ddcb072f404a175818010881666230fc803fb0b1bb29a88836f566533ae9866c

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Size

79KB
MD5

cc3803ef89079ca22a52c6fc4497d682
SHA1

efc02ed635ddf629d41d65d7611608a41664327e
SHA256

ddcb072f404a175818010881666230fc803fb0b1bb29a88836f566533ae9866c
SHA512

4d565fcabd70a0f0de6381b98ece6cffa5e41660e0cb0b4017829a2a1f296fddb8d04e7e6d77d878b85c4a9a3d26d6574e932d7b584a713baa4dfe34c166c0a8
SSDEEP

1536:IODmjia6Xie52YSQuGJHP5iOWAj+kho5PaYkJznR:bmjia6hfLZvLj+kho5PaYkJznR

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WOy6DyvB263h19Y.exe"	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Reserved_Words.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_types.ps1xml.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_methods.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Users.gif	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Language_Keywords.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_neutral_9209e816461a1a73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Arithmetic_Operators.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_jobs.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wd.inf_amd64_neutral_759109899b486d47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_WS-Management_Cmdlets.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_locations.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssessions.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Redirection.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_scopes.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Core_Commands.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfport.inf_amd64_neutral_f41f35e5c21bc350\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnfx002.inf_amd64_neutral_b6dd354531184f64\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Throw.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_debuggers.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_neutral_ae5de2e1bf2793c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnso002.inf_amd64_neutral_c3b7ce4e6f71641f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\AppInstalled.gif	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Return.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced_parameters.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_neutral_c4fe81ea47c6df87\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_neutral_cfffa4143b3c4592\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Comparison_Operators.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_parameters.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun2.inf_amd64_neutral_242c76ad2e288fb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\en-US\erofflps.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_objects.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_profiles.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387895.JPG	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21320_.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746U.BMP	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\cpu.html	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\11.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02187_.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR48F.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImagesMask.bmp	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01296_.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_snow.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_150.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\GRIP.JPG	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-back-static.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTAREA.JPG	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21324_.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\HEADER.GIF	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\cpu.html	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_left.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-bits-igdsearcher_31bf3856ad364e35_6.1.7600.16385_none_0d612eb0a8b155ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..entclient.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5536a12cd57020f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smbserver-v1_31bf3856ad364e35_6.1.7601.17514_none_381d6eca0d132216\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ty-syskey.resources_31bf3856ad364e35_6.1.7600.16385_it-it_496a4635bb5a2532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7600.16385_none_a61138e7aab17fed\Windows Navigation Start.wav	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e89ba9cb6f9dcbc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..orerframe.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_51f0750cff4cb31b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-app3rd.resources_31bf3856ad364e35_6.1.7600.16385_de-de_092dcb7043a043eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-core-svc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8b200ca438fcb5b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netbc664.inf_31bf3856ad364e35_6.1.7600.16385_none_a3677e8bc4b04b78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-wasw.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7f0d0964d059a2e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiaep003.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_38b653653c7d630e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\EventViewer\21464de9aa1dce17c1f42044129a986e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..libraries.resources_31bf3856ad364e35_6.1.7601.17514_it-it_3b0b02d59c06b437\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-v..cprovider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_22d0a47fe964019b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..providers.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8aca2809e3bf6497\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..rectplay8.resources_31bf3856ad364e35_6.1.7600.16385_es-es_949f9a643b902266\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..host-peer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_861592c73a32a46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_regular_expressions.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-pnpsysprep.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b9bd756f19e1e67b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_wcf-m_sm_mof_31bf3856ad364e35_6.1.7601.17514_none_c67936fbde6722ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\53cf54ff35686c4044952a8cf8b8021e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_black_foggy.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..framework.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_556a155877d69b46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..moregames.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2a9d472eca822078\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-appwiz.resources_31bf3856ad364e35_6.1.7600.16385_es-es_302e68ca7021e39c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..utilities.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dc65d79d6619fbb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_81e99da174638311\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_196bbbad4be46a44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_wpf-winfxtargets_31bf3856ad364e35_6.1.7600.16385_none_c90deabe0336cce6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp1.jpg	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_gray_foggy.png	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-rd.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6d7ed4c5abdfe031\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-infocard.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_94d8c43d28c969df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.management.i..mentation.resources_b77a5c561934e089_6.1.7600.16385_it-it_138c245ea7b1902b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mobilepc-sensors-api_31bf3856ad364e35_6.1.7600.16385_none_5e64cd3b287ee4db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_es-es_63ed8c3a00aad07b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..qossnapin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8e1ec0d4ea6e3429\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_rndiscmp.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7523c493e2ccfa7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..ilter-rtf.resources_31bf3856ad364e35_7.0.7600.16385_ja-jp_b63ee8f470f6737b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0404\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Afternoon\Windows Print complete.wav	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_hdaudbus.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_69e9b951684ed826\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_hpoa1ss.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2edb1393eadcdb52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-runonce.resources_31bf3856ad364e35_6.1.7601.17514_it-it_00549ab0f94c31a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..atibility.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_42d978a515feb50b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-rpc-netsh.resources_31bf3856ad364e35_6.1.7600.16385_de-de_47efd9cf5d66c35b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-runonce.resources_31bf3856ad364e35_6.1.7600.16385_es-es_15257f1f79fc40f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2e054b96ee6339d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-system_drawing_tlb_b03f5f7f11d50a3a_6.1.7600.16385_none_6f122e8e3a88e186\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_WMI_Cmdlets.help.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-efs-lsa-extension_31bf3856ad364e35_6.1.7600.16385_none_252f55f1cea824ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-fontview.resources_31bf3856ad364e35_6.1.7600.16385_de-de_871033f0b8a4ca1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_512fa3b8707f96fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_85615a334015f906\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\MiguiControls.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\45d49301a9e8ff19669155b1ec5c45ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_addinutil_b77a5c561934e089_6.1.7601.17514_none_1a816bc7556b71eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-duser.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cc15f8cd954588fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.servercod	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\shell	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WOy6DyvB263h19Y.exe"	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.servercod\ = "MNCLZRKXJMVEZRX"	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\ = "CRYPTED!"	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\DefaultIcon	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WOy6DyvB263h19Y.exe,0"	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\shell\open\command	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MNCLZRKXJMVEZRX\shell\open	cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cc3803ef89079ca22a52c6fc4497d682_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
940B

MD5
a15f40837c86eda78b9c082be38a70ba

SHA1
d57d6be5e82ae6ac131ff1df23873ee41288d158

SHA256
a797d863e66b8d837c879aa886128641b2496a8e7f33fb44be328b5582b5799f

SHA512
d2864054b32cc3e96420fb3fba0413382b33220e26216e1e70e2079ea0987b554f97196dc544c9b34c1ea83747300b1817c3c829d382a6d2bb38be8edb781912

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
c0dfd1aefc706c7fe17018160161cc30

SHA1
3d220f8ca1d330c0f612942448e993994b67c2b5

SHA256
abc7f14ea33f3a7ba577b0aeeb939361913f8762302db766c3e1b0652af36da6

SHA512
8db29ff5fbc0ca068407d6836410f6e3e1c7e248627843a67ffc432e15a8ad4f8fd82f2d456e5554846553932c8e763d081fb9c7c90a7484437723db5d745277

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
ac28f6a6e020858c011713e4395598e5

SHA1
8f5d0298f49fab31b05c8edfea3b39af85b3ef88

SHA256
51ac6ecac168eee2ead3d6b514ad68c6c0c3dbd8dc2d27b65ccf6fb2ff216c48

SHA512
c1c3bf75a1836934d0d53e778a4f71b6832696888c4a998ac6aa92c9a3079b82bd6ed18754939c777fa4a1a433f42d029e385a8d4b41bdfcaa795af9a82f9884

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
3e22156cc7b06263efb6ff07cb2d9346

SHA1
6d73a5c8aa359036bf6900333af823bea691c3ed

SHA256
a7ac0789f802cde484c6f5379462106db16baee69dc803ae018d397e49b49c79

SHA512
495ed328c7766c6030c3ca3bb2dfbd57f0fadf0c7c63f58d6005574e1493da425614b5878eb849289e08abf47c101e5a8300be67fe3332b926e34ccaa6df33d6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
f255e18e0a6a5d3b6f841687c5284c9e

SHA1
f84bd24d8e2d021e4e29b296435939c906583ca9

SHA256
bf140241456ae88ec2dcb1a9b7b6041e2642c5aaf9cc79a2f4092cca8738526a

SHA512
b4690746982a0f30430c1a675a662c5e079488bc634005093847502e54f18cfdb32afeff3cc85878577bde118ead4dc6230f8decd9718ec6b97c5433bac4129a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
c27bef1a3e0f8a3a09604797224cb3eb

SHA1
264d6e4f8c7270fa063c98a448b4644f59f3e27e

SHA256
bddc463a2a13de772db5f1be53ed20efcf5b68796f0578a5fca9dfb185ff0bd8

SHA512
8c11ef1b2d77071b9aa03ffb30b2af97ed2b3532175393fed61fbcec258bf7fae79392e57569e9390bf84422c706afefbe1dadf03c0682dfd948453e18b9c8fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
23a1d73d3b15883c47b5df123b1cedf8

SHA1
f7e5fefa097a54d60ddfff3b66cfeeebbcc80191

SHA256
f5477362053a711abbb15fc72bbb6a01e601e58b147fd4e8228daba910448637

SHA512
6ec831725fbeb82550df1268c6b84d3050478b5138ed9c8099fbad84dfbd2e5479d8e8b668b38a8ea53518c3ec5b9da11ecaaab0f7892d7644816c415b421e5f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
db487f60481b10708d55946463779da2

SHA1
4aaa5de817e4310b090c408a5046f245237f1af6

SHA256
22ca2785d28ed8334e3144766f947e2311f7a13c3aa5d34a34e96a40e6b37fb7

SHA512
749454a9415cc76333f9d84e4c16e6ef6c3bc6baed3058583ec9654c1c928018752c6310d09f0c6a75eef13db5fbad2b49a9bc8b4b6f24ac900f602ecbce3a0c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
fbf50e30899a3ae4ef64a2c9941de805

SHA1
b68d08c85a24485279922cc5def3f57c1a32fb3c

SHA256
04afa9ef41278358040d536e7ef17ac470047f13cd720e7eb38cc83a6137ad06

SHA512
29736a84ef1944ca025edc40a1932677838f7711dca25393584f4a2f9a2917703660d89f75a70277e734a37887a862fcbc3a7fc1375eb395cb08d3868af1b198

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
24194ea3fe0a0dbff8a1dff015ef4683

SHA1
8595f60a07a16cd3f84724f1b83948f26a4bdd58

SHA256
83bf8024c707d66a7bb07748440996e5905a766292acaaf3e6aceb755f227bad

SHA512
5effff7fe684c97ae580a46c5e130f2cf2351266366bb4b58b38ac9b15daa22a77577722153b101d6fd0f5610291456f67c457d2f44e6eb7547a314bff716855

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
6987bfe91bff59074dc2f1cc903e814d

SHA1
f03150f8282c0927acdecc8869a7e7bd062e49c7

SHA256
b6b40cfadae0778c3dc1899390e0befe06627fc42bd7476c013510fc10b89901

SHA512
2607e31dec19b9bca8c5e6991a7e55dc945c32461049a7646f5563a3f07f5e465e5ab3fd209466cf3b8f4d53fd765a60b81b4afad787b2690b87b7ddf34e521b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
4de07b50163a0b7ff4936c4643401f69

SHA1
9f2071f07ab94c1c662101d642aee09506f3e4cb

SHA256
79afc5ea00039e340b845583073637da6bc983f73930575903db636e497bf694

SHA512
4e29479245186b2cbf58b25c4791971966276181398bdef423f41b65b0b0082d98cf6626a10b0e243f7b68d2f78c610d87e3236863fb23bf997fa4cc2852f92b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
dfbf2498f6240e91233e1a7b1f92f168

SHA1
4d0c13f477281afb57d5ba85446c6e1c23a564c6

SHA256
6a6c84eedc57532bb37223fa14108259f94080dbc77b67cb2b1053dd500260a9

SHA512
1e9f8413549cf68bdfa21b06a1ef156441f1eeb5af2b78383d2a71616db9a1cec2ba008829f21bb943051282a4c5497d911535b57e6140ad7cd99ce33f1ca56e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
17b2a8d7947616b4c84e03a618948227

SHA1
2933334be0635fa7095d1a0619ae6c56cfabb73e

SHA256
aa9706fbf1478d85f081a84bbc73aa84ea30f83babc069046fee5d66a8100d9c

SHA512
3c806633401364743136f53b531bf23ea41b4e7c49f2ad9f85015daa475e7a545ed44e93366ec0b62a661374901ab438aaeda86536a0483439732586dd81a0b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
b441d4a96dc52529db6e14517e949a94

SHA1
e4df2861ca2b6f8d2f4c725a05d0abf001fb6b31

SHA256
9ef9162d940fb7949020feabfe6bd47a4224768fb14f31540b2d247854e4d6f2

SHA512
92be91456c4596f2188d6b97bd3d18f2e502ccd106d19483ec393612d31b30a6af942f972bbb44181602c23f8dcb0e0738ca35e8a7d06ae07138183559112845

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
b40835e5e63b8c584bb13f3680f8cd18

SHA1
3b925c3e8afdcc67e94e98b9e9af341aa4ce1e86

SHA256
67531c695e6a32305f50e4cbe13d37385a6ca75f6769cde24ab5fa6b3b0ff1d0

SHA512
0da608d4630779cb041cb42cfe1e597a87bb41ae7bdf371b62b9a0b14e7137ba2316022390bbac9b2e1b419f4348e79a9ff89de8a8932943a7e05fd2585c6da0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
1dededc4666d4a50b74bd7ae2330e606

SHA1
969b2a3700b8e0bd8f6a9d95564be9b98b8d670e

SHA256
3f682b941dd905118b42f055a353b71232c990add641585218ff5ab8201e2cdb

SHA512
ed5cb319ec581c8d62dec7ae759d86baaafbc4048933a0ffa87782ed33323bde93ee9114602557e6442b5dc8684d16c729d7d8b65990b2f5948472dfe8b99242

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
675debe49664a6914bf2fc317231e755

SHA1
1aec8c2d23b24d4589ddf6d4d15b7eab2387305d

SHA256
26ae9e3bbb47574869966ea9791ec268d663f4e662bf0bab973ea603d50d98d2

SHA512
b759dbb6c952d8285b83f98890e3ce1af3e93153d2106018b55988c855ff2d4211df777c08b402b0185d0a79e5d0a1c66c5b5b47f39fb82f8a87727e406b8f92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
d0e7a82de1a5c73651515f2acd0d8f3f

SHA1
f3ed40be920e4c974f12c9591285c828a70e9758

SHA256
c9b16cb41510e26eaae69fdb79f0e4121282ed7f1bf3929718b99f730028db6a

SHA512
33395f178a2b14958a9552222e9ebb5242d7fdd328c1e3e4d480751fddb2c7745e6e6d8eb0b70b37c02992fa694670b25f489d11f06e574f3cfabfc6227baa4d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
a76b0e5642bbf6f41f8e8a197a090747

SHA1
7fdd2377b3b7469e9ee8733dcfc1fe55aa35bbe5

SHA256
bb6ebf63db33bad56c67e1f7ef790bc80f4449014320e9a537add1c23bc4165c

SHA512
57dc746635e4f070a52799c0d7edf12593e0a532c0feddd18429503da1321be5e74833d5574e958e04dda18cec570445a38b6bb360feb59208feeb95e2ed92c6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
127e5c14959837791091a18ac537fc25

SHA1
c9d21bbeabde262a27d5033535a36c9a339e1ee7

SHA256
19d27a4de6c281080d079fb5929de614731de43abecd75201347dee28fd2cdd9

SHA512
e27d98a5d62eaa03459d7ba42d56a8a9789862320a8b01fab60f23814204c49d330a2f30e794721363992340e5de695aa0f86eadee0bd12333ca9cbe1834ab5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
b26444ecc3dfbf80e36922eba19f982e

SHA1
f184820899dbe6c6f1467aaf6a0e7c9b0ed6bdb1

SHA256
0728c13ccaa68d2f9c6a1a05face66d0e7e6d507791397bb13c994ff7d1be104

SHA512
bbf778ab6af3fd5a316580c393c7a86ef7ac44063c25bd75a09dd97476ef38bf31c47732378564c5263ce787070515aa0d726914d4ac88c627441934d08ddf38

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
e0471b0639d00a9056f5df98f5beea16

SHA1
cf1c08c9063bf3a0a025e54c14f00d193852888f

SHA256
5dd6c5b04aa3ed440168f100711d22700dde1ea5341f99274e916b5b18e58582

SHA512
4ed18ba9cc776e3337a1d0d881575703b8ed6cd6a63b7c097c8cf90ea4d220fc75dcbc340b08e2f08d2f17ba41ed7795655fb6ada27bcf31d780deca72ee1daf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
41819a0ad86f5214720e957d723665ac

SHA1
12bfca9fb8569204cb0c5772add0f7bc0cdde3a6

SHA256
c71ec2bd837e442c49418a33bc91d328291151ea6f782c9b9cf60965b3f75726

SHA512
42f881595421452cd7646cef267fafebba15c8c6639c952f603fd64d721c66c1da2c7ed435544b6216f9e5f8af09e67edf929eccca764ef4a9cf1f42547dd95b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
ff33928c8ad7c9340b5d945ea5e97b4a

SHA1
7f69b583a3fa16eee13634f712ea7ec3806e474a

SHA256
03dd81ebf2651a93b6756eb0e58b30a1ee56c1fe14976c72253fa314c0ed75c6

SHA512
08d376a1f881e42eb80d9c1a96d51f67f1ea49577c8263da445937615cbfdbfe9e4d4ae94b58f67de33533a95884836ec26f6ccc51df9e739e18186ca5c8b318

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
35af723061043a5f854236bc046512e2

SHA1
8eb2a0e30bbe78e118afa5a6c6878c640e75c501

SHA256
904d219e04d1299fdcae4c72f089ce6954d67ccc626cb390e29307bd3e7dd510

SHA512
93d9e2be64ccfc50e026b0bc7da5e7f0342fa484267a2de420e38c48b31cbb5bd81c0813c0e8fa0ece12b47c2bd9575b1f01a4803e6c652b1bc51a7afb0b83a0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
60e40fcff6838189323c0facf79446c4

SHA1
ad74b018efcdd1ed2c129487a547bc620b801386

SHA256
8d4acb5efb9b72cd773b40b626b48c69d66513e362f1743f3d497b62bb2db107

SHA512
b80c838ce6b27d83c11c802ff80897504b582ea27f9584e93ff874922b54934c1c80ab52887ba90b3b65dbe143f9e7d92dfcf46fea4322be1591b9b067d5cb91

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
ccaf3ab304f7806e2bd022a1d5fe67f6

SHA1
eed196831bef6e72f9683303bf073818e28f9873

SHA256
583bb7cdb372df1304e7449d3cd473a6e59c04a8eaf40ea483a199fdf3a30af0

SHA512
1dccd854efaee1f39e99f63fa807e8912f27734cf7dbe8155898548a1dee922794a1c0ebb0893ae85b0e8bc8c4489df59d3f94c5b84b53c2b601371a349893a6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
980c2d2f1dbdaceeb67b0d913ff09049

SHA1
5f948a01c5d070101b0ae1880c1f229921fb884c

SHA256
2457bc2a289c4bf4f4ef519b81ca0a419b8ce671e7784bcbb2b1acf3e5c4c9ac

SHA512
77898dbecc329e927e5b484cde3c253c970393ee43f0328f7843dd4efd1099fa2546f6f441fa083622908a5cf3e7198bbbd94ce54f3cfb28d11f0af9304b05d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
cad2bb2cf323f192989bd5017bdf683e

SHA1
1d598483e3774fe538a86e5febfba9ccc093e756

SHA256
ea0c60f1472c7388de760876ba2b1ae611ef0008f3678c3cd9912a7a8cc6750d

SHA512
c143253fe737f20c522c3638fdce9f9eabd8f9dc8fc5b2651e234149a72834d7b0a5ef730a0a0442ce1c4d8a32e8acf510526c47ee0f4fc8711f7fe72343207a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
d61180c2079cba8fa52fe72959c1e8ef

SHA1
2fb51fefb1a4b54fe266ad949228e5b7e2c64744

SHA256
6ac9b996766bc96a0a3abc55342127b362aa56b9b6652c8619e77f439945668e

SHA512
757f657f321014faa612fd0deafc448d5edeeec0d98fa75364fe95913ec10eb3974fd7fe18a5aaa21f5af51fbc5b4448b5584d21996c0eab2fce34bf35c19bba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
4f3b5553a6da47a81784f66498720840

SHA1
40ce80721fa8b781bf50ec095dad4dfd66ee784c

SHA256
6c398363557327c67fac1bbf84e1743f80db729e34bf291fe3f2f371e6ed245d

SHA512
f8391e38ccc7bd324c30ed51e189e75982441d440eeb92c5a8661925fbf1124552c1adf31b1f5a5cb6d7bb578620ebe98654d872bbd71df528e55fa834b942fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
81f86cc2aa0bfc3e13904105bc8c5d3e

SHA1
1b1c18c8c627b9cba421e8609c2c3d5da3d8bd36

SHA256
d5662d0c1138dabcaa0b10e579ea06aa610a552c92f406c19e6f69ab3dcbd366

SHA512
028f8cb16297ea3e70dff341649b2442c819c773d04ba4d6b79ff95c60948613e8a0c548e5320c18f454e5d6d7eb82cce24b700a1458823a71eea56e3bf7029a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
987fe3ec429f2da6691a4223303853df

SHA1
1aeebabeedfaa019b33a0cf546047d8a7cecfe40

SHA256
0da4417242d4578193956012af44d98add913f835adf0abe60fdd59b84e1c6de

SHA512
b2a47bca693ec575e21a69b246b20772311ba00c4f03edf84113691705b9783fe73b1efda7ccdaeccaf8cd13960760743f924520835d654c5241a32da17e82cb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
1200f9a761630ce34917e7c987b2ff48

SHA1
871fd79b67d1d56702cf2942583622d273a3c64e

SHA256
c79002e9733493cc75eef0392676b2052c9429ae1df7aa5cce8f802a6959646d

SHA512
6db8c342c3922f26ad73fc3b2eb18ab5d308ac657645817156e4cea23475f7d96ef4152550bbda7029598ecb6ea901eedee1ba01dd9c5e9b734a06858c830728

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
ae91b86c610937be5d6cd41813e48dbc

SHA1
27461791c27bc8477dd045cb3fb45716b0bd16ba

SHA256
2829626ce4acbb3de003ff09d6e2cedeac6b291c493e6f047243a169c1009518

SHA512
47a08e9ed4e51dd9cd66d272e05644159e275324d0f54e3270d419de755463d89c6fd5f125cd9373e5397dc70beb57d0a892cada287e66b1a1c7bfcc3afe1d5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
435ed5907917289ccacf3c5afd58ab1a

SHA1
acf46a908c4916d97da7d2b115a3b4c7ca2a0581

SHA256
96c1f6d78a358c7ba3294328367d00c78936ec3db27c3c186c36fed77983ad11

SHA512
67c4e59c23b60e4134b430c0f5af8a315da60ce0940c55294ea11e8081cdb01bfea3f7f051ff77cadc2f54774283d2701664028ae716314aa901d8ad7d14f910

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
cac6dc2e884faabf5308cec2690e5cea

SHA1
4cc5658852766db5411cf46f1923b8f27f3ebad7

SHA256
3c3805c94c968cc72717f13eddff505af7532719b5f21d033c479b78cfae1ede

SHA512
3340f7c346ff78028e3155f6b64c0661b45211d12185069ed03489e3f14109c32c8782bed499b205dbdfbb478e06f93fa88a2a6e734ad4162431652ab67106b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
d7ef39b5df4abf1530523fc571137bd0

SHA1
f4a770595e3c61e9a403cbf0415e6e8c5843821b

SHA256
9c1f728d573f7cf6cb238adc8041cdb00758366f0dda9a9e3f60173a5b778a00

SHA512
34d949a0a19169ec1b0cb54cdca6783c39cf5c5fad97b83dd26d809941cdf2d2ee4cd853fd4f880cff0c8b72edb21f3bdbe161d13a8ef6c4c2c497bdb10130af

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
489c64e018672147a1cc1db62e86cff3

SHA1
f6d205eb041781c0f71bf8fdacf8cc6b29526b92

SHA256
533b12849978fe0f93e7935a6614aff1392a36dcf397e50a4ffa58115d6e08ea

SHA512
915cdd6d564d11fc5c32a1fbc4c624572923d277a317f41bacf4b334d6cfdab3fc25dc8a598013b4d3fea05d2e085c408039fc44068cf0fcc34619767da3e320

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
87d08edcb4a916f6ba199c5d4fe0cb6a

SHA1
76d6cb0ae8b38f860b730235816469918f02b928

SHA256
48c60c25fe0f8209ba0988423e387a3e2f3995126ec995b603c052fcb64cfafb

SHA512
a1ffde23abd50ae4028996c1416a605a9dab615cc7b862b6aef991079e127b99146547e4c96534195c6150c141b7a1083ce0d7cbef8898a130bb8a2b3cc96510

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
ab8bbefd0f429fc03485def41559f570

SHA1
5134715bd8f4fbb870bb129c6dc1d99a1e7caccb

SHA256
5d5481672abe2a8b370a2b19567972cd2959640334a180064c842aa8e7c3c43d

SHA512
20d77063aa13187dbdaf279a61467bf6c7bfccd3e221efd4c73661227a5cb7f71238d8f7e0effa4605edf894be1024fb44a5018e78ee531ed415f9ce3eeecc1d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
1070eb1b81cb97bc504159dd2a2110c1

SHA1
02b528081e1c493e96a53c39bbd83a00331bddfa

SHA256
0f498812ef62c3efd927a02b918add257434db90b8ce00a0966d2f68763974fa

SHA512
b3ea0c1415235640a1006f22b39c753f0abc40e1d4bace563fcef7efd2cb15eea8943aea269d54e2e9691f0489a3421ad43fb7d2a2db0cd71a08a4ace3cbde59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
4a4a8999ca1abcf8a8348dd477f8eafd

SHA1
f5f35edca7e3520c0221ddbc225c471cb3a0574d

SHA256
7c4670796094a5ce8a462e5dc753e8d94f2fbdd8be06e259611e414cdfa24a72

SHA512
02d199044d22ae55016353c3fb6ca516b6e5b16148bc84407a0300902ad8c46a89d6e42746f8358960b551c60f1f4a825c880d16a0c0c741e2b7f8ad498d2493

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
1f0f8bbc7c753719c7d4d647e12c01ad

SHA1
6291f65cec0bf2aab47f74108713abfd4176ebea

SHA256
be1754964fabde46d0d3b8878b34935b8fc28d3f7a9f480b3a68ef5694872c23

SHA512
c418588d84ece4270fe9393043e087667b65b430c5b6b8bb20241f59e3636ccc58915e90d7e45a1ac47f2c1cae4d49308198991cc7f5bf376fe235dcce6a50b9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
2d8f42647399367b084d8e4066c55b89

SHA1
3fb1d950afd10b1a149c53459b105bef894d4a15

SHA256
79d87eb6ae97cbeb12e693555af65a0e3a337bfd4deef480729cda6ee0c61be1

SHA512
3ac516dfedc29044d71bcf199a16611206117e6ddb46857cd006acf0b8b7e4312a4569da9b099ed154e4445c320135fe7c4231c4500c93e646483b54a53fe885

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
4dcc9307594e0bb2941741865198f030

SHA1
8a33e8ae23f5e7e5c6db12c4794311fee3a8a74f

SHA256
c371c673ed2f071fdbcfc59261e4ad2cf664b50240a4e00613bdeb7a576705ef

SHA512
9e398766f7d8fe39e950a619b9600d64c04fcf39ee3028805473325baa4e06ed0f39dee04c0304e52517661d9a130334201130263b4c4e4561d4b1792fa49819

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
3dc2660bfe47480919da679a80e8a081

SHA1
18a0640e11e1e4908f15e025cb10bd7149016780

SHA256
ad38dccd3e49aff15755409bbd850ddea37a2f47bcc1df65b61f794406133c1c

SHA512
d9ef2c8dce4eed82b7c516c89ee0ec2f6649d6f6bd7288d68c84cc91635feab817001111da9a8c496414b246d309becb4612d3188c96c58f62b9bebb1b99409f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
bea1dba7ef6bb7e59e6a0caf311740e6

SHA1
ef7485581933530dbd347a92bff9adec46aea644

SHA256
b18f22316964ba4e353759ccfda779822760d536b2670c523d6f7b85326ed6a1

SHA512
dadac95ccdcf05004aa2bf0ca3939991b9a1fef32f9603711f47a65dd50563c17ca77802669cbf109d747a924c0aea0f763788f8ca2d04a1c1fbf0e1b8b5f2c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
799bce5e5f5bcf7580281aa9b2281423

SHA1
28f424a4451d5d816e4fc36f86c1a60b862cc74b

SHA256
28823fe434d53975bebb4dd277b6b3020ba67fed62e70c0aa577eb35248e6604

SHA512
bcdf1ea796ee4d001bf266ec59c2ae67806657a53de7ce6800df5abe722b2c825cf2d8e03d1f0cf3f1e7004e60a9021ca7283a8e14cc3ecd72c10902a99a8153

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
3d6c7dee712defd7e7b1aff69e2cdd95

SHA1
dd73d3df2ae6f386c0ac6ca22e7872eab9df74e9

SHA256
7ec91690f0230d49e89d3120a736e77aa001b5c4fafd217d929903e7544ceb9a

SHA512
709ab3e9acfa975d59d1074c44f807620403832199aa9f9dc329e179c42f85687dc16a883708c49240f58dd0eda3fab589aefb546187a8c4065d78a3f4eb3c1c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
ef0263ef9f97ffa354741bdda8bb53c9

SHA1
11b206fcc278fbec70007488b51931f821ec82e5

SHA256
7638e55079975c85fb01c0dd9e5e099de91af78465defdd350483003ea2b0ae3

SHA512
9ec5a1ecd5061c4072398930d71c0f71093a41466175d9db620e59d3fda530b1bec5921c7f11aec710ee24fee67d0f19db1214a1f33b0db7bbf4d1a016dfa9c4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
3acc5b4f65d061bfdfec0c7e7bc2e2e1

SHA1
c7af800f278420bc76f8fdf883f088e4cf1fb996

SHA256
36c3be5d6165723e37b27aa0c05e08b479dcf94862ddf854e7875e0fa10d6aab

SHA512
474bb5d432d841574f34a91b833e5bfd569b23b2ae109c6bba9d7e2a00c71d455960ccc3c3d60e339688eed95162e3c2eaadf3ec17afcd4fea578212ec702854

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
7f05903b2432cd8666344fe649a68840

SHA1
ebdeb03d35401a7c5c3c5999c9cca06289bd1281

SHA256
220998a8bf6af061d875c76b7f6d6bddfcf534c982bd8de9a5280ae4485db4d5

SHA512
2a43cb146e8f132aae69ae0f61e58815fe7c97b96ec3e45f838a87b8aa4838ce54014b705930b378204a495b8b6123862970c711b9b6ef89d68d75c891792044

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
9591e6934b36a0e822b227da1184c3a4

SHA1
bd334fae2e47b6f48955fdc29af91f9ae2660e87

SHA256
ac6c66cc43c603f69c220b4850a2a54a3ec188ee9ac4e248dd9786dcbde8fb22

SHA512
a743a516d251a88c2e154c9f9f6c3818b9c143f44c16223d92f6daab7b04a95dfa5cc077fef2276d169ed4f0acd5594a068ca3efe7a886dfe638a9cf351e5510

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
55944439bbb9e6aa41009fd028a84358

SHA1
edb443ecf813e7adcda09111f48ab36ec8761588

SHA256
0f2ff8f204870a86faccf71d59e0bb9e181fe8d2477e5e299c907a23d609f646

SHA512
9a5e97b24308ec7e4dec96a7565a2c8efdf90ac7650f017916c3769da8c0d1077e77255433d7574d580df66a7654077de2769fcb68a08ce100154e4b3aa845e4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
ef6488455b275195e59210ec99b8ca23

SHA1
4c0a2c1761e8e100cee3e2238a801e6666d68fe9

SHA256
7db8716a5f3a710c8f5b015cdce97fae88f40fc6423be90f6172988028d8b689

SHA512
0deaed7bfa1175b073c9d23aca98560e4f700877c816e10ff13d8d424e4a2ffece34324b8c790d35bca70d53f692535f4a19b7f19df98c5898b3f102cb86f940

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
768c9c71a9ba9a4baef5cc128fb7f230

SHA1
a3325f9035a4d616c4992df23013a006e4e1aec2

SHA256
a773d0e67b3274520166ac58c8d4c256c27ecf8b30b407cac3394e5e9f567d81

SHA512
66c4c8469a7878bb202c47ada10da234ed6d4982aa300338c2f657abe84b1258e97005194571879cb4ee341a65c6c38819638700f99df983c05f5306406f3928

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
348a34f59fa7bb8900717d8eacad003b

SHA1
0a06b24e75855b582fa27248d7aa85a3dcceed9e

SHA256
57643450ba049ba35a02b33d706baf3d12234ebd77600f33fb8d1dd09ab772e9

SHA512
4899185dc4e42e2540684aae92de899a21a13c21fde7a47d18bcf9ba9b372c2a64075805c4b55a62cfb46983eac8db79cd9b2454763f2606176919eaa2ff7806

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
851e74693ce765b432f22ede5db66f1d

SHA1
b29ead6cceaca2284ebc72badc2b8be971260d81

SHA256
68ff9d27de17a6db16b62294f76a3b788bcfcbcd25dfb578dd92e7fb6d7ba453

SHA512
7801940bd7458eee8bdb0f2252f6edd7ac2250bbd296fa6429e489816d717bfcf55bf75406faabea31aa5e4269753d39adb98c9dacd6255177c962dc6e0a0557

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
9dad9cd0a65aa31731d9ef9dd1ae0b21

SHA1
c475707eca66c78d4bd9c42d38033f974d300bd8

SHA256
a6b615146781a6fd52698fa1be0a19d3ce9e30f33843cbc4d80353cf9f8f79d4

SHA512
1f5139dc1f3f25aa641caab34ca81122759a68f2adbf9f0609e0b5c84878767be5dedd0f9789f9cd09552b793074d684b683bf684773afea60a96a3f35b63f69

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
009ba00b2b3167f6461d5e1551a86d16

SHA1
517d0b891ae04345c8218d4462ceb2d017af128c

SHA256
fa959fe02e5a5d3cd429b953720b87e426d819ed40f18529a0a0a5d4874af9cc

SHA512
7732ee33971bc430ac13e9dd1632f9113c32f471083c2cf77f5268763d1db70df8e32e9db511375c5a76699d5a63f7e6f40b84df3032ea5b3448f59e5de3b71e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
03319c80fcd3d0a62296ed378c57ecdb

SHA1
d2d065e150d95f7f432dcf97d7172121fcebe68f

SHA256
38db2dda5e979261629175384fef3db8ac99e71e170fb1ee45b0918f0643deff

SHA512
9ba676e17ce8f056298f1efc0d85fdf820b9c9df3a69688a67dded2d70720197bc2aa6b91aebd2cff6e227c306dfabb99c94d7c766cfa59b9c5416672c0306a9

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
2e7586b1a5ce58bbae81c63a35b76859

SHA1
f203ac18d092c1220247b751e942be076298c67f

SHA256
d43d05d9059ae5bb0cfa0080fbe372ad04cc65199a788acbe6bcbb8bb06b5585

SHA512
938101f4b536d559e62bbfbe8b38ee8324a92b2e10ce12b0d4448a30223467661d086785f40f9ab442ac3cd270fe1495701e9102472fe97c096bf591bc231969

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
243534e74c2d2ccb0a8edfeecdcb7dd0

SHA1
08a7b6ee3cdc060b646351877dc97f3ddcfcb0e6

SHA256
77040523a3b7e18114639710d68e3ba205d76497d10bae6a9fedbe7b64574645

SHA512
611c93ffd6a6a0e7a8177ec83fa7cb4ac39b7782f738096cd9a34640100efa99a96eab45343eb08851ac4188772c251b452664d9b02c925b1bb323f9ae119b69

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
002db7d03bc85148729f394e54e74fd4

SHA1
890ce003a028f051be9589b1a0b7ef5ce44b8fd8

SHA256
22967d4f92b989abcc83945a7dd4cf12877e4520340f0b9d4c7a89d0ed617306

SHA512
782520d3666595015030ec8dc6121ec79b4710ec24571f01fc9a90cd5e366e71b8d3094a52f66c0e4dfc5634b099290b3111cf05e48662dc60f8dfe036addb7b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
3e55887aeeaa96ba54c6b426e8d9895b

SHA1
414854b2b3b9b560323ce7f7fd8726489e083107

SHA256
13e246935c5b28f0055ff62ef341f3d3be6c3b029ab8253910db9dedfdc7b3c6

SHA512
5a75f9b23a36c47da8e9ffaf8d30936e1b7fdad57222c005dde72d5bf40b882a11106cfe0550c1b03b9a240416632f27f2c3822f17da16fa6749d797b759a83f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
80b1712247b9a0052963b71752c3ec49

SHA1
a9985b1f4f3da783c4cf474d5ff693010a3ad5b5

SHA256
27edad115433c19101d4448514628d64ebe8227dc27a7401c820b2e3e88f05b0

SHA512
ec5296d7aed7000ca7e5288d1fa38adbc7ed3d6c8de98a52bc031671f577511589630653efab384af15761decbc890cae57d8fae059f96594cf5d4606191063e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
718c3ebafef626e99f89c22447c5a0a0

SHA1
f4d6bb35e6eec4a702247b7f62d9772b69b477b1

SHA256
529d7161c447d710598f7aebe363374f3d403e22ad3cd8550dea993ad0a9751d

SHA512
2fb4a1496e6adc2dddc5704153f483d693a8ea5b5350d7dfd8eb2e8210edd136d1014b7a4f430fe8da103a4c279299771e525c5d4df0134a2f14042c7efb8572

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
d5bba3e3e9567bbd291b33a7729e88e4

SHA1
f3cd716e66e5a6cce1a5a8435327ab269b2b3b00

SHA256
315b8d30941a1d328366b427d359bb7fa28fc296d95ba0c974d99c7742f358f1

SHA512
b2103db3a8775694c557cbd03628174c2674438a6b45c893835df764258644cf4c84d70a417cb28c27baa771bb6c38de697847d5daeeb059f9875ed08e82e3a6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
e25e1980b2c0f8308bf33e7e3fb4d88c

SHA1
f053a23d3d95c0cff029928f092927c38743a6f1

SHA256
85584c9cebf02ff8b2a6a3abad5f73477fb997532ae615242115867382d2edb4

SHA512
76021fa3ffbc1fbba71bd9b723e76730c16059fc28159c06905242c25af99fd142fa4e2903641809a14335eef9e79f3c9fdc2e5d9986ce4a0966007726cdc6f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
24a618e5d67b27b32c4dfb1fc87a1f65

SHA1
d223c0d0bc629ee621983ac12f34c63660c8a41c

SHA256
eed253d95cef34deb8ce245bd619e85e094530936f863472b6eed2b6d301b1aa

SHA512
424953b1aa40dd3e1fdc7acacd2daf3ae42161ad1dc9b1432d4d1bcab78767c9214ccbaf055e445c19d689d415e398523f51327e1e40d40a30f1163109f55a2a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
d72a39c34ef96ea65ef518ba82859928

SHA1
7a7342c908404ac94642648f660ee6fbd3cac7b1

SHA256
56ac0b327711f99d02bffb227c6b4b6aa9bb04a9b0aef7738fd50b55b52e581d

SHA512
57543092905e98dc7ce97f68e87d4ad711e0c3587f5289d86fa818fca07cd302cf5a63a586c44def2d1d961b849b3e17dcb24168d8bd5d5cc9e2f257fe522757

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
41d207b740bad1904b1976cc21b78057

SHA1
6aeb76db62a590b32b8ffd6471ddd6db2cba6113

SHA256
8a80794a72ca5021e9ccbda41b4d03ae2cd10648d03b1eeb50a8af4dba49a712

SHA512
79097a068a319b7cd953c71623ff09b22dd812541f612b0496248bcf657a05751a7fda73b8c9b7784d364c287f3c416d6a98b8f5e3c2c2278f5ed648a327cf9f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
c4154c13451eaa54727e5c3297359191

SHA1
c76e3ee0b192f2481a809bc2401a950894fa7585

SHA256
02c731b49375c332b7a0df13a7c6409da7bce9b6e6ab6d7e64874fcec45aa122

SHA512
b43925398d375b7a80eb691890c8520c7b6f9d30510061de2e14224675b1ab189b0a97abe3bcb75e1e6af9a667158ee81b4ceed26f2e02584228a2f4eb64d223

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
0a41a97080b262ab97377adafef74e71

SHA1
27a1b930a4e41e3a71accf5a8d06908fcba54786

SHA256
8996ab843a82276aaee314d482b6d6535b61ca3d32bcd8e2a23f3e7391a51f4b

SHA512
5c4631d1e6f2d6441f4647f4b44db9e4464f9ff76231b607fc45520db5d25decae1f21da89166743e863dbfad298d79b47267b72d8c47a15801ef991b7123b4d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
176e0ee5bb675378fe2a906cf37c0358

SHA1
a25a55ff163fe704fc61653e613922f0f468cdd9

SHA256
1d0410c7576082458664722143247f8bb8560556435c0ca2e729ff3941c45e97

SHA512
2df819949f459fd16f8a9cb010cc3049d03d1077cffb741913a71c809ade82f8ab76d9fa1f88bbb6f8133d537af5b278eb265e1987f9e292b6a7b21afbaea3a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
8c85220c966399da82e78e92882476f1

SHA1
1c4b86dc9d6155ae93c8ce7a4f6e27717b208feb

SHA256
edda15dadf96037d7acc37e0c431ad307dd0d74f91be93f6d7e130b5924ead06

SHA512
5860b83cf2528ce55de695eebe1f649970088f266c774145a6ad0b77b72e6a60da371b42021e61c8c74d16224e74df247bd0a53c9e8b39d240834d6502004ae1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
b06e714b1c8d028b343390a3aae1a8b9

SHA1
6c3fd9240e8e49aee4a77e97e477a546bbfa2e18

SHA256
f071808aa03f25380569288f64f19e5cc8abb6156e1908d6f466dc0efdc8786e

SHA512
af4d6af9c902acd45d0ea7c1813d31359062870d2cee1359a3b3cad5667906a6de55957096590da04e66aa90577dc283cdfda0e1913e7f386dcd6b7ef17f3d1c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
0790bb852a4bc1d91fd63dd0c3d0eda7

SHA1
46f1ebd917cdf168052c31cd7d6dac5d01c3b34a

SHA256
ed75f71a8a39f038af5c060777f5219e920019715381d002fa282676c865df65

SHA512
111bf07cd107039c86a8e761f62951728b364025c3d1c85f89fe1b6cb41d8532da358fcc35f34a136c977bd29c9d6be20d01724bd0feef2d23aa11abd1577e69

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads