2e3926f66c4ed325d3145915efab797e44ad0f58acc291c30637a5267ea615c4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-12-2024 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Size

12KB
MD5

cc21a1139f4c776eadf232306d5aa684
SHA1

cea71702d3e5dc2f2f611d8b091754b692ea085f
SHA256

2e3926f66c4ed325d3145915efab797e44ad0f58acc291c30637a5267ea615c4
SHA512

cef78d50e62729f77a78d6197773b4611f8b661e415e313f4acd86af8f43abc7c297e185c223d5d8ac98332e1dec957b9ec3028f44675aba93d9611ed3b6bac1
SSDEEP

192:dj7RW0nlABG/3Nfv8tiTV3HGc7EkpAqjEnT6GpsHcxUw4h+lfPtRMNajSX7:zWwB/3N38titKkpAqonTps6B40WNH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Is9h1N0MONun0RN.exe"	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_environment_variables.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_neutral_6cb3fb6811a3f83d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Quoting_Rules.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\channels\OCUR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Foreach.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\erofflps.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_type_operators.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Parsing.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_neutral_3b741ca76444b9c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_script_internationalization.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_While.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_neutral_15bb3ed734fbbeb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_neutral_7c21481229e1e66c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx004.inf_amd64_neutral_2cf95f307381e481\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_neutral_80ee226e29362f51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_neutral_99bb33c9a5bedaea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IasServer-MigPlugin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_wildcards.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_neutral_b8ebf59556c3dbf0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_neutral_085226e1dfe76c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_properties.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_While.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhayes.inf_amd64_neutral_507db5d34d7acddc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_trap.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_neutral_fe5c4f29488f121e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmatm2k.inf_amd64_neutral_64a8fb018ead55a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_neutral_856142fd87f1c21a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_troubleshooting.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\about_BITS_Cmdlets.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mstape.inf_amd64_neutral_c2bb3ef1c45cd5a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_neutral_be11b7aaa746e92d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Arithmetic_Operators.help.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_thunderstorm.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01035U.BMP	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15020_.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_bottom.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_dot.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21296_.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_HighMask.bmp	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\dragHandle.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01244_.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR6F.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\ActiveTabImageMask.bmp	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_divider_right.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macHandle.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SplashScreen.zip	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.DATA.resources\8.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..filercore.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_209bc1f2bf7aeb04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..rting-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3295657625316fa0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_6.1.7600.16385_none_73076dd9cf3a9dce\Windows Logoff Sound.wav	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..pc-tabbtn.resources_31bf3856ad364e35_6.1.7600.16385_de-de_722e878d194be5c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..panese_dec_lk411-aj_31bf3856ad364e35_6.1.7601.17514_none_afe5eac6921f1c8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wdmaudio.inf_31bf3856ad364e35_6.1.7600.16385_none_bc5c4aba33d6af68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_moon-last-quarter_partly-cloudy.png	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\Boot\PCAT\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.spo..oncepts_v.resources_31bf3856ad364e35_6.1.7600.16385_de-de_704a968fb4cc0133\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_napsnap.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5bdd2bf01d7bc0ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-msdt_31bf3856ad364e35_6.1.7600.16385_none_0bcbfdec6b984220\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ieframe.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_d9272dc26349e436\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-bits-proxy4_31bf3856ad364e35_6.1.7600.16385_none_0d39ccd1226840e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.msmq.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_e342842f6d83c308\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..cyscripts.resources_31bf3856ad364e35_6.1.7600.16385_es-es_73edc4b92446fa08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_en-us_9cbb1d5656f57791\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systemcpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_152b0a9b894a4531\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..ablenetworkgraphics_31bf3856ad364e35_11.2.9600.16428_none_73fee6b3701a345f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_filter_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_a9d77998142ec36c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..xtensions.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4b73508b0d6a645b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3946be823da1aac0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-msbuild_core_schema__b03f5f7f11d50a3a_6.1.7600.16385_none_88c445c97b26f0fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5646c597a746df57\settings.html	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..oundation.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bd4fb7a4da83f8ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..e_runtime.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f32580d6cf22ed9e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00010405_31bf3856ad364e35_6.1.7601.17514_none_ea4c8a7b6c447320\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..idmanager.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_eedfa904cbfe02f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\4260e87dc94e25052b34ea78873dfedb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..eraccount.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2cf978a34335da7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..installer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c31f889fdc5c9c1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmiperf_31bf3856ad364e35_6.1.7600.16385_none_9f706a4c13ab6b41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-assemblylist_xml_b03f5f7f11d50a3a_6.1.7601.17514_none_2b4e40c201026eaf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..ager-core.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3cbcaca4ebf0ce6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..iles-core.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ec506ff0bdc9b5ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..andgroups.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1340f4790119b230\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-restore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_706db3f8d7bceae4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..oradapter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f5369791f5ef9fd1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..collector.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b36f5e7b32a82f8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.build.tasks.v3.5.resources_b03f5f7f11d50a3a_6.1.7600.16385_de-de_b1a76b317f391dd9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-nature_31bf3856ad364e35_6.1.7600.16385_none_d5909570704a09c0\img3.jpg	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tapi2xclient.resources_31bf3856ad364e35_6.1.7600.16385_es-es_44cecad90f56baa4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnca00d.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_62efd6227ab667ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-mshtmldac_31bf3856ad364e35_11.2.9600.16428_none_5e761a2653ce8cd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cryptext-dll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6dea4504c2e0e073\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_sdbus.inf_31bf3856ad364e35_6.1.7601.17514_none_d008c232e0f69c1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c216849e273364de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3a85e924971b68fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-kernel32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a3645f7773564239\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..confg-rll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9169f04eb7bce565\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\system.runtime.serialization.resources\3.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\dcbadb02f6000b436f1cb0fb736df3ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\ehome\MediaRenderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_ksfilter.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_05716bfe9bc460c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_1ae1925f96e1ea47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ostic-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51a64269f04431a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-photosamples.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3960237ecfaa3316\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b6e52d4a605b78ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
File created	C:\Windows\ehome\wow\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZLRXOYDNWSCIXAP"	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\ = "CRYPTED!"	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\shell\open\command	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\shell	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\DefaultIcon	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Is9h1N0MONun0RN.exe,0"	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\shell\open	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZLRXOYDNWSCIXAP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Is9h1N0MONun0RN.exe"	cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cc21a1139f4c776eadf232306d5aa684_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
283B

MD5
9056132bfc4ca05f70082f3c57f0a6d7

SHA1
89bfd3ba45277e6b91e810af623708efd61a1961

SHA256
6b27dad9a0384d693b4e73fe60523abcda625f0a80ca152c576aef4b6da31e16

SHA512
677dff65c9f7c607b53484c7a075ce6f7a8c291b3ec2412841189cb828fefde2db7ccb46c7d775bfd075e1a6d35c0feec86385fe2d5c7d067e96f9f6a8c9fe30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
2d4079aa8be61188a72344b0932bb362

SHA1
0dc07f656faa95173139a82ac89823a5f5986aaa

SHA256
fc8691d0ae0685b85fd116038f3df362d17611d3d624be3519c769bc243ac3e8

SHA512
41f7101a6fced829874c59e9e74bd193d141b26f45e4223075fac738b616977620499ee96f4a9c3ae671f79ba7e208680af6116e32e3f3a724fe2165c8d0f7c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
f3f3095944ca29a54a3b2df62363f473

SHA1
d74c112ec6b0ff6ef2fba808e397c8978de80f8a

SHA256
1ff851fc8f7d519af4b4b21b6c93622c1e747471f4eb6f09668433be07e7e228

SHA512
037290bf57e735037ce59e4576fc7ffaef97e245212ed90ae273871cad87a6de6ae7b696b2c330e63483e492e208c264d8706ede7746453bb7c11de75f4e36db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
96551042114879723c1b0ee4ef74a26b

SHA1
8d0ecd8684417ae9b298bb9fc21f3c0ed3ecae5a

SHA256
50aba2d343ae961e47921d423987749f1bb185206fe09e94ca6ff0d46e4cff29

SHA512
57fc1f14afbd2ab5ee1335ae08019ff111865cf477c36ae3730bb5f163b6586f7d87aaf32a7901e62026549b9e18c8f389008d281c3579289106f28a9b88f62a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
ccf9c8dfee86df0159a5d02327e67595

SHA1
a3d8f180997ca611c6903c123c2b0e33b30a0175

SHA256
1578c83d13c75296f5167c39e3b2df0d7b342003b32d99eef4234deb5b482f2a

SHA512
a6c4875800d01f9f9b01c0e9b52b5afc0cb1946c78c0cacad8a1288ae3237fd5a45b9e5057ff04ad8936458bec857b1ed9699fc7e12973ba9eaabe0633305d11

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
c2ea02f3abbe56596481048e11189692

SHA1
87e677168c2e252ef8c58f80ddac06a3e243a36d

SHA256
49a6e8d7f44e6115fb9cca99fec643325be3b211144325b0a45f2e8cbeb2c642

SHA512
9a58ee8b9a9f8f5b7ef389fdd4c48a355a075d84a63fc7c832b3e3b393738786e48b0cec9b443596a31ae427c00f7dfecc3976798b6ea4017c5bb83a524974bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
9a8494240879fc9cb25622797d5052a5

SHA1
3fe68c3fce9e709ccc217c9487e1ec33b67a610d

SHA256
cc29a0ea0c025ee3bc3b78d3d1337cd53d0a427e39af5eb23ab0398874c8b0d2

SHA512
fe70f39f0a027ee139166b2cc0a28912ad3315bd279843c20ac02ff4050590464f38f2f9be8f1d3946bc3b056ee3d9cb8b797214d9854b096b33843b030614c2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
9931dbce6ffadd2730d347ed50876197

SHA1
fdcca65c032633c146466b3a39ec537392b13990

SHA256
a69921e549b18edcfd64c90560906eea7889f8ac1b767af38c986cfa4cd8431b

SHA512
57a482fb62ea305d49064ecd734ea748fd2dfc6c8b370c0e5bde0db2c82737d4ae4bfeda26fd3e446dd3bd0c58ca6695ab09d36923f29d9e234229ae8e4d083e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
e360e8146e2f8dd5cad7eba45f15455f

SHA1
bdec9e57b19adc72840a847412e97dce4cbb03f6

SHA256
19fbbc0ec4b3ad0cb76ce472e9a86cb456dd1730764738257ed8a29e70dc1acc

SHA512
63ad23d8a220d0a33c330df132257e56f6a87de27067ca1d19e8b22f8afb4597efb0bf2c78bc24631eeb067656a2a6916791ee40b37acd43c4afd56ed2229846

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
201bd6f12958600a0d062d708f68a1a4

SHA1
5e760121dcd2a360e27a49aa6650fe2c8fba5d0d

SHA256
553eaf3fed9e5afaeba7339e6f8f43ff71d4983997e5403e6e36b1657182af11

SHA512
e29d40e442d62d82b15fef711016324e327f18fb220d27e38849023414a164b486d28d45e93b0e3d2c2670c5ff387e00ac843fc75239177ade67cc4e2782741e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
a5b798ec7d62b9862b864e200df8b357

SHA1
b57609804960abbe3efd5fab0df9f347e10c4c3f

SHA256
9e6db1dce9b250d3f6e3b697cad15473caec0ac49768493f50d78fbd91d98ecc

SHA512
9dc7c9237094b84b803ffd8467028d99970bb6d8757de861157deaecb004167661d5512eb4eef888a8bf8617c598f2caf50d910a43b2643b23effece11e38d09

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
9c29fe1d49116fc545ba1264b52c28e6

SHA1
bce91c4fa2e520c717766c691f0b353d9db82010

SHA256
b04d2d427bdee8485398ab16cf5a3ee089f06689fce825d9242e5e6e058c2706

SHA512
0fd23b986ddd39166d4ed33559a9d7167fc5e231ea4ee8a0cd4a8942aa8de8378e721802c593c8fb680801d13365f764814bbf6f625471dfc39027d051ec248a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
72a95c6d72f00c460c87a717aa834ba4

SHA1
12cb3521b326b2e7ea26ff2277bd538730367c37

SHA256
b4424cc6f13b73ccf6e7d9e9ecd1eb0b26d4bc6857634dadd243a8a954ab50ce

SHA512
290a6cc1f39feab0060287ef4187b6f453dab2b8fae3f98250c761a835a18274e5a4f6c9a449e99fbdabf2135331da20d484cacf11c0065e5482eab90e6f99cd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
8ba153af59557fcfa9067453c97aecdc

SHA1
fd6fb0878e1e6138d940defabcf35b29f9c639ad

SHA256
3565e23f2814f52bbaddeec8d909bcd55f8de0149577a7e2036ed270843a342b

SHA512
a3ab0b7cdefab78ebd665709e3a1f4351a0dd81e8f9d5df662b4d02919be0a1a8cbb517570218a7bb9d2f3d5258f9d1a9f23514a1f899217db477490cc1a4cde

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
7fe5bb28c46264d8dbdc500958833d41

SHA1
682d9aa3030eeb7f56bca3d64b8281c86f39e51d

SHA256
71f789a1a0961641006b30a92331ef4c350335bfcbf6238b1bcff1e4be432eab

SHA512
6120058ecc0a425719d6e726aeb6539a460734cdfd691868bc424d53157754a7f59910985274654bca5f9f4af6426c5b9b2796163e82737807cac3923dbac626

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
5dec7f0888666ccedb22aee154e61b54

SHA1
8e2b5cbde0be528026f482a60a4f6863b15f9a57

SHA256
1011714d8e1239c3f4b958e097de84cd449f9381b91715eca271bebc42e34ccd

SHA512
29684a06271bf9e5b9fb78277bb22cf7db756fab8e55feae2b1d2d359655f232f44404b452089ab54dfb060e012982506334e9ce5a8046e4cf949e83468a5140

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
125f61a5489e0cdd1da58d64886b58b2

SHA1
05acbb0865114f7ada8f2df26611ccf4b7092341

SHA256
341cd9e2e558de6d147d224d68cd9cbffbd739e95e2c6a75e203c0b20793bab3

SHA512
937307255843b04cb600d2858c839f712adf8f2e4eb1062ddc4a4f9c72296afc858c1e88bb8366009ad788fa6e3f8e09b283d3a8667545232bd78fe6058d486c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
2ae7c2dbc093bcebe6a59553d45403f7

SHA1
e128ac26314d9e254f9b5429f6713c0e6f7f9ebe

SHA256
c8a42426a7aeb2199f89faefdef8f00d01767746693fc0528a0c4d0ff6b62ee7

SHA512
ed784d5551cb66e9d6df43cf2904fb877e123595a5e010d828697e7b7fcfcc59e7ed6f070992676092fd83eefb7300c76bc2a9a959dda6b97b47c7547e17fe92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
142a0d831033b1d0c6e28c282dffe130

SHA1
d9dd8380c6950eb9b4fe5eb518a7268aba352b5d

SHA256
c8a815a54dee29b071f4a6418eafbf7f7bca9d0cd1f6bc83baf60456677bb469

SHA512
2c86f49831c41e10eba88018d4b0f4f587040abbe28b39c5260935a012bc39c854bebb4def884d9ba9d1083714848efa6d4691a95efe17bf0fdeb7c6142d2d0a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
a0be433e5a8cf515f9335854ded08667

SHA1
1a6e0642f3064c0514971208b4ad9c59a5c9b852

SHA256
a9b821e75ae9e7d3435a8a796b3229a4b6e3906afa689cb430613093cd59448c

SHA512
9c41666c68b88ac9da783c9dd74830fd060323f8dcb69dff7555dbe6a09414aa06b3f9c94b48ee5c4634cfe94acfbd718b71a519ad22a7494c884048e54fe05e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
bea6e6842812dae39b2a3e8dc9100bb6

SHA1
2e31fffe98304252f508df912578b1376d630b00

SHA256
9c1151a0636e71456e7e466c8f97e80bfb2c0f60bbd986b994bd7adbf75d22a8

SHA512
de2c06e386d996321893df93d65a235956644b5461cbdf395d831e283e0ebd133cc51332f6fef6b7be5df63fbef59b04b485afa1642de6a61a39203765b21632

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
60e601776d3e65aacf1ffd0aab374f0d

SHA1
c106e075aedea4167f3a4130f8a7f62fe947df9f

SHA256
d27b1cbe25f624efc007a090f3543edb11a42aff11e87336236e9bb51e542bbd

SHA512
410eb05c5d0852578dea3ec9a49d368dab0cb2dfae859aed5962206a0ef6457e02c6fd14e8a92d11b64121447249fd4f8bab00ffb3e9c63a7ea15f1377ea4527

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
1befe2a6d0ff2ec65ca6ceb9c4a5820f

SHA1
fc15815fe652c3121709e1db2eba7d506bac32eb

SHA256
fe257eb7ecdd6c17241e82f8ea0cca2db56e898f9f8b1862f89f132e9ecb7e07

SHA512
9eaa374038ce2c04d8d35ce2ef9cb90150af676992ab366c2fda337b6417e8af56f51d8ae3399d2623f534ff60ff70bf05997296db7ddd2f117bbfd2dc44df54

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
f76a3df3edf449e24ad600e51e41868f

SHA1
f0b1dd00f7f5080afef01f895dd4e61e27f8c10a

SHA256
7294cef586fddfca39bc3d7b1ff4e1e0a020decc1563e41f0a894ca3ba18c50b

SHA512
d530a4eeb1e8a306781d4c6d3e38ce348bdfada65463513c8931b9b00c0250e3d0111c33358c9cc9ee6b25ad594363ca051867549886b62356b4658409b4678c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
319e38acaa07ed319388a3058d4ca5c2

SHA1
6619ea7f4125723b6cdf4039458dea91e6f2b474

SHA256
b5ef48a0fb9f61ceee332d3321121a7f05b9a58f9019ce685b634290250f6902

SHA512
080ff3f0abec6f6c26532a5012c31d984d0f68564bf2ad9b898d4973f8740c3a2132338860315a9e19b79e224696f6424b6a3cf8482ca7a479ebd93294051f1d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
8335e341f788b608d80787542ebb921d

SHA1
1e367db36b8be317d0d832d63fd1e11151bd452f

SHA256
b3eef9208d2da3e4f3dca30a2c3d8217e312769269cbf255c4f52a1d7e981517

SHA512
08cc2a0b60899813de54167bae9977c6be426f54b274f20d6cbc6f7eac869d66e65fd84c91a605d19837070bc849d517b4ba2a55eeb5963083bd8ad2fe843d18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
acd77682cf1402af75baef1bef83dd0e

SHA1
97e86be21093a8f68fe9d232521db3acd17daff6

SHA256
3b0a82d41c80675026b99aa27c81966ba808748c74c7cf5c2ab9d3a0f630ec1c

SHA512
cbb26d0df1f55c93d2ee6000893438f7f01f5f701c736eca1a6760e8a3c0095c5cba77256896bb2a47e9fce92d311e1e4a5495cfb1e1519e0e7806001c0a885e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
81210be707035baa596ae275f0ecc126

SHA1
85cbdcb31257c35754f4d9a3c6511706a5ffae5c

SHA256
8008c61c081fb80e0ca3a15ecdc678040319571ec166ff8c32bbd55dc0f111dd

SHA512
34b37a0ef630202d77666ee2a715e2cb0babb3db41afce924da6c8f867308a0a0d93ed1e7f61b988ee01ea66f6ad56c043462dc0c31a21ef5f33c57972ed7c6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
ef45e8d2fa60830631c04f8b466b2253

SHA1
bf69f7dc72f79d30e81fb71b6e7ed12d2e295729

SHA256
9c6c83dcb52579ff518bf3e991fd4761cdc494ba5242bbe12d6b906f3fcf3e90

SHA512
ffc1c9735c226b3945cc849f0691a10df8b3f545f9796ecc5832166b1f7400c9ed4f8e30fa25501913a6c9ddea366622c865a1f5516ec7e82305d61ad9aaf25c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
1747acd4ff68be090220448e08dc1e5e

SHA1
a3494b844dd483e54d3d61e2fa3a1967bf50517b

SHA256
801db052bda0543ab45f8d5e08531340e3f14fe844dbe89bba7f83cd9e364a3c

SHA512
cbaa076b292f0b02b1087eb8f6b2ca523bee691ff8cc62de405eada7bb3e3c62d9f7098db602c81f24da2dcc54ad52595e80f249129d405512176f15a7ae76fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
856024c10461da970273de928d84860f

SHA1
aeb90af0a6d52edcd68d90bc8d4021f8e488221a

SHA256
b56cc838ae371ce7c28beb96bb21a263ae2221597e5b4d464282d81c7ab1f345

SHA512
a209811fa1ce64977780b1fe885bc77a2b37bab60c0704e2c9a206f1c6f94aa04c5c3b327ab56f94f4850d36da7cc9b40329179c23bc6bf40fa073d8edf34f4e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
8962f331088ab6c01c9ea2eb72343271

SHA1
e76ddf5be9cfa524ac2db13530c9bfbd1f6c2f20

SHA256
157c34c9de0f3a95c96e8ec4ae5cd6a5cb965913d0749c52dfa9f2e74c28e611

SHA512
059af04f93e9a1c91dfbb84e217094d584f19cc19c7ebacba1f35501f18bcacf53117735495b4b2e265b5a9c816cc551ac87d220b2d184bca5a99186b023850d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
e329623dc64b93b3d6d02b1288c13b67

SHA1
8dd6bd80c4b1c8a8327be892ed103cacaac2cb28

SHA256
c708a11e35459f241e6c8043b4deb7f45523fa853576105719afbb2d4ea16a1d

SHA512
f8b131cffe6611002c8d9c8dfc9b68951c0ad0e15a7c0096537641cfeebf933a3cc9becc8b92a6ddba7278f57ef12582f35d07cd1d312f33fca3d13c0c5b2fa0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
0730dd0feb84703e20c8f9bbdf98d10c

SHA1
e4db572a8510a111e56a4f55b8a5f02de31096d0

SHA256
126e80beb542e5444724a2b7ab3dc860b2682655e40751c79050d94d4d40a6cc

SHA512
3f8a35a3507ed49b51bec5f7676cd76aa6df8370a4ed2520d0c86de0b70907bd3fe9b187cd687086df9f8eb323d812f19c0de186b3376c757ff94c0d887e429a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
5ad25818c5baa049c86c238bdce22f7c

SHA1
2efb82b466470be67f80798677b62d2d14a2acfc

SHA256
a581cb983dfdb322093e9f49308761403f3e48ae2fab75a93255c57798120e12

SHA512
b1e598f90e31055e8050e58e73d10497b0062df9be8a5351fe3f46d672c6a50d69be527d645335951882c08ea76cec15d0641f57a7f8d14cf2212ef679933950

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
fa9127dbd6bc4a7a6defbd4a7cff2892

SHA1
3f9f7dc59a3ef94b1d707f870e12a48e5644e24f

SHA256
3ad46f1f729a020f76642f90f7b664a16f107fa013835b99a5216881c3b49c40

SHA512
0d50419d040f00dac684d76837a076eec5fbfe5ec2a70b805740f03eb89f327663c86a6501e1eb08f02e14f79b0628e6e8844e6cf29c885c54763f48bcd03cd8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
b11296da97346ac811dc710151b3d7db

SHA1
0406d5706926e335fb093b5608febb9d530eff38

SHA256
1213c1b1251346ace2d4cf5efa5a263cb6f130422573de09b5361a3078a9d8a7

SHA512
4e7af74781a5030257420575e5285a785d38ba627a3533199c0ee77259407372c611f057aa8d10cd64f4a7b96a6c0da4c0b0f337b9ce93f0126d66625e5bcefa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
41bb02ca9b30fb9ca6ed567be7c348bd

SHA1
1b43a5a31efb5207cbfc03eb0e0b85ac7325246c

SHA256
c8fddbcf7bc0c734e020b0fa43e29d688a10d138f6704b6726b1d4cb905780a8

SHA512
ae11ce211a3c1f33dd5c22398914d853dfaa240ac491f04ea7dc561dade78fcd980f8c41e76946e027d5866de328b413366aaf2e02c7aa8de9f2d75f81088a98

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
e606daa0438f4805d887afd7c247a4f9

SHA1
7bb0461913ab899b4716d658cbe5d4faf150a716

SHA256
5981df1f730d85f8b55ab46fabf1a396b7cd5af53b6ec80c30fb748ab7881023

SHA512
afcaaa3a7c94be3b85401d3bb632e79e96df0e970a7984b73831e5d95baccd878b142da39b0f4c2bea702ae05c3d56d19d3931b4fd9f1eb9c70ba8413839a76d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
4fe7377b3b99ee7b7179379f1314332c

SHA1
93e7541c40c931d728bc7d094b4366ae5166291d

SHA256
2aec2650b1b7e7d54b8094402df7cd4e34872ad1601cee78080fe742df263932

SHA512
b1959fafba23a305ece05eb65d4bc4cc577dfeaac2045219b60317c4f80b20cfb4381faee4c5de8ef91944808b401ef2d20024afd5f8ae199eb5816185803d81

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
dc66a71ba4c7c42b415dcb115bf1bf7f

SHA1
eadb1e4962bddc3a565d1c0aa3f6d9f19f04508b

SHA256
b55e87e5237a874d7ac0dd38cc820d7ee097aeb60747e26fffb3308e2060f1b9

SHA512
1a4d57865f904c88c8bf022b9d61cab4e16092c75864a22cdee6c720980b526f342ad2a704a52eed84ebf67a07bcc9bfebdff66f3c8b653c8f2ef83e6c20a7f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
b391a6cd8f64837121d8c5e377adcf0f

SHA1
ac4af4d2478c2994271eaf72b3e2a2fe4cc2779d

SHA256
2490e65557e01ca850b98408891d296ca274249f03b27e2e179d0a3288b170cb

SHA512
f31b638e587a108349ccadd910acd1654e5dbde0689a1ed29b6748b93699ad5103062dec127b72f719cc19e7ced15d1a3e567aff440c0f651bfccdcc970dadae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
e4414fdd78125694972218f489919543

SHA1
8e7a595751a421d6e52beea03ff66d87f6e7d0de

SHA256
c3b5277ec08f742b976a93b43fb51de95314505e79c50225a37f194ef754ca75

SHA512
bda5e3bf52d41ca7243e8d58e802055b731bc9300eafea3a62195d5dffcaac2a5786d65a921fde82e6146feb4f41ed2a599169247a47e41d052ac9f9021c4cf3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
e7254700fe9eff44f33aecb2998b6ef1

SHA1
71a3f33be3ce7779f0e834003065fcafacf82c4f

SHA256
a1d4b2f7d460ac0187d4337a18987859eafc56d907bcb8183c6e8733589de128

SHA512
490eb13b54aa9f9446691eae63c6f013bf2f9dbd49dafe18cfa3017664bde9d3cf7aa12de1bb89717eb1aef5bad811203e5ce5075e32972649ab849a1d303b2b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
c9611f0ac69e667e10ed3e967b871169

SHA1
982dd2b80db4511f666af8555d90bb0c32b7a2a1

SHA256
df2d98ae6c1a412789d029daf75dfc737c331130bcc3dcf52ac2f471e3b77316

SHA512
bf54f5300842cbac167f891ed6ed516f4ca84093958bb830eaf48bd0bd43b175e318669c04362ae0caf46df637262d87ccf886a37153aa2cb9f00e521a9af60f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
bf21ef321c8da239d137e9ea7f1989df

SHA1
241367f22a75bd0650fb2705c89286608be0a678

SHA256
b745a7f4e150b5fc14bc38184bdb7ef581cac8581e08412bef0512f355649cc2

SHA512
9be60a18def3b178f4442d0943be6b33875d454da0ade7a7662fa841796e825d020883df851c2d5bcf14a364efa816fd810e91cd5cb487a378877775fcde51b9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
eb168b09f2b9e306c4ee53914d4b2287

SHA1
88e6295ec4f9239423fa18052fa7002f89554269

SHA256
fa61b25a584fd2e8da2edb7922d9648fbf785e772e233831847fcb2fe0689dd1

SHA512
c987a038ce4a11c858915f36c5972f15fd27d719c6b550965844ce6dfb84d6ce8eea55c3bc5c3f34a5f61caf75192c0fa7d6f92aaa99659edb0811d44bb40594

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
c73274afe7ce07ad9cd191975065389e

SHA1
6b6150ebcd8fdecbd43db62eae54af87582b0e0d

SHA256
6368cba0a217fe6b18bbcb5cb191b977a23adb87577655cc77c84c233b165b49

SHA512
78f90ec0b0d726d256ca6415eafc84abfdea001957402062501d3a8648b191255fbc0e0cdff1c7498f3edeafb4873f6fb4834f634c69476dbfba5bf759560762

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
ef9641a9bddcd7a4c6dc8254d7cbc32c

SHA1
42cecbd59ab33f7aaab5137268b90cf93263a8a1

SHA256
c3ba70d9d392f71d4406d0d0954ebf8a458b1a1abdca43c80d763b891b6973c6

SHA512
3ec98e4d153ee53a75c058c287017cf55d2012bda2338a26a3d4f5d0c320e30c7b5796f4738f75f78c71c4574a5907c490051fd7334babb0ab64e857ba977917

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
ed41bceb587e04ae2afba15ec68773a3

SHA1
7fe2d247d511945b94a019307354778dfff99b1a

SHA256
a02830f81df316cb6ac50e9ceceaa46e5b11b399dec28f19c5cd3143e81dc91e

SHA512
46d304c2e3115d3f4837690a96a692e2c0f696b9da7a025d71e3fc2bfc3a91568712e7ee19a9578b1bfe97cc666a86c8070fb63b3beeee6fefe7b1564c507ca0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
1fab449ae1f779e0b8406df9e9e73070

SHA1
eecf11f751962b0b0fe11f7ed268d77f2b873e51

SHA256
104baca47b04647efe5e017d814c0857de2d807f512256a5a6432d9c0347224f

SHA512
92a3f4f38ad636a03760827a3ac995a736b8725e2b40da952d75c72241737d9ef7464c6f23cb6e517b7c6b9eb8802b22fa11bd9417cf2630f5a3a9b5806845ad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
8250f447d09abc539ed61d0362a32c05

SHA1
de86c1c04f040718090f4fbf8c8ef7daac43936e

SHA256
1200d3b030b1ca50819c9b3bdb35a82828ba211309a30fcf8255494766709160

SHA512
032b51fead256c905c81157a97bb5e9474abdfad7f2af39caa332a159bb9675a2a92c447d905583db115b5a33dcd6440552d962d31d7a8621a3f3b877457f5e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
6fe6cfd0d541c6a1f6cdd90dd38ef144

SHA1
3949853ac7cbc56048c780c84122454670feae82

SHA256
0e76b731b7797e7cc7ecbc0bc881a6a35538b135352877a45ec6bb9515f06a73

SHA512
764696ab4ec1ae0872f53bdbeed783fe6246f6b0cb13c1864c3e1426f08079a2b7809b3fd93efa53f55993b5ca7c22c50f3cf32c3acd7d6b382cba64cfde4e45

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
906476a0812bfc65f2050b48714d1599

SHA1
68cd039f60f8f412743d17eef931270e2f31a615

SHA256
74649408abcad224b7bd6784b9c2e18a149f84e58d6156ad80f4212394d787d7

SHA512
0a68b2fd2e2f39f1a3e1393ded4870fdb27497b94c0c0cd3460e31d5e5629659df2e20d6d41b1747ebb413576664c783b1b1b2636addfa2458839f6b89b530ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
c1c6bb4594c196b07cb021978a556da9

SHA1
a52c3124a89a06b344311d37db70025ff962df38

SHA256
69f9d765fece4203b20fc56fb77b8b6f5811d18f92687dd67aa12074c2d0b0cd

SHA512
d01076ef09d41d7a5baf9d97fb08d0315dafb3bc7883fa8dcf2f709c5d39a5957dcca93a9834c0a849d6edaf18bbd65ddc5ee7adc0fad5e0f4c89941ea81dd7f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
edf20613107f08c3db3175ec058f307d

SHA1
b758801b35b3d59416d0b201b9224e73b7a11377

SHA256
8d5488c661892534d1609a16f56eabe75f5cc2620cc44d2cf4180c97f3e44b11

SHA512
4a9ae98bb3fa4b548f631425a3d96aa944e28644f12b0b1720a037a7ca900659cecea6e6cc362f7144f7e3e49d1361b8fecdba123d1ed61e694354a6be3cecfb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
473b3702c0d10bd6b17828f7ac9ea321

SHA1
1f9a0a43e644b6eb097b61af31fbad092e984b53

SHA256
f531a5771f6d94c97719f729922a95b2a9dfbe035a88944ded6a24cb5f48db0d

SHA512
e0bad97e6361b2e7113eb71beba17a6a7ea1729b176c1fd5fc6b349ea309f22dcc9cd643a904ef5bbea33287a57b8331a12ace56967986629419b5a07e393eb1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
02c7b48273b70d97809d68fe07e5247f

SHA1
434602b4b4155f1504ceb942c690d4766bc91c32

SHA256
8a3c8049e5e4586451156b0713e116fff42f7ecbfd26b0a9ea91b15a57d4ca55

SHA512
f18c2ab127df093b00aa946cc20c22eccba0b50e5f936271e96fd6fb23140b996002405614e59f7162b0f740b204a1976f4c89166781690a0f596fe146dc16ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
92d30ec1d325b5b88a40d664fa81f3d7

SHA1
4a6209b222957d65cee6b2c899b68b3f5f0a8d79

SHA256
2f62a6d25687078cfa70fec323bccd98a7ba34629f780c2c85724ff922d5620b

SHA512
05a4b0b8d51c33550e06499de44f528759c1621c397e9d4b1d238e2f9d5d30d2a624d6cef8b2e0414259c99f7b4784c1689576cbb4e77b7ead70c3c1c4b82963

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
2dc6275ca92561465ec5c28619025efa

SHA1
78cd93223a27b1dfd9b81cc6c513c99eea39b8ad

SHA256
7de4d9dfa352b3f04bca35278caea3d826506e22b286c257d2d63202adfacc17

SHA512
d3d41628dfee0651cf7f04e98a21988c1a6224ddc7c98b9303c1a875c2f5eb22be579335d00082bbf2f2dfc7f365e5956c4f6e9ba881260710244aa557f8c29e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
de6b269f631a9927f78800e5fd330178

SHA1
f17770a7437e5c7fa1f5bf38d3a110c38cc1a4c8

SHA256
31e9d9214b82d6f68f5871fe1f69cf2d984c13d2294e4b5e10a31b7b8d7f0912

SHA512
daac23f4e552f3747cf6fbf44d5511d60315ec4165b0349d28e8e41e5e9f0cc97902bc64d0b003884547b4894ebfdd6ee5e7a5024ff9f999d283ae1f9b56f731

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
7415043ba18b99ceff78068898d4605d

SHA1
a5ad6af74a9f588a4b22a47167278531aa82c1ef

SHA256
8eef178931686b09640c72221fdc500e88ec4ce37b51bc7b7dcd68604d632a4f

SHA512
7cb8ba2a6f6e9668196d9347508ca0a5bc7aef5c14c1d3a2aaea8facd55324e4eb953c9d90635b3ff635ea8ee450eb03ba3ff26e14314d540830f515de287660

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
8fe0880f4d55a2919ce86ced928c61bf

SHA1
32bfe52108af30fa45bb4b652d1d430a94c1e9d8

SHA256
b57ae838755d13498b7c7fc4f94ecf2a1a52cb4cecc75353d41d9a586450c6af

SHA512
cb5308af2189fd69b16d122441cb0138cbbd925bade6d9470362e1f6d62820398f9a51665951a34ab2377d6e37a2b54a4e8209530e394cd8555cb4ee90c384b1

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
f8af3a3aa830e662092786cf82244789

SHA1
ceafa71225bebc28a14ef27e98f8861bfaf2fa06

SHA256
74efb7a5b550fb784dc1a38203cab1ba24993ce1be3bf3982387eb395f49765b

SHA512
b553823ecac02f778c1be56e500ff7b18be3f15bce4bd507c1eb6f342302886c9ef17dee3e80355210015d8c2a5763328fac820768d29d434a4adbb7761fd54e

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
e44d88ce6b81b3642008d7112f7dfbd9

SHA1
3f519f8c76e0e322cf18c36e89d391001d833552

SHA256
eea5ffff905a317295b771f7389c069247db92acb66b4edcbae6db0ec23ad278

SHA512
c02a0bd38de8fd286fba3daedd828e2d2d9072ad49f1df0f231146db216532560658f7904d5c36af347ec836e5ed09fb800544782821b934deb01de29c2c3c3e

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
52183751542908f3186a4419f3c1b985

SHA1
b0666d44fd25fa668c2cc93c5fd1a6d87dd7fe73

SHA256
48f43b55865fd474224ae5952780584b43ef797a30879b28d18a204e81a15bac

SHA512
ce26ec9767145fb52a5b9e2c9771274d406f052ea354a7caa33ac31402ef540c58906d6d5e216014539d0c776ca04559ebe04903233c9847975b9a045080ef7a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
7f55320d7aa4a6b209e003c956264941

SHA1
03e888a1e614885f8e78ef98a59a220c99752e95

SHA256
0d96f1137288034d2c8b6103763a55b0fff9e848bd2905e821ca5651ed5440e9

SHA512
e8a65c639c97f1f33ea7db7a2bc3ff3845c7e10fd75022dcd941d3a3997b29fa030c0e308b9921938c38ac9452948d80c35faf619f6f2ff3f60f5a1c362d6669

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
175d20dcd1dd761d496468d5c3de3175

SHA1
f77a0853494c628b17d40b79900fc193159ee0c6

SHA256
6fdb286943e3fc575de526ae4cfbde54c3977a4b74c799fa2633b140f0529853

SHA512
fcee237cc5bff9f1f8a1eba1bb2d6fa7d59e235f41244c3580c6f066d25f662749c0b132986177350b7ea52beb6f93f876dc2d7884fe8ddd9bf5e92bbd9fcf70

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif.EnCiPhErEd

Filesize
952B

MD5
2fc37b8b4102f112f2b1b8659cc7742b

SHA1
3a3ba6395257fcbc8f23fa099d02734ec22eb738

SHA256
3391e53f39c9f2e0aec80681921f54ba38808815505865c75753732754040ab2

SHA512
77f0ed26538f038891c5a00d18191d4df2114b9bb96f6c8a8d5061b5865a1aa0c43a1c7fd13aa7dce60475ba15e541aa2f88e148374ead563a318c5ca58c82fc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
1fedfb8d7761e9d1bd04f909a6011f9a

SHA1
e579c960d0bcfd8a8385c40da2d8bc57a824cc71

SHA256
a146c4a62670467d6968781f9b766186ab105c188b2c56c481b6144543743d0a

SHA512
e38cf5e18c160ba37540f97927018fe2891a085f03608a271fe581bd840746b86a3dfb709c014c069b858d8ba913d877608b10eb1b1898c9e7427d878a73031b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
4bc445527e1f71706ebaddf03a228223

SHA1
279e881e9844d465ef04786d6b5525ce9f59bdd7

SHA256
b174e1f1ede1797edae9560c58ed8c0ef206ed0a8f7368510b8c276b8e2e8ade

SHA512
50d8c61448bccddeb7bab3131e676b17b956fecc4b61dece11838f38434ab11a1370a69bc9be67a511431be090cd08aa978c0cc4c5b60063d94e1a3a5a4a5ad6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
1c3cc5ea26aba5b9679ef34a9c27e5d8

SHA1
7bc635e6dff6dc2c46a0a5f8eb14e31a5d067fd7

SHA256
ec874ec5825190ee220a25c24be05cdfe1dbd8d31980bdbc838176507af2a516

SHA512
7afe7b3c116dd5dbed0ab814f77d8c2fc6c5021395c81905debf2de99c60ec70101e4d385c1104ba35f8d1fcbb4b9c0ba46d41fc89be48c0650c99031906cc5a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
c1f3f435b91785bb40d77965810884dc

SHA1
45c6348e96b5b6e3d5d59cf9d0b74a319a0edfd9

SHA256
09cbc67999927b4874cea4fd14b54378ac57c9384809ed592903e5b8a6a9558c

SHA512
aac43df26e91bbf564a8b06a2611a604bba3b9b04c619cfba9462dbdd2f03a42a604210aa2e0e76372a85a4da92b0cd745b964cc58f406537b25062ded5cc0a4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
f6aa42e918ea8deeac751603b4b3a582

SHA1
a63c963ca691640eadcb2e9a6d8d0cb439100274

SHA256
1696682e3b4ce3f64ddf1dd02626c30a238e32208121f60bba0c0d235a96dff3

SHA512
ac451098726dc47e82cbd2950b93d565f96583953d70dd2fd6feb68541b6935eeae0ed55d747b8eb0e2c86b487b9747336a03daad8a658296727076e42e0ecfb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
67289fc4ea900117c5f0e618e15aa4e5

SHA1
f7a78f7dc4b95cf928cc8d2d861abfbf92c20311

SHA256
b60c935a666ba6f0dd644ac34ea467d4090da40053594dd7d3ce0f47d8b0aed5

SHA512
e74c470315553f9e956f4973a0e5c84a54e060c8834480c980d9dcb3771416cdbacfc9ec52aaa7437b57340a4b7c397c4da28587a4b146e118075e402cb7dd40

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
7c1cf29a3d643cfc56d3788eec02a921

SHA1
15eee516b7b95a580123dc65b2b2f3d2e9703027

SHA256
3702d087f5570bf15d91a32d0da5efa47b4258538a92c5204bc732cd70bba798

SHA512
f533b4160730c7c75d4852c7bb23bd4f168fa398d799d462a9aa075724e7e90cbf4d5d928c1478829a5446030cb0e59f305f6f997ce86add36bc12602daddeec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
0462a27ca42de6102bd2636987fe9f6f

SHA1
08ceebd37110c254e741b50f21a49db218b2c31a

SHA256
646832f1db870efbc92170b631d1575e7bb805b5948eafed6ce300529e282337

SHA512
53f5aef6ae1fead4fd86923669e543250b4378e8bbb6ba2ce636a2e671e05f33aae3cb86a5e29e30aeea64c524ef829b79431f5b20e0e7b9bfd300467fa47137

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
71300b51de09c416b5c3be1a354d6089

SHA1
b3a03fa7c824ea68d18a4bfbeb45ef92114e2a57

SHA256
1b1c4b6d342a51d64b5b3ff3eb2d2c8b8855dfde798a0cfd344c7229af552d51

SHA512
be0660803948aee146b517f4fcd39ec8bfbfc4f294da957a7fa68738aafbbe3537e4b84051514348b3c02ca369194202b9381cd7eb76c3569a2345fbceb68125

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
49030b9cd66b8c45677d97b57ef25421

SHA1
023326e473c882985a255cb94dbc433da298e0a9

SHA256
a2c43ff1ea38239de8868cc20bab758fb38f3c4da9ef20cdce466ee0b6502aec

SHA512
4ce55a172f5df7904021fe5b7de94946be406a05ab59df35a0300c1c7c19c27ac4371715e41c2ca00b4a864560d3502d6f339748ff07ea1f7052d4ce70987a37

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
429121b36c34a360f4ca8f328f3f3b54

SHA1
c5d410b296cbbfce10e13f44a59e28c83d6e7d1c

SHA256
6a7ee145b5ad522147ed6d945c2cc6990f2b8cc7c4f7c428effdc9275bf6a117

SHA512
d86a802399e8a44641c844dd40e913a2bf1b319406c5e3a56f28c170b7565f5dede44067470b3ef079996e7a45cbe6759ea5534d424bab09d65e7a5281d0f95f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
4f15174e3a60a26ce4b602cf2aeac5fc

SHA1
be85d026120a58c01beefd986093601c0a2fdddc

SHA256
8d2b77d26aeb470f6f748b6682963ede748fd5e43908e6dcd48bfa6e0c154c1a

SHA512
11c55d8ca998d1389775ecb2a43869a38350a2319e0508bb086544005fbcfdf7f19ce8d778322715db4b547bbb7bfcc53935c9d2ce600eb41db42b1a12d4c285

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
7aa30fd525f9aa044563ab4ecc4a5790

SHA1
1adc295685e4987eb40c7d43099fbca93ef1e07f

SHA256
1d3d0e8803a09514e7a262138e9bf6604762669de45ba9c10d77904797706955

SHA512
f95df676faad01beb04aab18ad6792f6d9ad234afd345e9901b8a7575e6088021eb0d988507f2b1d812f0a84f7a58ed423fc53053102d890867597fd916565e5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads