36e27fc3d476b9e94813b20e50d6fd88694bf0e4ad4372cec351481e668e1754

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Size

12KB
MD5

f00774a9eb0843d6661183fff0b1e036
SHA1

02bbff2a919a856488c83db3f302ad52f4a3cef7
SHA256

36e27fc3d476b9e94813b20e50d6fd88694bf0e4ad4372cec351481e668e1754
SHA512

35d8f208764359ddc780a9a3d16368871822cdd58105b0d733dc787f45ea833f1dc7b40bd6a65f7e9be209de5b35603dca72a963362e681e2a24186316b12b28
SSDEEP

192:m/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMLzo+xPmfX:mebFNw4Pk1itKkpAjjI2YpdmLzefEda

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1Px8LOI14KdwK2l.exe"	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Line_Editing.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdsata.inf_amd64_neutral_67db50590108ebd9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_neutral_0cf7696e2236ca4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Path_Syntax.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Path_Syntax.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_script_blocks.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\nslookup.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx008.inf_amd64_neutral_75545721835fd863\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_neutral_b4e8ccc6ba210e97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_neutral_256ad642985694b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pt-PT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\msinfo32.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Core_Commands.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mcbuilder.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Foreach.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Parsing.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_arrays.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Variables.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_output.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0012\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\shutdown.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dialer.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_neutral_e77f438012239042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_neutral_ed16756f950857e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmfj2.inf_amd64_neutral_9c9eb67d406a1632\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RpcPing.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\runas.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hu-HU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cttune.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr00a.inf_amd64_neutral_aa4f0850ff03674e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky302.inf_amd64_ja-jp_dd74fe49601b74f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql40xx2.inf_amd64_neutral_b95932400326817e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Comment_Based_Help.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\setx.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_providers.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_neutral_7617862a9cc286da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnova.inf_amd64_neutral_b52d8db82d8c3be9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_neutral_e853cea0022c059a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01298_.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\COIN.WAV	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Mail\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\PREVIEW.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\HEADER.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\shuffle_over.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\TAB_ON.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\deployed\jdk15\windows-amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR38F.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\PAWPRINT.HTM	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\logo.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-bullet.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_rest.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14795_.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15272_.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\QUERIES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonDown_On.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR47F.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7F.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Resource.zip	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15274_.GIF	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_es-es_accd0db07da7e5b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_83f9ba7f24518cb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\inf\MSDTC Bridge 3.0.0.0\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_megasas.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_54c77126780b8c98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_ro-ro_93df2ae4c2ef11d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..ation-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9f270d24fd5d0529\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-10.htm	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\mcbuilder.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_taskscheduler.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_52e0d9ffb6275e04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-crypt32-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5aa7fcdbe5c4f795\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2ae1bce6b81c0916\flyout.html	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-autochkconfigurator_31bf3856ad364e35_6.1.7600.16385_none_1898d1bbe9180b39\chkntfs.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Foreach.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ty-spp-ux.resources_31bf3856ad364e35_6.1.7600.16385_es-es_54a63fc9155a6773\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnep00b.inf_31bf3856ad364e35_6.1.7600.16385_none_ad2d68ddc89d49d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..providers.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b823e4c5e86dde32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2cde043816cec01b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prngt002.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4060ca3886538c9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_449a32d8d37f0185\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\inf\TermService\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..es-drprov.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4d3bb1d70ac28e9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..s-service.resources_31bf3856ad364e35_6.1.7600.16385_es-es_672d64655c2fd4d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnin004.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_21ecfa407734c24a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2d0643b056296a14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netmyk00.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d7a4ed29273cf0d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-imagesp1.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_460b0e06bf9d6fbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-bootconfig.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c35c1dfed0297589\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..framework.resources_31bf3856ad364e35_6.1.7600.16385_es-es_26652a05bab78d8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\system.io.log.resources\3.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnlx00w.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4845c082c93349d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-main.resources_31bf3856ad364e35_6.1.7600.16385_es-es_096480c5fb992866\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00010401_31bf3856ad364e35_6.1.7600.16385_none_e65559fb7079dd6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnbr003.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cb5615c491ff5304\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.mediacenter.bml_31bf3856ad364e35_6.1.7600.16385_none_867a3560cbde31e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_transactions.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ds-ce-rll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_64fe665193d19a8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-movie.resources_31bf3856ad364e35_6.1.7600.16385_en-us_80ddc92403116cc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cabview.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6d900c25fe9726ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-commonlogservicesapi_31bf3856ad364e35_6.1.7600.16385_none_6e8b7c84e12ac48e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-scrnsave.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_79ef66a203052213\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1055\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-publicapi_31bf3856ad364e35_6.1.7600.16385_none_dced72f14bf0da01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..omplus-ui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9732feaf635ba983\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..oledb-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d36dbea01368547a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ces-theme.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5cc21e7318e595ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..smenttool.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9728b91b875690eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-mscordbc_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_f9c9eb8d6d88670f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-com-dtc-client_31bf3856ad364e35_6.1.7600.16385_none_b33c89b0075f9149\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Switch.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_lsi_sas.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0b2db5728648fbb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..spp-tools.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b5694087aa5a965f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\PLA\Reports\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..licy-admin-admfiles_31bf3856ad364e35_6.1.7600.16385_none_beabfc5b1399cd8e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\shadow.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.data.services.client.resources_b77a5c561934e089_6.1.7601.17514_de-de_b9ecd08973f05915\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_join.help.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmviddsp_31bf3856ad364e35_6.1.7600.16385_none_a6ba49cfd6917b1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-uianimation.resources_31bf3856ad364e35_7.1.7601.16492_es-es_2691a3277d21c7e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..store-mof.resources_31bf3856ad364e35_6.1.7601.17514_en-us_86a717d49b758fe3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f661e404c67754b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1Px8LOI14KdwK2l.exe,0"	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\shell\open\command	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\shell	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "PPKOMBPFSDFSSET"	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\ = "CRYPTED!"	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1Px8LOI14KdwK2l.exe"	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\DefaultIcon	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PPKOMBPFSDFSSET\shell\open	f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f00774a9eb0843d6661183fff0b1e036_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
330B

MD5
1874a1c4e1bfa6879789a3b31adcc95f

SHA1
796d0e190184a1ff8232c5c22fd92d5d817ba7e9

SHA256
8c691aa8b074ddeb14d07e99609da9e04e4dede0fafdb23c5e4c4a65dedd870c

SHA512
d1d3869bc35ebc14f92230e86a67d5a1c6471cb5477b3b2748808e12688fdb3cef5a3a713f91f549fe2b3e004c8a182fbfa23fb62b6faf5d35777bae844e8ad2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
cd6cb1b35d9811d0d8b3c1ebf987fd14

SHA1
e30b388b3c24a5770c1bda9e8084c64e8a295a95

SHA256
d8d9317ab69fa1823268cb465f7b5ad8acd855b01f8d68d73c1192b40c303c6d

SHA512
51698805380df5840c5ae3eb8298ba4a1e810c69f5a89cee39707b9e9461d4915e909c7a37fb3fc3d8c618d67242606823344db202fa13bead9689f9af64c603

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
15e069e97f77072d7831392d34f0816e

SHA1
f1286b1086180e54dfec2c69f2419f9d77539ba7

SHA256
a938eb76ed7a1f9c13541a946fb279bfcc0b5e22126a5c5c4b1054af3dc70256

SHA512
12150d9a5f6d1f2b95ba615d418555d46dce66ff0935e14aaf998ec5390ead4162bbd182f7af32f5e65a3e821ecd736577496c6724dc68178501c6ca5ee993d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
fad420558b0d82ba3ce31480c5e1d9ce

SHA1
7cc9a1c819d24e8e826b1b9c40f7a43670eaee39

SHA256
fc6051668bfbc243a2e22c7419ecd8ae9938d41b09e4ca8f4ae372c5883f8bf7

SHA512
9604192dcfa5560f92ae1f7efb277cb09438e93ad58ab231a8492e0652d5d9ecb341c724bdf715f440d8b7d67aa34bd36cfdad5e3597d8665cbc520d673e6f46

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
5cee610f72d52d4bf46461ed85ada9a2

SHA1
82a20b4c6f7f533411da4ac0dfb247d97e98cdf9

SHA256
9dc7c1d2c06e863d20f7d63f0c7f0ec0876f99cfe48ab6dc0bd1efb8186abb85

SHA512
652238247349e929e2a456604821c364799152218adb8b086259c9e2139aa324c4c8cbce30714fda4848d9a2315b4d26f715a3229ad7a7c8b586341f649484a7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
230980f5126a9bc30151f67319b152d8

SHA1
bc635703ff882f67e054d067f3f43bf5457f7373

SHA256
bdd14c1b869251884c3cb1c9f780ccdc9eb5f9be34abe4e08a2d9937dafb30e7

SHA512
739b6046a845cb171549a974e058ab32ff2ac153eb032c0f4216f18c23de9d7b4367968cfcee8cbd4ae681ab84e56418a66c9c84a7ab19efc74f7ccc2887f815

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
a16d9a821df6c101a41983dff7da3580

SHA1
c178cd38854d1fa447ffbc1683946beab61811af

SHA256
db2769790e53432d527c9ef11c16a0385c4054012790d8974c12cc457fae43ec

SHA512
5dc055e6f71a28c300ba78b1d21698542c30ed081cc687aa40b5f8d2341ceb844dd95fba6c46ce177083d0ed83e583f081c800d21d92ef8af383ff7c0180b55d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
94d421b7941a30019e99472e3d0d0684

SHA1
83096713059ce20ed327efd5fc80230ca0e54a1f

SHA256
fe256f2980dbcf9e6135f569299ee4974bdbf8d809509f5bc9b2ef641f5adcd6

SHA512
cab535b46d8fe278da3026f0cf2d488a50a1e8ebcfcb1db51766a707245b23766642800dbb525fcc1d1d9f93ccb9cf5ea021866948c0ff4fc521d569a7993bec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
c6bf6d1c7a5da106aeb3520dbd7913f9

SHA1
9ffe2f2a47688b7ad18955eda75400bb5a19aac7

SHA256
6ec28cb0988f0732c4a351f708fe3a4aea960e3126bed0bec450b9054d3706ee

SHA512
fc9c7bbf7cafe5a5f25e033717fbdc253dd1e24f1bde8dfa177f20353bcacceff7bc9d072e0a19c3d4516f6d99b17fcca489ee6d860044a59f294b0a3695407c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
8b9dec96eac265203292766eacc90d23

SHA1
680a7e56dcaa9f4fed1361dcdae7d5a1d4908b82

SHA256
c4b0e2f28d6324c04c17c8e6f3ff0aafaa919237475c30502348ef8ee827b7af

SHA512
e0275584ee4a6327d28831b88571a69221557242ae51b6ba12ae4fcd204a405e4bd8f5d4479b57a4802c95143be8a575348b57364f13cd1a23ba21a6141eb913

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
21fb5a7a77d410b54c827ab931f68f16

SHA1
e606ac6bb26d1fd751f1177157b351ea69d32406

SHA256
c29f30dfcaccdb5d71a73df2ce0093d62ea5a5e2b5202e3c376637f7f250fcaf

SHA512
625756083aada26f393141f7064cee958f877b8479d7c83390592fbb3deb10209e90ece296ceae5e0bcce3042b1bb5db978d549667457b1941c883958954a1de

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
ace3a2f564608fc0d3ebcdb22b1ca4ce

SHA1
728a0791456be6a9611132a231aa1bcfc10e762a

SHA256
5d8221ca64015e9db3eac97e5717605140ddae188fd9b03d1bc38c50d7843dab

SHA512
ca8ef5163c74a2cc7c7af0c8b6f7ffe80fb38b49fff8207e51690caf621ff39cc47595116aa8b3d600dc63f99b3a5bcb3c8e1648b9bb7a2cd55240d264c79ee1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
44af45d43d638fbde95ced8286b230ae

SHA1
c653068908b905aacbbfd4eac39ebc1260b21b1c

SHA256
ed3342478c896d3e5ba6f57925613eafc26f6bc2d0d0e8f227c5db4af29dce91

SHA512
30eaf426feb67c502b48ea81c20636d88462d6392f55aa53e1740aa5ea96451549dcb755d14c534daca904d0db1c7b19ba81c0ff07387502f2f1460b553c50c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
6a631150bf6f96d2e4dfcc5033d16cf3

SHA1
1c54755984fe3781e709a1fe32759f098aa84915

SHA256
0a8d91572b54ac4a95b6652e9aa48cbc1b6e170e30622e04ed9cd14cc31408c9

SHA512
2f08eee1e14f3547d5084ba84f8221e2b2b7cdaa8628c83283a114132074669584bf5ab34ba97b431b4add9f07d7281b1fa00c9379c7bfbebc6c584214af2c46

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
34f34901a775152d8d8c60114d87d7e9

SHA1
407d2f911ea91dc65ce13fbc3271c58c61cab475

SHA256
cc98cb8b8f0e5f0206dbcd7989dedb8b5d1978ff91462ce0527f76db45596f9f

SHA512
1c5ad71d94ac9b442b5a96dd6714fd369b14186321d9fd573f04687e715bff7e050d9fef3c1820cb330387fe98e77fe2fe6a4cf0db84459d6063403ebc2787c1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
a9180635d5cc9467749ff29c0e14c4db

SHA1
9bf12f9237f53c7c2e1ed649c2048630ed3ae5fc

SHA256
0e1d4613cbbc8f9138c2871b95d26467886d16c428506896d0dd4c04571152fd

SHA512
62483e38f8f8de4dca04b7b7ffd35c5c6b992bad32a1f361886e1e84822f5eff6a8fa8fff106230f2675f84f86c8fd0de1b5841624f413784e6588f7c2d2910f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
43e2883acff99d491220f4bcdc8cb7b1

SHA1
d8fde46844c1fc99750da1f6e4deb7f8f5a4fb1b

SHA256
7fbf286e806cedc80079b71d8dc0d810272a5aca292e146e6e860a34c60c70d4

SHA512
48a288f0881deda472c9a26ca93a7de029cebf74711c3975052e892db539ea1fd3b0c767afcedc9fc2909b57f3e1434d01a03a649580c862f83091257f626d5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
bd7093d2631511da1b40bb714f38985f

SHA1
14349df5ff75ea060a226eeb30a46d3f5951674c

SHA256
46e4b828aaf264402e54700c4618472d322eade75978c2cc5bcbbb77046a84bd

SHA512
d36200a792ff0f8dd86c8cfaec37fbf9e0ca08a79aed70b45031a90efd682e3ac7dc829c70011194f2aa4a8dc2a3f6354bfc03deefacca83d4fd2fd5cb464f21

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
40583f46e3c75cb95ccc3ac11a3a28d5

SHA1
60c625ac86bc7bf75a54586dee945cd6c48734ab

SHA256
ccaa356607cd350131abf4b2803aa60dbaa43b83c4afe14ae0337d017981c0b0

SHA512
a3c8a5eb037daa0b7430a0e74874b0304ad27952ab8a04a072d37431909317809de39f560f7d129ac1f6298c868062b93046838af3b8eb52c215a7f4d5a9b343

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
107fe1946ae05720ebd6bf2a64bcd592

SHA1
81f9f55af32cfe303ae11dcbab3a3e157fa7b795

SHA256
6146bef7382c695d41f5f7b77840e170b7acbec4d514f0801a3770cd38044109

SHA512
1b6b63e8307fe9cebdce74a1c5e71063e99a505fdaaaab0d1b1f88d81d07c21333ed2de2dc2be37d467d2820e86d7e979c75cc5b27df3d4da09befb1282faa8c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
8e77512df273b7ffade913d659a64e84

SHA1
83f47a61de6510c87045a13a819254b6ce45a488

SHA256
22683aec3ab8cd270c25b58c64752d1bfcc6dbe6524faea7f7c930a7e3fd07cb

SHA512
2ba02d35726281ecf518932e78baf32dc27a6a44513e32a10363e2f065e1a8bc6043783c92cd182c38622e694aebd786e72351de57ec3dc110e5c723db313c1d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
577f89bddf02e25cad7263d6ffa6240e

SHA1
0058910293d4cf87b3b4935be6fb5f06f05c7ae7

SHA256
ab1a02f80d5754bfbc03054faf534a0b63ef3e913f5574df9a5c3ec9ba10d096

SHA512
d20384707c7198c09bf05d77574e5ec518bffecee00837a616ed36ddbf8aed484006ca91a5dce6b825564df92b2b2925b431b9277853be54a6e9a76b1cf9747e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
4999c02a780b31c951e028e098bcad6e

SHA1
924f158b4553e4afd1e7017d789a788b945861cc

SHA256
f524d98c8790c5601f4124a1bcb004ca4feeaf4f7a9e70bd1dd780896aafeb3c

SHA512
46999187c6a438e9919e918e4bc596daa2a47a1961bfad149cf1850047e76caf84671fb1b86069757668146d7529fa380c7fd38541dbabb5945b140c30b190f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
710fe71bf5f642278eefeac6f6126ad0

SHA1
e76d940189442bdfbea9cfe8b77971d8a2a9b713

SHA256
41bd9f1f603de53c341518da2522ed9c7046a08ae807e0025a3780d1cd6d245b

SHA512
d9b0249d69d2a21b2387eed5927b505b12dc308c54fc3229589c7b38f0e217f297a60596585cad38391133915421a989a07e6dc37da80a2128235cad98d6732a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
9712e49d146e372764ccd37fa73fc78d

SHA1
20936a7da4599a81f993990027e69117e3263fe3

SHA256
5c42ce06f18356585d5e427c3c0c011db9568c47e1edc92d76389ba22aff7855

SHA512
1d9a4ebb4af0a0d0c54680f29eae633caed883ef37da8b77e1f7737e3f18be90083c337e4035f692e1572df3817e7bb6fab612e45ccfa227e895adc58c7dbe11

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
d9ec31be30ba069294908154acdcdfe3

SHA1
82c7b98ba1f6a6d0019098b73319eabe62a3bb29

SHA256
68b1cdf37a8e623accb211de8aca152f85b6f8820bc3aeda66865f0da9dcedba

SHA512
ccd7308f8092199e349c5e53fd64acf8a8f0162d9f838effe49e52317abb08f1a7811adce116bbbf2e9cbcc44a8a1c8d34d9cc565683cda38fabcd420d10838d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
9ed8fd13fa6971b70c3e4a8b761e1789

SHA1
c35932bf8a658ab69274ba683869abdb012bb908

SHA256
b34d355000410ed3640fa636adf4310e7464e4b64b176dfa1d154f499a412c2a

SHA512
41721094e1847da0130dbb9215f68bb793cb4e4b4153974e5dc990c29083175be4a19f0b5e1ab4531689204b26d97d09b354eeee45216c5e1a0c3cc10e845c14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
5657ef17528ccc4024f398074811aa42

SHA1
b6c9a35ae6a82aae879400e4326a18197c334b23

SHA256
86593b71941e0ece0aacef46e5f5f0df5767d3db1961dfc8864ac372e8041008

SHA512
311d4d45eee3598f10d3fd9619763642e58dd079e090bac708230319060acb092908d877d72de953776b5100d49f29eca4bc26cbc9e7de02aed0dae1213c7d10

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
7843a88c5ece9b5ebb697d99065915f8

SHA1
6797a3a50d5fad8a3e61f27933c9d9cdf8126586

SHA256
9673cfe6fcec171af2959dda0281945f132fdecbc2c3fc22a470a9fe0f518146

SHA512
12de5e2345247ea93a40541bcef9e04e3067aedfe5ce74be17f0232ac67926cf5f146538ea0b2ad8e00bbce3c1a5162869c26ac221c1c5507f6db35d78350979

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
aa5358511fe3567dc37658c9a9ffa9ab

SHA1
dd038fb4d85908dc8867d03256dd0f9a6fd18cf7

SHA256
91d33842d500cea8a128c4535b0080fae1c4e07834e2d21d0800db2ddee1212f

SHA512
a5bec017d4edfc0411b8c3d62c7364677b59d530d1b14f86aa4086de14dbf12ca7d24704fbd7bd3a4cc65cefa30685010756cd25f94e34f4bb72ef4f86b25caa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
e6e625c500e51abab0d6d9dfd62f3fb5

SHA1
845742ee44ffff786f875b262166e2d540d142bb

SHA256
63a9d7dab458985c8f4ba0699853fe0bed681ff6986340081a61b00c743ba57b

SHA512
1a4e3a60ed3c46302f099dcce2e19b949f4dc97d3f4260a02efff4785f46e926fd56927a89357d64e7b25e4a724b3c3a2da8feede684a1238847ceaba4516404

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
f245a97bb05a768a75921b71ae096dd3

SHA1
7d5ba932d8be6cfaef22e2b013931f676856c126

SHA256
09ad5b92b11665df8d5aad85ff28eb2a47224eb4551ec05cde33e10f61907dbc

SHA512
eb743736528ac3a7558965fe3d380eed795b9f5633b31727b8ea2f02c4ecdbf3c8da6edf40d654dd87d2366fb5a69f0d8888fce4579645a712b5df10e11d88b8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
01be6d67023af8c3a2f71b9dd7e321b1

SHA1
947367d80ef7f3b48a323b5ea1ee024de53c1105

SHA256
964a757bf65aa7b9384396e1a3ccf53def3b3abf3f1a467ea03a2dd46daec08f

SHA512
10d540ebf1e9bc55c74d1ff3f36cb127993773c97f7f4422f34864e405bf23df50c31c323861a8bf7d36c2af125d21303cf1caaad05aa207c49407a51c644994

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
a606f1ea9c6fd9b62d95efd8dc77ffe0

SHA1
1128622f3a8bcb1bfe52f10bbc07de70a5ea3136

SHA256
180fd47df25d2dcf7fe58561ef9c89e7b9ebfa91920cc8acb7de26e0b5567555

SHA512
ded84f6ea324a6bad2345434d86b8b9d081e0f7e11ba3974571436e469b4ba71bc19e81a807918f2ccec6bd637f08a4095c02528573c349927b953ad5f5ed072

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
f23872ddfb451cd3283c6c53daa2661b

SHA1
0ad2f57565351db75aeaa946036b29a387658c78

SHA256
7ff9f91f1297cbedb5ebffad141e4c87326e20fafd08d157618cd28b61e51b99

SHA512
75d3f1b550d58cee6039513520ec65bbceded805e8fa8cb3e4653deec0c3c57aafbe18d51f7f5307c4033eeac64ec48dce1baf34d043b2f7393c5b5d84e574a3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
10875c93739b59b529bc7bdc5e612687

SHA1
6261e256f0e092a0a110f5ac960f403f35786e95

SHA256
1efca9cc90ef155fa81f6159eed6121b592513a912a359cebe7177f9b4bb5467

SHA512
d623b59fdab66c83aa14ca54f2169f1d92a590cd9efe5cbb226462cd0fc367388f438ee5847990832d281337775fd6597cf0b4206a429277639bfa958395b17a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
19559f1030628b1084853ff8b0f9dcc9

SHA1
95f83e7b5748fcd5142191a834b49a9a6bbea475

SHA256
445de92bd506c07e19fb11c8fa80f1e3d9505caa7e2160cae3848e72f2eadf98

SHA512
f968baddf94879e9de13b0b677eb934f20f1aec4d8697ffcb26fbc46d697fe9153b4e059b3d31f1ae3dc812c3e65ff543a6b9f654f187fcd21c0948ebdee6bf4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
09dc0bd72c4ef619d88245778e50814c

SHA1
6fb1c0bfee26ed56c98b5d4ad3235b3af1c264cb

SHA256
2e11faf1625b7126e51ca1f8749af2af6a3df154a73b446bf3348ad3cdcf83f9

SHA512
5038f6a94e5dc42a3ca2fc6d92bd77654ba425cceb6c590bf8b0fd9aa4fab17815c1bd9089fa18169279eb179963ed762c63191e35b3ef6576047886168ce4a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
1e85bfe8f6ff3e5028c688833ce368c3

SHA1
5a9afb827a66e5703dafb2ef9489c1ac22c5cb35

SHA256
6724bc2fcb98c38aa28beaf1f55cf6580e7dd8ef75e008e52634bd2468c3fcc1

SHA512
fa4f783aa05bcd11248522dbda63a90e23208ccc04b5aaa2038e992873d661b0b00e697390dfb9ee1fe183299453a2928a33b3aae7368aa4ba23f20ab731571a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
1411fd8eb9e8e1ed60c5da3423f30ccf

SHA1
320f2d6341f4aa2d776dc07d3cd6a48cb45fc6ba

SHA256
360edd0234cbde40f2866345da2c997adab27ee7f63400cb0143bb4437079ee4

SHA512
cf051af08392ca26a93253f80e23028bab03c3e8ec88f085964937f23c379ae72414e0c4249adf31797cace5838438a09b872afaf0aed6a17c5b4bcf98b43ce6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
06d703e28ac527dc51438080becf5b04

SHA1
bb866ae3b4636ee760375a53f21036a6e18fe55b

SHA256
965dd581f2ee820d3136cbf5b7ef12435eef254c7cf711ad904c54d2aa811d1c

SHA512
089bfdcf3d326987fdb119c94c2c7b887475549b254d8e0a4d0d306727c4d83201fa685ce6c90a3a478b8871da8d4db18bf130f682cc174bb42080ecd345d73c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
d6471dc37fb9a9c78ecd1fdf6159a72e

SHA1
75afb609feb3d2f8ee35b60b1942352fa0d66d42

SHA256
be9a0799f148c19fd433addfd0204b38ce7aab1f41c319f2a3f92bd9764c063f

SHA512
925cf596084bd710344ac75ffbd95b2833cca16fee37ab86e9cd9bbf967636dc78776651d332209e95a71c3daada71afcd11d601bf8a0a2f35b0bb198788f2e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
de5dc3813ee25e16718bee063d1ef73a

SHA1
6c2a4b713ddab15839722895e9bc12cc1ff6fc38

SHA256
84249990f3ec35062434086a8bc8de7ca371b2a3294f391036dff2fe6973936e

SHA512
83559f371a4af006545d972926f71f41c493dc574589cc95a54c719df4a5811974f3d68254aaf3f24f7d79539191b7ba3f9f463cb07389db71f46e1fac7ccc3b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
95509c066bbb6468f1733e577ce3feaf

SHA1
7053d768d31c2f412323f9eeba01338f281be50e

SHA256
956bb07d1f037c36f6d677ce1071e04ff694d8bd0fb38756cccdadff904adc1d

SHA512
c36a8a102a77bf857f71373b5f22d701c45d2ee33f7f4025c2824e9fc06adfc096dc514f77dc10b9bf21d90e6ddb358d455de32a0b6eafdb13348040bbeb9bc5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
97063b9bfb409e4370c07944f9fe1424

SHA1
71ea885cf56d83c7dc279a7bf60d91d305a66d75

SHA256
22fe5f1c5ab3299d9a75193f268d59cfb6c4056538d52ed1a948d9503b1886e2

SHA512
d895562f88e3d04913014f9be6bc2b6b09ea43dd712698576b5ba6feb975dac71bdc5427f621d10676acef4d00cad8ffe0616354c324ea6b8d310acb07b2966c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
cae6b78115a568e35895b10dda463b53

SHA1
6bada4a01554d4761bcad08e0d0d821e1fa6366b

SHA256
c669fa4b65b9f316bff674f8ec8baf32718a11aaf6a8e785b4b271de5b088935

SHA512
50077767d23db95e36c9078050317ca5cce05516349e44e27c658c9b08859f7e4857c88c5dbf1d047bd88113981baa5c5b12b068aa728390516e360ced7bd069

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
dbd2c222cf869ff5929f017a88b19d90

SHA1
cfe758c5256c802b3da4c0e54db677d0995376a1

SHA256
2cd0d1e5c987e53ec25bc84aec6d2848b10c35a5f88b5fe2de634a6df545eaf4

SHA512
4d1fd9753ec835f149be045214244c59a59379a66b05c078bddbb58f6ffb34e8bfaeb3cd7bf8f5d42ffacdda558d7ac521542110488069cb9d384030c65cbb32

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
8d8976f1cbfe0c79ef1c34fb3440045b

SHA1
12534f7b0a679fb5ba028fc930f4d6199a4240cb

SHA256
f02434bc749ba26d2f2e691bb11c4327dd932804971ad403487a5ebf7854877a

SHA512
d9ac8d61df37af4c33a2c409ae2531e8e807bf69a0df9f7d9da2c53944ffbf52daedc89520f88d8ca52633819140fea2483b3c7548f4cea63e2afc6e3a986c8f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
4ae9518e22b272c0f47db65775e8e5f0

SHA1
4464d14a0b9b03dd5dbd2de6c786a63aafba8b92

SHA256
63c0e651b16b4deae6fe3530056658a1d9acfc3c3955657f2ec10e988421e7ee

SHA512
64bd6642d8dd0bf29e737f0695cd1d81f78c0f03fe2aebf6d95a3e42e034fdc8ec1053e472906962e1aa3502465f30f110465ef5c9c7ce42bcc80a0f8d5acb24

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
7deecd127cf8baee460c068d45f6c40a

SHA1
16aff7a5463c7254d87456bb9eda7fe75bc97f90

SHA256
ae5c0c147dbb426770f172d520611e27496d4299b1560ebb467eed534d52ac0f

SHA512
627c511f3ecaafac028d705f5f51c503d0fc08ae4c930f3c9150a34c741c8758a75435e55b29c158e787bde271fd4fbab550b5e10909261696a94a8ba9ca86fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
93225bbc94e8287089f3b9fb9e896743

SHA1
2e1424d2be2109caa2433c2b66f5e6e7f431217d

SHA256
28a36025fedcc0b72dbb2a99cf106df085cc82f36e69f639b946f640ad570e73

SHA512
bfec64260115ec2cd501d66ea82c7667c2676a73b03307730b5a073347ae796f99cb6578df102df82116e4aa75468b455dc3c41c3849c7e64b606076a2bf66ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
d7a09d29d605bd2c5d93625f112f2379

SHA1
417fb312697bdd117bb0eec18efd22f617f66da5

SHA256
227dc7ea1531c2aaa012e1fa18b8e7811d2ee3181ca62e9796bfea7199949a8b

SHA512
07473009ccfc7b61e8bdd0e5fb64d0f04e93d688b8e8245eadd17b7c1fd11545db743309f6f170ab1cb2a73dad30b3b6e01db25dbd11cc841161bc5aa17ca52c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
3a9356a1a0ac48bf9f608aba8a4d0c16

SHA1
2c8fedfd1f247b7ed0045e2e39a3c55b57e8aa1e

SHA256
b5ba90581ce8f741539b15b20ef35c7f0572acc635cafd8761246cebded0b68e

SHA512
9c58a80c2e4843323fc2993b92f164719313fdb1838082b270e3fa78eb94beba288e331ff5c7a7959c3f9f8bb082c1700f37448acfbccbf79ebb75d80b1c0c8e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
2cb14875e55cdc398221537fd0151ec3

SHA1
edd8edda9584d89f29f336ff36dc5f00abc122ee

SHA256
2a06f7a3791363d68e6a46475bf45f09877713c34d6c08ac144f6fc43d602e7b

SHA512
1cdbb78e06382573c14f71d5036f93810988962f63d285d59c00a1f73a3e81a116999b42eb5359598482537c814bba7977fca9e8227ed39c37daded803c085c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
c39ea7aa86cca9f9b4a94a9913ce69e0

SHA1
d4660b1812005ebf06273b36867ccade51bcff55

SHA256
673fcf3bf932957d192dee8b76631717f897b282efd681a5edc5145dfeba7cf6

SHA512
dec64d4c9719808797e96dd2408c1a726740e6eebacdb8179d6ef73a0fe3f754ed103a2294de2cde7cd562e5ca692ecda3ac6639885bbe203c816bd042534eaf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
f6703a6ed9553c5532dfd9a8b2da47b1

SHA1
f9666dd9282c47620aad4a21fb24447d25991740

SHA256
93504c1608a14a86da6cdaf7b05b0c218ca4d2b400c079aa7974f880238c5af0

SHA512
d31f7656d563ea947ec3c4284af83903b3bb6481ab7bbfe5fb5931ff6386999e96f70b71467aefa18728509ce43a45172afced268d983415ca432b8bb6f7b151

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
531e6fb5d6db3bf2071930abe4311942

SHA1
aa4c88898b0b0b3989f34ecdf8caeb86b32e47a7

SHA256
d5dde517e86d88315b7373e5d45ac53da96df081b7ab93c00dd069faa1a0841f

SHA512
173830c715e9c6a06303bf3bcdfeba60e87e9b5971967ca38342ba366eca1237eee42d81d1de900a4cc091299ad00c5478f7256f73138176aa72217c765d8557

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
3a0695952e6f7a73f3107c07bfd8653e

SHA1
aa266875a5f9be033a3da93572908b94e96dc470

SHA256
56affcabac63ef644c9e2aa852ec95eef5d196ddc97860a35dbddab9a718e799

SHA512
81464c8e019c317cab040fc9cf3775f88737c06d1bdaf6b1a348cb3e6df397d6223c03ed76fcff049f650a17939a04e9090e198cf92870bfc416168b6d4d2127

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
353990b89109aa95cc2c2303e37431f1

SHA1
07655897161c79a10f9a542af14335ae6feb92ba

SHA256
7c9e0edc689882e4e5e09a7c52f4de5e543c14133e68b253fe7efe461c4bdbd1

SHA512
6c30c035f3221796ca7a9d26dbcc59243da3c6038fda8cc96024edb046d08b2477e87469b6515fa87f067cc6d8766845ea389806b88216892e625d0a85ed96c1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
2e927b8947456cb4581a79fe5ef5f51c

SHA1
1bca58c55613a02399d0613cbee22489295b8140

SHA256
ca5f11989e41da8d40a4a8055614e9860b43dc3d834c193c2924f063115fb9ed

SHA512
2c13110e46ce8da996d8278c42e7ca09eca1baa5dcb99b10e11ac2b7c64ee0853a1b71c7220c3e63b04ca33e7109635b5157e4917a6b2d6017ebe5665b688636

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
b4aeaeda405250b1d0a0e419c3dc9b7c

SHA1
9452ec3d042ea7a01fe9d55f7b01f2a9773f7dee

SHA256
1ab00dff85031f7bf18992341014c5f8339aef57fcfb4a6bd206f6a71ea4bd5a

SHA512
fb660b8a55284ce00839d1dd0a8d0ea0509f7baad224a588221e8052691fc8b4a340aea7717f8f0f3da62ea994f57aa05da6998e9d440b59947c4a358b9cc1e5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
6d6a341d428878d34440877c40314f21

SHA1
331ba2b5f97a3db2e8cc059f66745fd71ee0efb8

SHA256
68f81a98c3ce57f7899d4de75329eccae364ae9cf0926db2e1d6870ac970fc07

SHA512
9355aa842179d057eeb5fde830e7ccfddc5cf6654e974b8222f6e089e3a7de925d56eb9e67b52114c8ecf506aa2fe0d5c7212b75af82a902c68ff29b01d69554

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
c97e095331ea20a9ee1f4a85f10dbb29

SHA1
c0dbcdae5d8e9183dbd7a7816449ab89ab045335

SHA256
c2b8a5bd38a5a95187dadd79fd51afc9a9d8c7a914800e5b6dec8cf9312681c0

SHA512
ab2957b55d4763b33957657e58f2e5b51b4056f2b624fdca6df8d10c9f7f6299c99906122a010144a725f7ed8eabe89a3369c04012e4f1b14bba9199046e0cf5

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
81624a28c3e22ba32e3c354e0ba4ec64

SHA1
58d7c0805b7f007705a5583709406eaf9f31c234

SHA256
a171bd3a867292f5e86f3abb8d1bc0fcefd9e50b4c6ee10ff81d55e2a8e75c1f

SHA512
4de5501947cf35b90adc46459f71de71ffbe1a80a164556968c0e890971be8913a2324e7601888f4223adec2f500184bc57c1d378dc9fbb48ca6f8b4046af53f

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
ae011f3526108e588137c34b5e62e69b

SHA1
975708a448abcb70e41901393307cf3dc4da44c3

SHA256
c4f49fcad8f1c5a282b8d0be4e34458a3439e6d0f226d55ae2b2b0877eb80f33

SHA512
aef3d82054023bcdafaf777af8f9c1b4371422adbe5c4394396b4422a210a6008b00cfe038bb5c64c1f4dc201d223e8f3a5091628d0aa2a9fc65e8076c1d477a

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
0f659cb7fd3b4a67a2459ba5adf0ff72

SHA1
9e7e25963093a2541c45d43f567f1b1e1d98c77e

SHA256
43137695322171cf87d0557038fdf770f53670b4ca9a3ec2bd247df98eed4b3c

SHA512
afa81c3b12c0dc13faaa8aa77844f96777a4721225136166af16d06b8d48e7d13517977e7fd345096a85b98bf0931445f5cb4d57bf828381a7f1f33032e784a4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
cd43f10f293437ed98b69feed71d30ef

SHA1
16c84001f49586daab1eb7042bf2c74755c77183

SHA256
9c41c70255e2eb65dd4f0f1d7452da3b621b856bd49aa56f6fe0b0a4ea80fe91

SHA512
fef0c266717c493c5132e97976d276b3b101000cc0e1a241045e833c5db1ae99fe4b03c3336873d28e18d378efe3c047c27b0d8ddbb9b536bf9725be4343d1e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
0bb6bc70fefb5d6ef27e28664b39b1dd

SHA1
511f31e41e564f6220b8a332654010bc96c4d5eb

SHA256
d244035662ba0c12d001fbf619bdf30ec4569c264b99e9804e02339942a13ebf

SHA512
25362f4a6a0fd36aaaa4e779c8fee68b2c114c96e593f2cf2657531de39362d63730c43678582be05cf3d41b0e6901fe6bb23fce52735f66655f0b1c84ce02df

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
cf6419b748cbfe9d611cefc3377e25a6

SHA1
0625274880655bd48df513e15dc6a1badb6937be

SHA256
4259826a7f0336d83b92888b8d265b4a4a4ce6cc76d8c8438a7f7ed99507f227

SHA512
0d36672e72b5efa857f2932a61a6a3e3aecf450d61d14350296f311b45ba0549a5d0a3b12b38fe53e2574a0dd3a4733d8323b7d23500776749d40d0de90b2a52

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
e391ca88b5b0f624871ad4cc9c327dfe

SHA1
29b211a48c1a955c40b09e51b75648bcb33c50d1

SHA256
539cbd443dac34b9a2d8049ed51cd64abfd85babaa3a961f87239fdaa9f0d6f7

SHA512
9b59b7d05d026d6c87c9e49cb001e068755a15844d758d396e25ce4920cd23b4729c9e9bdaf1ec720811c0403bf83b3957c607fde2bd83701657249a16439879

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
2019026791181dfa20d162a8a6c3d49d

SHA1
c0ac58bd790680792ad34f6f7f0e218e851c3524

SHA256
f8c39086750249e229c70dc7e81672df456ea804ca01d4365b8d637c25079c98

SHA512
cda50dcb93abd9b480c8ddfba2ac03dbe7723aea392c754702f6a42eabdaebd8f7c5e9559f47b5f07f5aa8c8ca5d258c38f6a3bc43fe929a2559b90f40497711

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
a664dd644699ec67d1ee9fb1ec8f3669

SHA1
a137d59072daab879b3cc2aecb4ce6681f04180c

SHA256
cf4d832c653f24b6a489eb09d12121714a3b8d408465c896dd3e6de5e47fe2ff

SHA512
a9092687cfef164aac9ff9fa1331472f4bde792ea934e107fcc19078f49ea41ef62bf04bf9a4dace23f0d0d13610cb0f810cb565aba23c38d975008bcf273f4f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
65409bdf66d82b3ed2c694d0e0e60ef7

SHA1
ae501ea8f966a35be0791d6df62475d23e06be26

SHA256
7b02c5ca6c96da746648c9774c2c4b3ac50501e9372359b0fde5fb9947d51b6f

SHA512
a82bbf6de7bda6949d28d47adc5a8dbf280ba97516a262dc8312d393a550b9f7574c7d2d9b6147b00af46767e39efbfd69892497bf83cf62b7e03dcf14153913

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
ab6335062f24fea66dc3946f5659a367

SHA1
a1f0e36b9b65104ca6760b9e119eafa6abf8bfed

SHA256
726975b583b3e87615d0d731905d3e78035c6fc2e1367a2d1667e3bc972e4beb

SHA512
da6a06baee10564e9b2e75a9f7e2ee0692a60958ae0405a94d84f45080c24dfc37b820540ede12cf3929a482a0f67be9ac136c4e2dc46503e9a09c4ee47cee61

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
db998da03a26192daa52dd39e15abe07

SHA1
ed8ad79ce0cf22254eaae9c0d84774086114103f

SHA256
91b999c0d6bf9b6cdd4f11a64ae2eb8d6516a1e79ba5a3694340dea171ceaf1f

SHA512
7af39a39c7c5bb4f86981ba85fb626d93c67639f14f9dd62410e0696401a7eaf293a3a435ab32812b427870a5b6cb9bfb2ecab93ca21922e5ed6525f1a00f2be

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
3568fddc799fd3d28da6b16a2caac8cb

SHA1
184c969222c418a2f3386861ef4dc13bc236598a

SHA256
1314af738082f7837cd40c95b6bd9ad74ceba3c60b8c7b572d0ee791ae03d497

SHA512
490409fd1310b705d9c0ba615bb201226ddb5ec5f0c9469346f9fe6fcf3834192cc971a7c44646515575ac7052f954aa3ed398915aab1d43abbcf0380b30c68b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
c0ac39323c00c1d8a7ac8b852929b980

SHA1
09f5ea31610690bba03768f7f1771168d6dc481a

SHA256
594200d138a8b148e019db00f4f598b7bf5cdce5e9c4e1b52409fdcae97cd14c

SHA512
d18d7d953b299ce6e91d621b17d54dac798e876b2813f7466bb663337790b10c94dfaf51e26d46d068310a7098e1b6d83d90f0832b5c7bb38dd8dcc4515e9ab7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
bebb0d934bd2952fc9c09d1ed4b03021

SHA1
31b9f72f3f6762cdd099c7908c8fedacd8a65f42

SHA256
1c1691ac1b23ffec72c94477dd8a0a8d67339fae0a7c50d165ccec8c9a8dff5c

SHA512
d5b073aa496b49c08a9dd3831435e95a8f930f420ad585ce78d341b16f5fac365aabc985010219cef8ea7ede85795556496268744565505e3a172415868a0ef4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
d8d0f6f54a4e9f2ce2108060741e9468

SHA1
d7f6718bb008829c737e1e26e4b65bdb430a56f0

SHA256
e4b9c1918b4d97e0074ac670ba2e42288e33586ef064cb10b161c80323882b74

SHA512
dce0585e20969a7af133b8ca1fe6cfd252508f65f1d96c6fb3cc29cd8b097571e2fb3db5e45b3e48aebee3cb6fb55aaddd3eac9dfa7ab4758dd13a80826beed6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
855a6edbce1d61e0a05744dc7d37cc79

SHA1
f46087c755020301b239c056ed65325a753d91a3

SHA256
7cde1100085f91f59b3e74aef3716eaec4528e1ab110181945060f1ebcf5f8fc

SHA512
e29adf7d8e9d7e1c48648b8e6abbd68f897152321cfc6095fd3bc65814983107abcb977b4096732b18f87edc4e4f773607229998599d9c390066459595f7ddd6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a8dd921a687b288181369d64c7e37f79

SHA1
bc9ab49df38f8fe2e464c7ddf5303dc0b6ddbda4

SHA256
3c9246b1244f31428d9ee3eef93c8fd9ab818c088be8bba8e9975b3aebd33a74

SHA512
e6ae0bc63c674b3faaea84cfd79c9131484272083c08beb4ea5c6ba72f4711604ed4eb5333cd6a668fd97fb8b105efcbe027d2748c03a84fe2015f87380d7195

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
f9096b011a9f7ae95f2e3425a681b5d2

SHA1
e23543056185509a34b541b15678b4d50b4f2493

SHA256
daa0884af93a369eb94ad8aa0589eda1485cf392ddd01b085ea8da7a7f5c5423

SHA512
ac74ccd2d550d6f90f388cde99418740dea99ad52cd68ab0216c8b691c83362b0d2fcb8ac3cc61cbadf96210155011afe8c2b3c2edfd8c36706287ad0c8e113d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
921f4d49997bb2221821dd1b50d0dc8b

SHA1
acde315a41648b4c49ab0a6bf80a069c458ccf1b

SHA256
ab3766258229a44eb628d737a1d139fc8fff8230d49ce8728d9c4111907fed71

SHA512
68404ba26bd29cad107284da1538f9e7a3434f5777a14fbdcc584102485684e6411f6d8a006af12eeb4390a9db081f6645602c2892d2add15019080faafe9a11

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
ac9d8ea59923ad9c8f3e8197dbe9258a

SHA1
ab831803158bfe20404eb3297be82de0f9918630

SHA256
f01adcb27e0b225c9a23f37422e05d24189d8f673a8c9a41fbeafdf6f4c9c006

SHA512
aea1eac1c40edaf26ff15a4bbdbaf654ff111a1f84c9bdaacb4bf5dfc582fd20b21fa57dcc4f99ed0537042d881f9c694d952c563524346917d8e14096d2f47f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

Filesize
32KB

MD5
c43a72239a00fd43a6af3217af163ba1

SHA1
814aa2a271b914e43b12dc38f46f8eb064a4a974

SHA256
cd56a1e003cc40625943171d7b8ed13d0e6a1415e311ce21839a362f92c5551b

SHA512
5ad75f0981491ce31929f57d698c9ce60a580edfed958ba877f6551b630618690ded7069ca454946bda1a20258d6018d0cb9d15842b7e9d8fed7dc6f3540b93e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads