Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/12/2024, 23:00
Behavioral task
behavioral1
Sample
e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe
-
Size
12KB
-
MD5
e39ae0cec580a0c1281abb8ec1ea06ab
-
SHA1
b1a1b10c939861334cc77795c8d83c4c5de53a8d
-
SHA256
d1e59fa5d194bf240b25dc6e9b4d5926518ea0df642ad12efca727a047a68583
-
SHA512
62b70d48d0242a6bbae3913adf50009b0a6c17fb413c5dbd306768d2b98bdd438c36df3876d139e4b81b4b04c46a208788bdb4b245f2a1c563b56339c66b4682
-
SSDEEP
192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCRFd:eebFNw4Pk1itKkpAjjI2YpdmCRH
Malware Config
Signatures
-
Renames multiple (2198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qUYUesw0w27oXlC.exe" e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Ref.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Arithmetic_Operators.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_escape_characters.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_neutral_6fd673519d66ab20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Special_Characters.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_neutral_aed2e7a487803437\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Line_Editing.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00x.inf_amd64_neutral_808baf4e08594a59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_neutral_15bb3ed734fbbeb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_wildcards.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx004.inf_amd64_neutral_2cf95f307381e481\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_providers.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_neutral_d42522943de68905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_logical_operators.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_neutral_ece4b1cc5aee6a38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Throw.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_try_catch_finally.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Language_Keywords.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg62a.inf_amd64_neutral_5817ae5135655364\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_types.ps1xml.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comment_Based_Help.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc8.inf_amd64_neutral_c93e7023ef90e637\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sbp2.inf_amd64_neutral_332943647e950ada\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\PostMigRes\data\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_regular_expressions.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_neutral_4a983035eaabe2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_neutral_d9eee378245b3b8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_eventlogs.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_types.ps1xml.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_debuggers.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_profiles.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\winrm\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\migwiz\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_neutral_b4e8ccc6ba210e97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_modules.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Throw.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_aliases.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Windows Journal\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10299_.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office64.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_ON.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECHO\THMBNAIL.PNG e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21326_.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1B.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DiscussionToolIconImagesMask.bmp e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00052_.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\RSSFeeds.html e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Common Files\System\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR18F.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CASHREG.WAV e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0314068.JPG e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02750U.BMP e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02758U.BMP e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Visualizer.zip e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34B.GIF e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\MMHMM.WAV e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Speech\Engines\Lexicon\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\502.htm e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rtmonitor-tcpmondll_31bf3856ad364e35_6.1.7600.16385_none_2ea18f01c0d42c35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..tebox-isv.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c0c672c7816227ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wialx004.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cfe4b321af4846fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\AppPatch\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..ion_service_runtime_31bf3856ad364e35_6.1.7601.17514_none_fb08448fa0c85c23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiUPnP\8b58e86c1211cac8bb344ec05015055b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-d..e-handwritingapplet_31bf3856ad364e35_6.1.7600.16385_none_6a9dcfe209eaa05a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\logo.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-tapi2xclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_45036df50f2fc8ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_remote_requirements.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c939ab79572826de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-msxml30.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a0087dbe94df0997\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-time-tool.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d57b51f142dd7423\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_system.transactions_b77a5c561934e089_6.1.7600.16385_none_e812023124da1345\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-rpchelperclass_31bf3856ad364e35_6.1.7600.16385_none_c14a6a7e219d9012\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_el-gr_57c22a59585d3ab2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\405.htm e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_data_sections.help.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-u..trolpoint.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b4223180e30061e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-d..-dvdupgrd.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c397148d687db1ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\alertIcon.png e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-cityscape_31bf3856ad364e35_6.1.7600.16385_none_5b48f43248490503\Windows Navigation Start.wav e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..omponents.resources_31bf3856ad364e35_6.1.7600.16385_es-es_912246ee1073420f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-e..extension.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4441094abf1c13fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_203bbba4ef78364f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_flpydisk.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_127c05280e6839dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_bg-bg_13a3b6b1c4998439\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\4aea15334e123949e180d21d22095b1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Hardware Fail.wav e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wcf-icardres_dll_vista_31bf3856ad364e35_6.1.7600.16385_none_6d023da984892bd3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..odbcloggingbinaries_31bf3856ad364e35_6.1.7600.16385_none_774a3fb86d7fe723\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_8.0.7600.16385_none_a61138e7aab17fed\Windows Navigation Start.wav e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnhp002.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15a9be6cc36d1ca3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnts003.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4a778fe507163f28\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_wsdapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_19b1853872149302\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mmsys.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a8986d8f769ad4c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..utcontrol.resources_31bf3856ad364e35_6.1.7600.16385_en-us_54062fbb8cc4cb4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-time-tool.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_095b0ba4a75ef07e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..eakerstemmer-korean_31bf3856ad364e35_7.0.7600.16385_none_a7ca197ff4659c3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-18.htm e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..e-cleanup.resources_31bf3856ad364e35_6.1.7601.17514_de-de_49fa1712e78eca96\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-mprmsg.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dbc557144037871f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..-ux-sppcc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_80276e25a085b218\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-time-tool.resources_31bf3856ad364e35_6.1.7601.17514_en-us_809d3bb22eaa0382\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-wordpad.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4f62d31eb392bbca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..order-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9bc2b75f5dc02037\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..cachingbasebinaries_31bf3856ad364e35_6.1.7601.17514_none_9e27c9e59ecd6328\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_260f4e164060042b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-regsvr32.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bb9ea1d3b5467403\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_8.0.7600.16385_en-us_6e8728b65ebff004\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_it-it_47371910bb7e9c6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\Windows Critical Stop.wav e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_color48.bmp e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\amd64_prnlx004.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8f4a162defaf87d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\wow64_microsoft-windows-fax-common.resources_31bf3856ad364e35_6.1.7600.16385_es-es_afc3ba8c84e8b513\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_de-de_47529bf332e656a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe File created C:\Windows\winsxs\x86_microsoft-windows-rpc-ping.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ad23a7a77086960a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\ = "CRYPTED!" e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qUYUesw0w27oXlC.exe,0" e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\shell\open\command e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\shell e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\shell\open e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "UISURIYYTUPGNIV" e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\DefaultIcon e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UISURIYYTUPGNIV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qUYUesw0w27oXlC.exe" e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e39ae0cec580a0c1281abb8ec1ea06ab_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
282B
MD569a98ef655778f1cb3764a923acbae80
SHA122683321e95c9a631039d15fc49ac5d3e639ac54
SHA2562ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e
SHA512610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2
-
Filesize
341B
MD5ae2111a3373af16d1f34571c7dfd6ea9
SHA10e7f0543b3683506c68ead01066202db0568b8e1
SHA256c43150473f6c9decebe55d1d7a09246191cd28f11fd5b487f4fda9c8786e55e4
SHA512281a7946aefd35bb6b84e22cf775a039aaa110b57dcd6cf5421734bd986257c6d2dffd6fcb5401b1d9f9355bb492bab702bfbdafb3b7d7821d0c08503bdd42e4
-
Filesize
222B
MD5942ed2ef036c880f26dd4e511880ba3d
SHA164940b02e9985966bced25547683b007de65a5c9
SHA25638ff516a9605ef1c19b6040835a8238017e07dcba55404536ade1c5b9484091e
SHA512be562efd6307732c2e266d505ca6b16e19ef73c59649723a5a43fc24b35588740e7f795a609ee44f7b8d443d00226c195701643ee4b2d8c54670788694ec9bba
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
Filesize24KB
MD5b987ced4576aa29ae4736d9ff16e427a
SHA1e64f2fb402e86b1ff20eb00704aebff7e96690a8
SHA256f136d107d0614a161c526c682ed2aba260ef5b77354567bfacd7055a283fe08c
SHA51294045eb1e6ed5899a4eb1d706fc12f40b559063751c583fdd1dd27cb49a213f01be3dcfb2630969645e05028acc9918f8bb07ae58767323355769d7de6065ab0
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
Filesize185B
MD53e62553d97eb81441c04edd73b26b0eb
SHA1bee4e46a416fc61ece9bb3165d40d44d71ccc91e
SHA25670d7c89f4fe1f3a7f24d20cfdeffcb402e9a7a515b7e619e33a8c3ad10409ff1
SHA512164a8df723d0c6888482c36bfb80d3b0c148cf6058e82f2262ba29d8ecf95f67616c1a3626b2d933769eb3fb1320d9cd29942be82158a73fcb105316dd92e9fd
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
Filesize496B
MD55f459ffe66da6cafd9658d9060fc4894
SHA1e2121072de8a53f66627769eb5c9332826bd1305
SHA256113c762265b56a2f147446c34bf8a360b65d70bb6304fe4a23deb6af48ab1588
SHA512b852abc9c7c83b10d26993e796e23c6b0f5ceade3669e0d9a4146a3e19906cb6484e6b4d8972b34d34730358db521f098c5c2dab60bd12cf86a47cbeb2d547e7
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
Filesize1KB
MD5b514726b57f1d443976478eed6280f28
SHA116628cddcea2737caf771d4c2cfa3b410a525694
SHA2564637584afe320b1531ade6e51df0072bbdf49b839fc2e9394a596e2740b297c5
SHA512bb0da5d84b4c271803526c866ab2f18faa995c4f8f5fae3d5cf8dd53bba141108188d70fdf739eca345d4a01a83ee49ff5179c4d7a139f2680704492bf9d4743
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
Filesize341B
MD555baad4ca5a995c9f526e62d933cc6f2
SHA1c0748f7055ea4e72bf5ff7cd7228892ef72a1d67
SHA256399b09fc2c8032a72ff0c0bbcbfc66d49062835afb48b97f943aeb0e3100f64c
SHA512150071ec3975370fddacc4c381678bc0673573591463b20a580a6435bcbba69dcf55a3e3120a6cd776b34567c14b5c9546161dbbd36f69ecb64636940fc853b1
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
Filesize222B
MD5cbc8b1c478054831c307a8b4ba8e4e35
SHA113ab2cb22ba7b647c70cab95d62bbabe23aa19b3
SHA256b59ddc0b4ab353f6b3a4d0ecc188c73b8278483234ffc3ae38f3fdbd6c60d9d9
SHA512e1db8deda449667f0a3b8f80c7520cf24c377d630f8da7141afed172c313736b735892fe94a0a7e1c49822ed86f42be5aef1cb4265910e0852a1e7df42d9384a
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Filesize5KB
MD508ce86fea9d689d156a450bc59938316
SHA1c06122e629dc5bdb388e5ea54bf65bab8a7e2532
SHA2564ebe2b6705e09c80b5fd4f1b9e727b90e79707b529d745d814f2491dd49215ef
SHA5128997cc517debb90da7762548bb7b11d2864641732faacb24fee1e1b4dbd01335f4a7a6da2c6ad26558755ad4ba6a2735202d1a3761822dbce4d7232d32b7733f
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Filesize31KB
MD54da48918ca2e106cc919261d1e945e86
SHA1621ac98785d26beb3186bed8655be3fcef799c0d
SHA25623741bbe368ced5993e393cb03f0d87605141af83841481f24b6c4fe598980e3
SHA512e7b0b5ae3cd9d79e4d74794c7e4b38f0aa68a7688b32cda324c424895563cad876140019c9cfb35c68d09577412ef2e3fc09a39d02051d2a3b5efbed2a5fe8f5
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Filesize4KB
MD5f2c2873626c6cb203c7e3804b3a3aaac
SHA124020fe3e399c8875bdc0ae37e899638ef5329bb
SHA256e5d632571bef5ffd534a633b1f47f529f5e3d44f7bb9434a8d590594cca96ade
SHA512eab90fb8ab5da774e68892969ba1364def3c870a836ff540d4ba0b9f816179d579462f168a596f2a4dac71d72e4dc208ab6a92de900a3e3c2d8b50537861ea5b
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Filesize21KB
MD59f6ad3a6812d63fcfa534c8b70efb153
SHA18473fb3cc81bcb8fbb1f7562dab5da06d7f468db
SHA2568526c37f2fb62bfd8fa3a580fe5543978e80a6d8bbab9e2b9a3f01ac116cc2eb
SHA512e5b8c9175d33cafe3cf4b4e2304f82db8720d596ab1d430d7ee0511bddb035878fc014034b305464ac94d6aa9f76ab713bbc92fb3217cb394bcc655ce8e5dbe6
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Filesize8KB
MD5b32cdb5be3106c497238dc6b1bdb5d30
SHA1b4d49f55208c671dadf4c1c3d214e05ed8d1ec56
SHA256d838c2b4a460355a0f1e337a696dea7223dcb7bade8dcfc2242513799b13a7c3
SHA512650eacafe46d80642d10aec56de51c70fd1fdf37294143ff90e77514cc1cbf7347aec0d2ab3195e31c8ddfde9a3f5b184d8fe47407d71515e4133cb6cc541201
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Filesize15KB
MD5a33b5073185a5e35e728ec817a040fe2
SHA1b3e91669b118700a6b6f2bf57a56ccaffa6df1e9
SHA2562bd07883dae053810cf763df5d094321cb51f5c92418aad861442e2147a46ea8
SHA5124be53c3d908af8e66cf7c5e671ab97369d0d533b21480b75dfae299f16d9ec8884a6abaaebdc6fea90491cf55fc6c68903ecbb2732e3b34302b0bce770cc5a36
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Filesize6KB
MD5b35ddf170f1ae3a1cb8be9fa21dbbca4
SHA1fa26d38f351331fe2b50cd7a4e9ad6427e992d9b
SHA256dc4b6cf9e3757da593bc3d21eeb4df27a58f14b1d8e5616dabf109a8b35b5b68
SHA51207d22cda67f5dcfe46efac00e4e05ffbbf617a2fac4b35d15acb6c0966dcb01b6cc3ed030bc3a49587c85bf881e1c68db01c49daa88d8fc8dc1ce3d56f7ccbfd
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Filesize20KB
MD594ae87a9708d2d1549b2a6ff302969b7
SHA1d7d8787171872f1a9dd99d26e6013fcbbd97de82
SHA2564ddf56392f059751aa84594a680d7f12a94646839b712b176abca18fe16236bb
SHA512f5816d93d9c5b2707ec753a7e054553777a85d68ad770571c5be71a3aa3d8596ea34d40418625865feb67a80003c8535c5f2cbc9f54cb0c39dadd68247ebebab
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Filesize6KB
MD55e39f08b6bdb9444c7883160e6d66ed7
SHA13d2673a73c9b8ff50c4123b8462baa43e43c7cdf
SHA256d9a7107fb014bbc71b5923c872bd66087807c3083ddf828c30303b34ee8de4dc
SHA512d267b703d1e5de1292c6fa4e7709a0b673bf6ef75b52fa5789c0db0402223248cb84664772890d270a5202ab1276efd777e4b21084e3a1e8536ea1e65a075dce
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Filesize15KB
MD5bc3270a22093611cee0bfe191d419177
SHA1b3122cbcdfac0c7a7e62ce7fbd6f07c2ddc86050
SHA256be60a5d5d5a65930279c6bcc61ecd50215bc296ef5267f866d573928acef4fc5
SHA51239080e37b93e300cee60087cfc1564ed2351725c8ff900cd38d45621ab83c4c02bfd3ae283cadde6920b8b9c2479f24986d73ddc0e6f9eae1dd5578406be632c
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Filesize2KB
MD5bf7aeee996ce9bb559ae58b88adff3bb
SHA1afb9edab554742f37ab5696337b9dc1ad2d306ef
SHA2562d5fd956b4d13e5a1b6433d80b8606b43c378fedcac2affafea888848ff969ae
SHA512e92f9e5c7f0ba24b1da180e91a2f3f5dc54de52b9f24561b8942982bf4a04b83dde31df904e75f8f08d7156493b185907d3377222ecd7aea5a7aff59300e61a6
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Filesize2KB
MD5f2a1bf06827b83d0398d3d8da61bc927
SHA18952aeab77590e7bb1c0265f53ff0686c933706f
SHA25642d05e805c6b1676c6bc850ba4efa2c8dceb349af83be032b82999504deaf1d9
SHA5124791413bc28f8c23b9f1245f9df321914df2f6206303ec858125e3f8e5fad866c668f52c62a2d8ffebdaafab99a10918c67f1641ebe6d73753c97eab6d6a269b
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Filesize6KB
MD542fe0864ee2a6710ab0e2fd95325c67e
SHA104b4c14288d0455df2d0ea2cd1ba6a2a6af5a993
SHA2560509b2fb7fcfe46bb6ea9129f45c66bc6ddf45edf1020f20cead8de6e32b0469
SHA5120b884ca77b63b43e5bfc0bee38e72fc6f8902dca66a8fa76ac116fe0b2e27010863298e235fb5afcc29604dd1c2de1942b1c50a213efda3be59a765645a39726
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
Filesize255B
MD5d0c24b0b5c90c4a969f9b4e99aa06460
SHA14f0294365e41c1cfbc64508f01555700887ad5fb
SHA256b0daee96e874e7ec2f80705b1876b86c1a1047c9b564bef995cb8eb85f85f0ae
SHA512c200c28e9d610e5b7cb5711a25aaa41d28f0c2ea78436d25b852dac212c13d6b45d3fe5f95493af25797a5bbe2b00a9f5fa2097b9d5b3973f257c78e743ae40f
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Filesize323B
MD5f15f553840c240f755700f55726649aa
SHA1fa808a4ab2ac920e6f5d100504eb20a37367709d
SHA2563e6b35c2d47fc4534d3406885f9e3e0c562b1b8c0b45e6dfeb9131d61da972a6
SHA512a088d9f09ebc306f16800d1ba432de6cb9b6aa045bcb7913b93beb3610a52691787a6684faf501cda6f41a06bb4598651a4a8a7f7a15602b66c7c0b61a82601e
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
Filesize367B
MD5a0c76403219f5786d95500bf77793ccd
SHA1d011d9292ec40485132ba0b89a309316acf85296
SHA2565713d573ecac398bce6a68dd1b8d4dc4e2687daac572236811aee56289cbe1de
SHA512c58ee3082f7aa4cd2007b86fa44a546dfa5eb00bf650e22e5b3da8f1f390f3440c54c99b7acc240de1a676da1c9c137f3d36034bd4589b60d8ee7e69350f8bc9
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
Filesize148B
MD5972ff73ecddd84ecb3457971caa2da0b
SHA1938ae85a2be0e8102623e6d13346c3e5ba7c8a35
SHA256b84c1196670a8c1479d6e3434b1556c606f0b1fb719070ac0c0b9014b3ca871a
SHA5126911cb56ea74c4f394b6c35ca33ebc5211ac1559b84913f7f90293feaab9e45a0b7de3c2390640f91390bbe21522e1a648b4a80b7aaf911f90e8e8875601f5f4
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
Filesize440B
MD541b9f662dc77d5ce7ca9c7cf9271bf51
SHA1fd211f825227c5d23ef049356b99540787ca3516
SHA256549499cc8c9bbc7e59e6e8a53d785a3c55a423eada21a7a1d9d6189a77c9ba5b
SHA512f5d726843f51204772d9f900cfad1b081e71f96b43371321c52bd386310aaef75f99d4cdfc5d7c608f256fa2c11b38d92ddfd7098dcfd90e38411aa3e386bfa1
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
Filesize462B
MD5f3ba2ad78e84a101f0180916e30feeb6
SHA15c797d30dbd69e4d58634ed4003b697be684df2d
SHA2568e9e2e4d1c0959afbad1328124a28ef0e6db02425babf7b7b5529853809bd59f
SHA5125dfe28ff521beac7543122e6de958f07819b740776d093f32e8b9306217ae5dd14cbb3104522634a6dc0701e1d3d31b47783a5eb919fae9cc46119ed4ef80f94
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
Filesize267B
MD57ca2fb06018933c505b45877cddb051c
SHA16cbbce27e30fa72c15121c3e9fba189f46e67edf
SHA256b9c07498fa5704881fd81dc1f2c14b6ecbb10da73a73f5cb1005463bd66ea8e8
SHA512a259ab084b284b8953c434fc3770111d1d5bc494ab8381d06e32c8cbd55749391aa43af96653dad84f7c7c4ce5f35addcd1ea791892c8dcfd8aeddf056dbdedd
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
Filesize2KB
MD5443d8746c005bd0c87059382fb0f6d79
SHA1a62813dc7b04e159aabfed459dd1681ae16c8f5e
SHA2560390997f6367ecd1f7d4000eb166ad0fb9874f412b0c6771ee7822282bb8f937
SHA512681b6dd21d4b4af6d1433ca5a37734428656e4a648a143a94735cad39ff768fab2ed62c60488d2716c11868118c3e58fce9d9dcaed7d033f33ed4f1be019dca0
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Filesize233B
MD579e64f1c415be797046a1635d3428866
SHA19ca87d907d126bb01e574d7789df8091cd9a173f
SHA256c599069e46c989e8b5221233daef9a1f70104255014731de53f2f6ee149a182d
SHA512c104b93e585945b95909ac5e49fe5f5b5f6cba4a2a2ca7a9f4e12d711ce49b4ffd0d7b7ff16415dc662eec62ab179ae39cda0184ca318b8eac511e0bc6e73942
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
Filesize364B
MD50a69987a30c3092599d0ba091ec9c7d5
SHA16d740576967ddeef830879e18a06dbc1006f140d
SHA2562e862198391bc8679211c0aef2adf147764dcef0469f07a7487f0d2d421a6bd1
SHA5126938cb1a963c440090a597b3e76da1565e71864fea7307370a3d7388c3fd308527d8cf923f0cc45298676e7fe73808dc57ac78b21f9bc7a9f152183dc6e79a9a
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
Filesize364B
MD52037d934ef5342dfbd3d58266def4ff8
SHA155119ccd16d7660c821bae8cd83497a9bd6898d3
SHA256461398ffc3b08226983c8ac9e5600b1f35631f95434945bf78463e9be93f8fa6
SHA512bdb715245ac5fa1643a608e241d609a3792605a8d07a1c74e224c9d75839ea87b6b351687da39aa7e3c1644bbdd9d525aca4c7704175d07ea5412accb5ae30b7
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Filesize6KB
MD50fe8b0dddf1a07b745c6de6b0efe1558
SHA160de983cf9ccc0bb0a4c3de5ece03549a75b703c
SHA2567763847e83e416f0d98df1cc0df0f1d0a9d169090c6d9bf5acc0ffdd4c1ed27b
SHA512f269941ad386d9844ce9858c780c12a43a29e62e693f9144f438258a1b67de3e9ed903cf95b83b8ecbf153cc5acc818fdbc2477d525aef45f0a35c40f2159487
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
Filesize428B
MD5494156ac4677410cba650289a58f89ba
SHA155d61c9e9ed357482cab81d13223b764a6c0a65e
SHA256f4c48614da80438ad09688b74fae17e08ee62495535dad2a07c5e70f7a69f311
SHA512e27265b09cd035cbd4734f9cfc631b857b08408a078caf55a51a6972161f80308ef318cf5ca173df7fda697155cea22f09de213f1ee4b57d312b937a4b7661db
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Filesize815B
MD5391c4e3d1b33ce1b5b221a9f90fa627f
SHA1d56e6f806cc631fc4e52f26423df0165dea74cf9
SHA25673ed6b648c2ef2593f5a005a7221f92b2196d0a12fd9d59a436a31222ffb5c6c
SHA51232d6f9e88c6da95b6705497b1fb44875e9d04bbc86af4f896e3c3757869e865e845b99ddf6ad2407add081523ea38296a0b04e2afb68b04fb5a9ce234b030334
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
Filesize870B
MD54e6d219eaba561b12222ad13a69a2ee7
SHA1da2bb507730f8f2c8ab6586000c0fc7a14b2dd7a
SHA256d979e087d83fea6557e868059c1b95cdd1f4dcead06042a17be2a32bc559d677
SHA51204f2131796d7c84a4c4862a8d011f5864c7af3be07e73e4ad80350adb0b87d927b4ad47cc53e47622f3abe6a3b22ce42704857aeb0238226bcf356adcaf6172e
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Filesize3KB
MD57b1642052516142f5030f7b56fef8dda
SHA11f818bb1d77b96b3b937de4dfdce63e6866a4806
SHA25634d38d324cd0d2be68d5f3755519f2ad958ade18ca047e1f033c2a57bd625669
SHA512d226ed0e55043bc71d869930aab7a165114f686e62268d790bf0ca044f5487c967c5506b4cc561eb74126a5a230746ecc102c22a3b68d52c1051bec9550c925d
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
Filesize2KB
MD571ef5bff52cd2a2ba86946f39b34b7f0
SHA16d96bf3660fd184efffebf9dbe8d44fc276aaef0
SHA256aec8355c93dea18308a1102dd21c675efea6c802de80f7239cf8e69ba63f2941
SHA5129c056ce085519bbe08640a9d728a41b954a2692b9538d1116d69fa27378549897a89fb1699a77dea182ad023ace1b1e3542cce941918f1e719c770b6541738de
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Filesize19KB
MD51ac6836fc2881766bb7cb7400ff6ec3a
SHA17ae9b2d233b3645a0192347588681c69f1a94c56
SHA256199b4ebbd768866a12f99b633452a527a9e08f8ef151fa26f254e1818844e2a4
SHA512969b7955158616b01184ee71bb5843561732482e5ea413d0dc1d8501d3fedbd7b4c32d6814561ffddf9fc06536a37b3b27f5579864651a27eb1bccc467cd2ca0
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Filesize890B
MD51b40ba631cf5f7ab09d3a0c00815c29e
SHA1f19e9353cdf531980e270db149d21ad04be5f753
SHA256f83c88f53f2cd0f61c443f96cb6dc358504bf0dd2f5cf98265dddcddb3da31b3
SHA512e466c10f8c767b30e7e0c2d11a6d86527a2c4a503492e5c9e9d9b815d04f855a3919c5f15efd740fba6e2f73c00f0ab14212cb47e94dd3f9e1b94dc99008fee1
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Filesize852B
MD5c09df4c788828fb2634162e18d12ed00
SHA143ee4bbb05cff14bf2fecf85f00a325a4c1fd2ab
SHA2568277504230f58e5da5fce4902b545bbc9c759d710a184e058aa5b6f11884b4c0
SHA51239c8af2e0e1c1bf55903c104c2059eb2047e57101acd1637eec2ed50d70cd903c1eceecc457bc2fb23144e31732c6583f6a7245acb5a25a3d6ea8ff41cf519ea
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Filesize860B
MD51d998d3556d2c6c02dee3f69725abd3f
SHA1261351b944f77794fe217ee858d5928088fceed8
SHA25660c2c05d6492079298efd46444c9e0fcf28da72b5a6bdf38fbf78fbe8b3b15b1
SHA5122835bb68609c27a6ae40b6403f45732a586732de2e5050ccf01bad77d73890295999214726051f8cf71fd3732df71bd1692ed0f35040e9a7f6c1c916d8ab7ecf
-
Filesize
580B
MD5304e8cefa8b35368a8976343d6f7e1c9
SHA13011a7d5112266505c7a363e83919815bbdb9794
SHA25624c7bb2797aa6732e7eea3da6c848c9f579b1d088418cb503d93037d47c8cbf9
SHA51227a5f3ede59047002904666b130a7c9fe8708ec91c58e09ca842d48ea4c06ce1512da93e2d1c1a2c893708baa6eae648cdf65628beac1ade8404d1515dee5b78
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
Filesize899B
MD565413c775ac8f350d20189f654a15cee
SHA16147f53a59579697284bbda1c5d490c31eb3c24d
SHA2561a3a847ab123e49d9be29a80e97a49595e966f5aaebd26d58f29bb16467cc31a
SHA512159bd84f01daeef7ea758d96377349e5a8d85c0b2dff5067aa637ad41bc5da54448c908ac7354366ca2e711b27ad615c7b9bfb7de1acb41ef4ff1f1d326cf12f
-
Filesize
625B
MD55aeaeb75343b703e60d1d1509219fb0e
SHA19714ca9c4a2df25b760e212334cca05b10d16682
SHA256f2dc766cabf053f1dd72488b6eb2560478ba12c321e4c23a3b7be2ae6a1d6322
SHA5127486cfb090b5369ca40c7cfa7ad3447eac0ac08d7c1d63ad5a91c59c2e068bedbd0762e30ade9dc6a57e7c92077a427621e77502a07f2164339f3a2f410e7d43
-
Filesize
873B
MD5faa62d6a3deb3108312a97e4dba42b45
SHA1838c984d69d1fbfd2d74fc193e72d612888466f9
SHA2565a8b385ab8b66da5d65ee4f19eac3485ecba24272e95c1c87091a0098151b884
SHA512273316893fa0ca489109e7b38a8ca878416a28e906c271c9b958adeb4dd067195000e7a77bc48f1c67847b76fe702087ef90bae588691148ce91956df9421af1
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Filesize5KB
MD5cb8c6852bd778574f0fc5c2f05a714bf
SHA15028845288224fd837d7fb39d4a2a2d551536393
SHA256aeb8f79c4d8c5e7c35e4be10af4c6743cfb6063ace8ba98d7b92a2da7dacb377
SHA5125f93f7b3fdf2acc1cc138e4c456c76f53b79e195a69cf5120dc5780d77c6e9a5f2c8302ded837522d8db5c799964082b5e004aa12b276a246345387a20f5ea91
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Filesize1KB
MD5b46a16e69d086a87c8e2ca73435b4440
SHA1bb711a86a3b9b7da29b6db6e82e0313f4b173087
SHA25629e3ac07fec304b2cc0d6a177a5e900a20917239f7cb61bae757f0ef56379d8f
SHA512ebdef547ae93b8198026960ffae8bc9d6fc6daba09790058bebf1ca7382dd6d81487a5ca5c7fb65d0fba8fcedd474ec765d81e51efd6c6b423fba8491ffe47c7
-
Filesize
615B
MD55df8c268dc21ed2ff7cf95715c889264
SHA1803e8ce4c56d29cc90da542ff6896b7fe4bfd448
SHA2564973fb14cf91bdd2146b75fb78d1c5a21c23bbaa25d3674bdfe9c698935a8c49
SHA51212af31af42af70bb95035da3e822ac932d1e9c568e594832863a7cb9b8bd7f938720f3cba8191ad7299911588cfd878d2118d62f4bdd2c2b96dcca8ac5e78ac0
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Filesize848B
MD539110b3830184f0129ecb246a645e109
SHA178cbe103a07472268faa06265408dc9994632ea1
SHA256975801cfa6458e9677beb1a6931192e40be12fa185fb6bbc5277ff1023702d54
SHA512af42e9632ea98fde434b3416703c44f0d6b25a41ead65cf39bb32a64a3c466baab94fdd9b902cc0df8bc8a0bfcdfa112a154d4c14aeeca0540f2f83298c10662
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Filesize847B
MD5a48bc3392ddc5948458ec781ec554522
SHA194429e2b6a3158a3b9c036d95d29c538821282f2
SHA256f6db179cc5441a888f8a340257cdcbd87914505cb09b05265f25d2639e13baff
SHA512d9d9f69559e82f39f7b44a97d208f7b20870a520a0896dd9ffc9b59e02debec0f819bedf242909fccac101705c1f72fc779f241da98d8cd78c3cdb1c24bd0b28
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Filesize869B
MD51d12d074be098365484c3b88064761dd
SHA198f8635c562f5d164d205531a4c08fb8c6e2a826
SHA256d12bf2570f9c8148aedf82fb940097b565764f329890006dccd1fd5dc2a61a27
SHA5120a1c01039d36c9c36580ec37ee85d9113ae0af866b4fc30a92da58660bee05e2ebcfa91a9cbb8ce85771b9c2d5e2bac9ee8ee37b8868fe1b080be8245ec8e142
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Filesize847B
MD5a4f2474bc03501f521fc51e6b7fe8574
SHA13139e8ee0fb1c7f79159dc513cafe1f2e7d7f4ab
SHA256c0651d831d74fb7da22890348687879ff1f85c8f08162f4994520797ed315d3f
SHA512a2c49579f4d782e19da9ec348596d7c1d681dee633d9e1b0a103468439b2ad0fc1c343ec50efae8514bda649ecb42cb08738dc046832c6b2d0096f3a22a2f887
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Filesize863B
MD532f730232edb578ce9a3cde133292086
SHA121aed3f09f169647ae7d114255c3db1054f03dff
SHA256d7d1e4f2daa519514df925199d0527992dc44c0027f0f4a248c7a7461653a573
SHA512034600ae726667d5b81bbe683b89a310d2601be73e683c0841e1e1bb327b09f26f5f81c8ef6c3b72d49ae8fd6da98c5096c83af3793ab2008a016c9ef36c4120
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Filesize861B
MD5ae6f5dc36a6fcce6c78a156e64ce268b
SHA1415b3fe4894dc8ee8e26f4b562450742bb86773a
SHA2567ce7bb21f3b364a4386a232c5f01267329bb4d0c0d5470cdf34b67ce55a45313
SHA5124ad6a11bb96be092aef92af65415027e3f19094d4f2b8516f1eda9f7b34e060595a281a0deb54cc54db1df49c0179b659b59f52d5df0bfc907924093a74a432c
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Filesize850B
MD5a89457512af36b4a5de3c33a9fe825ca
SHA10500da77bb8d70d12c4b075d87fd937a0c7edf51
SHA2561b1896f9de9b58982932d83331a4e7fff939b128759ae6d4b29191bec5cfe98d
SHA512f10e543f0defe470401e4e440ec84aaadf8a6ed7b890fa4d96b16e8be8d869f43054f2fa3b6a940784deccda04a7f4fce365c220a445268f1a5683f29628e82e
-
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Filesize883B
MD5372062d684a7a99be88d8e7f6d1a3c5f
SHA1f10067ee4ff790ccbb5e7aaa3b2aff8ca2e1a342
SHA256fc11551102257bbae536268bc76380aeda9b77d9ee95c3a22ef167a7970b2ddc
SHA51298c0b028ec6e663113cdb53a77618ce41d89ff0b646044f87f6eacb96c623ecda01d5db4b2976e2bb8a04e63d4c32226f7d37112a2c9909dd0b31618c4bbffca
-
Filesize
153B
MD5617ba0d83223aec5d918f881e885a7b9
SHA1e778056385a8cdc3ccba942459b10fea0c100535
SHA25608e71d7496788bb892c62a0038534a60d62f864286125dc3c1b59cf3fa000f1e
SHA512107fa887c533a23c4d3df92eee0b9f6fc6eb73d3c23e9dc606acf00a0bc94978e224dff8a0131bff06afdcc2cad008e9d1c5a512bb3801860c9819a8413138a4
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Filesize12KB
MD5abda2d480a81d9f0631199b6a5fbfe07
SHA13474df6712272b12c04ff6a7aa380ca0e097e1da
SHA256956fc6fabfc5d30dde2489f7866197df935235b8fdb5fe3c5bb8448d2c99f4d4
SHA51296e46013f15ab379bfcdb19af8ff74c4d94287496f67950a89465cdefcd1c45b981a79370eaa9c1d34a93a643336c95006fb86e28b0cb42f79f13d0b25794598
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Filesize8KB
MD5531751e30242b840eafaefa9b802ec1b
SHA1bda47a738a3928549cab5e2dae970bd59ef49a14
SHA256c4adb5db53f685e436ec65669ca5b843a6be4a125a317a99c0b7dad06823bdfe
SHA512b9d2303cccb769e02e0b71adb2c84790978d7384e2e43be8102723d76968a45323b49f4ee832d5daa02f3f81ac793feb75364b8419e437d0bc44ad56b403127f
-
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Filesize11KB
MD55e63ac9b9770dbe8c50d8946d409ea9b
SHA100e14842c6553f790c311b7348bd495dd15b7286
SHA2561dea41a4a8b813f7c0ab28b4d9f81a44d6836c2274cb3c61d8474c8220b2f7cd
SHA512e150a2bc5b94091c908151c0dfc5aceceb8a5ebab19da534f7b9dd9a0f8d22d71c8f2fc46c44c7e48dcef2807efe01d335119122c99ba624835f5c5893d31e1c
-
Filesize
109KB
MD50fecff4ad203ec4306c40384d16722e3
SHA10795e626ac8891ae9313f9706df452a3e86a2d6e
SHA256df7e9648040d5a4524587e0106510c8c848ad9dc8f9db7584e9f2f817bfa4a72
SHA51289ad01a06982c538b13b32594368a6090ca0c2a5fd85af9de1bb55f0329e7becd203993b1596e4e58c28d0e33e3444ad213fb0f520f864e04619942f08d93bbd
-
Filesize
172KB
MD559e076d26295c63e897f24751cb9a183
SHA16e9fbbcd08be127f7bfca852bb31d621cbf587a8
SHA2564887f9a50cbde505ff6d5948c08e27780c5cde18cb475c7241f205ea80780a0a
SHA51201867e7a26a0c2af0ad4224191ce99d1500b67f2d6896a4caa35ecc781074cd7f8cc9dad331b120014419ed6b0d2b3cd44b9afbc08e2eb0135e1a85612733f9f
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
Filesize1KB
MD5d465d23357c2959cc5c50aa5c2982475
SHA1b595dfa26084d77eaaa83a35fc226193a0d651c5
SHA256fb652c19d1b9ef2fe793a891357e1cc408e3b5cc9c6e896f474c20e184c64775
SHA5128b4949078cc0efea4fbb4d11995ec4ac6ede75d0846ae9837c18976a7063c4a5b896a4a40f1092e52a42828c967574c7a8f3047f732451b0f2ffa190ce18b073
-
Filesize
21KB
MD55d7d2dee1a3f9b9e47bf7ec11ba9d98b
SHA1588a6f75bfe938ed74afbb9d0191274bfc8fad86
SHA256e1f5da52f91a9257a5d079fc32b833ff0722365b8fe8af72d08f73fff4f9a605
SHA512336f1b768812d615536d22d2d12dd9003cf9c7995f6ffdacb750fc2d05e8a934cb8592c876f7f03b7fb52eebbd48b588dd948d252ea4392439b6b01facb22094
-
Filesize
1KB
MD55a72da1216a1fe2d788f5f99a189d8bc
SHA1fd8a95b0c5e0519cc47376057e087180ae121eca
SHA2566836ebe7db1b334ead958cf9803f058a67ab0baf73819962d796e54405bdd8ea
SHA512764e0f97e3a35121caa3cac031a4f80712764ac99575381c7d9abb50cb052a4536776ac982ba23b38d9cf46c7fb128ed3b2395a8c5c67d3dc326566462aecf27
-
Filesize
952B
MD5b6a1962593447a4c0bbd38b0d95ee2c6
SHA1d652918eee2ed79b06e60a66a998f29893e862eb
SHA256da92c33d874738ca8e5971b9323193c22f712b3f73e42395bb8c1cf684405ae3
SHA512216b1d7bc29613c10c0e90c1a3d58f76045f81dc1d83d8c4e917c5389de39083dc0651a87a44e9cf87a935e016c9080e2fd16a5441bf894b037884a7e063ee88
-
Filesize
121B
MD5bc60d114ab69b8788b87dbbafc5f6ebf
SHA14b567a2ea842cc00af56e4b1f429b0fff35d2c07
SHA2567bd64e2c1dff6019282bca56a03456ac11d508fe2d32b7fd8d624d40a90ee738
SHA5122fd55da2a543702cdd05375b78f6585610bfa15af00e87a69348cd602128f8a095184d5224fdc64452348bc4ac03b483c69457176e0a1f6710496d46ae9e7fcc
-
Filesize
1KB
MD5a3668938b91d1abf963fe7652f2fda8e
SHA11bc7390e05ebcb114f931e43a5127ba73fc0645f
SHA25612b9989ac5a2b3cf79922c600b4a87cb0a22a08133e2f03fe2723e008b93bd16
SHA512af482cf09c9715f3c7c9f38131818b32fb2a15dba9c03bc5a04f66f09af8c343ff1b56eb15e50ec57f7e35da897b79de2a27791066e07dbe4e2df2a13198f61c
-
Filesize
8KB
MD5b51f97c98ff867343bcea48bb2a5cb7c
SHA1fc8a2fb68d3183574dd968f00a0d86367fcc3a1d
SHA256c08da82b437b7f147c842c5a72b0d8e37cddbbe8073d0589c38c1a7c5ba6b597
SHA512659587b35b7db3f510985c356660d295c0695460f53920c01aa3da9d3b6ce42012476a8e77910ae6c80402ecf3a48ec5c2d13bfb4a85e326c2c76237bbb05449
-
Filesize
914B
MD50bbdd9712b0f772742359855ca3695ec
SHA170f007ee1ea3da89d04eb434acbd5c15fc301815
SHA2560e13bc4c9e8a6a2bea4d830deb580a3cc901d4e9b9a67179b9f541fd3de10294
SHA512764f999ae3d37fc627435b81112af29d6c487b525b59f99fc268a8689fa82ac033cebf5e5cc044f5fead021245833f3ba70e0fc52b567c06c525eff4a3eb6511
-
Filesize
328B
MD503908a38f7e3f17088bb399b7d01fcd9
SHA13399b55936fdd8cf505b8a5ae5270a0638500b77
SHA25618a1950676ecd79250b4eeb9fea701294dde0705b5d2b03729a2debb2da5685e
SHA5125b9b1aad8ea779185547e6bc71907cf208b4a99fd07f16a7d0e580c5dc4a9c2595681ec631fdf5175f88acc7b9c5def18c361b031d50e2b06003418ffca7995c
-
Filesize
1KB
MD57b8e1c63526e2d5c0a63d557f475f226
SHA1ca4554baf36367109c8f3a6896a044349b78e05a
SHA2568944b5232dd0adca082ae530cf7824f6ae99d5620b7264eb32a52fb9bebd78f4
SHA5128202f577df93755e494473fce31427a09c7961d65d05bb98d24a1bf771bcad62ad0f967fdbfff909885b25adfeb64fc4706fb5197f65d15c1d5871fcc069465c
-
Filesize
162B
MD57241430a4efb8e881374383c13eb2e87
SHA148edc9b326141ffaf5f8b1600d58fa9edb250af2
SHA2561e26995741f367c8e2c8983da1715b8e4b857e5d6c04683cfd6b5efea5e6583f
SHA512c1a6f3d2b8772350d9448d6ac7fffe4b247fba3a9e90ff64a04ee0a3b6cffdce1b5cea962f3f33d758a249a0814fc5bbbbab15e68dc6cd1eb287efea76b346bd
-
Filesize
586B
MD54a92a9b897bcd49a6217deed5827cc22
SHA1740179a1eb745f3f5e4700fe7c0544034aebbcf0
SHA25662a111c93792fb25ee452cf584801a522f14dd084770bb72c1b9682670873323
SHA5127c4a18f460cf09b14b6e2578e01eb4221c78002235373b6aac3117b16893ef7cbfebd369f65be591edad89104ab691b71acba141acbdf69832549e5b0eb2ab29
-
Filesize
124B
MD5d02b7220ce90d7c8e3ae38ae149598a4
SHA1df318bf256425ce3bda38b10def747d53191efca
SHA2566cb21335331e38eec2b27103ac334247dfec496ef6558453ba3e0369aafa8781
SHA5127f6240b48497867909c118770621739c30ebc4f0d55b644c42e4d92816516ca0821abaa727adb5b183fda05bbc3ed71201f049970016ffb1763083f072a85e4c
-
Filesize
8KB
MD568d6d2400991315727ef86bd269976a9
SHA1deddbc96a7070a37821f5f5d053a04a9dfc7cc01
SHA25665ead79ffed0503e113f861aae0bc938389d0c2c62532e668fb0712a8f26271a
SHA5127ac3eea783ac2340047c40ce8e5bd04f6f0158b6e7e2543e335216dc76c95093f42c0f483ffb88815b5adc3dbc535aa70e7f8d81e6656f7aedaf9be609680135
-
Filesize
880B
MD567c0722a889fe7780c7d5b6d3f9fdbbf
SHA1d0aa29f8f918cd8ea24ea35bca240df71f7b74a1
SHA25674655e2c7aca7bb65f89c21c2f3f8c94b8f8806813f413c0908802fd6374bfe0
SHA512f36989f4a8ea6f52c88463cf85427bc99e6ac5ce2e6de1b4618dabe4d42592dcb82b3d8a5a3233b816133e96f09ece94b49f97f744bfeed4581885bf682214d8