ebf3eacf989db

SHA512
7789a1110daabf7195ee2e03af103402d9e1ab2356af7da57c17def45f19692a428874921dccd7b1a2b9783f018ec07ff2fa0174f6e9724a7e4d97df26856a40

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
f4d76a4bba28399c8445aaf99e8ef65b

SHA1
0c71fe48690f1c2e2aabe151e15f1798c8a2e640

SHA256
3ff8789862e1c09f2961a950fda40d0de52b22933c315e264d4ea2bb36ec365c

SHA512
d9d8a41f907b1ff05a28028cf373352776b3ae444eb7a57c2ac7b3274e72c58d3c9bf681750b858bcc7459ccdedf94d62ad796fbfd1d9da6a7002296d431adfb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
aa92cc210c6255301491a4fb39cbfdd2

SHA1
a5bf367bf7d88808dd01596f31fc40df0138057e

SHA256
ffd1d6aaa5f2ff4b918f6513287bc6521115a4d953856a73304746c7813e3630

SHA512
4ecd63faefbef37f1b248d1dec399ea4882663a4dc28184ca6542dd804666aaf2e799d3d76a516ca091a61921d48794edbef08f834a8311905c1f2fe92b1eed1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
87572ff31846811e2b3c0c124af7eb26

SHA1
5ce7139a7dc731436fd6c51409b74773b9c97e38

SHA256
486b2a9dd995d06346b3c86afa69b4102f3e5bbb3a49563fbc9b32a626c67681

SHA512
8a875277116ab71b80eedaa4dfda9cce7905ab47ce0f1dba05916aa39201506a043bcb511edb6d17b9bd04b44bbbee7dd98e97a366e5378f7e78a2b7b7eccd9d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
6aa8cc47094ed7a56c5c49ee1532fc39

SHA1
b8d351ee9a9847372bce1ca4583be1b50926c057

SHA256
79ce2748157ce2164ff86ba1fafed5c5b0aa9392a75f05ff6f15c7f23c6b9928

SHA512
dfb9aa68d9f63995fa671a2355dcabdcb9cdee6cacadae51a0508f7a9ef83f66ad6a6a4edaa84fc907bea6e9e8b4079d684fbca83175e2ac20b6a0eb6dd92c69

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
b3c5db48657daab0691717c33610e08a

SHA1
f341984996bf6115e6ac705b1e86b04a9081effe

SHA256
080e6aa6ce1e87f0462d753d3eed7c3d876ddc24321d6dc35d8107e36fbaab36

SHA512
6f714d52c6b7c72b2afc52a811c7112e77907ab17b2ec9499cbfa5b0cc235c5d712f66d27fe9a7782be68bdd617d4525614a445b887b5ab0a72ac1f06c29ef59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
f55dbc07c2c3e9848211097985f614d1

SHA1
95a4c117685eccb252e8c2be542c29934491eaf0

SHA256
715b89d3210e75505cb589229150e3e3e7cec2e87ec14930dc6c2534ba068bde

SHA512
ce959662074eb3d5a6a6f696757f812eb707ea556574a9dee59e848f043ae2a543a88a42c3970cc44c362426bb12d4d08537e15d2a47062701998509b3138622

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
b386172a60a7711f86d68639972c4534

SHA1
9845331edcfe34261a2f740af281d7684107443c

SHA256
7616811150ff89e3256a7170f327770574d637ca2621fb55ebcdf660e196000e

SHA512
4c2dfdb477d3987aef76b67f9a142f9a3eaa50687e44517c7c20fd8e8f9a66fd6310b2ec3149b0924799f3e74e82fa7ca6108ae4b74841eb741cbf1db6a0ba36

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
2f124d930f11263b567f720ffa92e443

SHA1
9340ead27c233056fbae180eb135926ba445707f

SHA256
84a4a5e635c3f0880f80b1a474b9b601031eee47179600be6beb4d0fcccb8d08

SHA512
576ca475d74bb3b16f4ac8189864800d447421479abad9bb1113b1c2c8a223f611e9b87794534f1dead323f4dd0c44ad5d34f2336021df0fd5561153cfa4c57d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
1bbcd6c6825d06127f332d9928c4a3b1

SHA1
fb87c1890171dfe0b3bea8750aa1abc4e06f56d6

SHA256
01df4f628f5af1e1a5424e8f3a3dc9d7de8be19b0bedcd669f6fc0840916e98d

SHA512
1b54438a4e545e44d941e566de784510d8026c059f0cd66c0fbafe87d695c33f257445bd8e06ecaa6e26e7ed9b419bd444cb1d95f9aae0e6c429f6f086505ed6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
08b299e1d02478150aac83d6711dbc85

SHA1
f9105f333b5c0bcdfd4e101f959796401cb31f0a

SHA256
da5b49721c83ed481f8a60103bafe4e15b8f63ddd12e9f719d3c7b97a2900e62

SHA512
440e1ef6b6874fef8de51671cef2469d34253fa6ec8e225a447c1fa08c1b35cca09b55f652021ab1f1d3b35f9807de0d9d383b336edd20a83adc1de3f5b92a4a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
0f035c55cbffb9bc88cfc4d1dc622713

SHA1
d11fc0cfda48332cdd8baf6dbfe056e6053ee7c1

SHA256
26e96eb5ce65ce2a1d4139faf615a4bedf0d58c4122a2d0038f411e8b39ab28a

SHA512
2a5727eddc0d1d3ca8a0520ad75b237087e0e6018840b8ef122701d92dee9760eeb44ee01a73bce2d8af8a0e420c7a64be2939b474311608863c0f889ddc834c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
cd7acfb646da0155a5fd486b551e91aa

SHA1
905e7abb58b7a5cdb65bd335e0936a7f8670d35d

SHA256
228165ceab8765e7d2749d644fb69fcdf1d3adc8590af57cb26e56d93db906c0

SHA512
564ba5e05cedde9a94915559617753f11dba758e9a2b9524d14c5ce9261aa04773f0fc513644da48168582c881ef8a9f693cdf1ab52f0a8e5acfc7c18d8a5bce

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
9e2789cc63eabe41c55080e512889d7b

SHA1
0ff28d866005509b371d354486783ff774bf19d3

SHA256
7510b755bfa40650f4cdd19229abf7c193fd753ba55b41cff65a220e262c51d4

SHA512
750432ddcfa8c2150380091a182bac7ee7571584e23e5ffaeccab315f8562613a316c626673110199659b8b484a75797200d1dcf480a2a02785306523d40a342

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
c76e5ec0e5e0e2575fb328d67f89200e

SHA1
edacd2978447c897fe7bcd38d9eed7254c127b8b

SHA256
8d68e45095a73e9a8c14e09819690819aa8844ba8e6baf4208356e1918c20936

SHA512
efb9a65c7a34cd65906e5a20386c2891d186a00ac7502a97595e95e8c2d68f223eee324584ee0adfaaa47f803390ff00b1e7bc1b55ede5513fb8785409e61295

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
6408f3f235d9c84106e9a93c57dff497

SHA1
d5631bcc84faf6ec6ad666014c526491852fb816

SHA256
0f23d5841237020fcbe597257d7c504b861109411c62ee4a7e8b06571431e38f

SHA512
b1d6d1be89de3ad904dab5e08464db7f2e184756c0c93f59c0162513bb82430ef344f495137883105afe2bf266022f9592277006a1ccba27ec3d8aacf9a0039f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
590a3143bec35fb88025206754e1c355

SHA1
11474c443711b11f1eb4fbf471d61d2e148ca878

SHA256
5a33e0512ddb89a48b03eaad36db9b787acf64081c303f2ce3041a6021ad215e

SHA512
9a374c4a50c246e9c58868fc458e53b894db8bd92d45427f23e40746af4e2d7fc09943d0344c359ffa673ef4aba918315018a05ca3c2d2581c03c9e96601234f

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
15ab40700e4f8b13449bae4547d8f33d

SHA1
14195a9e4c50ba47f9d460ee9a4d33ec00c065a3

SHA256
853ae448acc2fb650bd28c62a4593e127052247610af3ce0f2b886a9550a74df

SHA512
1b64b5e7f51a3d278e01e13eee25efba8ba706d51064bd4be6f804ca82959b22256b18f2c9a9e98260b35f3626b6b3725343bb59f3b43ab49f76d6268793ed17

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
a5f696013da818e95b225fb8835babce

SHA1
8a1db6834068ac709e6bf6009a4d1258401a907d

SHA256
752987daf5d7976e9f9673c8012ec63cf70d3a797df6ee2d842ce4635f7dfa89

SHA512
baf5051cd0a01ca7c4277ba6303d47f4470730b41c179a572ca353f33c94eabd5df55b56f66c40f5aff47d20a2cc41811e9408f338bdd2d07eb4611f59e8fe66

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
5fbf735eb38ef2618c16829cfb9bde88

SHA1
614a9442eeca382450b3ab5928533facc6c5c5e8

SHA256
05b73b3ecb380072ebc458d20f15ae26e220f9358007dc42adf9d0570247888a

SHA512
d60bbbea5c69340af68ed382d8cd4e1dbc9ca6bc26c3b849a175285bbc45d6161c3eb9d9a2f13b9bf80bfa0dd7e2ad081e730a71b7af2a08a746234155dcf259

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
eecc7041cfa333012c1607bb73a0c66a

SHA1
d3e30c0e4d4079a3f3fc162eda1a1548fa6cfef8

SHA256
82aeab79eca6a952bfc7920b66350492644990eca4d8e3a8964f7ed777dd5779

SHA512
9a8ed27deb1499cb0b24b92e138833ea8c36dd0ae35e336bdd114230b2bc19db399262188d6b8a63efb2e866b8833efbc9ec4c77f094cc04b14218ac802684bf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
8f5f70446c4ef773e5f9747a5fe81e60

SHA1
60e09fab6b56307c7de57f35cf0f9e639bbefcf3

SHA256
8dbab18f3aef912cb1ff70557c07356d0004d4990b5a42cfd386fc15de3a36cc

SHA512
c35b2e2a5845b7858522cd7611a81ee4541899fd47de48db408074591999a9503d40951c1722ebd952fd639f7028822b2f77398d9b6c90305423c68f1c0d74b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
fbebe17fe31f2dc8a645dabc9c976c69

SHA1
b26e3ef16ef8dc2d13001f7505571672761d90ba

SHA256
c51ad52f3667b8364da9dcfa96793bcfe3fe284ec75d8c2dd695e43fb3879b15

SHA512
ec5ead08322bd5cc65bdfef77ac9d68341b51be1a40709dd541434b240aeeef8559e2100996e00072e44ce1b430d9861a9ac29416902d86f67963e7fdb8b1ca1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
d449642291b179259b5e294067d835c6

SHA1
7e52e4928402e67e5ac2199549fb32ea9522db6f

SHA256
c6ebecb43d192ee0c6a1e4399ddfd37ab6a071c41ddaa1ae7d0f69d8e4c1f887

SHA512
b9904a9ef94fe67607bbff530c2ea296a45f3469f6d61c61890cbc4b19e5cf96a4b9a155559246d4c0b771ed053e11bf2d75d11bc615ab75ae6bafc6955693dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d2c0e5dd62843253272e90ba33df8185

SHA1
238d28920a3465fd5033fa2b547a83e1e148f0c3

SHA256
776e88a8b28bad5e0bef832d855a9565a5134f4ed0041610d3fc2fe31cc6d76d

SHA512
3a8a11b42224a9d8448d54f8aee7e515c2ec58ac0efc2dbb279518d1100b19402ebc409ea9aa222444e8abbf2ea186cefb0f308e38c0c2ff3cd6e8b7e953b566

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
17ad67d1985501e94cec6394f4a21dc2

SHA1
abf3344c96ab288efda68b3eb997d8651dcdbc39

SHA256
f75b142053ee21200d70dd683ef085e1b078ae3cc546168ae3dcb3789f87b951

SHA512
757b4734ebbfb6aa63e0cc97c6475a848c556c96d0dd7db81545c84d1af617c6c0bf670d8cb8d5948a1ed9e9e7d7f2f134b78e0b7c6b52bea1061ac2bed3b06a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
5f3f91c680b6f633c953c31605831fe2

SHA1
5430d91cf3a29de734f4c115107fcca9922322b5

SHA256
b4bccbdf1afe96012a2674ea5b52d46eb89d5b442f845ce9bd0e5a7e5cc97779

SHA512
2d0a9f4cc422eca4596e4de95d8f0f4a896dc09da7c5083507b90460b80ce9b8d0c41ea1b0bdda77d4dfb26e0a04d4a3886652b2390649fac70b3f105b0424ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
44b54b71ebec5e1480f791f8b46fce60

SHA1
8852c17e1ef60d094718b4e9a4c9b6e2bdebecc3

SHA256
faa4f9e5f1523152b55759c277c356a687a38fba6ce033362877cbf7a7ff1a97

SHA512
77a61d499e8fdd958a2dad95ce5f5d11e3a448dc12983072bb9abd5626ceedc42193b425d1cfe40ffd1cce2577461885aff7baf017922408f365c93c9ba599b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
86d24fe196c45b536d8b90986abb9773

SHA1
cb6a3da11af882e9e9aaa236c68d064401fdd51a

SHA256
fc683f28079f16333a5cacf59dde8c237c3ea524a1bfc8075c07231a0e05d4ab

SHA512
43f6e9001316d19f53e24d8b8a09019bde0071a1e7808127cef63465a403bfc1bf83b84355f140e943b90fb7732c212d09e184c506b2d4e46656b936f700e310

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
7b0e540a7d6d5e120f48f6e9acf1f40b

SHA1
a6ab8cb52d2bbc8c03e1bd2203458cc3b2de25df

SHA256
b85349b7b3e634f9e8254d5d1b60a3b274a7e563c523dfea4479644bb8d82624

SHA512
6ef9f39b4f4b4be2060b13cce89af4928c338bcfc0cc82beb5817494523bfcdfe0ec31f6b0293e8f5400ea3e2f3b09f192d0b09f5355e1cf1aa74658d0ad3117

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
cb95644b2ac229d8cc81966ac8e73e94

SHA1
1dbc2a74e222d7db43ed01a708fcbe075a667a3e

SHA256
eb07a9e5b1316a77387b06bdab222d8015b14fbdee5ecc70e636354f4666537f

SHA512
5043c8b4c635a65a582ed7fb7d3416841b6a6ffee9026474a207f41556162048856a250269c264ec630bb63cb1635c842693422472a28666ce185c4311f815a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
df1b80dc937584ef39aca206f36ebe0c

SHA1
63ddb17169c3c47b9e0aa10d84db76d1ce4d2e6a

SHA256
ba93f63b5675a0050a6912963eb7d833e3b46e01723d1cf023f396ff06322493

SHA512
5f0b64dda5163c6058bce3168f89227af20a2cc5ee5e2871c47cd454c03fbfb97d1a481e1df4fa2ac9428d49cea818840a136aa32f6bbc73eee60e6811845933

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
5792a608b1320f18a85bcba5779c65f6

SHA1
dfde1b3970643a9a6b5e2bf06112c26615760e6b

SHA256
3096a66859b2b9c0ff250d867011464ba7a3f73ab2be4784d71910b70c8c6150

SHA512
81bb26eab77e58b895799ca3d78e53dadf896b5fc54c6c3954a2c1d75c854ee5fea7e0e43b0a8d54e8627130b5edcdf1534a4c40e417f0431a5740c1d1300162

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
0a64a973bc55ffd02c7c5d8b84dddd21

SHA1
49e96b981a637167d38f6ddfd58ee4049827dfb5

SHA256
1e31057dfe6d1b410cc2a9ea1354bbd079927bcb4ce27058bc5a9f80abe80c18

SHA512
7736f9f121a9a61926b12404189b1b9b17aaca834ea011fd811b6e1e9aa34f0ad9671c10e1acd61d79123925350b1ff9f5e652b4d485a320a611429de550a50f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
b92e8e6355a7f4321ec412dd07a337b4

SHA1
81e2cebb30fa69e85dc6496fbc2e387f1116bfea

SHA256
03740453540a5a7876c57e88303669ac8f4f3cc700e04d34a6387b09bd18aa9a

SHA512
9113ffa558f8c96cf48e4a3ef73b513dadd471b7d5e3f1874afbf772dc94c9715311ed3ef8e2c57a35aab3852625dc9c086de35fa96f5b1301fdd81c1ee77a64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
5e97dac33f223ea9bc02f32e015fe223

SHA1
0883317ce1162e863c5c6fa76f4a27afbc981651

SHA256
6c951fe2536bda8c5a0051d7e4b14a3542a3d946232f54ed01adff7361a9480c

SHA512
079cf36716fb742d96d9031a7be637e2a3d448bd9bf2dc56de8c76cfe6a2420e7601d307e5dcaf97999a4312872a52b078b17178f142b0ba83e7707ac6317400

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads